From e64c27e1c308f1157f24442020aad31f22a2f111 Mon Sep 17 00:00:00 2001 From: Gauthier PC portable 024 Date: Tue, 8 Jun 2021 10:27:33 +0200 Subject: [PATCH 01/92] FIX : need to add payment sum to getlibstatus function in object linked block --- htdocs/compta/facture/tpl/linkedobjectblock.tpl.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php b/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php index a02a0fc1682..1e18eb6bfeb 100644 --- a/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php +++ b/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php @@ -85,7 +85,7 @@ foreach ($linkedObjectBlock as $key => $objectlink) } } print ''; - print ''.$objectlink->getLibStatut(3).''; + print ''.$objectlink->getLibStatut(3, $objectlink->getSommePaiement()).''; print ''.img_picto($langs->transnoentitiesnoconv("RemoveLink"), 'unlink').''; print "\n"; } From 33553f33476efd363b93cf6c5257943b560b59a0 Mon Sep 17 00:00:00 2001 From: Gauthier PC portable 024 Date: Mon, 14 Jun 2021 17:01:59 +0200 Subject: [PATCH 02/92] FIX : same thing on supplier orders --- htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php b/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php index 1b85082616a..1e5ed8c724c 100644 --- a/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php +++ b/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php @@ -65,7 +65,7 @@ foreach ($linkedObjectBlock as $key => $objectlink) echo ''.price($objectlink->total_ht).''; } } ?> - getLibStatut(3); ?> + getLibStatut(3, $objectlink->getSommePaiement()); ?> ">transnoentitiesnoconv("RemoveLink"), 'unlink'); ?> Date: Mon, 14 Jun 2021 17:08:16 +0200 Subject: [PATCH 03/92] FIX : method exists --- htdocs/compta/facture/tpl/linkedobjectblock.tpl.php | 5 ++++- htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php b/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php index 1e18eb6bfeb..1b81446c243 100644 --- a/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php +++ b/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php @@ -85,7 +85,10 @@ foreach ($linkedObjectBlock as $key => $objectlink) } } print ''; - print ''.$objectlink->getLibStatut(3, $objectlink->getSommePaiement()).''; + print ''; + if(method_exists($objectlink, 'getSommePaiement')) print $objectlink->getLibStatut(3, $objectlink->getSommePaiement()); + else print $objectlink->getLibStatut(3); + print ''; print ''.img_picto($langs->transnoentitiesnoconv("RemoveLink"), 'unlink').''; print "\n"; } diff --git a/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php b/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php index 1e5ed8c724c..5bb6e45a8c8 100644 --- a/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php +++ b/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php @@ -65,7 +65,10 @@ foreach ($linkedObjectBlock as $key => $objectlink) echo ''.price($objectlink->total_ht).''; } } ?> - getLibStatut(3, $objectlink->getSommePaiement()); ?> + getLibStatut(3, $objectlink->getSommePaiement()); + else echo $objectlink->getLibStatut(3); + ?> ">transnoentitiesnoconv("RemoveLink"), 'unlink'); ?> Date: Mon, 14 Jun 2021 15:10:24 +0000 Subject: [PATCH 04/92] Fixing style errors. --- htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php b/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php index 5bb6e45a8c8..20969cddf22 100644 --- a/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php +++ b/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php @@ -66,9 +66,9 @@ foreach ($linkedObjectBlock as $key => $objectlink) } } ?> getLibStatut(3, $objectlink->getSommePaiement()); + if(method_exists($objectlink, 'getSommePaiement')) echo $objectlink->getLibStatut(3, $objectlink->getSommePaiement()); else echo $objectlink->getLibStatut(3); - ?> + ?> ">transnoentitiesnoconv("RemoveLink"), 'unlink'); ?> Date: Sun, 20 Jun 2021 21:55:48 +0200 Subject: [PATCH 05/92] FIX Accoutancy Limit date payment not register on purchases operations --- htdocs/accountancy/journal/purchasesjournal.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/accountancy/journal/purchasesjournal.php b/htdocs/accountancy/journal/purchasesjournal.php index 42bff74097f..5238ee993e1 100644 --- a/htdocs/accountancy/journal/purchasesjournal.php +++ b/htdocs/accountancy/journal/purchasesjournal.php @@ -92,7 +92,7 @@ if (!GETPOSTISSET('date_startmonth') && (empty($date_start) || empty($date_end)) $date_end = dol_get_last_day($pastmonthyear, $pastmonth, false); } -$sql = "SELECT f.rowid, f.ref as ref, f.type, f.datef as df, f.libelle,f.ref_supplier, f.date_lim_reglement as dlf, f.close_code,"; +$sql = "SELECT f.rowid, f.ref as ref, f.type, f.datef as df, f.libelle,f.ref_supplier, f.date_lim_reglement as dlr, f.close_code,"; $sql .= " fd.rowid as fdid, fd.description, fd.product_type, fd.total_ht, fd.tva as total_tva, fd.total_localtax1, fd.total_localtax2, fd.tva_tx, fd.total_ttc, fd.vat_src_code,"; $sql .= " s.rowid as socid, s.nom as name, s.fournisseur, s.code_client, s.code_fournisseur, s.code_compta, s.code_compta_fournisseur,"; $sql .= " p.accountancy_code_buy , aa.rowid as fk_compte, aa.account_number as compte, aa.label as label_compte"; From 0dc16b135d27d30c546808ddcd7c3df1924a7b34 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 21 Jun 2021 00:05:01 +0200 Subject: [PATCH 06/92] FIX allow disabling of a module (not dangerous) even if pb with token. --- htdocs/admin/modules.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/admin/modules.php b/htdocs/admin/modules.php index 56b6e6e1f01..674cbbf52f5 100644 --- a/htdocs/admin/modules.php +++ b/htdocs/admin/modules.php @@ -28,7 +28,7 @@ * \brief Page to activate/disable all modules */ -if (!defined('CSRFCHECK_WITH_TOKEN')) { +if (!defined('CSRFCHECK_WITH_TOKEN') && (empty($_GET['action']) || $_GET['action'] != 'reset')) { // We do not force security to disable modules so we can do it if problem define('CSRFCHECK_WITH_TOKEN', '1'); // Force use of CSRF protection with tokens even for GET } From 9fd06537b7961c1594d1d0c60fa55aa7bce95575 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20FRANCE?= Date: Mon, 21 Jun 2021 10:42:20 +0200 Subject: [PATCH 07/92] move admin warnings on top instead bottom --- htdocs/index.php | 62 +++++++++++++++++++++++------------------------- 1 file changed, 30 insertions(+), 32 deletions(-) diff --git a/htdocs/index.php b/htdocs/index.php index 7eaf517b321..0f457b0f40b 100644 --- a/htdocs/index.php +++ b/htdocs/index.php @@ -4,6 +4,7 @@ * Copyright (C) 2005-2017 Regis Houssin * Copyright (C) 2011-2012 Juanjo Menent * Copyright (C) 2015 Marcos García + * Copyright (C) 2021 Frédéric France * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -101,7 +102,36 @@ if (!empty($conf->global->MAIN_MOTD)) { } } +/* + * Show security warnings + */ +// Security warning repertoire install existe (si utilisateur admin) +if ($user->admin && empty($conf->global->MAIN_REMOVE_INSTALL_WARNING)) { + $message = ''; + + // Check if install lock file is present + $lockfile = DOL_DATA_ROOT.'/install.lock'; + if (!empty($lockfile) && !file_exists($lockfile) && is_dir(DOL_DOCUMENT_ROOT."/install")) { + $langs->load("errors"); + //if (! empty($message)) $message.='
'; + $message .= info_admin($langs->trans("WarningLockFileDoesNotExists", DOL_DATA_ROOT).' '.$langs->trans("WarningUntilDirRemoved", DOL_DOCUMENT_ROOT."/install"), 0, 0, '1', 'clearboth'); + } + + // Conf files must be in read only mode + if (is_writable($conffile)) { + $langs->load("errors"); + //$langs->load("other"); + //if (! empty($message)) $message.='
'; + $message .= info_admin($langs->transnoentities("WarningConfFileMustBeReadOnly").' '.$langs->trans("WarningUntilDirRemoved", DOL_DOCUMENT_ROOT."/install"), 0, 0, '1', 'clearboth'); + } + + if ($message) { + print $message; + //$message.='
'; + //print info_admin($langs->trans("WarningUntilDirRemoved",DOL_DOCUMENT_ROOT."/install")); + } +} /* * Dashboard Dolibarr states (statistics) @@ -722,38 +752,6 @@ print $boxlist; print ''; - -/* - * Show security warnings - */ - -// Security warning repertoire install existe (si utilisateur admin) -if ($user->admin && empty($conf->global->MAIN_REMOVE_INSTALL_WARNING)) { - $message = ''; - - // Check if install lock file is present - $lockfile = DOL_DATA_ROOT.'/install.lock'; - if (!empty($lockfile) && !file_exists($lockfile) && is_dir(DOL_DOCUMENT_ROOT."/install")) { - $langs->load("errors"); - //if (! empty($message)) $message.='
'; - $message .= info_admin($langs->trans("WarningLockFileDoesNotExists", DOL_DATA_ROOT).' '.$langs->trans("WarningUntilDirRemoved", DOL_DOCUMENT_ROOT."/install"), 0, 0, '1', 'clearboth'); - } - - // Conf files must be in read only mode - if (is_writable($conffile)) { - $langs->load("errors"); - //$langs->load("other"); - //if (! empty($message)) $message.='
'; - $message .= info_admin($langs->transnoentities("WarningConfFileMustBeReadOnly").' '.$langs->trans("WarningUntilDirRemoved", DOL_DOCUMENT_ROOT."/install"), 0, 0, '1', 'clearboth'); - } - - if ($message) { - print $message; - //$message.='
'; - //print info_admin($langs->trans("WarningUntilDirRemoved",DOL_DOCUMENT_ROOT."/install")); - } -} - //print 'mem='.memory_get_usage().' - '.memory_get_peak_usage(); // End of page From ac8564dc34f3df651970e31873ab1371b809689b Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 21 Jun 2021 13:06:40 +0200 Subject: [PATCH 08/92] Fix disable token renewal on .css.php, .js.php and .json.php --- htdocs/main.inc.php | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index 437e024a3ae..2301ca75161 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -413,15 +413,17 @@ if ((!empty($conf->global->MAIN_VERSION_LAST_UPGRADE) && ($conf->global->MAIN_VE } // Creation of a token against CSRF vulnerabilities -if (!defined('NOTOKENRENEWAL')) -{ - // Rolling token at each call ($_SESSION['token'] contains token of previous page) - if (isset($_SESSION['newtoken'])) $_SESSION['token'] = $_SESSION['newtoken']; +if (!defined('NOTOKENRENEWAL')) { + // No token renewal on .css.php, .js.php and .json.php + if (!preg_match('/\.(css|js|json)\.php$/', $_SERVER["PHP_SELF"])) { + // Rolling token at each call ($_SESSION['token'] contains token of previous page) + if (isset($_SESSION['newtoken'])) $_SESSION['token'] = $_SESSION['newtoken']; - // Save in $_SESSION['newtoken'] what will be next token. Into forms, we will add param token = $_SESSION['newtoken'] - $token = dol_hash(uniqid(mt_rand(), true)); // Generates a hash of a random number - $_SESSION['newtoken'] = $token; - dol_syslog("NEW TOKEN reclaimed by : " . $_SERVER['PHP_SELF'], LOG_DEBUG); + // Save in $_SESSION['newtoken'] what will be next token. Into forms, we will add param token = $_SESSION['newtoken'] + $token = dol_hash(uniqid(mt_rand(), true)); // Generates a hash of a random number + $_SESSION['newtoken'] = $token; + dol_syslog("NEW TOKEN generated by : " . $_SERVER['PHP_SELF'], LOG_DEBUG); + } } //dol_syslog("aaaa - ".defined('NOCSRFCHECK')." - ".$dolibarr_nocsrfcheck." - ".$conf->global->MAIN_SECURITY_CSRF_WITH_TOKEN." - ".$_SERVER['REQUEST_METHOD']." - ".GETPOST('token', 'alpha').' '.$_SESSION['token']); From 05bb2c720d06501eb6e744996201e0b9c5b0bd7e Mon Sep 17 00:00:00 2001 From: damien clochard Date: Mon, 21 Jun 2021 18:24:52 +0200 Subject: [PATCH 09/92] FIX #17996: Avoid implicit type casts for llx_adherent_type.subscription The llx_adherent_type.subscription column is VARCHAR so we need to compare it with a string, not an int. --- htdocs/adherents/list.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/htdocs/adherents/list.php b/htdocs/adherents/list.php index 7a4a7d5bc1f..d669270b565 100644 --- a/htdocs/adherents/list.php +++ b/htdocs/adherents/list.php @@ -363,13 +363,13 @@ if ($search_type > 0) { $sql .= " AND t.rowid=".((int) $search_type); } if ($search_filter == 'withoutsubscription') { - $sql .= " AND (datefin IS NULL OR t.subscription = 0)"; + $sql .= " AND (datefin IS NULL OR t.subscription = '0')"; } if ($search_filter == 'uptodate') { - $sql .= " AND (datefin >= '".$db->idate($now)."' OR t.subscription = 0)"; + $sql .= " AND (datefin >= '".$db->idate($now)."' OR t.subscription = '0')"; } if ($search_filter == 'outofdate') { - $sql .= " AND (datefin < '".$db->idate($now)."' AND t.subscription = 1)"; + $sql .= " AND (datefin < '".$db->idate($now)."' AND t.subscription = '1')"; } if ($search_status != '') { // Peut valoir un nombre ou liste de nombre separes par virgules From a0b594fbdc5b490a99107a10903aea89d87c5a3b Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 21 Jun 2021 19:47:43 +0200 Subject: [PATCH 10/92] Debug emailcollector --- htdocs/admin/emailcollector_card.php | 28 +-- htdocs/core/class/commonobject.class.php | 10 +- htdocs/core/class/translate.class.php | 2 +- .../class/emailcollector.class.php | 5 +- .../template/class/myobject.class.php | 4 + test/phpunit/AllTests.php | 4 + test/phpunit/EmailCollector.php | 235 ++++++++++++++++++ 7 files changed, 269 insertions(+), 19 deletions(-) create mode 100644 test/phpunit/EmailCollector.php diff --git a/htdocs/admin/emailcollector_card.php b/htdocs/admin/emailcollector_card.php index 724c4ab6dd4..4e2c9e34bf9 100644 --- a/htdocs/admin/emailcollector_card.php +++ b/htdocs/admin/emailcollector_card.php @@ -482,13 +482,13 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea print ''; // Filters - print '
'; - print ''; - print ''; + print '
'; + print '
'; + print ''; print ''; print ''; // Add filter - print ''; + print ''; print '
'.$form->textwithpicto($langs->trans("Filters"), $langs->trans("EmailCollectorFilterDesc")).'
'; $arrayoftypes = array( 'from'=>array('label'=>'MailFrom', 'data-placeholder'=>$langs->trans('SearchString')), @@ -518,7 +518,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea 'isnotanswer'=>array('label'=>'IsNotAnAnswer', 'data-noparam'=>1), 'isanswer'=>array('label'=>'IsAnAnswer', 'data-noparam'=>1) ); - print $form->selectarray('filtertype', $arrayoftypes, '', 1, 0, 0, '', 1, 0, 0, '', 'maxwidth500', 1, '', 2); + print $form->selectarray('filtertype', $arrayoftypes, '', 1, 0, 0, '', 1, 0, 0, '', 'maxwidth300', 1, '', 2); print "\n"; print '