diff --git a/ChangeLog b/ChangeLog
index 2e8bfc968c7..de1482ea183 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,21 @@
English Dolibarr ChangeLog
--------------------------------------------------------------
+
+***** ChangeLog for 15.0.0 compared to 14.0.0 *****
+
+For developers:
+---------------
+
+WARNING:
+
+Following changes may create regressions for some external modules, but were necessary to make Dolibarr better:
+* Update hook 'printOriginObjectLine', removed check on product type and special code. Need now reshook.
+* Old deprecated module "SimplePOS" has been completely removed. Use module "TakePOS" is you need a Point Of Sale.
+* The method static ActionComm::getActions($db, ...) is no more static. Use $actioncomm->getActions(...) instead (without $db param).
+
+
+
***** ChangeLog for 14.0.2 compared to 14.0.1 *****
FIX: #18353 Invoice list translation issue
@@ -86,19 +101,6 @@ FIX: using Tulip, deposit mask was not saved
FIX: #yogosha6907
-***** ChangeLog for 15.0.0 compared to 14.0.0 *****
-
-For developers:
----------------
-
-WARNING:
-
-Following changes may create regressions for some external modules, but were necessary to make Dolibarr better:
-* Update hook 'printOriginObjectLine', removed check on product type and special code. Need now reshook.
-* Old deprecated module "SimplePOS" has been completely removed. Use module "TakePOS" is you need a Point Of Sale.
-
-
-
***** ChangeLog for 14.0.0 compared to 13.0.0 *****
For users:
diff --git a/README.md b/README.md
index 834cc09236e..2cfe4138d62 100644
--- a/README.md
+++ b/README.md
@@ -81,7 +81,7 @@ If you don't have time to install it yourself, you can try some commercial 'read
Dolibarr supports upgrading, usually without the need for any (commercial) support (depending on if you use any commercial extensions). It supports upgrading all the way from any version after 2.8 without breakage. This is unique in the ERP ecosystem and a benefit our users highly appreciate!
-- At first make a backup of your Dolibarr files & than [see](https://wiki.dolibarr.org/index.php/Installation_-_Upgrade#Upgrade_Dolibarr)
+- At first make a backup of your Dolibarr files & then [see](https://wiki.dolibarr.org/index.php/Installation_-_Upgrade#Upgrade_Dolibarr)
- Check that your installed PHP version is supported by the new version [see PHP support](./doc/phpmatrix.md).
- Overwrite all old files from 'dolibarr' directory with files provided into the new version's package.
- At first next access, Dolibarr will redirect you to the "install/" page to follow the upgrade process.
diff --git a/SECURITY.md b/SECURITY.md
index 4c7fbaa8fd5..427b1cc7ae2 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -4,11 +4,11 @@ This file contains some policies about the security reports on Dolibarr ERP CRM
## Supported Versions for security reports
-| Version | Supported |
-| ---------- | ------------------ |
-| <= 14.0.1 | :x: |
-| >= 14.0.2+ | :white_check_mark: |
-
+| Version | Supported |
+| ---------- | ---------------------- |
+| <= 14.0.1 | :x: |
+| >= 14.0.2+ | :white_check_mark: except CSRF attacks|
+| >= develop | :white_check_mark: |
## Reporting a Vulnerability
@@ -54,12 +54,12 @@ ONLY vulnerabilities discovered, when the following setup on test platform is us
* $dolibarr_main_prod must be set to 1 into conf.php
* $dolibarr_nocsrfcheck must be kept to the value 0 into conf.php (this is the default value)
* $dolibarr_main_force_https must be set to something else than 0.
-* The constant MAIN_SECURITY_CSRF_WITH_TOKEN must be set to 1 into backoffice menu Home - Setup - Other (this protection should be set to 1 soon by default)
+* The constant MAIN_SECURITY_CSRF_WITH_TOKEN must be set to 3 into backoffice menu Home - Setup - Other (this protection should be set to 3 soon by default)
* The module DebugBar and ModuleBuilder must NOT be enabled (by default, these modules are not enabled. They are developer tools)
* ONLY security reports on modules provided by default and with the "stable" status are valid (troubles into "experimental", "developement" or external modules are not valid vulnerabilities).
* The root of web server must link to htdocs and the documents directory must be outside of the web server root (this is the default when using the default installer but may differs with external installer).
* The web server setup must be done so only the documents directory is in write mode. The root directory called htdocs must be readonly.
-* CSRF attacks are accepted when using a POST URL, but when using GET URL, they are validated only for creating, updating or deleting data resctricted from pages restricted to admin users.
+* CSRF attacks are accepted but double check that you have set MAIN_SECURITY_CSRF_WITH_TOKEN to value 3.
* Ability for a high level user to edit web site pages into the CMS by including HTML or Javascript is an expected feature. Vulnerabilities into the website module are validated only if HTML or Javascript injection can be done by a non allowed user.
Scope is the web application (back office) and the APIs.
@@ -90,9 +90,8 @@ Scope is the web application (back office) and the APIs.
* Clickjacking/UI redressing
* Physical or social engineering attempts or issues that require physical access to a victim’s computer/device
* Presence of autocomplete attribute on web forms
-* Vulnerabilities affecting outdated browsers or platforms
+* Vulnerabilities affecting outdated browsers or platforms, or vulnerabilities inside browsers themself.
* Logout and other instances of low-severity Cross-Site Request Forgery
-* Missing cookie flags
* Missing security-related HTTP headers which do not lead directly to a vulnerability
* Reports from automated web vulnerability scanners (Acunetix, Vega, etc.) that have not been validated
* Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM/DMARC)
diff --git a/build/docker/Dockerfile b/build/docker/Dockerfile
index dca74e9e720..eb8e3ade6dc 100644
--- a/build/docker/Dockerfile
+++ b/build/docker/Dockerfile
@@ -57,7 +57,6 @@ RUN echo "host mail" >> /etc/msmtprc
RUN echo "from local@localdomain.com" >> /etc/msmtprc
RUN echo "domain localhost.localdomain" >> /etc/msmtprc
RUN echo "sendmail_path=/usr/bin/msmtp -t" >> /usr/local/etc/php/conf.d/php-sendmail.ini
-RUN echo "localhost localhost.localdomain" >> /etc/hosts
EXPOSE 80
diff --git a/build/docker/docker-compose.yml b/build/docker/docker-compose.yml
index 2167f069f25..b72118de5fb 100644
--- a/build/docker/docker-compose.yml
+++ b/build/docker/docker-compose.yml
@@ -46,6 +46,8 @@ services:
networks:
- internal-pod
- external-pod
+ extra_hosts:
+ - "localhost.localdomain:127.0.0.1"
mail:
image: maildev/maildev
diff --git a/dev/initdemo/initdemopassword.sh b/dev/initdemo/initdemopassword.sh
index 933c3b1afa2..37264fb8e4d 100755
--- a/dev/initdemo/initdemopassword.sh
+++ b/dev/initdemo/initdemopassword.sh
@@ -171,7 +171,10 @@ if [ $res -ne 0 ]; then
fi
if [ -s "$mydir/initdemopostsql.sql" ]; then
+ echo A file initdemopostsql.sql was found, we execute it.
mysql -P$port $base < "$mydir/initdemopostsql.sql"
+else
+ echo No file initdemopostsql.sql found, we extra sql action done.
fi
diff --git a/dev/tools/github_authors_peryear.sh b/dev/tools/github_authors_and_commits_peryear.sh
similarity index 100%
rename from dev/tools/github_authors_peryear.sh
rename to dev/tools/github_authors_and_commits_peryear.sh
diff --git a/htdocs/accountancy/admin/account.php b/htdocs/accountancy/admin/account.php
index 930e76c7690..c9849f9f54f 100644
--- a/htdocs/accountancy/admin/account.php
+++ b/htdocs/accountancy/admin/account.php
@@ -195,7 +195,7 @@ if (empty($reshook)) {
} elseif ($action == 'enable' && $permissiontoadd) {
if ($accounting->fetch($id)) {
$mode = GETPOST('mode', 'int');
- $result = $accounting->account_activate($id, $mode);
+ $result = $accounting->accountActivate($id, $mode);
}
$action = 'update';
if ($result < 0) {
diff --git a/htdocs/accountancy/admin/card.php b/htdocs/accountancy/admin/card.php
index 86efee3a04a..4d69eae7db8 100644
--- a/htdocs/accountancy/admin/card.php
+++ b/htdocs/accountancy/admin/card.php
@@ -61,7 +61,7 @@ $object = new AccountingAccount($db);
*/
if (GETPOST('cancel', 'alpha')) {
- $urltogo = $backtopage ? $backtopage : dol_buildpath('/accountancy/admin/account.php', 1);
+ $urltogo = $backtopage ? $backtopage : DOL_URL_ROOT.'/accountancy/admin/account.php';
header("Location: ".$urltogo);
exit;
}
@@ -75,7 +75,7 @@ if ($action == 'add' && $user->rights->accounting->chartofaccount) {
setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentities("Label")), null, 'errors');
$action = 'create';
} else {
- $sql = 'SELECT pcg_version FROM ' . MAIN_DB_PREFIX . 'accounting_system WHERE rowid='.((int) $conf->global->CHARTOFACCOUNTS);
+ $sql = "SELECT pcg_version FROM " . MAIN_DB_PREFIX . "accounting_system WHERE rowid = ".((int) $conf->global->CHARTOFACCOUNTS);
dol_syslog('accountancy/admin/card.php:: $sql=' . $sql);
$result = $db->query($sql);
@@ -121,7 +121,7 @@ if ($action == 'add' && $user->rights->accounting->chartofaccount) {
}
if (!$error) {
setEventMessages("RecordCreatedSuccessfully", null, 'mesgs');
- $urltogo = $backtopage ? $backtopage : dol_buildpath('/accountancy/admin/account.php', 1);
+ $urltogo = $backtopage ? $backtopage : DOL_URL_ROOT.'/accountancy/admin/account.php';
header("Location: " . $urltogo);
exit;
}
@@ -138,7 +138,7 @@ if ($action == 'add' && $user->rights->accounting->chartofaccount) {
} else {
$result = $object->fetch($id);
- $sql = 'SELECT pcg_version FROM '.MAIN_DB_PREFIX.'accounting_system WHERE rowid='.((int) $conf->global->CHARTOFACCOUNTS);
+ $sql = "SELECT pcg_version FROM ".MAIN_DB_PREFIX."accounting_system WHERE rowid=".((int) $conf->global->CHARTOFACCOUNTS);
dol_syslog('accountancy/admin/card.php:: $sql=' . $sql);
$result2 = $db->query($sql);
@@ -260,7 +260,7 @@ if ($action == 'create') {
print '';
// autosuggest from existing account types if found
print '