-
+[](https://github.com/Dolibarr/dolibarr/graphs/contributors)
## CREDITS
@@ -171,7 +162,6 @@ Dolibarr est le résultat du travail de nombreux contributeurs depuis des année
Voir le fichier [COPYRIGHT](https://github.com/Dolibarr/dolibarr/blob/develop/COPYRIGHT)
-
## ACTUALITES ET RESEAUX SOCIAUX
Suivez le projet Dolibarr project sur les réseaux francophones
diff --git a/README.md b/README.md
index 54fdf1e958b..b0f7a2c3761 100644
--- a/README.md
+++ b/README.md
@@ -43,7 +43,7 @@ You can use a web server and a supported database (MariaDB, MySQL or PostgreSQL)
On GNU/Linux, first check if your distribution has already packaged Dolibarr.
-#### Generic install steps:
+#### Generic install steps
- Check that your installed PHP version is supported [see PHP support](https://wiki.dolibarr.org/index.php/Releases).
@@ -71,86 +71,87 @@ On GNU/Linux, first check if your distribution has already packaged Dolibarr.
- Follow the installer instructions
-
### Saas/Cloud setup
-If you don't have time to install it yourself, you can try some commercial 'ready to use' Cloud offers (See https://saas.dolibarr.org). However, this third solution is not free.
-
+If you don't have time to install it yourself, you can try some commercial 'ready to use' Cloud offers (See [https://saas.dolibarr.org](https://saas.dolibarr.org)). However, this third solution is not free.
## UPGRADING
Dolibarr supports upgrading, usually without the need for any (commercial) support (depending on if you use any commercial extensions). It supports upgrading all the way from any version after 2.8 without breakage. This is unique in the ERP ecosystem and a benefit our users highly appreciate!
-
+
- At first make a backup of your Dolibarr files & then [see](https://wiki.dolibarr.org/index.php/Installation_-_Upgrade#Upgrade_Dolibarr)
- Check that your installed PHP version is supported by the new version [see PHP support](./doc/phpmatrix.md).
- Overwrite all old files from 'dolibarr' directory with files provided into the new version's package.
- At first next access, Dolibarr will redirect you to the "install/" page to follow the upgrade process.
If an `install.lock` file exists to lock any other upgrade process, the application will ask you to remove the file manually (you should find the `install.lock` file in the directory used to store generated and uploaded documents, in most cases, it is the directory called "*documents*").
-
## WHAT'S NEW
See the [ChangeLog](https://github.com/Dolibarr/dolibarr/blob/develop/ChangeLog) file.
-
## FEATURES
### Main application/modules (all optional)
-- Third-Parties Management: Customers, Prospects (Leads) and/or Suppliers + Contacts
-- Members/Membership/Foundation management
+- Third-Parties Management: Customers, Prospects (Leads) and/or Suppliers + Contacts
+- Members/Membership/Foundation management
- Product Management
-- Products and/or Services catalog
-- Stock / Warehouse management + Inventory
-- Barcodes
-- Batches / Lots / Serials
-- Product Variants
+ Product Management
+
+- Products and/or Services catalog
+- Stock / Warehouse management + Inventory
+- Barcodes
+- Batches / Lots / Serials
+- Product Variants
- Bill of Materials (BOM)
-- Manufacturing Orders
+- Manufacturing Orders
- Customer/Sales Management
-- Customers/Prospects + Contacts management
-- Opportunities or Leads management
-- Commercial proposals management
-- Customer Orders management
-- Contracts/Subscription management
-- Interventions management
-- Ticket System
-- Shipping management
-- Customer Invoices/Credit notes and payment management
-- Point of Sale (POS)
+ Customer/Sales Management
- Supplier/Purchase Management
-- Suppliers/Vendors + Contacts
-- Supplier (price) requests
-- Purchase Orders management
-- Delivery/Receiption
-- Supplier Invoices/credit notes and payment management
-- INCOTERMS
+- Customers/Prospects + Contacts management
+- Opportunities or Leads management
+- Commercial proposals management
+- Customer Orders management
+- Contracts/Subscription management
+- Interventions management
+- Ticket System
+- Shipping management
+- Customer Invoices/Credit notes and payment management
+- Point of Sale (POS)
- Finance / Accounting
-- Invoices / Payments
-- Bank accounts management
-- Direct debit orders management (European SEPA)
-- Accounting management
-- Donations management
-- Loan management
-- Margins
-- Reports
+ Supplier/Purchase Management
- Collaboration
-- Shared calendar/agenda (with ical and vcal export for third party tools integration)
-- Projects & Tasks management
-- Ticket System
+- Suppliers/Vendors + Contacts
+- Supplier (price) requests
+- Purchase Orders management
+- Delivery/Receiption
+- Supplier Invoices/credit notes and payment management
+- INCOTERMS
+
+ Finance / Accounting
+
+- Invoices / Payments
+- Bank accounts management
+- Direct debit orders management (European SEPA)
+- Accounting management
+- Donations management
+- Loan management
+- Margins
+- Reports
+
+ Collaboration
+
+- Shared calendar/agenda (with ical and vcal export for third party tools integration)
+- Projects & Tasks management
+- Ticket System
- Surveys
- HR
-- Employee's leave requests management
-- Expense reports
-- Recruitment management
-- Timesheets
+ HR
+- Employee's leave requests management
+- Expense reports
+- Recruitment management
+- Timesheets
### Other application/modules
@@ -171,7 +172,6 @@ See the [ChangeLog](https://github.com/Dolibarr/dolibarr/blob/develop/ChangeLog)
(around 100 modules available by default, 1000+ on the addon market place)
-
### Other general features
- Localization in most major languages
@@ -190,27 +190,24 @@ See the [ChangeLog](https://github.com/Dolibarr/dolibarr/blob/develop/ChangeLog)
- Canadian double taxes (federal/province) and other countries using cumulative VAT
- Tunisian tax stamp
- Argentina invoice numbering using A,B,C...
- - Compatible with [European directives] (https://europa.eu/legislation_summaries/taxation/l31057_en.htm) (2006/112/CE ... 2010/45/UE)
+ - Compatible with [European directives](https://europa.eu/legislation_summaries/taxation/l31057_en.htm) (2006/112/CE ... 2010/45/UE)
- Compatible with European GDPR rules
- ...
- Flexible PDF & ODT generation for invoices, proposals, orders...
- ...
-
### System Environment / Requirements
- PHP
-- MariaDB, MySQL or PostgreSQL
+- MariaDB, MySQL or PostgreSQL
- Compatible with all Cloud solutions that match PHP & MySQL or PostgreSQL prerequisites.
See exact requirements on the [Wiki](https://wiki.dolibarr.org/index.php/Prerequisite)
-
### Extending
Dolibarr can be extended with a lot of other external application or modules from third party developers available at the [DoliStore](https://www.dolistore.com).
-
## WHAT DOLIBARR CAN'T DO YET
These are features that Dolibarr does **not** yet fully support:
@@ -220,21 +217,18 @@ These are features that Dolibarr does **not** yet fully support:
- No native embedded Webmail, but you can send email to contacts in Dolibarr with e.g. offers, invoices, etc.
- Dolibarr can't do coffee (yet)
-
## DOCUMENTATION
Administrator, user, developer and translator's documentations are available along with other community resources in the [Wiki](https://wiki.dolibarr.org).
-
## CONTRIBUTING
-This project exists thanks to all the people who contribute.
+This project exists thanks to all the people who contribute.
Please read the instructions how to contribute (report a bug/error, a feature request, send code ...) [[Contribute](https://github.com/Dolibarr/dolibarr/blob/develop/.github/CONTRIBUTING.md)]
A view on Contributors:
-
-
+[](https://github.com/Dolibarr/dolibarr/graphs/contributors)
## CREDITS
@@ -242,7 +236,6 @@ Dolibarr is the work of many contributors over the years and uses some fine PHP
See [COPYRIGHT](https://github.com/Dolibarr/dolibarr/blob/develop/COPYRIGHT) file.
-
## NEWS AND SOCIAL NETWORKS
Follow Dolibarr project on:
@@ -253,8 +246,6 @@ Follow Dolibarr project on:
- [YouTube](https://www.youtube.com/user/DolibarrERPCRM)
- [GitHub](https://github.com/Dolibarr/dolibarr)
-
### Sponsors
Support this project by becoming a sponsor. Your logo will show up here. 🙏 [[Become a sponsor/backer](https://opencollective.com/dolibarr#backer)]
-
diff --git a/htdocs/core/ajax/row.php b/htdocs/core/ajax/row.php
index 52cc23faf8f..0b1106ca20a 100644
--- a/htdocs/core/ajax/row.php
+++ b/htdocs/core/ajax/row.php
@@ -99,7 +99,7 @@ if (GETPOST('roworder', 'alpha', 3) && GETPOST('table_element_line', 'aZ09', 3)
$perm = 1;
} elseif ($table_element_line == 'ecm_files' && $fk_element == 'fk_ticket' && !empty($user->rights->ticket->write)) {
$perm = 1;
- } elseif ($table_element_line == 'product_association' && $fk_element == 'fk_product' && !empty($user->rights->produit->creer)) {
+ } elseif ($table_element_line == 'product_association' && $fk_element == 'fk_product' && (!empty($user->rights->produit->creer) || !empty($user->rights->service->creer))) {
$perm = 1;
} elseif ($table_element_line == 'projet_task' && $fk_element == 'fk_projet' && $user->rights->projet->creer) {
$perm = 1;
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index 084a4a4f25a..1c533f0e686 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -108,6 +108,10 @@ function getEntity($element, $shared = 1, $currentobject = null)
{
global $conf, $mc, $hookmanager, $object, $action;
+ if (! is_object($hookmanager)) {
+ $hookmanager = new HookManager($db);
+ }
+
// fix different element names (France to English)
switch ($element) {
case 'contrat':
@@ -8151,16 +8155,20 @@ function dol_eval($s, $returnvalue = 0, $hideerrors = 1)
return 'Bad string syntax to evaluate: '.$s;
}
- // We block using of php exec or php file functions
- $forbiddenphpstrings = array("exec(", "passthru(", "shell_exec(", "system(", "proc_open(", "popen(", "eval(", "dol_eval(", "executeCLI(");
- $forbiddenphpstrings = array_merge($forbiddenphpstrings, array("fopen(", "file_put_contents(", "fputs(", "fputscsv(", "fwrite(", "fpassthru(", "unlink(", "mkdir(", "rmdir(", "symlink(", "touch(", "umask("));
- $forbiddenphpstrings = array_merge($forbiddenphpstrings, array('function(', '$$', 'call_user_func('));
+ // We block use of php exec or php file functions
+ $forbiddenphpstrings = array('$$');
$forbiddenphpstrings = array_merge($forbiddenphpstrings, array('_ENV', '_SESSION', '_COOKIE', '_GET', '_POST', '_REQUEST'));
- $forbiddenphpregex = 'global\s+\$';
+
+ $forbiddenphpfunctions = array("exec", "passthru", "shell_exec", "system", "proc_open", "popen", "eval", "dol_eval", "executeCLI");
+ $forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("fopen", "file_put_contents", "fputs", "fputscsv", "fwrite", "fpassthru", "unlink", "mkdir", "rmdir", "symlink", "touch", "umask"));
+ $forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("function", "call_user_func"));
+
+ $forbiddenphpregex = 'global\s+\$|\b('.implode('|', $forbiddenphpfunctions).')\b';
+
do {
$oldstringtoclean = $s;
$s = str_ireplace($forbiddenphpstrings, '__forbiddenstring__', $s);
- $s = preg_replace('/'.$forbiddenphpregex.'/', '__forbiddenstring__', $s);
+ $s = preg_replace('/'.$forbiddenphpregex.'/i', '__forbiddenstring__', $s);
//$s = preg_replace('/\$[a-zA-Z0-9_\->\$]+\(/i', '', $s); // Remove $function( call and $mycall->mymethod(
} while ($oldstringtoclean != $s);
diff --git a/htdocs/core/modules/modHRM.class.php b/htdocs/core/modules/modHRM.class.php
index d6870244521..b13e5b6bbba 100644
--- a/htdocs/core/modules/modHRM.class.php
+++ b/htdocs/core/modules/modHRM.class.php
@@ -1,5 +1,5 @@
+/* Copyright (C) 2015-2021 Alexandre Spangaro