diff --git a/ChangeLog b/ChangeLog
index 1f4afc83e82..46779a760c5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,7 @@
English Dolibarr ChangeLog
--------------------------------------------------------------
+
***** ChangeLog for 13.0.0 compared to 12.0.0 *****
For users:
NEW: Add module Credit transfer SEPA to manage payment of supplier using bank credit transfer SEPA files
@@ -22,6 +23,52 @@ Following changes may create regressions for some external modules, but were nec
you must now also include declaration of the Trait CommonIncoterm in your class. All incoterm functions were moved into this Trait.
* The GETPOST(..., 'alpha') has now the same behaviour than GETPOST(..., 'alpahnohtml');
+
+***** ChangeLog for 12.0.3 compared to 12.0.2 *****
+FIX: 10.0 - when the mime file name is different from the filesystem name, the attachment name should be the mime filename
+FIX: 11.0 - expenses lines overlapping the total amounts frame
+FIX: 12.0 - round value of virtual stock on product stock reassort list
+FIX: #14469
+FIX: #14474 Error when deleting
+FIX: #14530
+FIX: #14703
+FIX: - Accountancy balance Error SQL on entity
+FIX: Bad number of subscription (forgotten when member was resiliated)
+FIX: bad route url to delete subproduct with API
+FIX: Category for suplements not saved
+FIX: Compatibility with modules without document generation
+FIX: Cron load lang
+FIX: CSS
+FIX: Error management. Do no try to approve PO if validation fails.
+FIX: expenses lines overlapping the frame for total amounts.
+FIX: Filter in "billed" of orders was not saved
+FIX: infinite fetch object linked loop
+FIX: Intervention lose html tags when updating
+FIX: JS CRASH - bad usage of moreparam
+FIX: lang fr retained warranty
+FIX: Look and feel v12: First tab must be name of object
+FIX: missing entity check
+FIX: missing param for hook
+FIX: Missing transaction on PO actions
+FIX: MySql Strict mode
+FIX: param entity in html form file
+FIX: Problems on FEC format
+FIX: round stock value on product list
+FIX: - Send mail from contact : select mail model
+FIX: set sales representatives on create company card
+FIX: Setup of stock increase/decrease
+FIX: sign of amount with credit note and multicurrencies
+FIX: Static property called as non static
+FIX: task leftmenu
+FIX: title button attribute id empty
+FIX: unit price divided by quantity when accepting supplier price proposal
+FIX: Update extrafields on line only if it is supported
+FIX: Update line of BOM
+FIX: using decimal on stock correction
+FIX: Visualization rights correction on last modified contacts box
+FIX: Wrong redirection
+FIX: Yogosha report 4425 (backport)
+
***** ChangeLog for 12.0.2 compared to 12.0.1 *****
FIX: computation of the bottom margin of returns NaN because body is not loaded yet
FIX: DebugBar hides content at page bottom
diff --git a/SECURITY.md b/SECURITY.md
index 06d1407229a..56e1da679ed 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -97,19 +97,19 @@ Scope is the web application (back office) and the APIs.
## Non-qualifying vulnerabilities for Bug bounty programs, but qualified for reporting
* "Self" XSS
-* Missing cookie flags
* SSL/TLS best practices
* Denial of Service attacks
* Clickjacking/UI redressing
-* Physical or social engineering attempts
+* Physical or social engineering attempts or issues that require physical access to a victim’s computer/device
* Presence of autocomplete attribute on web forms
* Vulnerabilities affecting outdated browsers or platforms
-* Issues that require physical access to a victim’s computer/device
* Logout and other instances of low-severity Cross-Site Request Forgery
+* Missing cookie flags
* Missing security-related HTTP headers which do not lead directly to a vulnerability
* Reports from automated web vulnerability scanners (Acunetix, Vega, etc.) that have not been validated
* Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM/DMARC)
* Reports on features flagged as "experimental" or "development"
-* Software version disclosure when logged user is admin
+* Software version or private IP disclosure when logged user is admin
* Stack traces or path disclosure when logged user is admin
+* Any vulnerabilities due to a configuration different than the one defined into chapter "Scope for qualified vulnerabilities".
diff --git a/htdocs/accountancy/bookkeeping/list.php b/htdocs/accountancy/bookkeeping/list.php
index cba4756fdd0..5ae9c3d4742 100644
--- a/htdocs/accountancy/bookkeeping/list.php
+++ b/htdocs/accountancy/bookkeeping/list.php
@@ -640,7 +640,9 @@ $newcardbutton .= dolGetButtonTitle($buttonLabel, $langs->trans("ExportFilteredL
$newcardbutton .= dolGetButtonTitle($langs->trans('GroupByAccountAccounting'), '', 'fa fa-stream paddingleft', DOL_URL_ROOT.'/accountancy/bookkeeping/listbyaccount.php?'.$param);
-$newcardbutton .= dolGetButtonTitle($langs->trans('NewAccountingMvt'), '', 'fa fa-plus-circle paddingleft', './card.php?action=create', '', $user->rights->accounting->mouvements->creer);
+$url = './card.php?action=create';
+if (!empty($socid)) $url .= '&socid='.$socid;
+$newcardbutton .= dolGetButtonTitle($langs->trans('NewAccountingMvt'), '', 'fa fa-plus-circle paddingleft', $url, '', $user->rights->accounting->mouvements->creer);
print_barre_liste($title_page, $page, $_SERVER["PHP_SELF"], $param, $sortfield, $sortorder, '', $num, $nbtotalofrecords, 'title_accountancy', 0, $newcardbutton, '', $limit);
diff --git a/htdocs/accountancy/index.php b/htdocs/accountancy/index.php
index 4f6c66ff7d5..80ed833b828 100644
--- a/htdocs/accountancy/index.php
+++ b/htdocs/accountancy/index.php
@@ -38,6 +38,7 @@ if ($user->socid > 0)
// Initialize technical object to manage hooks. Note that conf->hooks_modules contains array of hooks
$hookmanager->initHooks(array('accountancyindex'));
+
/*
* Actions
*/
@@ -54,6 +55,7 @@ if (GETPOST('addbox')) // Add box (when submit is done from a form when ajax dis
if ($result > 0) setEventMessages($langs->trans("BoxAdded"), null);
}
+
/*
* View
*/
diff --git a/htdocs/admin/stock.php b/htdocs/admin/stock.php
index 61ab031376b..6983c228007 100644
--- a/htdocs/admin/stock.php
+++ b/htdocs/admin/stock.php
@@ -23,7 +23,7 @@
/**
* \file htdocs/admin/stock.php
* \ingroup stock
- * \brief Page d'administration/configuration du module gestion de stock
+ * \brief Page to setup module stock
*/
require '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
@@ -760,76 +760,6 @@ print '';
print '';
-/*
-print ' ';
-if ($conf->global->MAIN_FEATURES_LEVEL >= 2)
-{
- print '
';
- print '
';
- print '
'.$langs->trans("Inventory").'
'."\n";
- print '
'.$langs->trans("Status").'
'."\n";
- print '
'."\n";
-
- // Example with a yes / no select
- print '
';
-}
-*/
-
-/* I keep the option/feature, but hidden to end users for the moment. If feature is used by module, no need to have users see it.
-If not used by a module, I still need to understand in which case user may need this now we can set rule on product page.
-if ($conf->global->PRODUIT_SOUSPRODUITS)
-{
- print '
';
- print '
'.$langs->trans("IndependantSubProductStock").'
';
- print '
';
- print "';
- print "
\n";
- print "
\n";
-}
-*/
-
// End of page
llxFooter();
$db->close();
diff --git a/htdocs/admin/syslog.php b/htdocs/admin/syslog.php
index 079fb3a6052..60de87d2d2e 100644
--- a/htdocs/admin/syslog.php
+++ b/htdocs/admin/syslog.php
@@ -212,6 +212,12 @@ foreach ($syslogModules as $moduleName)
print '