Merge branch 'develop' of git@github.com:Dolibarr/dolibarr.git into develop

htdocs/adherents/subscription.php

@@ -927,7 +927,7 @@ if ($rowid > 0) {
 
                 // Bank account
                 print '<tr class="bankswitchclass"><td class="fieldrequired">'.$langs->trans("FinancialAccount").'</td><td>';
-                $form->select_comptes(GETPOST('accountid'), 'accountid', 0, '', 1);
+                $form->select_comptes(GETPOST('accountid'), 'accountid', 0, '', 2);
                 print "</td></tr>\n";
 
                 // Payment mode

htdocs/compta/bank/various_payment/card.php

@@ -370,7 +370,7 @@ if ($action == 'create')
 	{
 		print '<tr><td>';
 		print $form->editfieldkey('BankAccount', 'selectaccountid', '', $object, 0, 'string', '', 1).'</td><td>';
-		$form->select_comptes($accountid, "accountid", 0, '', 1); // Affiche liste des comptes courant
+		$form->select_comptes($accountid, "accountid", 0, '', 2); // Affiche liste des comptes courant
 		print '</td></tr>';
 	}
 

htdocs/compta/localtax/card.php

@@ -178,7 +178,7 @@ if ($action == 'create')
     if (!empty($conf->banque->enabled))
     {
 		print '<tr><td class="fieldrequired">'.$langs->trans("Account").'</td><td>';
-        $form->select_comptes($_POST["accountid"], "accountid", 0, "courant=1", 1); // Affiche liste des comptes courant
+        $form->select_comptes($_POST["accountid"], "accountid", 0, "courant=1", 2); // Affiche liste des comptes courant
         print '</td></tr>';
 
 	    print '<tr><td class="fieldrequired">'.$langs->trans("PaymentMode").'</td><td>';

htdocs/compta/paiement_charge.php

@@ -236,7 +236,7 @@ if ($action == 'create')
 	print '<tr>';
 	print '<td class="fieldrequired">'.$langs->trans('AccountToDebit').'</td>';
 	print '<td>';
-	$form->select_comptes(isset($_POST["accountid"]) ? $_POST["accountid"] : $charge->accountid, "accountid", 0, '', 1); // Show opend bank account list
+	$form->select_comptes(isset($_POST["accountid"]) ? $_POST["accountid"] : $charge->accountid, "accountid", 0, '', 2); // Show opend bank account list
 	print '</td></tr>';
 
 	// Number

htdocs/compta/sociales/card.php

@@ -370,7 +370,7 @@ if ($action == 'create')
 	if (!empty($conf->banque->enabled))
 	{
 		print '<tr><td>'.$langs->trans('BankAccount').'</td><td colspan="2">';
-		$form->select_comptes($fk_account, 'fk_account', 0, '', 1);
+		$form->select_comptes($fk_account, 'fk_account', 0, '', 2);
 		print '</td></tr>';
 	}
 

htdocs/core/class/html.form.class.php

@@ -3901,7 +3901,7 @@ class Form
 				while ($i < $num)
 				{
 					$obj = $this->db->fetch_object($result);
-					if ($selected == $obj->rowid)
+					if ($selected == $obj->rowid || ($useempty == 2 && $num == 1 && empty($selected)))
 					{
 						print '<option value="'.$obj->rowid.'" selected>';
 					} else {

htdocs/don/payment/payment.php

@@ -215,7 +215,7 @@ if ($action == 'create')
 	print '<tr>';
 	print '<td class="fieldrequired">'.$langs->trans('AccountToCredit').'</td>';
 	print '<td colspan="2">';
-	$form->select_comptes(GETPOSTISSET("accountid") ? GETPOST("accountid") : $object->accountid, "accountid", 0, '', 1); // Show open bank account list
+	$form->select_comptes(GETPOSTISSET("accountid") ? GETPOST("accountid") : $object->accountid, "accountid", 0, '', 2); // Show open bank account list
 	print '</td></tr>';
 
 	// Number

htdocs/expensereport/payment/payment.php

@@ -262,7 +262,7 @@ if ($action == 'create' || empty($action))
     	print '<tr>';
     	print '<td class="fieldrequired">'.$langs->trans('AccountToDebit').'</td>';
     	print '<td colspan="2">';
-    	$form->select_comptes(GETPOSTISSET("accountid") ? GETPOST("accountid", "int") : $expensereport->accountid, "accountid", 0, '', 1); // Show open bank account list
+    	$form->select_comptes(GETPOSTISSET("accountid") ? GETPOST("accountid", "int") : $expensereport->accountid, "accountid", 0, '', 2); // Show open bank account list
     	print '</td></tr>';
 	}
 

test/acceptance/features/Api/apiAddUsers.feature

@@ -65,3 +65,14 @@ Feature: Add user
       | g!!@%ui       | नेपाली                 |
       | swikriti@h    | सिमप्ले $%#?&@name.txt |
       | !@#$%^&*()-_+ | España§àôœ€            |
+
+  Scenario: Non-admin user with api key adds user
+    Given the admin has created the following users
+      | login | last name | password | api_key     |
+      | Harry | Potter    | hello123 | harrypotter |
+    When the non-admin user "Harry" with password "hello123" creates user with following details using API
+      | last name | Potter   |
+      | login     | Ginny    |
+      | password  | password |
+    Then the response status code should be "200"
+    And user with login "Ginny" should exist

test/acceptance/features/Api/apiListUsers.feature

@@ -0,0 +1,23 @@
+Feature: list users
+  As an admin user
+  I want to view the list of users
+  So that I can manage users
+
+  Scenario: Admin user should be able to see list of created users
+    Given the admin has created the following users
+      | login | last name | password |
+      | Harry | Potter    | hello123 |
+    When the admin gets the list of all users using the API
+    Then the response status code should be "200"
+    And the user list returned by API should be following
+      | login    | last name  |
+      | dolibarr | SuperAdmin |
+      | Harry    | Potter     |
+
+  Scenario: Non-admin user should not be able to see list of created users
+    Given the admin has created the following users
+      | login | last name | password | api_key     |
+      | Harry | Potter    | hello123 | harrypotter |
+    When user "Harry" with password "hello123" tries to list all users using the API
+    Then the response status code should be "401"
+    And the error message should be "Unauthorized: You are not allowed to read list of users"

test/acceptance/setup.js

@@ -4,10 +4,15 @@ const fetch = require('node-fetch');
 let initialUsers = {};
 let dolApiKey = '';
 
-const getUsers = async function () {
+const getUsers = async function (api_key = null) {
     const header = {};
+    let dolApiKey;
     const url = client.globals.backend_url + 'api/index.php/users';
-    const users = {};
+    if (api_key === null) {
+        dolApiKey = client.globals.dolApiKey;
+    } else {
+        dolApiKey = api_key;
+    }
     header['Accept'] = 'application/json';
     header['DOLAPIKEY'] = dolApiKey;
     await fetch(url, {
@@ -15,44 +20,59 @@ const getUsers = async function () {
         headers: header
     })
         .then(async (response) => {
-            const json_response = await response.json();
+            client.globals.response = response;
+        });
+};
+
+const getUsersId = async function () {
+    const users = {};
+    await getUsers();
+    const json_response = await client.globals.response.json();
     for (const user of json_response) {
         users[user.id] = user.id;
     }
-        });
     return users;
 };
 
-Before(async function getDolApiKey() {
+const getDolApiKey = async function (login = null, password = null) {
-	const header = {}
+    const header = {};
-	const adminUsername = client.globals.adminUsername;
+    if (login === null && password === null) {
-	const adminPassword = client.globals.adminPassword;
+        login = client.globals.adminUsername;
-	const params = new URLSearchParams()
+        password = client.globals.adminPassword;
-	params.set('login', adminUsername)
+    }
-	params.set('password', adminPassword)
+    const params = new URLSearchParams();
+    params.set('login', login);
+    params.set('password', password);
     const apiKey = client.globals.backend_url + `api/index.php/login?${params.toString()}`;
-	header['Accept'] = 'application/json'
+    header['Accept'] = 'application/json';
     await fetch(apiKey, {
         method: 'GET',
         headers: header
     })
         .then(async (response) => {
-			const jsonResponse = await response.json()
+            const jsonResponse = await response.json();
-			dolApiKey = jsonResponse['success']['token']
+            dolApiKey = jsonResponse['success']['token'];
-			client.globals.dolApiKey = dolApiKey
+            if (login === client.globals.adminUsername && password === client.globals.adminPassword) {
-		})
+                client.globals.dolApiKey = dolApiKey;
-})
+            }
+        });
+    return dolApiKey;
+};
+
+Before(async function getAdminDolApiKey() {
+    await getDolApiKey();
+});
 
 Before(async () => {
-	initialUsers = await getUsers();
+    initialUsers = await getUsersId();
 });
 
 After(async () => {
-	const finalUsers = await getUsers();
+    const finalUsers = await getUsersId();
     const header = {};
     const url = client.globals.backend_url + 'api/index.php/users/';
     header['Accept'] = 'application/json';
-	header['DOLAPIKEY'] = dolApiKey;
+    header['DOLAPIKEY'] = client.globals.dolApiKey;
     let found;
     for (const finaluser in finalUsers) {
         for (const initialuser in initialUsers) {
@@ -75,3 +95,5 @@ After(async () => {
         }
     }
 });
+
+module.exports = {getDolApiKey, getUsers};

test/acceptance/stepDefinitions/addUsersContext.js

@@ -2,7 +2,7 @@ const {Given, When, Then} = require('cucumber');
 const {client} = require('nightwatch-api');
 const fetch = require('node-fetch');
 const assert = require('assert');
-let response;
+const {getDolApiKey} = require('../setup');
 let Login = {};
 
 Given('the administrator has browsed to the new users page', function () {
@@ -57,11 +57,20 @@ Then('the response message should be {string}', function (expectedResponseMessag
     return getResponseMessage(expectedResponseMessage);
 });
 
-const createUserRequest = function (login, lastname, password) {
+When('the non-admin user {string} with password {string} creates user with following details using API', async function (login, password, dataTable) {
+    const userDolApikey = await getDolApiKey(login, password);
+    return userCreatesUserWithApi(dataTable, userDolApikey);
+});
+
+const createUserRequest = function (login, lastname, password, api_key = null, dolApiKey = null) {
     const header = {};
     const url = client.globals.backend_url + 'api/index.php/users';
     header['Accept'] = 'application/json';
+    if (dolApiKey === null) {
         header['DOLAPIKEY'] = client.globals.dolApiKey;
+    } else {
+        header['DOLAPIKEY'] = dolApiKey;
+    }
     header['Content-Type'] = 'application/json';
     return fetch(url, {
         method: 'POST',
@@ -70,7 +79,8 @@ const createUserRequest = function (login, lastname, password) {
             {
                 login: login,
                 lastname: lastname,
-                pass: password
+                pass: password,
+                api_key: api_key
             }
         )
     });
@@ -80,13 +90,31 @@ const adminCreatesUserWithAPI = function (dataTable) {
     const userDetails = dataTable.rowsHash();
     return createUserRequest(userDetails['login'], userDetails['last name'], userDetails['password'])
         .then((res) => {
-            response = res;
+            client.globals.response = res;
+        });
+};
+
+const userCreatesUserWithApi = function (dataTable, dolApiKey) {
+    const userDetails = dataTable.rowsHash();
+    return createUserRequest(userDetails['login'], userDetails['last name'], userDetails['password'], null, dolApiKey)
+        .then((res) => {
+            client.globals.response = res;
         });
 };
 
 const adminHasCreatedUser = async function (dataTable) {
     const userDetails = dataTable.hashes();
     for (const user of userDetails) {
+
+        if (user['api_key']) {
+            await createUserRequest(user['login'], user['last name'], user['password'], user['api_key'])
+                .then((response) => {
+                    if (response.status < 200 || response.status >= 400) {
+                        throw new Error('Failed to create user: ' + user['login'] +
+                            ' ' + response.statusText);
+                    }
+                });
+        } else {
             await createUserRequest(user['login'], user['last name'], user['password'])
                 .then((response) => {
                     if (response.status < 200 || response.status >= 400) {
@@ -95,6 +123,7 @@ const adminHasCreatedUser = async function (dataTable) {
                     }
                 });
         }
+    }
 };
 
 const getUsersLogin = async function () {
@@ -137,13 +166,13 @@ const userShouldExist = async function (login) {
 };
 
 const getStatusCode = async function (expectedStatusCode) {
-    const actualStatusCode = response.status.toString();
+    const actualStatusCode = client.globals.response.status.toString();
     return assert.strictEqual(actualStatusCode, expectedStatusCode,
         `The expected status code was ${expectedStatusCode} but got ${actualStatusCode}`);
 };
 
 const getResponseMessage = async function (expectedResponseMessage) {
-    const json_response = await response.json();
+    const json_response = await client.globals.response.json();
     const actualResponseMessage = json_response['error']['0'];
     return assert.strictEqual(actualResponseMessage, expectedResponseMessage,
         `the expected response message was ${expectedResponseMessage} but got ${actualResponseMessage}`);

test/acceptance/stepDefinitions/listUsersContext.js

@@ -1,5 +1,7 @@
 const {When, Then} = require('cucumber');
 const {client} = require('nightwatch-api');
+const {getDolApiKey, getUsers} = require('../setup');
+const assert = require('assert');
 
 When('the administrator browses to the list of users page using the webUI', function () {
     return client.page.homePage().browsedToListOfUsers();
@@ -12,3 +14,49 @@ Then('following users should be displayed in the users list', function (dataTabl
 Then('the number of created users should be {int}', function (number) {
     return client.page.listUsersPage().numberOfUsersDisplayed(number);
 });
+
+When('the admin gets the list of all users using the API', function () {
+    return getUsers();
+});
+
+Then('the user list returned by API should be following', function (dataTable) {
+    return theUsersShouldBe(dataTable);
+});
+
+When('user {string} with password {string} tries to list all users using the API', async function (login, password) {
+    const userDolApikey = await getDolApiKey(login, password);
+    return getUsers(userDolApikey);
+});
+
+Then('the error message should be {string}', function (errorMessage) {
+    return getErrorMessage(errorMessage);
+});
+
+const theUsersShouldBe = async function (dataTable) {
+    const expectedUsers = dataTable.hashes();
+    let users = {};
+    const json_response = await client.globals.response.json();
+
+    for (const expectedUser of expectedUsers) {
+        let found;
+        for (const user of json_response) {
+            users["login"] = user.login;
+            users["last name"] = user.lastname;
+            found = false;
+            if (expectedUser["login"] === users.login && expectedUser["last name"] === users["last name"]) {
+                found = true;
+                break;
+            } else {
+                found = false;
+            }
+        }
+        assert.strictEqual(found, true);
+    }
+};
+
+const getErrorMessage = async function (expectedErrorMessage) {
+    const json_response = await client.globals.response.json();
+    const actualErrorMessage = json_response['error']['message'];
+    return assert.strictEqual(actualErrorMessage, expectedErrorMessage,
+        `the expected response message was ${expectedErrorMessage} but got ${actualErrorMessage}`);
+};