From 28218a00b384a3c3071c067500cdc4e877d7e2f9 Mon Sep 17 00:00:00 2001
From: gauthier <gauthier.verdol@atm-consulting.fr>
Date: Thu, 13 Jun 2019 11:01:12 +0200
Subject: [PATCH 1/2] FIX : syntax error

---
 htdocs/core/class/html.formother.class.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/htdocs/core/class/html.formother.class.php b/htdocs/core/class/html.formother.class.php
index 6cf3c816a24..79aa4cc8c77 100644
--- a/htdocs/core/class/html.formother.class.php
+++ b/htdocs/core/class/html.formother.class.php
@@ -402,7 +402,6 @@ class FormOther
         	if (! empty($user->admin) && empty($user->entity) && $conf->entity == 1) {
         		$sql_usr.= " WHERE u.entity IS NOT NULL"; // Show all users
         	} else {
-        		$sql_usr.= ",
         		$sql_usr.= " WHERE EXISTS (SELECT ug.fk_user FROM ".MAIN_DB_PREFIX."usergroup_user as ug WHERE u.rowid = ug.fk_user AND ug.entity IN (".getEntity('user')."))";
         		$sql_usr.= " OR u.entity = 0"; // Show always superadmin
         	}

From 787e1319b9744ea9d5f8950827e3a7e699fe2ca3 Mon Sep 17 00:00:00 2001
From: "atm-florian.m" <florian.mortgat@atm-consulting.fr>
Date: Thu, 13 Jun 2019 16:21:07 +0200
Subject: [PATCH 2/2] FIX: in edit mode, dictionary inputs do not escape the
 string inside the 'value' attribute, causing errors if there are any double
 quotes

---
 htdocs/admin/dict.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php
index e1e0c0d419e..07b8a9d7119 100644
--- a/htdocs/admin/dict.php
+++ b/htdocs/admin/dict.php
@@ -1976,7 +1976,7 @@ function fieldList($fieldlist, $obj='', $tabname='', $context='')
 			}
 			if (! $transfound)
 			{
-                print '<input type="text" class="flat'.($class?' '.$class:'').'" value="'.(isset($obj->{$fieldlist[$field]})?$obj->{$fieldlist[$field]}:'').'" name="'.$fieldlist[$field].'">';
+                print '<input type="text" class="flat'.($class?' '.$class:'').'" value="'.dol_escape_htmltag(isset($obj->{$fieldlist[$field]})?$obj->{$fieldlist[$field]}:'').'" name="'.$fieldlist[$field].'">';
 			}
 			print '</td>';
 		}