'.$langs->trans("EnableShowLogo").' ';
if ($edit) {
print ajax_constantonoff('MAIN_SHOW_LOGO', array(), null, 0, 0, 1);
//print $form->selectyesno('MAIN_SHOW_LOGO', $conf->global->MAIN_SHOW_LOGO, 1);
diff --git a/htdocs/core/lib/website.lib.php b/htdocs/core/lib/website.lib.php
index 2eb44c517f7..170202717c8 100644
--- a/htdocs/core/lib/website.lib.php
+++ b/htdocs/core/lib/website.lib.php
@@ -859,7 +859,7 @@ function getPagesFromSearchCriterias($type, $algo, $searchstring, $max = 25, $so
foreach ($tmparrayoftype as $tmptype) {
$typestring .= ($typestring ? ", " : "")."'".$db->escape(trim($tmptype))."'";
}
- $sql .= " AND wp.type_container IN (".$typestring.")";
+ $sql .= " AND wp.type_container IN (".$db->sanitize($typestring, 1).")";
}
$sql .= " AND (";
$searchalgo = '';
diff --git a/htdocs/core/lib/website2.lib.php b/htdocs/core/lib/website2.lib.php
index 2efeec151a3..e9a5aa6309f 100644
--- a/htdocs/core/lib/website2.lib.php
+++ b/htdocs/core/lib/website2.lib.php
@@ -214,7 +214,7 @@ function dolSavePageContent($filetpl, Website $object, WebsitePage $objectpage)
}
}
// Add "has translation pages"
- $sql = 'SELECT rowid as id, lang, pageurl from '.MAIN_DB_PREFIX.'website_page where fk_page IN ('.$objectpage->id.($translationof ? ", ".$translationof : "").")";
+ $sql = 'SELECT rowid as id, lang, pageurl from '.MAIN_DB_PREFIX.'website_page where fk_page IN ('.$db->sanitize($objectpage->id.($translationof ? ', '.$translationof : '')).")";
$resql = $db->query($sql);
if ($resql) {
$num_rows = $db->num_rows($resql);
diff --git a/htdocs/core/menus/init_menu_auguria.sql b/htdocs/core/menus/init_menu_auguria.sql
index efa0c44a4ff..1a5550f3e72 100644
--- a/htdocs/core/menus/init_menu_auguria.sql
+++ b/htdocs/core/menus/init_menu_auguria.sql
@@ -233,7 +233,7 @@ insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, left
insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', '$conf->tax->enabled && empty($conf->global->TAX_DISABLE_VAT_MENUS) && $leftmenu=="tax_vat"', __HANDLER__, 'left', 2301__+MAX_llx_menu__, 'billing', '', 2300__+MAX_llx_menu__, '/compta/tva/card.php?mainmenu=billing&leftmenu=tax_vat&action=create', 'New', 2, 'companies', '$user->rights->tax->charges->creer', '', 0, 0, __ENTITY__);
insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', '$conf->tax->enabled && empty($conf->global->TAX_DISABLE_VAT_MENUS) && $leftmenu=="tax_vat"', __HANDLER__, 'left', 2302__+MAX_llx_menu__, 'billing', '', 2300__+MAX_llx_menu__, '/compta/tva/list.php?mainmenu=billing&leftmenu=tax_vat', 'List', 2, 'companies', '$user->rights->tax->charges->lire', '', 0, 1, __ENTITY__);
insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', '$conf->tax->enabled && empty($conf->global->TAX_DISABLE_VAT_MENUS) && $leftmenu=="tax_vat"', __HANDLER__, 'left', 2303__+MAX_llx_menu__, 'billing', '', 2300__+MAX_llx_menu__, '/compta/tva/index.php?mainmenu=billing&leftmenu=tax_vat', 'ReportByMonth', 2, 'companies', '$user->rights->tax->charges->lire', '', 0, 2, __ENTITY__);
-insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', '$conf->tax->enabled && empty($conf->global->TAX_DISABLE_VAT_MENUS) && $leftmenu=="tax_vat"', __HANDLER__, 'left', 2304__+MAX_llx_menu__, 'billing', '', 2300__+MAX_llx_menu__, '/compta/tva/clients.php?mainmenu=billing&leftmenu=tax_vat', 'ReportByCustomers', 2, 'companies', '$user->rights->tax->charges->lire', '', 0, 3, __ENTITY__);
+insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', '$conf->tax->enabled && empty($conf->global->TAX_DISABLE_VAT_MENUS) && $leftmenu=="tax_vat"', __HANDLER__, 'left', 2304__+MAX_llx_menu__, 'billing', '', 2300__+MAX_llx_menu__, '/compta/tva/clients.php?mainmenu=billing&leftmenu=tax_vat', 'ReportByThirdparties', 2, 'companies', '$user->rights->tax->charges->lire', '', 0, 3, __ENTITY__);
insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', '$conf->tax->enabled && empty($conf->global->TAX_DISABLE_VAT_MENUS) && $leftmenu=="tax_vat"', __HANDLER__, 'left', 2305__+MAX_llx_menu__, 'billing', '', 2300__+MAX_llx_menu__, '/compta/tva/quadri_detail.php?mainmenu=billing&leftmenu=tax_vat', 'ReportByQuarter', 2, 'companies', '$user->rights->tax->charges->lire', '', 0, 4, __ENTITY__);
-- Salary
insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', '$conf->salaries->enabled', __HANDLER__, 'left', 2210__+MAX_llx_menu__, 'billing', 'tax_sal', 6__+MAX_llx_menu__, '/salaries/list.php?mainmenu=billing&leftmenu=tax_salary', 'Salaries', 0, 'salaries', '$user->rights->salaries->read', '', 0, 10, __ENTITY__);
diff --git a/htdocs/core/menus/standard/eldy.lib.php b/htdocs/core/menus/standard/eldy.lib.php
index 89e63c16db4..99fcea707e2 100644
--- a/htdocs/core/menus/standard/eldy.lib.php
+++ b/htdocs/core/menus/standard/eldy.lib.php
@@ -1104,7 +1104,7 @@ function print_left_eldy_menu($db, $menu_array_before, $menu_array_after, &$tabM
$newmenu->add("/compta/tva/list.php?leftmenu=tax_vat", $langs->trans("List"), 2, $user->rights->tax->charges->lire);
$newmenu->add("/compta/tva/payments.php?mode=tvaonly&leftmenu=tax_vat", $langs->trans("Payments"), 2, $user->rights->tax->charges->lire);
$newmenu->add("/compta/tva/index.php?leftmenu=tax_vat", $langs->trans("ReportByMonth"), 2, $user->rights->tax->charges->lire);
- $newmenu->add("/compta/tva/clients.php?leftmenu=tax_vat", $langs->trans("ReportByCustomers"), 2, $user->rights->tax->charges->lire);
+ $newmenu->add("/compta/tva/clients.php?leftmenu=tax_vat", $langs->trans("ReportByThirdparties"), 2, $user->rights->tax->charges->lire);
$newmenu->add("/compta/tva/quadri_detail.php?leftmenu=tax_vat", $langs->trans("ReportByQuarter"), 2, $user->rights->tax->charges->lire);
}
@@ -1115,7 +1115,7 @@ function print_left_eldy_menu($db, $menu_array_before, $menu_array_after, &$tabM
$newmenu->add("/compta/localtax/card.php?leftmenu=tax_1_vat&action=create&localTaxType=1", $langs->trans("New"), 2, $user->rights->tax->charges->creer);
$newmenu->add("/compta/localtax/list.php?leftmenu=tax_1_vat&localTaxType=1", $langs->trans("List"), 2, $user->rights->tax->charges->lire);
$newmenu->add("/compta/localtax/index.php?leftmenu=tax_1_vat&localTaxType=1", $langs->trans("ReportByMonth"), 2, $user->rights->tax->charges->lire);
- $newmenu->add("/compta/localtax/clients.php?leftmenu=tax_1_vat&localTaxType=1", $langs->trans("ReportByCustomers"), 2, $user->rights->tax->charges->lire);
+ $newmenu->add("/compta/localtax/clients.php?leftmenu=tax_1_vat&localTaxType=1", $langs->trans("ReportByThirdparties"), 2, $user->rights->tax->charges->lire);
$newmenu->add("/compta/localtax/quadri_detail.php?leftmenu=tax_1_vat&localTaxType=1", $langs->trans("ReportByQuarter"), 2, $user->rights->tax->charges->lire);
}
}
@@ -1126,7 +1126,7 @@ function print_left_eldy_menu($db, $menu_array_before, $menu_array_after, &$tabM
$newmenu->add("/compta/localtax/card.php?leftmenu=tax_2_vat&action=create&localTaxType=2", $langs->trans("New"), 2, $user->rights->tax->charges->creer);
$newmenu->add("/compta/localtax/list.php?leftmenu=tax_2_vat&localTaxType=2", $langs->trans("List"), 2, $user->rights->tax->charges->lire);
$newmenu->add("/compta/localtax/index.php?leftmenu=tax_2_vat&localTaxType=2", $langs->trans("ReportByMonth"), 2, $user->rights->tax->charges->lire);
- $newmenu->add("/compta/localtax/clients.php?leftmenu=tax_2_vat&localTaxType=2", $langs->trans("ReportByCustomers"), 2, $user->rights->tax->charges->lire);
+ $newmenu->add("/compta/localtax/clients.php?leftmenu=tax_2_vat&localTaxType=2", $langs->trans("ReportByThirdparties"), 2, $user->rights->tax->charges->lire);
$newmenu->add("/compta/localtax/quadri_detail.php?leftmenu=tax_2_vat&localTaxType=2", $langs->trans("ReportByQuarter"), 2, $user->rights->tax->charges->lire);
}
}
diff --git a/htdocs/core/modules/expensereport/doc/index.html b/htdocs/core/modules/expensereport/doc/index.html
new file mode 100644
index 00000000000..8b137891791
--- /dev/null
+++ b/htdocs/core/modules/expensereport/doc/index.html
@@ -0,0 +1 @@
+
diff --git a/htdocs/core/modules/mailings/advthirdparties.modules.php b/htdocs/core/modules/mailings/advthirdparties.modules.php
index 9f434be9498..cbf668b6c67 100644
--- a/htdocs/core/modules/mailings/advthirdparties.modules.php
+++ b/htdocs/core/modules/mailings/advthirdparties.modules.php
@@ -79,7 +79,7 @@ class mailing_advthirdparties extends MailingTargets
$sql = "SELECT s.rowid as id, s.email as email, s.nom as name, null as fk_contact";
$sql .= " FROM ".MAIN_DB_PREFIX."societe as s LEFT OUTER JOIN ".MAIN_DB_PREFIX."societe_extrafields se ON se.fk_object=s.rowid";
$sql .= " WHERE s.entity IN (".getEntity('societe').")";
- $sql .= " AND s.rowid IN (".implode(',', $socid).")";
+ $sql .= " AND s.rowid IN (".$this->db->sanitize(implode(',', $socid)).")";
$sql .= " ORDER BY email";
// Stock recipients emails into targets table
@@ -125,10 +125,10 @@ class mailing_advthirdparties extends MailingTargets
$sql .= " FROM ".MAIN_DB_PREFIX."socpeople as socp";
$sql .= " WHERE socp.entity IN (".getEntity('socpeople').")";
if (count($contactid) > 0) {
- $sql .= " AND socp.rowid IN (".implode(',', $contactid).")";
+ $sql .= " AND socp.rowid IN (".$this->db->sanitize(implode(',', $contactid)).")";
}
if (count($socid) > 0) {
- $sql .= " AND socp.fk_soc IN (".implode(',', $socid).")";
+ $sql .= " AND socp.fk_soc IN (".$this->db->sanitize(implode(',', $socid)).")";
}
$sql .= " ORDER BY email";
diff --git a/htdocs/core/modules/mailings/thirdparties.modules.php b/htdocs/core/modules/mailings/thirdparties.modules.php
index 8b8a57f6628..b3b88224df6 100644
--- a/htdocs/core/modules/mailings/thirdparties.modules.php
+++ b/htdocs/core/modules/mailings/thirdparties.modules.php
@@ -83,13 +83,13 @@ class mailing_thirdparties extends MailingTargets
if (GETPOSTISSET("filter_client") && GETPOST("filter_client") <> '-1') {
$addFilter .= " AND s.client=".((int) GETPOST("filter_client", 'int'));
$addDescription = $langs->trans('ProspectCustomer')."=";
- if ($_POST["filter_client"] == 0) {
+ if (GETPOST("filter_client") == 0) {
$addDescription .= $langs->trans('NorProspectNorCustomer');
- } elseif ($_POST["filter_client"] == 1) {
+ } elseif (GETPOST("filter_client") == 1) {
$addDescription .= $langs->trans('Customer');
- } elseif ($_POST["filter_client"] == 2) {
+ } elseif (GETPOST("filter_client") == 2) {
$addDescription .= $langs->trans('Prospect');
- } elseif ($_POST["filter_client"] == 3) {
+ } elseif (GETPOST("filter_client") == 3) {
$addDescription .= $langs->trans('ProspectCustomer');
} else {
$addDescription .= "Unknown status ".GETPOST("filter_client");
diff --git a/htdocs/core/modules/mailings/thirdparties_services_expired.modules.php b/htdocs/core/modules/mailings/thirdparties_services_expired.modules.php
index 2718a33247b..7b5d4f38737 100644
--- a/htdocs/core/modules/mailings/thirdparties_services_expired.modules.php
+++ b/htdocs/core/modules/mailings/thirdparties_services_expired.modules.php
@@ -197,7 +197,7 @@ class mailing_thirdparties_services_expired extends MailingTargets
$sql .= " WHERE s.entity IN (".getEntity('societe').")";
$sql .= " AND s.rowid = c.fk_soc AND cd.fk_contrat = c.rowid AND s.email != ''";
$sql .= " AND cd.statut= 4 AND cd.fk_product=p.rowid";
- $sql .= " AND p.ref IN ('".join("','", $this->arrayofproducts)."')";
+ $sql .= " AND p.ref IN (".$this->db->sanitize("'".join("','", $this->arrayofproducts)."'", 1).")";
$sql .= " AND cd.date_fin_validite < '".$this->db->idate($now)."'";
$a = parent::getNbOfRecipients($sql);
diff --git a/htdocs/core/modules/modCommande.class.php b/htdocs/core/modules/modCommande.class.php
index 29f4dc60515..6a44075822c 100644
--- a/htdocs/core/modules/modCommande.class.php
+++ b/htdocs/core/modules/modCommande.class.php
@@ -368,7 +368,7 @@ class modCommande extends DolibarrModules
//Import CPV Lines
$r++;
$this->import_code[$r] = 'commande_lines_'.$r;
- $this->import_label[$r] = 'OrderLine';
+ $this->import_label[$r] = 'SaleOrderLines';
$this->import_icon[$r] = $this->picto;
$this->import_entities_array[$r] = [];
$this->import_tables_array[$r] = ['cd' => MAIN_DB_PREFIX.'commandedet', 'extra' => MAIN_DB_PREFIX.'commandedet_extrafields'];
diff --git a/htdocs/core/modules/modDeplacement.class.php b/htdocs/core/modules/modDeplacement.class.php
index 0f92e8a7e6c..f0f06395565 100644
--- a/htdocs/core/modules/modDeplacement.class.php
+++ b/htdocs/core/modules/modDeplacement.class.php
@@ -143,7 +143,7 @@ class modDeplacement extends DolibarrModules
$childids[] = $user->id;
if (empty($user->rights->deplacement->readall) && empty($user->rights->deplacement->lire_tous)) {
- $this->export_sql_end[$r] .= ' AND d.fk_user IN ('.join(',', $childids).')';
+ $this->export_sql_end[$r] .= ' AND d.fk_user IN ('.$this->db->sanitize(join(',', $childids)).')';
}
}
}
diff --git a/htdocs/core/modules/modEventOrganization.class.php b/htdocs/core/modules/modEventOrganization.class.php
index 386da21d798..244b4f41cab 100644
--- a/htdocs/core/modules/modEventOrganization.class.php
+++ b/htdocs/core/modules/modEventOrganization.class.php
@@ -341,6 +341,7 @@ class modEventOrganization extends DolibarrModules
'fk_menu'=>'fk_mainmenu=project', // '' if this is a top menu. For left menu, use 'fk_mainmenu=xxx' or 'fk_mainmenu=xxx,fk_leftmenu=yyy' where xxx is mainmenucode and yyy is a leftmenucode
'type'=>'left', // This is a Left menu entry
'titre'=>'EventOrganizationMenuLeft',
+ 'prefix' => img_picto('', 'eventorganization', 'class="paddingright pictofixedwidth"'),
'mainmenu'=>'project',
'leftmenu'=>'eventorganization',
'url'=>'',
@@ -355,7 +356,7 @@ class modEventOrganization extends DolibarrModules
'fk_menu'=>'fk_mainmenu=project,fk_leftmenu=eventorganization', // '' if this is a top menu. For left menu, use 'fk_mainmenu=xxx' or 'fk_mainmenu=xxx,fk_leftmenu=yyy' where xxx is mainmenucode and yyy is a leftmenucode
'type'=>'left', // This is a Left menu entry
'titre'=>'List',
- 'url'=>'/projet/list.php?search_usage_event_organization=1&mainmenu=project',
+ 'url'=>'/projet/list.php?search_usage_event_organization=1&mainmenu=project&contextpage=organizedevents',
'langs'=>'eventorganization@eventorganization', // Lang file to use (without .lang) by module. File must be in langs/code_CODE/ directory.
'position'=>1000+$r,
'enabled'=>'$conf->eventorganization->enabled', // Define condition to show or hide menu entry. Use '$conf->eventorganization->enabled' if entry must be visible if module is enabled. Use '$leftmenu==\'system\'' to show if leftmenu system is selected.
@@ -378,7 +379,8 @@ class modEventOrganization extends DolibarrModules
$this->menu[$r++]=array(
'fk_menu'=>'fk_mainmenu=project', // '' if this is a top menu. For left menu, use 'fk_mainmenu=xxx' or 'fk_mainmenu=xxx,fk_leftmenu=yyy' where xxx is mainmenucode and yyy is a leftmenucode
'type'=>'left', // This is a Left menu entry
- 'titre'=>'EventOrganizationMenuLeft',
+ 'titre'=>'ConferenceOrBooth',
+ 'prefix' => img_picto('', 'conferenceorbooth', 'class="paddingright pictofixedwidth"'),
'mainmenu'=>'project',
'leftmenu'=>'eventorganizationconforbooth',
'url'=>'',
diff --git a/htdocs/core/modules/modExpedition.class.php b/htdocs/core/modules/modExpedition.class.php
index ba8568ba13e..238eef2d6fe 100644
--- a/htdocs/core/modules/modExpedition.class.php
+++ b/htdocs/core/modules/modExpedition.class.php
@@ -313,7 +313,7 @@ class modExpedition extends DolibarrModules
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product as p on cd.fk_product = p.rowid';
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_extrafields as extraprod ON p.rowid = extraprod.fk_object';
if ($idcontacts && !empty($conf->global->SHIPMENT_ADD_CONTACTS_IN_EXPORT)) {
- $this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'element_contact as ee ON ee.element_id = cd.fk_commande AND ee.fk_c_type_contact IN ('.$idcontacts.')';
+ $this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'element_contact as ee ON ee.element_id = cd.fk_commande AND ee.fk_c_type_contact IN ('.$this->db->sanitize($idcontacts).')';
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'socpeople as sp ON sp.rowid = ee.fk_socpeople';
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'socpeople_extrafields as extra3 ON sp.rowid = extra3.fk_object';
}
diff --git a/htdocs/core/modules/modExternalSite.class.php b/htdocs/core/modules/modExternalSite.class.php
index a996a55ddaa..71c3387ff5e 100644
--- a/htdocs/core/modules/modExternalSite.class.php
+++ b/htdocs/core/modules/modExternalSite.class.php
@@ -67,7 +67,7 @@ class modExternalSite extends DolibarrModules
$this->dirs = array();
// Config pages. Put here list of php page names stored in admmin directory used to setup module
- $this->config_page_url = array("externalsite.php@externalsite");
+ $this->config_page_url = array("index.php@externalsite");
// Dependencies
$this->depends = array(); // List of modules id that must be enabled if this module is enabled
diff --git a/htdocs/core/modules/modFournisseur.class.php b/htdocs/core/modules/modFournisseur.class.php
index 46d6dd7bead..71f101014ad 100644
--- a/htdocs/core/modules/modFournisseur.class.php
+++ b/htdocs/core/modules/modFournisseur.class.php
@@ -666,7 +666,7 @@ class modFournisseur extends DolibarrModules
$r++;
$this->import_code[$r] = $this->rights_class.'_'.$r;
- $this->import_label[$r] = "Supplier Invoice"; // Translation key
+ $this->import_label[$r] = "SupplierInvoices"; // Translation key
$this->import_icon[$r] = $this->picto;
$this->import_entities_array[$r] = []; // We define here only fields that use another icon that the one defined into import_icon
$this->import_tables_array[$r] = ['f' => MAIN_DB_PREFIX.'facture_fourn', 'extra' => MAIN_DB_PREFIX.'facture_fourn_extrafields'];
@@ -759,7 +759,7 @@ class modFournisseur extends DolibarrModules
//Import Supplier Invoice Lines
$r++;
$this->import_code[$r] = $this->rights_class.'_'.$r;
- $this->import_label[$r] = "Supplier Invoice Lines"; // Translation key
+ $this->import_label[$r] = "SupplierInvoiceLines"; // Translation key
$this->import_icon[$r] = $this->picto;
$this->import_entities_array[$r] = []; // We define here only fields that use another icon that the one defined into import_icon
$this->import_tables_array[$r] = ['fd' => MAIN_DB_PREFIX.'facture_fourn_det', 'extra' => MAIN_DB_PREFIX.'facture_fourn_det_extrafields'];
@@ -839,7 +839,7 @@ class modFournisseur extends DolibarrModules
//Import Purchase Orders
$r++;
$this->import_code[$r] = 'commande_fournisseur_'.$r;
- $this->import_label[$r] = 'Purchase Orders';
+ $this->import_label[$r] = 'SuppliersOrders';
$this->import_icon[$r] = $this->picto;
$this->import_entities_array[$r] = [];
$this->import_tables_array[$r] = ['c' => MAIN_DB_PREFIX.'commande_fournisseur', 'extra' => MAIN_DB_PREFIX.'commande_fournisseur_extrafields'];
@@ -922,7 +922,7 @@ class modFournisseur extends DolibarrModules
//Import PO Lines
$r++;
$this->import_code[$r] = 'commande_fournisseurdet_'.$r;
- $this->import_label[$r] = 'PO Lines';
+ $this->import_label[$r] = 'PurchaseOrderLines';
$this->import_icon[$r] = $this->picto;
$this->import_entities_array[$r] = [];
$this->import_tables_array[$r] = ['cd' => MAIN_DB_PREFIX.'commande_fournisseurdet', 'extra' => MAIN_DB_PREFIX.'commande_fournisseurdet_extrafields'];
diff --git a/htdocs/core/modules/modIntracommreport.class.php b/htdocs/core/modules/modIntracommreport.class.php
index 077f51ab519..47ef889e2dd 100644
--- a/htdocs/core/modules/modIntracommreport.class.php
+++ b/htdocs/core/modules/modIntracommreport.class.php
@@ -44,13 +44,13 @@ class modIntracommreport extends DolibarrModules
$this->numero = 68000;
$this->family = "financial";
- $this->module_position = '100';
+ $this->module_position = '60';
// Module label (no space allowed), used if translation string 'ModuleXXXName' not found (where XXX is value of numeric property 'numero' of module)
$this->name = preg_replace('/^mod/i', '', get_class($this));
$this->description = "Intracomm report management (Support for French DEB/DES format)";
// Possible values for version are: 'development', 'experimental', 'dolibarr' or 'dolibarr_deprecated' or version
- $this->version = 'development';
+ $this->version = 'experimental';
$this->const_name = 'MAIN_MODULE_'.strtoupper($this->name);
$this->picto = 'intracommreport';
diff --git a/htdocs/core/modules/modProductBatch.class.php b/htdocs/core/modules/modProductBatch.class.php
index 166b8f6e637..79529898bb0 100644
--- a/htdocs/core/modules/modProductBatch.class.php
+++ b/htdocs/core/modules/modProductBatch.class.php
@@ -64,8 +64,8 @@ class modProductBatch extends DolibarrModules
// Data directories to create when module is enabled.
$this->dirs = array();
- // Config pages. Put here list of php page, stored into /product/admin/ directory, to setup the module.
- $this->config_page_url = array("product_lot_extrafields.php@product");
+ // Config pages. Put here list of php page, stored into productdluo/admin directory, to use to setup module.
+ $this->config_page_url = array("product_lot.php@product");
// Dependencies
$this->hidden = false; // A condition to hide module
@@ -76,8 +76,24 @@ class modProductBatch extends DolibarrModules
$this->need_dolibarr_version = array(3, 0); // Minimum version of Dolibarr required by module
$this->langfiles = array("productbatch");
+ // Constants
// Constants
$this->const = array();
+ $r = 0;
+
+ $this->const[$r][0] = "PRODUCTBATCH_LOT_ADDON";
+ $this->const[$r][1] = "chaine";
+ $this->const[$r][2] = "mod_lot_free";
+ $this->const[$r][3] = 'Module to control product codes';
+ $this->const[$r][4] = 0;
+ $r++;
+
+ $this->const[$r][0] = "PRODUCTBATCH_SN_ADDON";
+ $this->const[$r][1] = "chaine";
+ $this->const[$r][2] = "mod_sn_free";
+ $this->const[$r][3] = 'Module to control product codes';
+ $this->const[$r][4] = 0;
+ $r++;
$this->tabs = array();
diff --git a/htdocs/core/modules/modPropale.class.php b/htdocs/core/modules/modPropale.class.php
index 687d8ea3669..c13a92e744e 100644
--- a/htdocs/core/modules/modPropale.class.php
+++ b/htdocs/core/modules/modPropale.class.php
@@ -350,7 +350,7 @@ class modPropale extends DolibarrModules
//Import Proposal Lines
$r++;
$this->import_code[$r] = $this->rights_class.'line_'.$r;
- $this->import_label[$r] = "ProposalLine"; // Translation key
+ $this->import_label[$r] = "ProposalLines"; // Translation key
$this->import_icon[$r] = $this->picto;
$this->import_entities_array[$r] = []; // We define here only fields that use another icon that the one defined into import_icon
$this->import_tables_array[$r] = [
diff --git a/htdocs/core/modules/modReception.class.php b/htdocs/core/modules/modReception.class.php
index 247a4faeddc..02f17cf0fbe 100644
--- a/htdocs/core/modules/modReception.class.php
+++ b/htdocs/core/modules/modReception.class.php
@@ -236,7 +236,7 @@ class modReception extends DolibarrModules
$this->export_sql_end[$r] .= ' , '.MAIN_DB_PREFIX.'commande_fournisseurdet as cd';
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product as p on cd.fk_product = p.rowid';
if ($idcontacts && !empty($conf->global->RECEPTION_ADD_CONTACTS_IN_EXPORT)) {
- $this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'element_contact as ee ON ee.element_id = cd.fk_commande AND ee.fk_c_type_contact IN ('.$idcontacts.')';
+ $this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'element_contact as ee ON ee.element_id = cd.fk_commande AND ee.fk_c_type_contact IN ('.$this->db->sanitize($idcontacts).')';
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'socpeople as sp ON sp.rowid = ee.fk_socpeople';
$this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'socpeople_extrafields as extra3 ON sp.rowid = extra3.fk_object';
}
diff --git a/htdocs/core/modules/modSociete.class.php b/htdocs/core/modules/modSociete.class.php
index 38ca03ffe3b..f30709445b3 100644
--- a/htdocs/core/modules/modSociete.class.php
+++ b/htdocs/core/modules/modSociete.class.php
@@ -343,7 +343,7 @@ class modSociete extends DolibarrModules
$this->export_sql_end[$r] .= ' AND (sc.fk_user = '.$user->id.' ';
if (!empty($conf->global->SOCIETE_EXPORT_SUBORDINATES_CHILDS)) {
$subordinatesids = $user->getAllChildIds();
- $this->export_sql_end[$r] .= count($subordinatesids) > 0 ? ' OR (sc.fk_user IN ('.implode(',', $subordinatesids).')' : '';
+ $this->export_sql_end[$r] .= count($subordinatesids) > 0 ? ' OR (sc.fk_user IN ('.$this->db->sanitize(implode(',', $subordinatesids)).')' : '';
}
$this->export_sql_end[$r] .= ')';
}
@@ -413,7 +413,7 @@ class modSociete extends DolibarrModules
$this->export_sql_end[$r] .= ' AND (sc.fk_user = '.$user->id.' ';
if (!empty($conf->global->SOCIETE_EXPORT_SUBORDINATES_CHILDS)) {
$subordinatesids = $user->getAllChildIds();
- $this->export_sql_end[$r] .= count($subordinatesids) > 0 ? ' OR (sc.fk_user IN ('.implode(',', $subordinatesids).')' : '';
+ $this->export_sql_end[$r] .= count($subordinatesids) > 0 ? ' OR (sc.fk_user IN ('.$this->db->sanitize(implode(',', $subordinatesids)).')' : '';
}
$this->export_sql_end[$r] .= ')';
}
diff --git a/htdocs/core/modules/modTicket.class.php b/htdocs/core/modules/modTicket.class.php
index a1318266334..b374000c74c 100644
--- a/htdocs/core/modules/modTicket.class.php
+++ b/htdocs/core/modules/modTicket.class.php
@@ -127,16 +127,21 @@ class modTicket extends DolibarrModules
'tabsql' => array(
'SELECT f.rowid as rowid, f.code, f.pos, f.label, f.active, f.use_default FROM '.MAIN_DB_PREFIX.'c_ticket_type as f',
'SELECT f.rowid as rowid, f.code, f.pos, f.label, f.active, f.use_default FROM '.MAIN_DB_PREFIX.'c_ticket_severity as f',
- 'SELECT f.rowid as rowid, f.code, f.pos, f.label, f.active, f.use_default FROM '.MAIN_DB_PREFIX.'c_ticket_category as f',
+ 'SELECT f.rowid as rowid, f.code, f.pos, f.label, f.active, f.use_default, f.public FROM '.MAIN_DB_PREFIX.'c_ticket_category as f',
'SELECT f.rowid as rowid, f.code, f.pos, f.label, f.active, f.use_default FROM '.MAIN_DB_PREFIX.'c_ticket_resolution as f'
),
'tabsqlsort' => array("pos ASC", "pos ASC", "pos ASC", "pos ASC"),
- 'tabfield' => array("code,label,pos,use_default", "code,label,pos,use_default", "code,label,pos,use_default", "code,label,pos,use_default"),
- 'tabfieldvalue' => array("code,label,pos,use_default", "code,label,pos,use_default", "code,label,pos,use_default", "code,label,pos,use_default"),
- 'tabfieldinsert' => array("code,label,pos,use_default", "code,label,pos,use_default", "code,label,pos,use_default", "code,label,pos,use_default"),
+ 'tabfield' => array("code,label,pos,use_default", "code,label,pos,use_default", "code,label,pos,use_default,public", "code,label,pos,use_default"),
+ 'tabfieldvalue' => array("code,label,pos,use_default", "code,label,pos,use_default", "code,label,pos,use_default,public", "code,label,pos,use_default"),
+ 'tabfieldinsert' => array("code,label,pos,use_default", "code,label,pos,use_default", "code,label,pos,use_default,public", "code,label,pos,use_default"),
'tabrowid' => array("rowid", "rowid", "rowid", "rowid"),
'tabcond' => array($conf->ticket->enabled, $conf->ticket->enabled, $conf->ticket->enabled, $conf->ticket->enabled),
- 'tabhelp' => array(array('code'=>$langs->trans("EnterAnyCode"), 'use_default'=>$langs->trans("Enter0or1")), array('code'=>$langs->trans("EnterAnyCode"), 'use_default'=>$langs->trans("Enter0or1")), array('code'=>$langs->trans("EnterAnyCode"), 'use_default'=>$langs->trans("Enter0or1")), array('code'=>$langs->trans("EnterAnyCode"), 'use_default'=>$langs->trans("Enter0or1"))),
+ 'tabhelp' => array(
+ array('code'=>$langs->trans("EnterAnyCode"), 'use_default'=>$langs->trans("Enter0or1")),
+ array('code'=>$langs->trans("EnterAnyCode"), 'use_default'=>$langs->trans("Enter0or1")),
+ array('code'=>$langs->trans("EnterAnyCode"), 'use_default'=>$langs->trans("Enter0or1"), 'public'=>$langs->trans("Enter0or1").'
+ * Copyright (C) 2005-2009 Regis Houssin
+ * Copyright (C) 2008 Raphael Bertrand (Resultic)
+ * Copyright (C) 2019 Frédéric France
+ * Copyright (C) 2021 Christophe Battarel
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see
+ * Copyright (C) 2021 Christophe Battarel
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see
+ * Copyright (C) 2005-2009 Regis Houssin
+ * Copyright (C) 2008 Raphael Bertrand (Resultic)
+ * Copyright (C) 2019 Frédéric France
+ * Copyright (C) 2021 Christophe Battarel
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see
+ * Copyright (C) 2021 Christophe Battarel
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see '.$width.' x '.$langs->trans("Height").': '.$height.' '.$langs->trans("CurrentInformationOnImage").': ';
+print $langs->trans("Width").': '.$width.' x '.$langs->trans("Height").': '.$height.' ';
print ''.$langs->trans("Date").' ';
- $datepaid = dol_mktime(12, 0, 0, $_POST["remonth"], $_POST["reday"], $_POST["reyear"]);
- $datepayment = empty($conf->global->MAIN_AUTOFILL_DATE) ? (empty($_POST["remonth"]) ?-1 : $datepaid) : 0;
+ $datepaid = dol_mktime(12, 0, 0, GETPOST("remonth"), GETPOST("reday"), GETPOST("reyear"));
+ $datepayment = empty($conf->global->MAIN_AUTOFILL_DATE) ? (GETPOST("remonth") ? $datepaid : -1) : 0;
print $form->selectDate($datepayment, '', 0, 0, 0, "add_payment", 1, 1, 0, '', '', $object->date, '', 1, $langs->trans("DonationDate"));
print " ";
print ''."\n";
// Common attributes
diff --git a/htdocs/eventorganization/conferenceorbooth_list.php b/htdocs/eventorganization/conferenceorbooth_list.php
index f4cda255cdb..89e614cc3ba 100644
--- a/htdocs/eventorganization/conferenceorbooth_list.php
+++ b/htdocs/eventorganization/conferenceorbooth_list.php
@@ -265,7 +265,7 @@ if ($projectid > 0) {
// Define a complementary filter for search of next/prev ref.
if (!$user->rights->project->all->lire) {
$objectsListId = $project->getProjectsAuthorizedForUser($user, 0, 0);
- $project->next_prev_filter = " rowid in (".(count($objectsListId) ?join(',', array_keys($objectsListId)) : '0').")";
+ $project->next_prev_filter = " rowid IN (".$db->sanitize(count($objectsListId) ? join(',', array_keys($objectsListId)) : '0').")";
}
dol_banner_tab($project, 'ref', $linkback, 1, 'ref', 'ref', $morehtmlref);
@@ -554,9 +554,9 @@ print '';
- print $form->load_tva('vatrate', (isset($_POST["vatrate"]) ? $_POST["vatrate"] : $line->vatrate), $mysoc, '', 0, 0, '', false, 1);
+ print $form->load_tva('vatrate', (GETPOSTISSET("vatrate") ? GETPOST("vatrate") : $line->vatrate), $mysoc, '', 0, 0, '', false, 1);
print ' ';
// Unit price
diff --git a/htdocs/expensereport/class/api_expensereports.class.php b/htdocs/expensereport/class/api_expensereports.class.php
index 98da4534e0c..13148e4247a 100644
--- a/htdocs/expensereport/class/api_expensereports.class.php
+++ b/htdocs/expensereport/class/api_expensereports.class.php
@@ -108,7 +108,7 @@ class ExpenseReports extends DolibarrApi
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport as t";
$sql .= ' WHERE t.entity IN ('.getEntity('expensereport').')';
if ($user_ids) {
- $sql .= " AND t.fk_user_author IN (".$user_ids.")";
+ $sql .= " AND t.fk_user_author IN (".$this->db->sanitize($user_ids).")";
}
// Add sql filters
diff --git a/htdocs/expensereport/class/expensereport.class.php b/htdocs/expensereport/class/expensereport.class.php
index 89178693a43..496f57812a6 100644
--- a/htdocs/expensereport/class/expensereport.class.php
+++ b/htdocs/expensereport/class/expensereport.class.php
@@ -2367,8 +2367,8 @@ class ExpenseReport extends CommonObject
$sql .= " AND ex.entity IN (".getEntity('expensereport').")";
if (empty($user->rights->expensereport->readall)) {
$userchildids = $user->getAllChildIds(1);
- $sql .= " AND (ex.fk_user_author IN (".join(',', $userchildids).")";
- $sql .= " OR ex.fk_user_validator IN (".join(',', $userchildids)."))";
+ $sql .= " AND (ex.fk_user_author IN (".$this->db->sanitize(join(',', $userchildids)).")";
+ $sql .= " OR ex.fk_user_validator IN (".$this->db->sanitize(join(',', $userchildids))."))";
}
$resql = $this->db->query($sql);
@@ -2414,8 +2414,8 @@ class ExpenseReport extends CommonObject
$sql .= " AND ex.entity IN (".getEntity('expensereport').")";
if (empty($user->rights->expensereport->readall)) {
$userchildids = $user->getAllChildIds(1);
- $sql .= " AND (ex.fk_user_author IN (".join(',', $userchildids).")";
- $sql .= " OR ex.fk_user_validator IN (".join(',', $userchildids)."))";
+ $sql .= " AND (ex.fk_user_author IN (".$this->db->sanitize(join(',', $userchildids)).")";
+ $sql .= " OR ex.fk_user_validator IN (".$this->db->sanitize(join(',', $userchildids))."))";
}
$resql = $this->db->query($sql);
diff --git a/htdocs/expensereport/class/expensereportstats.class.php b/htdocs/expensereport/class/expensereportstats.class.php
index 3d627cbce8d..ec71f530f51 100644
--- a/htdocs/expensereport/class/expensereportstats.class.php
+++ b/htdocs/expensereport/class/expensereportstats.class.php
@@ -78,11 +78,11 @@ class ExpenseReportStats extends Stats
if (empty($user->rights->expensereport->readall) && empty($user->rights->expensereport->lire_tous)) {
$childids = $user->getAllChildIds();
$childids[] = $user->id;
- $this->where .= " AND e.fk_user_author IN (".(join(',', $childids)).")";
+ $this->where .= " AND e.fk_user_author IN (".$this->db->sanitize(join(',', $childids)).")";
}
if ($this->userid > 0) {
- $this->where .= ' AND e.fk_user_author = '.$this->userid;
+ $this->where .= ' AND e.fk_user_author = '.((int) $this->userid);
}
}
diff --git a/htdocs/expensereport/index.php b/htdocs/expensereport/index.php
index 541c2c0738e..f9792d5b68c 100644
--- a/htdocs/expensereport/index.php
+++ b/htdocs/expensereport/index.php
@@ -91,7 +91,7 @@ if (empty($user->rights->expensereport->readall) && empty($user->rights->expense
&& (empty($conf->global->MAIN_USE_ADVANCED_PERMS) || empty($user->rights->expensereport->writeall_advance))) {
$childids = $user->getAllChildIds();
$childids[] = $user->id;
- $sql .= " AND d.fk_user_author IN (".join(',', $childids).")\n";
+ $sql .= " AND d.fk_user_author IN (".$db->sanitize(join(',', $childids)).")\n";
}
$sql .= " GROUP BY tf.code, tf.label";
@@ -180,11 +180,11 @@ if (empty($user->rights->expensereport->readall) && empty($user->rights->expense
&& (empty($conf->global->MAIN_USE_ADVANCED_PERMS) || empty($user->rights->expensereport->writeall_advance))) {
$childids = $user->getAllChildIds();
$childids[] = $user->id;
- $sql .= " AND d.fk_user_author IN (".join(',', $childids).")\n";
+ $sql .= " AND d.fk_user_author IN (".$db->sanitize(join(',', $childids)).")\n";
}
$sql .= ' AND d.entity IN ('.getEntity('expensereport').')';
if (!$user->rights->societe->client->voir && !$user->socid) {
- $sql .= " AND d.fk_user_author = s.rowid AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
+ $sql .= " AND d.fk_user_author = s.rowid AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
}
if ($socid) {
$sql .= " AND d.fk_user_author = ".$socid;
diff --git a/htdocs/expensereport/list.php b/htdocs/expensereport/list.php
index 35642ead0c4..51022f8c40b 100644
--- a/htdocs/expensereport/list.php
+++ b/htdocs/expensereport/list.php
@@ -290,12 +290,12 @@ if ($search_user != '' && $search_user >= 0) {
}
// Status
if ($search_status != '' && $search_status >= 0) {
- $sql .= " AND d.fk_statut IN (".$db->sanitize($db->escape($search_status)).")";
+ $sql .= " AND d.fk_statut IN (".$db->sanitize($search_status).")";
}
// RESTRICT RIGHTS
if (empty($user->rights->expensereport->readall) && empty($user->rights->expensereport->lire_tous)
&& (empty($conf->global->MAIN_USE_ADVANCED_PERMS) || empty($user->rights->expensereport->writeall_advance))) {
- $sql .= " AND d.fk_user_author IN (".join(',', $childids).")\n";
+ $sql .= " AND d.fk_user_author IN (".$db->sanitize(join(',', $childids)).")\n";
}
// Add where from extra fields
include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_sql.tpl.php';
diff --git a/htdocs/expensereport/payment/payment.php b/htdocs/expensereport/payment/payment.php
index 926559769b4..d50f6336669 100644
--- a/htdocs/expensereport/payment/payment.php
+++ b/htdocs/expensereport/payment/payment.php
@@ -36,6 +36,7 @@ $ref = GETPOST('ref', 'alpha');
$action = GETPOST('action', 'aZ09');
$amounts = array();
$accountid = GETPOST('accountid', 'int');
+$cancel = GETPOST('cancel');
// Security check
$socid = 0;
@@ -51,7 +52,7 @@ if ($user->socid > 0) {
if ($action == 'add_payment') {
$error = 0;
- if ($_POST["cancel"]) {
+ if ($cancel) {
$loc = DOL_URL_ROOT.'/expensereport/card.php?id='.$id;
header("Location: ".$loc);
exit;
@@ -64,9 +65,9 @@ if ($action == 'add_payment') {
setEventMessages($expensereport->error, $expensereport->errors, 'errors');
}
- $datepaid = dol_mktime(12, 0, 0, $_POST["remonth"], $_POST["reday"], $_POST["reyear"]);
+ $datepaid = dol_mktime(12, 0, 0, GETPOST("remonth", 'int'), GETPOST("reday", 'int'), GETPOST("reyear", 'int'));
- if (!($_POST["fk_typepayment"] > 0)) {
+ if (!(GETPOST("fk_typepayment", 'int') > 0)) {
setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentities("PaymentMode")), null, 'errors');
$error++;
}
diff --git a/htdocs/externalsite/admin/index.html b/htdocs/externalsite/admin/index.html
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/htdocs/externalsite/admin/externalsite.php b/htdocs/externalsite/admin/index.php
similarity index 90%
rename from htdocs/externalsite/admin/externalsite.php
rename to htdocs/externalsite/admin/index.php
index 47f0a3d57be..1710a570c45 100644
--- a/htdocs/externalsite/admin/externalsite.php
+++ b/htdocs/externalsite/admin/index.php
@@ -21,9 +21,9 @@
*/
/**
- * \file htdocs/externalsite/admin/externalsite.php
+ * \file htdocs/externalsite/admin/index.php
* \ingroup externalsite
- * \brief Page de configuration du module externalsite
+ * \brief Page to setup module external site
*/
if (!defined('NOSCANPOSTFORINJECTION')) {
@@ -41,18 +41,24 @@ if (!$user->admin) {
// Load translation files required by the page
$langs->loadLangs(array('admin', 'other', 'externalsite'));
-$def = array();
-
$action = GETPOST('action', 'aZ09');
+
+/*
+ * Actions
+ */
+
// Sauvegardes parametres
if ($action == 'update') {
$i = 0;
$db->begin();
- $label = GETPOST('EXTERNALSITE_LABEL', 'alpha');
- $exturl = GETPOST('EXTERNALSITE_URL', 'restricthtml');
+ $label = GETPOST('EXTERNALSITE_LABEL', 'alphanohtml');
+
+ $exturl = GETPOST('EXTERNALSITE_URL', 'none');
+ $exturl = dol_string_onlythesehtmltags($exturl, 1, 1, 0, 1);
+ $exturl = dol_string_onlythesehtmlattributes($exturl);
$i += dolibarr_set_const($db, 'EXTERNALSITE_LABEL', trim($label), 'chaine', 0, '', $conf->entity);
$i += dolibarr_set_const($db, 'EXTERNALSITE_URL', trim($exturl), 'chaine', 0, '', $conf->entity);
@@ -77,7 +83,7 @@ $linkback = '';
-print $langs->trans("Module100Desc")."'.$langs->trans("Module100Desc")."
';
print '';
- print '';
+ print '';
+ print '';
- print img_picto($langs->trans("Tranfer"), 'uparrow', 'class="hideonsmartphone"').' ';
- print 'id.'">'.$langs->trans("TransferStock").' ';
- // Disabled, because edition of stock content must use the "Correct stock menu".
- // Do not use this, or data will be wrong (bad tracking of movement label, inventory code, ...
- //print 'id.'#'.$pdluo->id.'">';
- //print img_edit().' ';
- print '';
+ print "\n".' ';
+ print ' ';
+ print '';
print $product_lot_static->getNomUrl(1);
print ' ';
$colspan = 3;
@@ -990,6 +1000,30 @@ if (!$variants) {
}
print ''.$pdluo->qty.($pdluo->qty < 0 ? ' '.img_warning() : '').' ';
print '';
+ if ($entrepotstatic->status != $entrepotstatic::STATUS_CLOSED) {
+ print 'id.'">';
+ print img_picto($langs->trans("TransferStock"), 'add', 'class="hideonsmartphone paddingright" style="color: #a69944"');
+ print $langs->trans("TransferStock");
+ print ' ';
+ // Disabled, because edition of stock content must use the "Correct stock menu".
+ // Do not use this, or data will be wrong (bad tracking of movement label, inventory code, ...
+ //print 'id.'#'.$pdluo->id.'">';
+ //print img_edit().' ';
+ }
+ print ' ';
+ print '';
+ if ($entrepotstatic->status != $entrepotstatic::STATUS_CLOSED) {
+ print 'id.'">';
+ print img_picto($langs->trans("CorrectStock"), 'add', 'class="hideonsmartphone paddingright" style="color: #a69944"');
+ print $langs->trans("CorrectStock");
+ print ' ';
+ // Disabled, because edition of stock content must use the "Correct stock menu".
+ // Do not use this, or data will be wrong (bad tracking of movement label, inventory code, ...
+ //print 'id.'#'.$pdluo->id.'">';
+ //print img_edit().' ';
+ }
+ print ' ';
print '
";
diff --git a/htdocs/product/stock/stockatdate.php b/htdocs/product/stock/stockatdate.php
index 5a3b0cb0a9c..bdac3a70f54 100644
--- a/htdocs/product/stock/stockatdate.php
+++ b/htdocs/product/stock/stockatdate.php
@@ -133,7 +133,7 @@ if ($date && $dateIsValid) { // Avoid heavy sql if mandatory date is not defined
$sql .= " WHERE w.entity IN (".getEntity('stock').")";
$sql .= " AND w.rowid = ps.fk_entrepot";
if (!empty($conf->global->ENTREPOT_EXTRA_STATUS) && count($warehouseStatus)) {
- $sql .= " AND w.statut IN (".$db->sanitize($db->escape(implode(',', $warehouseStatus))).")";
+ $sql .= " AND w.statut IN (".$db->sanitize(implode(',', $warehouseStatus)).")";
}
if ($productid > 0) {
$sql .= " AND ps.fk_product = ".$productid;
@@ -183,7 +183,7 @@ if ($date && $dateIsValid) {
$sql .= " WHERE w.entity IN (".getEntity('stock').")";
$sql .= " AND w.rowid = sm.fk_entrepot";
if (!empty($conf->global->ENTREPOT_EXTRA_STATUS) && count($warehouseStatus)) {
- $sql .= " AND w.statut IN (".$db->sanitize($db->escape(implode(',', $warehouseStatus))).")";
+ $sql .= " AND w.statut IN (".$db->sanitize(implode(',', $warehouseStatus)).")";
}
if ($mode == 'future') {
$sql .= " AND sm.datem <= '".$db->idate($dateendofday)."'";
@@ -191,10 +191,10 @@ if ($date && $dateIsValid) {
$sql .= " AND sm.datem >= '".$db->idate($date)."'";
}
if ($productid > 0) {
- $sql .= " AND sm.fk_product = ".$productid;
+ $sql .= " AND sm.fk_product = ".((int) $productid);
}
if ($fk_warehouse > 0) {
- $sql .= " AND sm.fk_entrepot = ".$fk_warehouse;
+ $sql .= " AND sm.fk_entrepot = ".((int) $fk_warehouse);
}
$sql .= " GROUP BY sm.fk_product, sm.fk_entrepot";
$resql = $db->query($sql);
diff --git a/htdocs/product/stock/tpl/stocktransfer.tpl.php b/htdocs/product/stock/tpl/stocktransfer.tpl.php
index e98244e5eed..dcd19be4ad6 100644
--- a/htdocs/product/stock/tpl/stocktransfer.tpl.php
+++ b/htdocs/product/stock/tpl/stocktransfer.tpl.php
@@ -72,7 +72,10 @@ print '';
if ($object->element == 'product') {
print ''.$langs->trans("WarehouseSource").' ';
print '';
- print img_picto('', 'stock').$formproduct->selectWarehouses((GETPOST("dwid") ?GETPOST("dwid", 'int') : (GETPOST('id_entrepot') ?GETPOST('id_entrepot', 'int') : ($object->element == 'product' && $object->fk_default_warehouse ? $object->fk_default_warehouse : 'ifone'))), 'id_entrepot', 'warehouseopen,warehouseinternal', 1);
+ print img_picto('', 'stock');
+ $selected = (GETPOST("dwid") ?GETPOST("dwid", 'int') : (GETPOST('id_entrepot') ?GETPOST('id_entrepot', 'int') : ($object->element == 'product' && $object->fk_default_warehouse ? $object->fk_default_warehouse : 'ifone')));
+ $warehousestatus = 'warehouseopen,warehouseinternal';
+ print $formproduct->selectWarehouses($selected, 'id_entrepot', $warehousestatus, 1);
print ' ';
}
if ($object->element == 'stock') {
diff --git a/htdocs/projet/activity/index.php b/htdocs/projet/activity/index.php
index c49ca736bbb..fe2188de904 100644
--- a/htdocs/projet/activity/index.php
+++ b/htdocs/projet/activity/index.php
@@ -454,7 +454,7 @@ if (empty($conf->global->PROJECT_HIDE_TASKS) && !empty($conf->global->PROJECT_SH
$sql .= " AND p.rowid IN (".$db->sanitize($projectsListId).")"; // project i have permission on
}
if ($mine) { // this may duplicate record if we are contact twice
- $sql .= " AND ect.fk_c_type_contact IN (".join(',', array_keys($listoftaskcontacttype)).") AND ect.element_id = t.rowid AND ect.fk_socpeople = ".$user->id;
+ $sql .= " AND ect.fk_c_type_contact IN (".$db->sanitize(join(',', array_keys($listoftaskcontacttype))).") AND ect.element_id = t.rowid AND ect.fk_socpeople = ".$user->id;
}
if ($socid) {
$sql .= " AND (p.fk_soc IS NULL OR p.fk_soc = 0 OR p.fk_soc = ".$socid.")";
diff --git a/htdocs/projet/activity/perday.php b/htdocs/projet/activity/perday.php
index 1309ae4455e..5b30d77ca21 100644
--- a/htdocs/projet/activity/perday.php
+++ b/htdocs/projet/activity/perday.php
@@ -601,8 +601,10 @@ if (!empty($arrayfields['t.progress']['checked'])) {
if ($usertoprocess->id == $user->id) print ''.$langs->trans("TimeSpentByYou").' ';
else print ''.$langs->trans("TimeSpentByUser").' ';*/
print ''.$langs->trans("TimeSpent").'';
print ''.$langs->trans("Everybody").' ';
+print ' ';
print ' ';
print ''.$langs->trans("TimeSpent").($usertoprocess->firstname ? ''.dol_trunc($usertoprocess->firstname, 10).' ' : '').' ';
print ''.$langs->trans("HourStart").'';
diff --git a/htdocs/projet/activity/permonth.php b/htdocs/projet/activity/permonth.php
index d023dcc69d3..7f40ab1c9a1 100644
--- a/htdocs/projet/activity/permonth.php
+++ b/htdocs/projet/activity/permonth.php
@@ -491,9 +491,11 @@ print ' '.$langs->trans("ProgressDeclared").
/*print ' '.$langs->trans("TimeSpent").' ';
if ($usertoprocess->id == $user->id) print ''.$langs->trans("TimeSpentByYou").' ';
else print ''.$langs->trans("TimeSpentByUser").' ';*/
-print ''.$langs->trans("TimeSpent").' '.$langs->trans("TimeSpent").'';
print ''.$langs->trans("Everybody").' ';
+print ' ';
print ' ';
print ''.$langs->trans("TimeSpent").($usertoprocess->firstname ? ''.dol_trunc($usertoprocess->firstname, 10).' ' : '').' ';
diff --git a/htdocs/projet/activity/perweek.php b/htdocs/projet/activity/perweek.php
index 028bb97726c..b6cd2c04f10 100644
--- a/htdocs/projet/activity/perweek.php
+++ b/htdocs/projet/activity/perweek.php
@@ -657,9 +657,11 @@ if (!empty($arrayfields['t.progress']['checked'])) {
/*print ''.$langs->trans("TimeSpent").' ';
if ($usertoprocess->id == $user->id) print ''.$langs->trans("TimeSpentByYou").' ';
else print ''.$langs->trans("TimeSpentByUser").' ';*/
-print ''.$langs->trans("TimeSpent").' '.$langs->trans("TimeSpent").'';
print ''.$langs->trans("Everybody").' ';
+print '';
print ' ';
print ''.$langs->trans("TimeSpent").($usertoprocess->firstname ? ''.dol_trunc($usertoprocess->firstname, 10).' ' : '').' ';
diff --git a/htdocs/projet/card.php b/htdocs/projet/card.php
index 5d0f197568c..916f23eb056 100644
--- a/htdocs/projet/card.php
+++ b/htdocs/projet/card.php
@@ -52,7 +52,7 @@ $status = GETPOST('status', 'int');
$opp_status = GETPOST('opp_status', 'int');
$opp_percent = price2num(GETPOST('opp_percent', 'alpha'));
-if ($id == '' && $ref == '' && ($action != "create" && $action != "add" && $action != "update" && !$_POST["cancel"])) {
+if ($id == '' && $ref == '' && ($action != "create" && $action != "add" && $action != "update" && !GETPOST("cancel"))) {
accessforbidden();
}
@@ -224,12 +224,10 @@ if (empty($reshook)) {
if (empty($ref)) {
$error++;
- //$_GET["id"]=$_POST["id"]; // We return on the project card
setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentities("Ref")), null, 'errors');
}
- if (empty($_POST["title"])) {
+ if (!GETPOST("title")) {
$error++;
- //$_GET["id"]=$_POST["id"]; // We return on the project card
setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentities("ProjectLabel")), null, 'errors');
}
@@ -512,7 +510,7 @@ if ($action == 'create' && $user->rights->projet->creer) {
}
// Ref
- $suggestedref = ($_POST["ref"] ? $_POST["ref"] : $defaultref);
+ $suggestedref = (GETPOST("ref") ? GETPOST("ref") : $defaultref);
print ' '.$langs->trans("Ref").' ';
- //$newdate=dol_mktime(12,0,0,$_POST["timemonth"],$_POST["timeday"],$_POST["timeyear"]);
$newdate = '';
print $form->selectDate($newdate, 'time', ($conf->browser->layout == 'phone' ? 2 : 1), 1, 2, "timespent_date", 1, 0);
print ' ';
diff --git a/htdocs/public/opensurvey/studs.php b/htdocs/public/opensurvey/studs.php
index 90dab0379ff..5f5446ae3f1 100644
--- a/htdocs/public/opensurvey/studs.php
+++ b/htdocs/public/opensurvey/studs.php
@@ -203,7 +203,6 @@ if ($testmodifier) {
//var_dump($_POST);exit;
$nouveauchoix = '';
for ($i = 0; $i < $nbcolonnes; $i++) {
- //var_dump($_POST["choix$i"]);
if (GETPOSTISSET("choix".$i) && GETPOST("choix".$i) == '1') {
$nouveauchoix .= "1";
} elseif (GETPOSTISSET("choix".$i) && GETPOST("choix".$i) == '2') {
@@ -217,7 +216,7 @@ if ($testmodifier) {
accessforbidden('', 0, 0, 1);
}
- $idtomodify = $_POST["idtomodify".$modifier];
+ $idtomodify = GETPOST("idtomodify".$modifier);
$sql = 'UPDATE '.MAIN_DB_PREFIX."opensurvey_user_studs";
$sql .= " SET reponses = '".$db->escape($nouveauchoix)."'";
$sql .= " WHERE id_users = '".$db->escape($idtomodify)."'";
diff --git a/htdocs/public/project/new.php b/htdocs/public/project/new.php
index f25843f69e4..048df9c41b3 100644
--- a/htdocs/public/project/new.php
+++ b/htdocs/public/project/new.php
@@ -223,11 +223,11 @@ if (empty($reshook) && $action == 'add') {
$error++;
$errmsg .= $langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv('Nature'))."';
} else {
print '
'.$langs->trans('TicketPublicInfoCreateTicket').'
';
- $formticket->showForm();
+ $formticket->showForm(0, 'edit', 1);
}
}
diff --git a/htdocs/public/ticket/index.php b/htdocs/public/ticket/index.php
index 81d13832ca4..31ee838f6f5 100644
--- a/htdocs/public/ticket/index.php
+++ b/htdocs/public/ticket/index.php
@@ -82,9 +82,9 @@ llxHeaderTicket($langs->trans("Tickets"), "", 0, 0, $arrayofjs, $arrayofcss);
print '
';
print '
'.($conf->global->TICKET_PUBLIC_TEXT_HOME ? $conf->global->TICKET_PUBLIC_TEXT_HOME : $langs->trans("TicketPublicDesc")).'
';
print '
';
print '
';
diff --git a/htdocs/public/ticket/list.php b/htdocs/public/ticket/list.php
index befeee00a7b..125aa5acd82 100644
--- a/htdocs/public/ticket/list.php
+++ b/htdocs/public/ticket/list.php
@@ -364,7 +364,7 @@ if ($action == "view_ticketlist") {
$sql .= " AND ".$key." = '".$db->escape($value)."'";
} elseif ($key == 't.fk_statut') {
if (is_array($value) && count($value) > 0) {
- $sql .= 'AND '.$key.' IN ('.implode(',', $value).')';
+ $sql .= 'AND '.$key.' IN ('.$db->sanitize(implode(',', $value)).')';
} else {
$sql .= ' AND '.$key.' = '.$db->escape($value);
}
@@ -432,7 +432,7 @@ if ($action == "view_ticketlist") {
if (!empty($arrayfields['category.code']['checked'])) {
print '
';
- $formTicket->selectGroupTickets($search_category, 'search_category', '', 2, 1, 1);
+ $formTicket->selectGroupTickets($search_category, 'search_category', 'public=1', 2, 1, 1);
print ' ';
}
diff --git a/htdocs/reception/card.php b/htdocs/reception/card.php
index 83701e59e40..bbfccb3b945 100644
--- a/htdocs/reception/card.php
+++ b/htdocs/reception/card.php
@@ -317,11 +317,16 @@ if (empty($reshook)) {
//var_dump($_POST);exit;
for ($i = 1; $i <= $num; $i++) {
$lineToTest = '';
+ $lineId = GETPOST($idl, 'int');
foreach ($objectsrc->lines as $linesrc) {
- if ($linesrc->id == GETPOST($idl, 'int')) {
+ if ($linesrc->id == $lineId) {
$lineToTest = $linesrc;
+ break;
}
}
+ if (empty($lineToTest)) {
+ continue;
+ }
$qty = "qtyl".$i;
$comment = "comment".$i;
$eatby = "dlc".$i;
@@ -340,7 +345,7 @@ if (empty($reshook)) {
if ($entrepot_id < 0) {
$entrepot_id = '';
}
- if (!($linesrc->fk_product > 0) && empty($conf->global->STOCK_SUPPORTS_SERVICES)) {
+ if (!($lineToTest->fk_product > 0) && empty($conf->global->STOCK_SUPPORTS_SERVICES)) {
$entrepot_id = 0;
}
$eatby = GETPOST($eatby, 'alpha');
diff --git a/htdocs/reception/list.php b/htdocs/reception/list.php
index 661c14c9d01..b77742dd71d 100644
--- a/htdocs/reception/list.php
+++ b/htdocs/reception/list.php
@@ -472,10 +472,10 @@ if ($search_state) {
$sql .= natural_search("state.nom", $search_state);
}
if ($search_country) {
- $sql .= " AND s.fk_pays IN (".$search_country.')';
+ $sql .= " AND s.fk_pays IN (".$db->sanitize($search_country).')';
}
if ($search_type_thirdparty != '' && $search_type_thirdparty > 0) {
- $sql .= " AND s.fk_typent IN (".$search_type_thirdparty.')';
+ $sql .= " AND s.fk_typent IN (".$db->sanitize($search_type_thirdparty).')';
}
if ($search_ref_rcp) {
$sql .= natural_search('e.ref', $search_ref_rcp);
diff --git a/htdocs/recruitment/class/recruitmentcandidature.class.php b/htdocs/recruitment/class/recruitmentcandidature.class.php
index 99ac555ba8e..db9c4eaaa4a 100644
--- a/htdocs/recruitment/class/recruitmentcandidature.class.php
+++ b/htdocs/recruitment/class/recruitmentcandidature.class.php
@@ -106,7 +106,7 @@ class RecruitmentCandidature extends CommonObject
'rowid' => array('type'=>'integer', 'label'=>'TechnicalID', 'enabled'=>'1', 'position'=>1, 'notnull'=>1, 'visible'=>0, 'noteditable'=>'1', 'index'=>1, 'comment'=>"Id"),
'entity' => array('type'=>'integer', 'label'=>'Entity', 'enabled'=>1, 'visible'=>0, 'position'=>5, 'notnull'=>1, 'default'=>'1', 'index'=>1),
'ref' => array('type'=>'varchar(128)', 'label'=>'Ref', 'enabled'=>'1', 'position'=>10, 'notnull'=>1, 'visible'=>4, 'noteditable'=>'1', 'default'=>'(PROV)', 'index'=>1, 'searchall'=>1, 'showoncombobox'=>'1', 'comment'=>"Reference of candidature"),
- 'fk_recruitmentjobposition' => array('type'=>'integer:RecruitmentJobPosition:recruitment/class/recruitmentjobposition.class.php', 'label'=>'Job', 'enabled'=>'1', 'position'=>15, 'notnull'=>0, 'visible'=>1, 'index'=>1),
+ 'fk_recruitmentjobposition' => array('type'=>'integer:RecruitmentJobPosition:recruitment/class/recruitmentjobposition.class.php', 'label'=>'Job', 'enabled'=>'1', 'position'=>15, 'notnull'=>0, 'visible'=>1, 'index'=>1, 'picto'=>'recruitmentjobposition', 'css'=>'maxwidth500'),
'note_public' => array('type'=>'html', 'label'=>'NotePublic', 'enabled'=>'1', 'position'=>61, 'notnull'=>0, 'visible'=>0,),
'note_private' => array('type'=>'html', 'label'=>'NotePrivate', 'enabled'=>'1', 'position'=>62, 'notnull'=>0, 'visible'=>0,),
'date_creation' => array('type'=>'datetime', 'label'=>'DateCreation', 'enabled'=>'1', 'position'=>500, 'notnull'=>1, 'visible'=>-2,),
@@ -116,7 +116,7 @@ class RecruitmentCandidature extends CommonObject
'lastname' => array('type'=>'varchar(128)', 'label'=>'Lastname', 'enabled'=>'1', 'position'=>20, 'notnull'=>0, 'visible'=>1,),
'firstname' => array('type'=>'varchar(128)', 'label'=>'Firstname', 'enabled'=>'1', 'position'=>21, 'notnull'=>0, 'visible'=>1,),
'email' => array('type'=>'varchar(255)', 'label'=>'EMail', 'enabled'=>'1', 'position'=>30, 'notnull'=>1, 'visible'=>1, 'picto'=>'email'),
- 'phone' => array('type'=>'varchar(64)', 'label'=>'Phone', 'enabled'=>'1', 'position'=>31, 'notnull'=>0, 'visible'=>1,),
+ 'phone' => array('type'=>'phone', 'label'=>'Phone', 'enabled'=>'1', 'position'=>31, 'notnull'=>0, 'visible'=>1, 'picto'=>'phone'),
'date_birth' => array('type'=>'date', 'label'=>'DateOfBirth', 'enabled'=>'1', 'position'=>70, 'visible'=>-1,),
'email_msgid' => array('type'=>'varchar(255)', 'label'=>'EmailMsgID', 'visible'=>-2, 'enabled'=>1, 'position'=>540, 'notnull'=>-1, 'help'=>'EmailMsgIDDesc'),
//'fk_recruitment_origin' => array('type'=>'integer:CRecruitmentOrigin:recruitment/class/crecruitmentorigin.class.php', 'label'=>'Origin', 'enabled'=>'1', 'position'=>45, 'visible'=>1, 'index'=>1),
@@ -819,6 +819,9 @@ class RecruitmentCandidature extends CommonObject
if ($status == self::STATUS_CANCELED) {
$statusType = 'status6';
}
+ if ($status == self::STATUS_REFUSED) {
+ $statusType = 'status10';
+ }
return dolGetStatus($this->labelStatus[$status], $this->labelStatusShort[$status], '', $statusType, $mode);
}
diff --git a/htdocs/recruitment/recruitmentcandidature_agenda.php b/htdocs/recruitment/recruitmentcandidature_agenda.php
index 2930b3889c6..b70fd7cd0b6 100644
--- a/htdocs/recruitment/recruitmentcandidature_agenda.php
+++ b/htdocs/recruitment/recruitmentcandidature_agenda.php
@@ -111,12 +111,13 @@ if ($id > 0 || !empty($ref)) {
$upload_dir = $conf->recruitment->multidir_output[$object->entity]."/".$object->id;
}
+$permissiontoadd = $user->rights->recruitment->recruitmentjobposition->write; // Used by the include of actions_addupdatedelete.inc.php
+
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
-//$result = restrictedArea($user, 'recruitment', $object->id);
-
-$permissiontoadd = $user->rights->recruitment->recruitmentjobposition->write; // Used by the include of actions_addupdatedelete.inc.php
+$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0);
+$result = restrictedArea($user, 'recruitment', $object->id, 'recruitment_recruitmentcandidature', 'recruitmentjobposition', '', 'rowid', $isdraft);
/*
diff --git a/htdocs/recruitment/recruitmentcandidature_card.php b/htdocs/recruitment/recruitmentcandidature_card.php
index 653b38c90b3..4826dc735ef 100644
--- a/htdocs/recruitment/recruitmentcandidature_card.php
+++ b/htdocs/recruitment/recruitmentcandidature_card.php
@@ -132,10 +132,8 @@ $upload_dir = $conf->recruitment->multidir_output[isset($object->entity) ? $obje
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
-//$isdraft = (($object->statut == $object::STATUS_DRAFT) ? 1 : 0);
-//$result = restrictedArea($user, 'recruitment', $object->id, '', '', 'fk_soc', 'rowid', $isdraft);
-
-//if (!$permissiontoread) accessforbidden();
+$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0);
+$result = restrictedArea($user, 'recruitment', $object->id, 'recruitment_recruitmentcandidature', 'recruitmentjobposition', '', 'rowid', $isdraft);
/*
@@ -555,55 +553,6 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
print dol_get_fiche_end();
-
- /*
- * Lines
- */
-
- if (!empty($object->table_element_line)) {
- // Show object lines
- $result = $object->getLinesArray();
-
- print '
\n";
- }
-
-
// Buttons for actions
if ($action != 'presend' && $action != 'editline') {
diff --git a/htdocs/recruitment/recruitmentcandidature_document.php b/htdocs/recruitment/recruitmentcandidature_document.php
index ee79a4c59a5..2d736e1564b 100644
--- a/htdocs/recruitment/recruitmentcandidature_document.php
+++ b/htdocs/recruitment/recruitmentcandidature_document.php
@@ -106,7 +106,8 @@ if ($id > 0 || !empty($ref)) {
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
-//$result = restrictedArea($user, 'recruitment', $object->id);
+$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0);
+$result = restrictedArea($user, 'recruitment', $object->id, 'recruitment_recruitmentcandidature', 'recruitmentjobposition', '', 'rowid', $isdraft);
$permissiontoadd = $user->rights->recruitment->recruitmentjobposition->write; // Used by the include of actions_addupdatedelete.inc.php
diff --git a/htdocs/recruitment/recruitmentcandidature_list.php b/htdocs/recruitment/recruitmentcandidature_list.php
index 05f007fcb1a..515ddfe80c0 100644
--- a/htdocs/recruitment/recruitmentcandidature_list.php
+++ b/htdocs/recruitment/recruitmentcandidature_list.php
@@ -180,17 +180,11 @@ $permissiontoread = $user->rights->recruitment->recruitmentjobposition->read;
$permissiontoadd = $user->rights->recruitment->recruitmentjobposition->write;
$permissiontodelete = $user->rights->recruitment->recruitmentjobposition->delete;
-// Security check
-if (empty($conf->recruitment->enabled)) {
- accessforbidden('Module not enabled');
-}
-$socid = 0;
-if ($user->socid > 0) { // Protection if external user
- //$socid = $user->socid;
- accessforbidden();
-}
-//$result = restrictedArea($user, 'recruitment', $id, '');
-//if (!$permissiontoread) accessforbidden();
+// Security check - Protection if external user
+//if ($user->socid > 0) accessforbidden();
+//if ($user->socid > 0) $socid = $user->socid;
+//$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0);
+$result = restrictedArea($user, 'recruitment', 0, 'recruitment_recruitmentcandidature', 'recruitmentjobposition');
diff --git a/htdocs/recruitment/recruitmentcandidature_note.php b/htdocs/recruitment/recruitmentcandidature_note.php
index 9dbe3909f2c..d4c18155c5d 100644
--- a/htdocs/recruitment/recruitmentcandidature_note.php
+++ b/htdocs/recruitment/recruitmentcandidature_note.php
@@ -74,11 +74,6 @@ $hookmanager->initHooks(array('recruitmentjobpositionnote', 'globalcard')); // N
// Fetch optionals attributes and labels
$extrafields->fetch_name_optionals_label($object->table_element);
-// Security check - Protection if external user
-//if ($user->socid > 0) accessforbidden();
-//if ($user->socid > 0) $socid = $user->socid;
-//$result = restrictedArea($user, 'recruitment', $id);
-
// Load object
include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be include, not include_once // Must be include, not include_once. Include fetch and fetch_thirdparty but not fetch_optionals
if ($id > 0 || !empty($ref)) {
@@ -88,6 +83,11 @@ if ($id > 0 || !empty($ref)) {
$permissionnote = $user->rights->recruitment->recruitmentjobposition->write; // Used by the include of actions_setnotes.inc.php
$permissiontoadd = $user->rights->recruitment->recruitmentjobposition->write; // Used by the include of actions_addupdatedelete.inc.php
+// Security check - Protection if external user
+//if ($user->socid > 0) accessforbidden();
+//if ($user->socid > 0) $socid = $user->socid;
+$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0);
+$result = restrictedArea($user, 'recruitment', $object->id, 'recruitment_recruitmentcandidature', 'recruitmentjobposition', '', 'rowid', $isdraft);
/*
diff --git a/htdocs/recruitment/recruitmentjobposition_agenda.php b/htdocs/recruitment/recruitmentjobposition_agenda.php
index 388d4e8eadc..253bf2a7e0c 100644
--- a/htdocs/recruitment/recruitmentjobposition_agenda.php
+++ b/htdocs/recruitment/recruitmentjobposition_agenda.php
@@ -111,12 +111,13 @@ if ($id > 0 || !empty($ref)) {
$upload_dir = $conf->recruitment->multidir_output[$object->entity]."/".$object->id;
}
+$permissiontoadd = $user->rights->recruitment->recruitmentjobposition->write; // Used by the include of actions_addupdatedelete.inc.php
+
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
-//$result = restrictedArea($user, 'recruitment', $object->id);
-
-$permissiontoadd = $user->rights->recruitment->recruitmentjobposition->write; // Used by the include of actions_addupdatedelete.inc.php
+$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0);
+$result = restrictedArea($user, 'recruitment', $object->id, 'recruitment_recruitmentjobposition', 'recruitmentjobposition', '', 'rowid', $isdraft);
/*
diff --git a/htdocs/recruitment/recruitmentjobposition_applications.php b/htdocs/recruitment/recruitmentjobposition_applications.php
index c126c594c3a..95daeae54a6 100644
--- a/htdocs/recruitment/recruitmentjobposition_applications.php
+++ b/htdocs/recruitment/recruitmentjobposition_applications.php
@@ -131,10 +131,8 @@ $upload_dir = $conf->recruitment->multidir_output[isset($object->entity) ? $obje
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
-//$isdraft = (($object->statut == $object::STATUS_DRAFT) ? 1 : 0);
-//$result = restrictedArea($user, 'recruitment', $object->id, '', '', 'fk_soc', 'rowid', $isdraft);
-
-//if (!$permissiontoread) accessforbidden();
+$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0);
+$result = restrictedArea($user, 'recruitment', $object->id, 'recruitment_recruitmentjobposition', 'recruitmentjobposition', '', 'rowid', $isdraft);
/*
@@ -412,54 +410,6 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
print dol_get_fiche_end();
-
- /*
- * Lines
- */
-
- if (!empty($object->table_element_line)) {
- // Show object lines
- $result = $object->getLinesArray();
-
- print '
\n";
- }
-
print '
'.$langs->trans("FeatureNotYetAvailable");
}
diff --git a/htdocs/recruitment/recruitmentjobposition_card.php b/htdocs/recruitment/recruitmentjobposition_card.php
index 2b832b3b467..45e6ddab01f 100644
--- a/htdocs/recruitment/recruitmentjobposition_card.php
+++ b/htdocs/recruitment/recruitmentjobposition_card.php
@@ -133,10 +133,8 @@ $usercanclose = $permissiontoadd;
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
-//$isdraft = (($object->statut == $object::STATUS_DRAFT) ? 1 : 0);
-//$result = restrictedArea($user, 'recruitment', $object->id, '', '', 'fk_soc', 'rowid', $isdraft);
-
-//if (!$permissiontoread) accessforbidden();
+$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0);
+$result = restrictedArea($user, 'recruitment', $object->id, 'recruitment_recruitmentjobposition', 'recruitmentjobposition', '', 'rowid', $isdraft);
/*
@@ -440,54 +438,6 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
print dol_get_fiche_end();
- /*
- * Lines
- */
-
- if (!empty($object->table_element_line)) {
- // Show object lines
- $result = $object->getLinesArray();
-
- print '
\n";
- }
-
-
// Buttons for actions
if ($action != 'presend' && $action != 'editline') {
diff --git a/htdocs/recruitment/recruitmentjobposition_document.php b/htdocs/recruitment/recruitmentjobposition_document.php
index 9a3339b5130..0f1bdeef0fc 100644
--- a/htdocs/recruitment/recruitmentjobposition_document.php
+++ b/htdocs/recruitment/recruitmentjobposition_document.php
@@ -106,7 +106,8 @@ if ($id > 0 || !empty($ref)) {
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
-//$result = restrictedArea($user, 'recruitment', $object->id);
+$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0);
+$result = restrictedArea($user, 'recruitment', $object->id, 'recruitment_recruitmentjobposition', 'recruitmentjobposition', '', 'rowid', $isdraft);
$permissiontoadd = $user->rights->recruitment->recruitmentjobposition->write; // Used by the include of actions_addupdatedelete.inc.php
diff --git a/htdocs/recruitment/recruitmentjobposition_list.php b/htdocs/recruitment/recruitmentjobposition_list.php
index d497fa3d998..c28a55e0b2d 100644
--- a/htdocs/recruitment/recruitmentjobposition_list.php
+++ b/htdocs/recruitment/recruitmentjobposition_list.php
@@ -181,17 +181,11 @@ $permissiontoread = $user->rights->recruitment->recruitmentjobposition->read;
$permissiontoadd = $user->rights->recruitment->recruitmentjobposition->write;
$permissiontodelete = $user->rights->recruitment->recruitmentjobposition->delete;
-// Security check
-if (empty($conf->recruitment->enabled)) {
- accessforbidden('Module not enabled');
-}
-$socid = 0;
-if ($user->socid > 0) { // Protection if external user
- //$socid = $user->socid;
- accessforbidden();
-}
-//$result = restrictedArea($user, 'recruitment', $id, '');
-//if (!$permissiontoread) accessforbidden();
+// Security check - Protection if external user
+//if ($user->socid > 0) accessforbidden();
+//if ($user->socid > 0) $socid = $user->socid;
+//$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0);
+$result = restrictedArea($user, 'recruitment', 0, 'recruitment_recruitmentjobposition', 'recruitmentjobposition');
diff --git a/htdocs/recruitment/recruitmentjobposition_note.php b/htdocs/recruitment/recruitmentjobposition_note.php
index 9dcb5ad9d7d..9dbcd0e1180 100644
--- a/htdocs/recruitment/recruitmentjobposition_note.php
+++ b/htdocs/recruitment/recruitmentjobposition_note.php
@@ -88,6 +88,11 @@ if ($id > 0 || !empty($ref)) {
$permissionnote = $user->rights->recruitment->recruitmentjobposition->write; // Used by the include of actions_setnotes.inc.php
$permissiontoadd = $user->rights->recruitment->recruitmentjobposition->write; // Used by the include of actions_addupdatedelete.inc.php
+// Security check - Protection if external user
+//if ($user->socid > 0) accessforbidden();
+//if ($user->socid > 0) $socid = $user->socid;
+$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0);
+$result = restrictedArea($user, 'recruitment', $object->id, 'recruitment_recruitmentjobposition', 'recruitmentjobposition', '', 'rowid', $isdraft);
/*
diff --git a/htdocs/salaries/admin/index.html b/htdocs/salaries/admin/index.html
new file mode 100644
index 00000000000..8b137891791
--- /dev/null
+++ b/htdocs/salaries/admin/index.html
@@ -0,0 +1 @@
+
diff --git a/htdocs/salaries/card.php b/htdocs/salaries/card.php
index 775221caeb2..e1225f15258 100755
--- a/htdocs/salaries/card.php
+++ b/htdocs/salaries/card.php
@@ -282,7 +282,7 @@ if ($action == 'confirm_delete') {
}
-if ($action == 'update' && !$_POST["cancel"] && $user->rights->salaries->write) {
+if ($action == 'update' && !GETPOST("cancel") && $user->rights->salaries->write) {
$amount = price2num(GETPOST('amount'), 'MT', 2);
if (empty($amount)) {
diff --git a/htdocs/salaries/class/salariesstats.class.php b/htdocs/salaries/class/salariesstats.class.php
index 123dc044a4a..f8a7d618fb0 100644
--- a/htdocs/salaries/class/salariesstats.class.php
+++ b/htdocs/salaries/class/salariesstats.class.php
@@ -67,7 +67,7 @@ class SalariesStats extends Stats
$this->where .= " AND fk_soc = ".$this->socid;
}
if (is_array($this->userid) && count($this->userid) > 0) {
- $this->where .= ' AND fk_user IN ('.join(',', $this->userid).')';
+ $this->where .= ' AND fk_user IN ('.$this->db->sanitize(join(',', $this->userid)).')';
} elseif ($this->userid > 0) {
$this->where .= ' AND fk_user = '.$this->userid;
}
diff --git a/htdocs/salaries/list.php b/htdocs/salaries/list.php
index 7bc75f52793..b192fa14011 100644
--- a/htdocs/salaries/list.php
+++ b/htdocs/salaries/list.php
@@ -234,7 +234,7 @@ $help_url = '';
$title = $langs->trans('Salaries');
$sql = "SELECT u.rowid as uid, u.lastname, u.firstname, u.login, u.email, u.admin, u.salary as current_salary, u.fk_soc as fk_soc, u.statut as status,";
-$sql .= " s.rowid, s.fk_account, s.paye, s.fk_user, s.amount, s.salary, s.label, s.datesp, s.dateep, ps.fk_typepayment as paymenttype, ";
+$sql .= " s.rowid, s.fk_account, s.paye, s.fk_user, s.amount, s.salary, s.label, s.datesp, s.dateep, s.fk_typepayment as paymenttype, ";
$sql .= " ba.rowid as bid, ba.ref as bref, ba.number as bnumber, ba.account_number, ba.fk_accountancy_journal, ba.label as blabel,";
$sql .= " pst.code as payment_code,";
$sql .= " SUM(ps.amount) as alreadypayed";
@@ -247,7 +247,7 @@ $sql .= " ".MAIN_DB_PREFIX."user as u";
$sql .= " WHERE u.rowid = s.fk_user";
$sql .= " AND s.entity IN (".getEntity('payment_salaries').")";
if (empty($user->rights->salaries->readall)) {
- $sql .= " AND s.fk_user IN (".join(',', $childids).")";
+ $sql .= " AND s.fk_user IN (".$db->sanitize(join(',', $childids)).")";
}
// Search criteria
@@ -275,15 +275,11 @@ if ($search_account > 0) {
if ($search_status != '' && $search_status >= 0) {
$sql .= " AND s.paye = ".$db->escape($search_status);
}
-if ($filtre) {
- $filtre = str_replace(":", "=", $filtre);
- $sql .= " AND ".$filtre;
-}
if ($search_type_id) {
$sql .= " AND s.fk_typepayment=".$search_type_id;
}
$sql .= " GROUP BY u.rowid, u.lastname, u.firstname, u.login, u.email, u.admin, u.salary, u.fk_soc, u.statut,";
-$sql .= " s.rowid, s.fk_account, s.paye, s.fk_user, s.amount, s.salary, s.label, s.datesp, s.dateep, ps.fk_typepayment, s.fk_bank,";
+$sql .= " s.rowid, s.fk_account, s.paye, s.fk_user, s.amount, s.salary, s.label, s.datesp, s.dateep, s.fk_typepayment, s.fk_bank,";
$sql .= " ba.rowid, ba.ref, ba.number, ba.account_number, ba.fk_accountancy_journal, ba.label,";
$sql .= " pst.code";
$sql .= $db->order($sortfield, $sortorder);
diff --git a/htdocs/salaries/paiement_salary.php b/htdocs/salaries/paiement_salary.php
index ac70d5c4a8c..eb9fe8bfd17 100644
--- a/htdocs/salaries/paiement_salary.php
+++ b/htdocs/salaries/paiement_salary.php
@@ -33,6 +33,7 @@ $langs->load("bills");
$chid = GETPOST("id", 'int');
$action = GETPOST('action', 'alpha');
+$cancel = GETPOST('cancel', 'alpha');
$amounts = array();
// Security check
@@ -49,7 +50,7 @@ if ($user->socid > 0) {
if ($action == 'add_payment' || ($action == 'confirm_paiement' && $confirm == 'yes')) {
$error = 0;
- if ($_POST["cancel"]) {
+ if ($cancel) {
$loc = DOL_URL_ROOT.'/salaries/card.php?id='.$chid;
header("Location: ".$loc);
exit;
@@ -73,23 +74,23 @@ if ($action == 'add_payment' || ($action == 'confirm_paiement' && $confirm == 'y
$action = 'create';
}
+ // Read possible payments
+ foreach ($_POST as $key => $value) {
+ if (substr($key, 0, 7) == 'amount_') {
+ $other_chid = substr($key, 7);
+ $amounts[$other_chid] = price2num($_POST[$key]);
+ }
+ }
+
+ if ($amounts[key($amounts)] <= 0) {
+ $error++;
+ setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentities("Amount")), null, 'errors');
+ $action = 'create';
+ }
+
if (!$error) {
$paymentid = 0;
- // Read possible payments
- foreach ($_POST as $key => $value) {
- if (substr($key, 0, 7) == 'amount_') {
- $other_chid = substr($key, 7);
- $amounts[$other_chid] = price2num($_POST[$key]);
- }
- }
-
- if (count($amounts) <= 0) {
- $error++;
- setEventMessages($langs->trans("ErrorNoPaymentDefined"), null, 'errors');
- $action = 'create';
- }
-
if (!$error) {
$db->begin();
@@ -174,7 +175,7 @@ if ($action == 'create') {
print '
';
print '
';
- print dol_get_fiche_end();
+ print dol_get_fiche_head();
print '
';
@@ -198,21 +199,21 @@ if ($action == 'create') {
print ''.$langs->trans("RemainderToPay").' '.price($total-$sumpaid,0,$outputlangs,1,-1,-1,$conf->currency).' '.$langs->trans("Date").' ';
- $datepaye = dol_mktime(12, 0, 0, $_POST["remonth"], $_POST["reday"], $_POST["reyear"]);
- $datepayment = empty($conf->global->MAIN_AUTOFILL_DATE) ? (empty($_POST["remonth"]) ?-1 : $datepaye) : '';
+ $datepaye = dol_mktime(12, 0, 0, GETPOST("remonth", 'int'), GETPOST("reday", 'int'), GETPOST("reyear", 'int'));
+ $datepayment = empty($conf->global->MAIN_AUTOFILL_DATE) ? (GETPOST("remonth") ? $datepaye : -1) : '';
print $form->selectDate($datepayment, '', '', '', '', "add_payment", 1, 1);
print " ";
print ''.$langs->trans("PaymentMode").' ';
- $form->select_types_paiements(isset($_POST["paiementtype"]) ? $_POST["paiementtype"] : $salary->type_payment, "paiementtype");
+ $form->select_types_paiements(GETPOSTISSET("paiementtype") ? GETPOST("paiementtype") : $salary->type_payment, "paiementtype");
print " \n";
print '';
print ''.$langs->trans('AccountToDebit').' ';
print '';
- $form->select_comptes(isset($_POST["accountid"]) ? $_POST["accountid"] : $salary->accountid, "accountid", 0, '', 1); // Show opend bank account list
+ $form->select_comptes(GETPOSTISSET("accountid") ? GETPOST("accountid", 'int') : $salary->accountid, "accountid", 0, '', 1); // Show opend bank account list
print ' ';
// Number
@@ -270,12 +271,13 @@ if ($action == 'create') {
if ($sumpaid < $objp->amount) {
$namef = "amount_".$objp->id;
$nameRemain = "remain_".$objp->id;
+ /* Disabled, we autofil the amount with remain to pay by default
if (!empty($conf->use_javascript_ajax)) {
print img_picto("Auto fill", 'rightarrow', "class='AutoFillAmount' data-rowid='".$namef."' data-value='".($objp->amount - $sumpaid)."'");
- }
+ } */
$remaintopay = $objp->amount - $sumpaid;
print ''.img_picto('', 'object_phoning_fax').' ';
// EMail / Web
- print ''.$form->editfieldkey('EMail', 'email', GETPOST('email', 'alpha'), $object, 0, 'string', '', (!empty($conf->global->SOCIETE_EMAIL_MANDATORY))).' ';
- print ''.img_picto('', 'object_email').' '.$form->editfieldkey('EMail', 'email', GETPOST('email', 'custom', 0, FILTER_SANITIZE_EMAIL), $object, 0, 'string', '', (!empty($conf->global->SOCIETE_EMAIL_MANDATORY))).' ';
+ print ''.img_picto('', 'object_email').' '.$form->editfieldkey('Web', 'url', GETPOST('url', 'alpha'), $object, 0).' ';
print ''.img_picto('', 'globe').'
';
print '
';
$html_name = ($action == 'editparentcompany') ? 'parent_id' : 'none';
- $form->form_thirdparty($_SERVER['PHP_SELF'].'?socid='.$object->id, $object->parent, $html_name, 's.rowid <> '.$object->id, 1);
+ $form->form_thirdparty($_SERVER['PHP_SELF'].'?socid='.$object->id, $object->parent, $html_name, '', 1, 0, 0, null, 0, array($object->id));
print ' ';
$moreforfilter .= img_picto('', 'user', 'class="pictofixedwidth"');
- $moreforfilter .= $formother->select_salesrepresentatives($search_sale, 'search_sale', $user, 0, $langs->trans('SalesRepresentatives'), 'maxwidth300', 1);
+ $moreforfilter .= $formother->select_salesrepresentatives($search_sale, 'search_sale', $user, 0, $langs->trans('SalesRepresentatives'), ($conf->dol_optimize_smallscreen ? 'maxwidth200' : 'maxwidth300'), 1);
$moreforfilter .= '
';
}
if ($moreforfilter) {
@@ -1525,13 +1525,13 @@ while ($i < min($num, $limit)) {
}
}
if (!empty($arrayfields['s.phone']['checked'])) {
- print "