From c4d8a25c5a09f018fd42a9b346085c36fa8a87ee Mon Sep 17 00:00:00 2001
From: florian HENRY <florian.henry@atm-consuliting.fr>
Date: Mon, 10 Aug 2020 13:40:55 +0200
Subject: [PATCH 001/101] fix external module multidiroutput

---
 htdocs/core/lib/files.lib.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php
index 23b631bae53..cb139edd29b 100644
--- a/htdocs/core/lib/files.lib.php
+++ b/htdocs/core/lib/files.lib.php
@@ -2992,7 +2992,7 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity,
 			if ($partofdirinoriginalfile && ($fuser->rights->$modulepart->$partofdirinoriginalfile->{$lire} || $fuser->rights->$modulepart->$partofdirinoriginalfile->{$read})) $accessallowed = 1;
 			if ($fuser->rights->$modulepart->{$lire} || $fuser->rights->$modulepart->{$read}) $accessallowed = 1;
 			//}
-			$original_file = $conf->$modulepart->dir_output.'/'.$original_file;
+			$original_file = $conf->$modulepart->multidir_output[$entity].'/'.$original_file;
 		}
 
 		// For modules who wants to manage different levels of permissions for documents

From 6928b6543c9f6db15e1c7fc8ba257602debd1c52 Mon Sep 17 00:00:00 2001
From: Alexandre SPANGARO <aspangaro.dolibarr@gmail.com>
Date: Wed, 16 Sep 2020 21:24:24 +0200
Subject: [PATCH 002/101] Revert "FIX Yogosha report 4425 (backport)"

This reverts commit 23c4cfe913429a38b3e4f9edec33bdfb0166d274.
---
 htdocs/core/lib/functions.lib.php | 37 +++++++------------------------
 htdocs/document.php               |  9 ++++----
 2 files changed, 12 insertions(+), 34 deletions(-)

diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index 3f4229589dd..97ad5d58969 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -7705,16 +7705,19 @@ function getAdvancedPreviewUrl($modulepart, $relativepath, $alldata = 0, $param
 
 	if (empty($conf->use_javascript_ajax)) return '';
 
-	$isAllowedForPreview = dolIsAllowedForPreview($relativepath);
+	$mime_preview = array('bmp', 'jpeg', 'png', 'gif', 'tiff', 'pdf', 'plain', 'css', 'svg+xml');
+	//$mime_preview[]='vnd.oasis.opendocument.presentation';
+	//$mime_preview[]='archive';
+	$num_mime = array_search(dol_mimetype($relativepath, '', 1), $mime_preview);
 
 	if ($alldata == 1)
 	{
-		if (isAllowedForPreview) return array('target'=>'_blank', 'css'=>'documentpreview', 'url'=>DOL_URL_ROOT.'/document.php?modulepart='.$modulepart.'&attachment=0&file='.urlencode($relativepath).($param?'&'.$param:''), 'mime'=>dol_mimetype($relativepath), );
+		if ($num_mime !== false) return array('target'=>'_blank', 'css'=>'documentpreview', 'url'=>DOL_URL_ROOT.'/document.php?modulepart='.$modulepart.'&attachment=0&file='.urlencode($relativepath).($param?'&'.$param:''), 'mime'=>dol_mimetype($relativepath), );
 		else return array();
 	}
 
-	// old behavior, return a string
-	if ($isAllowedForPreview) return 'javascript:document_preview(\''.dol_escape_js(DOL_URL_ROOT.'/document.php?modulepart='.$modulepart.'&attachment=0&file='.urlencode($relativepath).($param?'&'.$param:'')).'\', \''.dol_mimetype($relativepath).'\', \''.dol_escape_js($langs->trans('Preview')).'\')';
+	// old behavior
+	if ($num_mime !== false) return 'javascript:document_preview(\''.dol_escape_js(DOL_URL_ROOT.'/document.php?modulepart='.$modulepart.'&attachment=0&file='.urlencode($relativepath).($param?'&'.$param:'')).'\', \''.dol_mimetype($relativepath).'\', \''.dol_escape_js($langs->trans('Preview')).'\')';
 	else return '';
 }
 
@@ -7738,30 +7741,6 @@ function ajax_autoselect($htmlname, $addlink = '')
 	return $out;
 }
 
-/**
- *	Return if a file is qualified for preview
- *
- *	@param	string	$file		Filename we looking for information
- *	@return int					1 If allowed, 0 otherwise
- *  @see    dol_mimetype(), image_format_supported() from images.lib.php
- */
-function dolIsAllowedForPreview($file) {
-	global $conf;
-
-	// Check .noexe extension in filename
-	if (preg_match('/\.noexe$/i', $file)) return 0;
-
-	// Check mime types
-	$mime_preview = array('bmp', 'jpeg', 'png', 'gif', 'tiff', 'pdf', 'plain', 'css', 'webp');
-	if (!empty($conf->global->MAIN_ALLOW_SVG_FILES_AS_IMAGES)) $mime_preview[] = 'svg+xml';
-	//$mime_preview[]='vnd.oasis.opendocument.presentation';
-	//$mime_preview[]='archive';
-	$num_mime = array_search(dol_mimetype($file, '', 1), $mime_preview);
-	if ($num_mime !== false) return 1;
-
-	// By default, not allowed for preview
-	return 0;
-}
 
 /**
  *	Return mime type of a file
@@ -7770,7 +7749,7 @@ function dolIsAllowedForPreview($file) {
  *  @param  string	$default    Default mime type if extension not found in known list
  * 	@param	int		$mode    	0=Return full mime, 1=otherwise short mime string, 2=image for mime type, 3=source language, 4=css of font fa
  *	@return string 		    	Return a mime type family (text/xxx, application/xxx, image/xxx, audio, video, archive)
- *  @see    dolIsAllowedForPreview(), image_format_supported() from images.lib.php
+ *  @see    image_format_supported() from images.lib.php
  */
 function dol_mimetype($file, $default = 'application/octet-stream', $mode = 0)
 {
diff --git a/htdocs/document.php b/htdocs/document.php
index ccd404f7315..2b37792d69a 100644
--- a/htdocs/document.php
+++ b/htdocs/document.php
@@ -156,13 +156,12 @@ if (isset($_GET["attachment"])) $attachment = GETPOST("attachment", 'alpha')?tru
 if (! empty($conf->global->MAIN_DISABLE_FORCE_SAVEAS)) $attachment=false;
 
 // Define mime type
-$type = 'application/octet-stream';	// By default
+$type = 'application/octet-stream';
 if (GETPOST('type', 'alpha')) $type=GETPOST('type', 'alpha');
 else $type=dol_mimetype($original_file);
-// Security: Force to octet-stream if file is a dangerous file. For example when it is a .noexe file
-if (!dolIsAllowedForPreview($original_file)) {
-	$type = 'application/octet-stream';
-}
+// Security: Force to octet-stream if file is a dangerous file
+if (preg_match('/\.noexe$/i', $original_file)) $type = 'application/octet-stream';
+
 // Security: Delete string ../ into $original_file
 $original_file = str_replace("../", "/", $original_file);
 

From 55e3f8365e74477f0e582cae10638bfc44848aec Mon Sep 17 00:00:00 2001
From: Alexandre SPANGARO <aspangaro.dolibarr@gmail.com>
Date: Wed, 16 Sep 2020 21:36:55 +0200
Subject: [PATCH 003/101] FIX Yogosha report 4434 (backport)

---
 htdocs/adherents/card.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/htdocs/adherents/card.php b/htdocs/adherents/card.php
index c6ec8569a09..f8289e04cb2 100644
--- a/htdocs/adherents/card.php
+++ b/htdocs/adherents/card.php
@@ -286,7 +286,7 @@ if (empty($reshook))
 			$object->firstname   = trim(GETPOST("firstname", 'alpha'));
 			$object->lastname    = trim(GETPOST("lastname", 'alpha'));
 			$object->gender      = trim(GETPOST("gender", 'alpha'));
-			$object->login       = trim(GETPOST("login", 'alpha'));
+			$object->login       = trim(GETPOST("login", 'alphanohtml'));
 			$object->pass        = trim(GETPOST("pass", 'alpha'));
 
 			$object->societe     = trim(GETPOST("societe", 'alpha'));
@@ -453,7 +453,7 @@ if (empty($reshook))
 		$facebook=GETPOST("member_facebook", 'alpha');
         $linkedin=GETPOST("member_linkedin", 'alpha');
 		$email=preg_replace('/\s+/', '', GETPOST("member_email", 'alpha'));
-		$login=GETPOST("member_login", 'alpha');
+		$login=GETPOST("member_login", 'alphanohtml');
 		$pass=GETPOST("password", 'alpha');
 		$photo=GETPOST("photo", 'alpha');
 		//$comment=GETPOST("comment",'none');
@@ -914,7 +914,7 @@ else
 		// Login
 		if (empty($conf->global->ADHERENT_LOGIN_NOT_REQUIRED))
 		{
-			print '<tr><td><span class="fieldrequired">'.$langs->trans("Login").' / '.$langs->trans("Id").'</span></td><td><input type="text" name="member_login" class="minwidth300" maxlength="50" value="'.(isset($_POST["member_login"])?GETPOST("member_login", 'alpha', 2):$object->login).'" autofocus="autofocus"></td></tr>';
+			print '<tr><td><span class="fieldrequired">'.$langs->trans("Login").' / '.$langs->trans("Id").'</span></td><td><input type="text" name="member_login" class="minwidth300" maxlength="50" value="'.(GETPOSTISSET("member_login") ? GETPOST("member_login", 'alphanohtml', 2):$object->login).'" autofocus="autofocus"></td></tr>';
 		}
 
 		// Password
@@ -1171,7 +1171,7 @@ else
 		// Login
 		if (empty($conf->global->ADHERENT_LOGIN_NOT_REQUIRED))
 		{
-			print '<tr><td><span class="fieldrequired">'.$langs->trans("Login").' / '.$langs->trans("Id").'</span></td><td><input type="text" name="login" class="minwidth300" maxlength="50" value="'.(isset($_POST["login"])?GETPOST("login", 'alpha', 2):$object->login).'"></td></tr>';
+			print '<tr><td><span class="fieldrequired">'.$langs->trans("Login").' / '.$langs->trans("Id").'</span></td><td><input type="text" name="login" class="minwidth300" maxlength="50" value="'.(GETPOSTISSET("login") ? GETPOST("login", 'alphanohtml', 2):$object->login).'"></td></tr>';
 		}
 
 		// Password

From f453e43ccafd649c6bffce6eab6ac1135fafd455 Mon Sep 17 00:00:00 2001
From: Alexandre SPANGARO <aspangaro.dolibarr@gmail.com>
Date: Fri, 18 Sep 2020 01:37:15 +0200
Subject: [PATCH 004/101] FIX Yogosha report 4425 (backport)

---
 htdocs/document.php | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/htdocs/document.php b/htdocs/document.php
index 2b37792d69a..ccd404f7315 100644
--- a/htdocs/document.php
+++ b/htdocs/document.php
@@ -156,12 +156,13 @@ if (isset($_GET["attachment"])) $attachment = GETPOST("attachment", 'alpha')?tru
 if (! empty($conf->global->MAIN_DISABLE_FORCE_SAVEAS)) $attachment=false;
 
 // Define mime type
-$type = 'application/octet-stream';
+$type = 'application/octet-stream';	// By default
 if (GETPOST('type', 'alpha')) $type=GETPOST('type', 'alpha');
 else $type=dol_mimetype($original_file);
-// Security: Force to octet-stream if file is a dangerous file
-if (preg_match('/\.noexe$/i', $original_file)) $type = 'application/octet-stream';
-
+// Security: Force to octet-stream if file is a dangerous file. For example when it is a .noexe file
+if (!dolIsAllowedForPreview($original_file)) {
+	$type = 'application/octet-stream';
+}
 // Security: Delete string ../ into $original_file
 $original_file = str_replace("../", "/", $original_file);
 

From 6d7f5ef0a8dcfccdcbde227fb109035e7d36c117 Mon Sep 17 00:00:00 2001
From: Pascal Hubrecht <hansemschnokeloch@users.noreply.github.com>
Date: Tue, 22 Sep 2020 12:40:26 +0200
Subject: [PATCH 005/101] Fix label inversion

Private and public labels where inverted.
---
 htdocs/fichinter/class/fichinter.class.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/fichinter/class/fichinter.class.php b/htdocs/fichinter/class/fichinter.class.php
index 488040ff5d3..f370b8bb571 100644
--- a/htdocs/fichinter/class/fichinter.class.php
+++ b/htdocs/fichinter/class/fichinter.class.php
@@ -58,8 +58,8 @@ class Fichinter extends CommonObject
 	'datet' =>array('type'=>'date', 'label'=>'Datet', 'enabled'=>1, 'visible'=>-1, 'position'=>95),
 	'duree' =>array('type'=>'double', 'label'=>'Duree', 'enabled'=>1, 'visible'=>-1, 'position'=>100),
 	'description' =>array('type'=>'text', 'label'=>'Description', 'enabled'=>1, 'visible'=>-1, 'position'=>105, 'showoncombobox'=>1),
-	'note_private' =>array('type'=>'text', 'label'=>'NotePublic', 'enabled'=>1, 'visible'=>0, 'position'=>110),
-	'note_public' =>array('type'=>'text', 'label'=>'NotePrivate', 'enabled'=>1, 'visible'=>0, 'position'=>115),
+	'note_private' =>array('type'=>'text', 'label'=>'NotePrivate', 'enabled'=>1, 'visible'=>0, 'position'=>110),
+	'note_public' =>array('type'=>'text', 'label'=>'NotePublic', 'enabled'=>1, 'visible'=>0, 'position'=>115),
 	'model_pdf' =>array('type'=>'varchar(255)', 'label'=>'Model pdf', 'enabled'=>1, 'visible'=>0, 'position'=>120),
 	'last_main_doc' =>array('type'=>'varchar(255)', 'label'=>'Last main doc', 'enabled'=>1, 'visible'=>-1, 'position'=>125),
 	'import_key' =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>-2, 'position'=>130),

From fcfe5423f42245af690a5466f6c246b6a4a8cc21 Mon Sep 17 00:00:00 2001
From: Regis Houssin <regis.houssin@inodbox.com>
Date: Tue, 22 Sep 2020 16:34:38 +0200
Subject: [PATCH 006/101] FIX missing field entity

---
 htdocs/compta/paiement/card.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/compta/paiement/card.php b/htdocs/compta/paiement/card.php
index e14581f6531..d3dec6fde82 100644
--- a/htdocs/compta/paiement/card.php
+++ b/htdocs/compta/paiement/card.php
@@ -318,7 +318,7 @@ dol_fiche_end();
  * List of invoices
  */
 
-$sql = 'SELECT f.rowid as facid, f.ref, f.type, f.total_ttc, f.paye, f.fk_statut, pf.amount, s.nom as name, s.rowid as socid';
+$sql = 'SELECT f.rowid as facid, f.ref, f.type, f.total_ttc, f.paye, f.entity, f.fk_statut, pf.amount, s.nom as name, s.rowid as socid';
 $sql .= ' FROM '.MAIN_DB_PREFIX.'paiement_facture as pf,'.MAIN_DB_PREFIX.'facture as f,'.MAIN_DB_PREFIX.'societe as s';
 $sql .= ' WHERE pf.fk_facture = f.rowid';
 $sql .= ' AND f.fk_soc = s.rowid';

From 0fc6e9b84f9cc12c8d8161df600e1dc8dc8d3163 Mon Sep 17 00:00:00 2001
From: atm-lena <lena@atm-consulting.fr>
Date: Wed, 23 Sep 2020 10:54:49 +0200
Subject: [PATCH 007/101] FIX - Backtick not work with postgresql

---
 htdocs/install/mysql/migration/10.0.0-11.0.0.sql | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/htdocs/install/mysql/migration/10.0.0-11.0.0.sql b/htdocs/install/mysql/migration/10.0.0-11.0.0.sql
index 7055898ada6..37bb2962724 100644
--- a/htdocs/install/mysql/migration/10.0.0-11.0.0.sql
+++ b/htdocs/install/mysql/migration/10.0.0-11.0.0.sql
@@ -98,7 +98,8 @@ ALTER TABLE llx_bom_bomline ADD COLUMN position integer NOT NULL DEFAULT 0;
 ALTER TABLE llx_bom_bomline ADD COLUMN qty_frozen smallint DEFAULT 0;
 ALTER TABLE llx_bom_bomline ADD COLUMN disable_stock_change smallint DEFAULT 0;
 
-ALTER TABLE llx_bom_bomline DROP COLUMN `rank`;
+-- VMYSQL4.1 ALTER TABLE llx_bom_bomline DROP COLUMN `rank`;
+-- VPGSQL8.2 ALTER TABLE llx_bom_bomline DROP COLUMN rank;
 
 create table llx_categorie_warehouse
 (

From 905f676c71318adedab7ed4cdc3297b8d683a0f3 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 23 Sep 2020 19:27:55 +0200
Subject: [PATCH 008/101] Fix 12.0.3

---
 htdocs/filefunc.inc.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/filefunc.inc.php b/htdocs/filefunc.inc.php
index ffd2e9bd5ff..94ecf930724 100644
--- a/htdocs/filefunc.inc.php
+++ b/htdocs/filefunc.inc.php
@@ -31,7 +31,7 @@
  */
 
 if (!defined('DOL_APPLICATION_TITLE')) define('DOL_APPLICATION_TITLE', 'Dolibarr');
-if (!defined('DOL_VERSION')) define('DOL_VERSION', '12.0.4'); // a.b.c-alpha, a.b.c-beta, a.b.c-rcX or a.b.c
+if (!defined('DOL_VERSION')) define('DOL_VERSION', '12.0.3'); // a.b.c-alpha, a.b.c-beta, a.b.c-rcX or a.b.c
 
 if (!defined('EURO')) define('EURO', chr(128));
 

From 732bb708269e68ec08099af015828db008be7858 Mon Sep 17 00:00:00 2001
From: atm-greg <gregory.blemand@atm-consulting.fr>
Date: Thu, 24 Sep 2020 11:47:41 +0200
Subject: [PATCH 009/101] fix sql

---
 htdocs/install/mysql/migration/12.0.0-13.0.0.sql        | 1 +
 htdocs/install/mysql/tables/llx_actioncomm_reminder.sql | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/htdocs/install/mysql/migration/12.0.0-13.0.0.sql b/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
index 1f7740de467..8e3d0e1ee69 100644
--- a/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
+++ b/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
@@ -306,6 +306,7 @@ insert into llx_c_action_trigger (code,label,description,elementtype,rang) value
 ALTER TABLE llx_actioncomm_reminder ADD COLUMN entity integer NOT NULL DEFAULT 1;
 ALTER TABLE llx_actioncomm_reminder ADD COLUMN fk_actioncomm integer NOT NULL;
 ALTER TABLE llx_actioncomm_reminder ADD COLUMN fk_email_template integer;
+ALTER TABLE llx_actioncomm_reminder CHANGE offsetunit offsetunit VARCHAR(10);
 
 ALTER TABLE llx_actioncomm_reminder DROP INDEX uk_actioncomm_reminder_unique;
 ALTER TABLE llx_actioncomm_reminder ADD UNIQUE uk_actioncomm_reminder_unique (fk_user, typeremind, offsetvalue, offsetunit, fk_actioncomm);
diff --git a/htdocs/install/mysql/tables/llx_actioncomm_reminder.sql b/htdocs/install/mysql/tables/llx_actioncomm_reminder.sql
index 78dd00d6ea5..ff992227d0d 100644
--- a/htdocs/install/mysql/tables/llx_actioncomm_reminder.sql
+++ b/htdocs/install/mysql/tables/llx_actioncomm_reminder.sql
@@ -21,7 +21,7 @@ CREATE TABLE llx_actioncomm_reminder(
 	typeremind varchar(32) NOT NULL, 
 	fk_user integer NOT NULL, 
 	offsetvalue integer NOT NULL, 
-	offsetunit varchar(1) NOT NULL,
+	offsetunit varchar(10) NOT NULL,
 	status integer NOT NULL DEFAULT 0,
 	entity integer NOT NULL DEFAULT 1,
 	fk_actioncomm integer NOT NULL,

From 101405b052a576a3b506934e3cd3eaf3f5862190 Mon Sep 17 00:00:00 2001
From: atm-greg <gregory.blemand@atm-consulting.fr>
Date: Thu, 24 Sep 2020 12:31:28 +0200
Subject: [PATCH 010/101] fix notification creation => must create for every
 user linked to the event

---
 htdocs/comm/action/card.php                   | 31 +++++++++++--------
 htdocs/comm/action/class/actioncomm.class.php |  8 +++--
 2 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index 0fe69fa10ea..be100a97656 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -48,7 +48,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/extrafields.class.php';
 require_once DOL_DOCUMENT_ROOT.'/categories/class/categorie.class.php';
 
 // Load translation files required by the page
-$langs->loadLangs(array("companies", "other", "commercial", "bills", "orders", "agenda"));
+$langs->loadLangs(array("companies", "other", "commercial", "bills", "orders", "agenda", "mails"));
 
 $action = GETPOST('action', 'aZ09');
 $cancel = GETPOST('cancel', 'alpha');
@@ -393,7 +393,7 @@ if (empty($reshook) && $action == 'add')
 				$moreparam = '';
 				if ($user->id != $object->userownerid) $moreparam = "filtert=-1"; // We force to remove filter so created record is visible when going back to per user view.
 
-                //Create eminder
+                //Create reminder
                 if ($addreminder == 'on'){
                     $actionCommReminder = new ActionCommReminder($db);
 
@@ -401,23 +401,28 @@ if (empty($reshook) && $action == 'add')
 
                     $actionCommReminder->dateremind = $dateremind;
                     $actionCommReminder->typeremind = $remindertype;
-                    $actionCommReminder->fk_user = $user;
                     $actionCommReminder->offsetunit = $offsetunit;
                     $actionCommReminder->offsetvalue = $offsetvalue;
                     $actionCommReminder->status = $actionCommReminder::STATUS_TODO;
                     $actionCommReminder->fk_actioncomm = $object->id;
                     if ($remindertype == 'email') $actionCommReminder->fk_email_template = $modelmail;
 
-                    $res = $actionCommReminder->create($user);
+                    // the notification must be created for every user assigned to the event
+					foreach ($object->userassigned as $userassigned)
+					{
+						$actionCommReminder->fk_user = $userassigned['id'];
+						$res = $actionCommReminder->create($user);
 
-                    if ($res <= 0){
-                        // If error
-                        $error++;
-                        $langs->load("errors");
-                        $error = $langs->trans('ErrorReminderActionCommCreation').' '.$actionCommReminder->error;
-                        setEventMessages($error, $actionCommReminder->errors, 'errors');
-                        $action = 'create'; $donotclearsession = 1;
-                    }
+						if ($res <= 0){
+							// If error
+							$db->rollback();
+							$langs->load("errors");
+							$error = $langs->trans('ErrorReminderActionCommCreation');
+							setEventMessages($error, null, 'errors');
+							$action = 'create'; $donotclearsession = 1;
+							break;
+						}
+					}
                 }
 
                 if ($error) {
@@ -1236,7 +1241,7 @@ if ($action == 'create')
                             }
 	            		 });
 
-	            		$("#selectremindertype").click(function(){
+	            		$("#selectremindertype").change(function(){
 	            	        var selected_option = $("#selectremindertype option:selected").val();
 	            		    if(selected_option == "email") {
 	            		        $("#select_actioncommsendmodel_mail").closest("tr").show();
diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php
index a5084bfac74..113f860962f 100644
--- a/htdocs/comm/action/class/actioncomm.class.php
+++ b/htdocs/comm/action/class/actioncomm.class.php
@@ -1958,9 +1958,10 @@ class ActionComm extends CommonObject
 	 *
 	 *  @param	string	$type		Type of reminder 'browser' or 'email'
 	 *  @param	int		$fk_user	Id of user
+	 *  @param	bool	$onlypast	true = get only past reminder, false = get all reminders linked to this
 	 *  @return int         		0 if OK, <>0 if KO (this function is used also by cron so only 0 is OK)
 	 */
-	public function loadReminders($type = '', $fk_user = 0)
+	public function loadReminders($type = '', $fk_user = 0, $onlypast = true)
 	{
 		global $conf, $langs, $user;
 
@@ -1971,7 +1972,10 @@ class ActionComm extends CommonObject
 		//Select all action comm reminders for event
 		$sql = "SELECT rowid as id, typeremind, dateremind, status, offsetvalue, offsetunit, fk_user";
 		$sql .= " FROM ".MAIN_DB_PREFIX."actioncomm_reminder";
-		$sql .= " WHERE fk_actioncomm = ".$this->id." AND dateremind <= '".$this->db->idate(dol_now())."'";
+		$sql .= " WHERE fk_actioncomm = ".$this->id;
+		if ($onlypast) {
+			$sql .= " AND dateremind <= '".$this->db->idate(dol_now())."'";
+		}
 		if ($type) {
 			$sql .= " AND typeremind ='".$this->db->escape($type)."'";
 		}

From e6eff6511e03149d7ce2f96deed2686c6837b09d Mon Sep 17 00:00:00 2001
From: atm-greg <gregory.blemand@atm-consulting.fr>
Date: Thu, 24 Sep 2020 15:20:30 +0200
Subject: [PATCH 011/101] fix reminder offsetunit and display problems

---
 htdocs/comm/action/card.php                      | 8 +++++---
 htdocs/install/mysql/migration/12.0.0-13.0.0.sql | 1 -
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index be100a97656..5179b4c0ab1 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -397,7 +397,7 @@ if (empty($reshook) && $action == 'add')
                 if ($addreminder == 'on'){
                     $actionCommReminder = new ActionCommReminder($db);
 
-                    $dateremind = dol_time_plus_duree($datep, -$offsetvalue, 'i');
+                    $dateremind = dol_time_plus_duree($datep, -$offsetvalue, $offsetunit);
 
                     $actionCommReminder->dateremind = $dateremind;
                     $actionCommReminder->typeremind = $remindertype;
@@ -1697,6 +1697,7 @@ if ($id > 0)
 							print $langs->trans("Done");
 							print ' </span>';
 						}
+						print '<br />';
 					}
 				}
 			}
@@ -1985,7 +1986,7 @@ if ($id > 0)
         {
         	$filtreuserid = $user->id;
         	if ($user->rights->agenda->allactions->read) $filtreuserid = 0;
-        	$object->loadReminders('', $filteruserid);
+        	$object->loadReminders('', $filteruserid, false);
 
         	print '<tr><td class="titlefieldcreate nowrap">'.$langs->trans("Reminders").'</td><td>';
 
@@ -1996,7 +1997,7 @@ if ($id > 0)
         			print $TRemindTypes[$actioncommreminder->typeremind];
         			if ($actioncommreminder->fk_user > 0) {
         				$tmpuserstatic->fetch($actioncommreminder->fk_user);
-        				print ' ('.$tmpuser->getNomUrl(0, '', 0, 0, 16).')';
+        				print ' ('.$tmpuserstatic->getNomUrl(0, '', 0, 0, 16).')';
         			}
         			print ' - '.$actioncommreminder->offsetvalue.' '.$TDurationTypes[$actioncommreminder->offsetunit];
         			if ($actioncommreminder->status == $actioncommreminder::STATUS_TODO) {
@@ -2008,6 +2009,7 @@ if ($id > 0)
         				print $langs->trans("Done");
         				print ' </span>';
         			}
+        			print '<br />';
         		}
         	}
 
diff --git a/htdocs/install/mysql/migration/12.0.0-13.0.0.sql b/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
index 8e3d0e1ee69..1f7740de467 100644
--- a/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
+++ b/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
@@ -306,7 +306,6 @@ insert into llx_c_action_trigger (code,label,description,elementtype,rang) value
 ALTER TABLE llx_actioncomm_reminder ADD COLUMN entity integer NOT NULL DEFAULT 1;
 ALTER TABLE llx_actioncomm_reminder ADD COLUMN fk_actioncomm integer NOT NULL;
 ALTER TABLE llx_actioncomm_reminder ADD COLUMN fk_email_template integer;
-ALTER TABLE llx_actioncomm_reminder CHANGE offsetunit offsetunit VARCHAR(10);
 
 ALTER TABLE llx_actioncomm_reminder DROP INDEX uk_actioncomm_reminder_unique;
 ALTER TABLE llx_actioncomm_reminder ADD UNIQUE uk_actioncomm_reminder_unique (fk_user, typeremind, offsetvalue, offsetunit, fk_actioncomm);

From b269af5bf602b040a34742852d46ee472d0ec60f Mon Sep 17 00:00:00 2001
From: atm-greg <gregory.blemand@atm-consulting.fr>
Date: Thu, 24 Sep 2020 15:26:35 +0200
Subject: [PATCH 012/101] delete reminders on ActionComm::delete

---
 htdocs/comm/action/class/actioncomm.class.php | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php
index 113f860962f..c6fd2183459 100644
--- a/htdocs/comm/action/class/actioncomm.class.php
+++ b/htdocs/comm/action/class/actioncomm.class.php
@@ -925,6 +925,18 @@ class ActionComm extends CommonObject
 			}
 		}
 
+		if (!$error)
+		{
+			$sql = "DELETE FROM ".MAIN_DB_PREFIX."actioncomm_reminder";
+			$sql .= " WHERE fk_actioncomm = ".$this->id;
+
+			$res = $this->db->query($sql);
+			if (!$res) {
+				$this->error = $this->db->lasterror();
+				$error++;
+			}
+		}
+
 		// Removed extrafields
 		if (!$error) {
 			  $result = $this->deleteExtraFields();

From 6aad3b47f5cbd798c3139010d1c84e627f686b3a Mon Sep 17 00:00:00 2001
From: atm-greg <gregory.blemand@atm-consulting.fr>
Date: Thu, 24 Sep 2020 15:28:41 +0200
Subject: [PATCH 013/101] remove fields size modification

---
 htdocs/install/mysql/tables/llx_actioncomm_reminder.sql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/install/mysql/tables/llx_actioncomm_reminder.sql b/htdocs/install/mysql/tables/llx_actioncomm_reminder.sql
index ff992227d0d..78dd00d6ea5 100644
--- a/htdocs/install/mysql/tables/llx_actioncomm_reminder.sql
+++ b/htdocs/install/mysql/tables/llx_actioncomm_reminder.sql
@@ -21,7 +21,7 @@ CREATE TABLE llx_actioncomm_reminder(
 	typeremind varchar(32) NOT NULL, 
 	fk_user integer NOT NULL, 
 	offsetvalue integer NOT NULL, 
-	offsetunit varchar(10) NOT NULL,
+	offsetunit varchar(1) NOT NULL,
 	status integer NOT NULL DEFAULT 0,
 	entity integer NOT NULL DEFAULT 1,
 	fk_actioncomm integer NOT NULL,

From 5244c05abbee09cadf213e74bbfb1151028c389d Mon Sep 17 00:00:00 2001
From: atm-greg <gregory.blemand@atm-consulting.fr>
Date: Thu, 24 Sep 2020 15:30:29 +0200
Subject: [PATCH 014/101] reminders in the future can be displayed too

---
 htdocs/comm/action/card.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index 5179b4c0ab1..6c9f7f55f08 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -1669,7 +1669,7 @@ if ($id > 0)
 		{
 			$filtreuserid = $user->id;
 			if ($user->rights->agenda->allactions->read) $filtreuserid = 0;
-			$object->loadReminders('', $filteruserid);
+			$object->loadReminders('', $filteruserid, false);
 
 			print '<hr>';
 

From 554948d3e21d3a73e312a1df80501b2ac4a05754 Mon Sep 17 00:00:00 2001
From: atm-greg <gregory.blemand@atm-consulting.fr>
Date: Thu, 24 Sep 2020 15:34:52 +0200
Subject: [PATCH 015/101] bad user for getNomUrl

---
 htdocs/comm/action/card.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index 6c9f7f55f08..d158528ce0f 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -1685,7 +1685,7 @@ if ($id > 0)
 						print $TRemindTypes[$actioncommreminder->typeremind];
 						if ($actioncommreminder->fk_user > 0) {
 							$tmpuserstatic->fetch($actioncommreminder->fk_user);
-							print ' ('.$tmpuser->getNomUrl(0, '', 0, 0, 16).')';
+							print ' ('.$tmpuserstatic->getNomUrl(0, '', 0, 0, 16).')';
 						}
 						print ' - '.$actioncommreminder->offsetvalue.' '.$TDurationTypes[$actioncommreminder->offsetunit];
 						if ($actioncommreminder->status == $actioncommreminder::STATUS_TODO) {

From d38c557fba732229f71b99c8494bd4e1651ba8f9 Mon Sep 17 00:00:00 2001
From: Regis Houssin <regis.houssin@inodbox.com>
Date: Sun, 21 Jun 2020 19:52:15 +0200
Subject: [PATCH 016/101] FIX Can create user but not update user with
 activedirectory

---
 htdocs/core/class/ldap.class.php | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/htdocs/core/class/ldap.class.php b/htdocs/core/class/ldap.class.php
index ea4ec500405..b09db176852 100644
--- a/htdocs/core/class/ldap.class.php
+++ b/htdocs/core/class/ldap.class.php
@@ -55,6 +55,10 @@ class Ldap
 	/**
 	 * Version du protocole ldap
 	 */
+    public $ldapProtocolVersion;
+    /**
+     * Server DN
+     */
     public $domain;
 	/**
 	 * User administrateur Ldap
@@ -466,8 +470,6 @@ class Ldap
 	 */
     public function modify($dn, $info, $user)
 	{
-		global $conf;
-
 		dol_syslog(get_class($this)."::modify dn=".$dn." info=".join(',', $info));
 
 		// Check parameters
@@ -492,7 +494,11 @@ class Ldap
 		$this->dump($dn, $info);
 
 		//print_r($info);
-		$result = @ldap_modify($this->connection, $dn, $info);
+		// For better compatibility with Samba4 AD
+		if ($this->serverType == "activedirectory") {
+			unset($info['cn']); // For avoid error : Operation not allowed on RDN (Code 67)
+		}
+		$result=@ldap_modify($this->connection, $dn, $info);
 
 		if ($result)
 		{
@@ -520,9 +526,7 @@ class Ldap
 	 */
     public function rename($dn, $newrdn, $newparent, $user, $deleteoldrdn = true)
 	{
-		global $conf;
-
-		dol_syslog(get_class($this)."::modify dn=".$dn." newrdn=".$newrdn." newparent=".$newparent." deleteoldrdn=".($deleteoldrdn ? 1 : 0));
+		dol_syslog(get_class($this)."::modify dn=".$dn." newrdn=".$newrdn." newparent=".$newparent." deleteoldrdn=".($deleteoldrdn?1:0));
 
 		// Check parameters
 		if (!$this->connection)
@@ -571,8 +575,6 @@ class Ldap
 	 */
     public function update($dn, $info, $user, $olddn, $newrdn = false, $newparent = false)
 	{
-		global $conf;
-
 		dol_syslog(get_class($this)."::update dn=".$dn." olddn=".$olddn);
 
 		// Check parameters
@@ -589,7 +591,7 @@ class Ldap
 
 		if (!$olddn || $olddn != $dn)
 		{
-			if (!empty($olddn) && !empty($newrdn) && !empty($newparent) && $conf->global->LDAP_SERVER_PROTOCOLVERSION === '3')
+			if (! empty($olddn) && ! empty($newrdn) && ! empty($newparent) && $this->ldapProtocolVersion === '3')
 			{
 				// This function currently only works with LDAPv3
 				$result = $this->rename($olddn, $newrdn, $newparent, $user, true);
@@ -631,8 +633,6 @@ class Ldap
 	 */
     public function delete($dn)
 	{
-		global $conf;
-
 		dol_syslog(get_class($this)."::delete Delete LDAP entry dn=".$dn);
 
 		// Check parameters

From 7a9332815c6e852e564d8ad47cae19cb06d4d1c6 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Fri, 25 Sep 2020 12:22:24 +0200
Subject: [PATCH 017/101] Fix migration

---
 htdocs/install/mysql/migration/3.2.0-3.3.0.sql | 1 +
 1 file changed, 1 insertion(+)

diff --git a/htdocs/install/mysql/migration/3.2.0-3.3.0.sql b/htdocs/install/mysql/migration/3.2.0-3.3.0.sql
index 91c155d3d84..c0efe6d68b3 100644
--- a/htdocs/install/mysql/migration/3.2.0-3.3.0.sql
+++ b/htdocs/install/mysql/migration/3.2.0-3.3.0.sql
@@ -315,6 +315,7 @@ ALTER TABLE llx_c_chargesociales ADD COLUMN accountancy_code varchar(15) DEFAULT
 
 -- Tables for accountancy expert
 DROP TABLE llx_accountingaccount;
+DROP TABLE llx_accounting_account;
 DROP TABLE llx_accountingsystem;
 DROP TABLE llx_accounting_system;
 

From 0dcd85485aba5e1b7566d6a3bf616aeed556114f Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Fri, 25 Sep 2020 12:36:32 +0200
Subject: [PATCH 018/101] Fix migration

---
 htdocs/install/mysql/migration/3.3.0-3.4.0.sql | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/htdocs/install/mysql/migration/3.3.0-3.4.0.sql b/htdocs/install/mysql/migration/3.3.0-3.4.0.sql
index 0f84c92ef22..88d9ae1b685 100644
--- a/htdocs/install/mysql/migration/3.3.0-3.4.0.sql
+++ b/htdocs/install/mysql/migration/3.3.0-3.4.0.sql
@@ -102,6 +102,10 @@ ALTER TABLE llx_expedition DROP FOREIGN KEY fk_expedition_fk_shipping_method;
 ALTER TABLE llx_expedition DROP INDEX idx_expedition_fk_expedition_methode;
 ALTER TABLE llx_expedition CHANGE COLUMN fk_expedition_methode fk_shipping_method integer;
 
+-- This table and constraint should not exists as it appears in more recent version, but we may have it if we load an old dump 
+-- on a newly created database and we want to be sure upgrade of rowid into autoincrement done later will works. 
+ALTER TABLE llx_reception DROP FOREIGN KEY fk_reception_fk_shipping_method;
+
 ALTER TABLE llx_c_shipment_mode ADD COLUMN tracking VARCHAR(255) NOT NULL DEFAULT '' AFTER description;
 
 --ALTER TABLE llx_c_shipment_mode DROP COLUMN CASCADE;

From fcbc48fa287d80a51c041ed9e8298186e42d0bda Mon Sep 17 00:00:00 2001
From: root <root@ns3370527.ip-37-187-92.eu>
Date: Fri, 25 Sep 2020 14:24:26 +0200
Subject: [PATCH 019/101] Bug fix last_gen should be date_last_gen

---
 htdocs/compta/facture/class/facture-rec.class.php | 2 +-
 htdocs/fichinter/class/fichinterrec.class.php     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/htdocs/compta/facture/class/facture-rec.class.php b/htdocs/compta/facture/class/facture-rec.class.php
index 8a13cf0f814..c5bd8a987ac 100644
--- a/htdocs/compta/facture/class/facture-rec.class.php
+++ b/htdocs/compta/facture/class/facture-rec.class.php
@@ -155,7 +155,7 @@ class FactureRec extends CommonInvoice
 		'note_private' =>array('type'=>'text', 'label'=>'NotePublic', 'enabled'=>1, 'visible'=>0, 'position'=>105),
 		'note_public' =>array('type'=>'text', 'label'=>'NotePrivate', 'enabled'=>1, 'visible'=>0, 'position'=>110),
 		'modelpdf' =>array('type'=>'varchar(255)', 'label'=>'Modelpdf', 'enabled'=>1, 'visible'=>-1, 'position'=>115),
-		'last_gen' =>array('type'=>'varchar(7)', 'label'=>'Last gen', 'enabled'=>1, 'visible'=>-1, 'position'=>120),
+		'date_last_gen' =>array('type'=>'varchar(7)', 'label'=>'Last gen', 'enabled'=>1, 'visible'=>-1, 'position'=>120),
 		'unit_frequency' =>array('type'=>'varchar(2)', 'label'=>'Unit frequency', 'enabled'=>1, 'visible'=>-1, 'position'=>125),
 		'date_when' =>array('type'=>'datetime', 'label'=>'Date when', 'enabled'=>1, 'visible'=>-1, 'position'=>130),
 		'date_last_gen' =>array('type'=>'datetime', 'label'=>'Date last gen', 'enabled'=>1, 'visible'=>-1, 'position'=>135),
diff --git a/htdocs/fichinter/class/fichinterrec.class.php b/htdocs/fichinter/class/fichinterrec.class.php
index 679d231d6a8..a09547b3164 100644
--- a/htdocs/fichinter/class/fichinterrec.class.php
+++ b/htdocs/fichinter/class/fichinterrec.class.php
@@ -567,14 +567,14 @@ class FichinterRec extends Fichinter
         if ($user->rights->fichinter->creer) {
             $sql = "UPDATE ".MAIN_DB_PREFIX."fichinter_rec ";
             $sql .= " SET frequency='".$this->db->escape($freq)."'";
-            $sql .= ", last_gen='".$this->db->escape($courant)."'";
+            $sql .= ", date_last_gen='".$this->db->escape($courant)."'";
             $sql .= " WHERE rowid = ".$this->id;
 
             $resql = $this->db->query($sql);
 
             if ($resql) {
                 $this->frequency = $freq;
-                $this->last_gen = $courant;
+                $this->date_last_gen = $courant;
                 return 0;
             } else {
                 dol_print_error($this->db);

From ec54e33d81e0c89ffc6c08c656eba15a7d91d768 Mon Sep 17 00:00:00 2001
From: "jove@bisquerra.com" <jove@bisquerra.com>
Date: Sun, 27 Sep 2020 11:11:31 +0200
Subject: [PATCH 020/101] NEW: Introducing new modal boxes in TakePOS

---
 htdocs/takepos/css/pos.css.php | 73 ++++++++++++++++++++++++++++++++++
 htdocs/takepos/index.php       | 55 +++++++++++++++----------
 2 files changed, 106 insertions(+), 22 deletions(-)

diff --git a/htdocs/takepos/css/pos.css.php b/htdocs/takepos/css/pos.css.php
index 4666de59a8e..e320142ff35 100644
--- a/htdocs/takepos/css/pos.css.php
+++ b/htdocs/takepos/css/pos.css.php
@@ -669,3 +669,76 @@ div#moreinfo, div#infowarehouse {
 		padding-right: 4px;
 	}
 }
+
+/* Modal box */
+.modal {
+  display: none; /* Hidden by default */
+  position: fixed;
+  z-index: 1;
+  left: 0;
+  top: 0;
+  width: 100%;
+  height: 100%;
+  overflow: auto;
+  background-color: rgb(0,0,0);
+  background-color: rgba(0,0,0,0.4);
+}
+
+/* The Close Button */
+.close {
+  color: #aaa;
+  float: right;
+  font-size: 28px;
+  font-weight: bold;
+}
+
+.close:hover,
+.close:focus {
+  color: black;
+  text-decoration: none;
+  cursor: pointer;
+}
+
+.modal-header {
+  padding: 2px 16px;
+  background-color: #2b4161;
+  color: white;
+}
+
+.modal-body {padding: 2px 16px;}
+
+.modal-footer {
+  padding: 2px 16px;
+  background-color: #2b4161;
+  color: white;
+}
+
+.modal-content {
+  position: relative;
+  background-color: #fefefe;
+  margin: 15% auto; /* 15% from the top and centered */
+  padding: 0;
+  border: 1px solid #888;
+  width: 40%;
+  box-shadow: 0 4px 8px 0 rgba(0,0,0,0.2),0 6px 20px 0 rgba(0,0,0,0.19);
+  animation-name: animatetop;
+  animation-duration: 0.4s
+}
+
+@keyframes animatetop {
+  from {top: -300px; opacity: 0}
+  to {top: 0; opacity: 1}
+}
+
+.block {
+  display: block;
+  width: 100%;
+  border: none;
+  color: white;
+  background-color: #8c907e;
+  padding: 14px 28px;
+  font-size: 16px;
+  cursor: pointer;
+  text-align: center;
+  margin: 2px;
+}
\ No newline at end of file
diff --git a/htdocs/takepos/index.php b/htdocs/takepos/index.php
index 73b039d97e9..04c0fbecac5 100644
--- a/htdocs/takepos/index.php
+++ b/htdocs/takepos/index.php
@@ -728,27 +728,12 @@ function CashReport(rowid)
 // Popup to select the terminal to use
 function TerminalsDialog()
 {
-    jQuery("#dialog-info").dialog({
-	    resizable: false,
-	    height: <?php echo 180 + round($conf->global->TAKEPOS_NUM_TERMINALS / 3 * 20); ?>,
-	    width: <?php echo ($conf->dol_optimize_smallscreen ? 316 : 400); ?>,
-	    modal: true,
-	    buttons: {
-			'<?php echo dol_escape_js($langs->trans("Terminal")) ?> 1': function() {
-				location.href='index.php?setterminal=1';
-			}
-			<?php
-			for ($i = 2; $i <= $conf->global->TAKEPOS_NUM_TERMINALS; $i++)
-			{
-				print ",
-				'".dol_escape_js($langs->trans("Terminal"))." ".$i."': function() {
-					location.href='index.php?setterminal=".$i."';
-				}
-				";
-			}
-			?>
-	    }
-	});
+    var modal = document.getElementById("ModalTerminal");
+	var span = document.getElementsByClassName("close")[0];
+	span.onclick = function() {
+		modal.style.display = "none";
+	}
+	modal.style.display = "block";
 }
 
 function DirectPayment(){
@@ -774,6 +759,8 @@ function WeighingScale(){
 	});
 }
 
+
+
 $( document ).ready(function() {
     PrintCategories(0);
 	LoadProducts(0);
@@ -802,7 +789,6 @@ $( document ).ready(function() {
 
 <body class="bodytakepos" style="overflow: hidden;">
 <?php
-print '<div class="hidden dialog-info-takepos-terminal" id="dialog-info" title="TakePOS">'.$langs->trans('TerminalSelect').'</div>';
 $keyCodeForEnter = $conf->global->{'CASHDESK_READER_KEYCODE_FOR_ENTER'.$_SESSION['takeposterminal']} > 0 ? $conf->global->{'CASHDESK_READER_KEYCODE_FOR_ENTER'.$_SESSION['takeposterminal']} : '';
 ?>
 <div class="container">
@@ -853,6 +839,31 @@ if (empty($conf->global->TAKEPOS_HIDE_HEAD_BAR)) {
 }
 ?>
 
+<!-- Modal terminal box -->
+<div id="ModalTerminal" class="modal">
+	<div class="modal-content">
+		<div class="modal-header">
+		<span class="close">&times;</span>
+		<h2><?php print $langs->trans("Terminal");?></h2>
+	</div>
+	<div class="modal-body">
+		<button type="button" class="block" onclick="location.href='index.php?setterminal=1'"><?php print $langs->trans("Terminal");?> 1</button>
+		<?php
+			for ($i = 2; $i <= $conf->global->TAKEPOS_NUM_TERMINALS; $i++)
+			{
+				print '<button type="button" class="block" onclick="location.href=\'index.php?setterminal='.$i.'\'">'.$langs->trans("Terminal").' '.$i.'</button>';
+			}
+		?>
+	</div>
+	<div class="modal-footer">
+		<h3><?php print $langs->trans("TerminalSelect");?></h3>
+	</div>
+</div>
+
+</div>
+
+
+
 	<div class="row1<?php if (empty($conf->global->TAKEPOS_HIDE_HEAD_BAR)) print 'withhead'; ?>">
 
 		<div id="poslines" class="div1">

From 494348356a4eee3f32616bd639fd9bbac4ebaed5 Mon Sep 17 00:00:00 2001
From: andreubisquerra <jove@bisquerra.com>
Date: Sun, 27 Sep 2020 11:35:07 +0200
Subject: [PATCH 021/101] Fix travis

---
 htdocs/takepos/index.php | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/htdocs/takepos/index.php b/htdocs/takepos/index.php
index 04c0fbecac5..6444a51f3ec 100644
--- a/htdocs/takepos/index.php
+++ b/htdocs/takepos/index.php
@@ -759,8 +759,6 @@ function WeighingScale(){
 	});
 }
 
-
-
 $( document ).ready(function() {
     PrintCategories(0);
 	LoadProducts(0);
@@ -849,10 +847,10 @@ if (empty($conf->global->TAKEPOS_HIDE_HEAD_BAR)) {
 	<div class="modal-body">
 		<button type="button" class="block" onclick="location.href='index.php?setterminal=1'"><?php print $langs->trans("Terminal");?> 1</button>
 		<?php
-			for ($i = 2; $i <= $conf->global->TAKEPOS_NUM_TERMINALS; $i++)
-			{
-				print '<button type="button" class="block" onclick="location.href=\'index.php?setterminal='.$i.'\'">'.$langs->trans("Terminal").' '.$i.'</button>';
-			}
+		for ($i = 2; $i <= $conf->global->TAKEPOS_NUM_TERMINALS; $i++)
+		{
+			print '<button type="button" class="block" onclick="location.href=\'index.php?setterminal='.$i.'\'">'.$langs->trans("Terminal").' '.$i.'</button>';
+		}
 		?>
 	</div>
 	<div class="modal-footer">

From 5ff7e376962e0a78d7c292a441b24fd28c80c122 Mon Sep 17 00:00:00 2001
From: Florian HENRY <florian.henry@open-concept.pro>
Date: Sun, 27 Sep 2020 18:05:19 +0200
Subject: [PATCH 022/101] review code

---
 htdocs/core/lib/files.lib.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php
index cb139edd29b..ddd20159e09 100644
--- a/htdocs/core/lib/files.lib.php
+++ b/htdocs/core/lib/files.lib.php
@@ -2992,7 +2992,11 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity,
 			if ($partofdirinoriginalfile && ($fuser->rights->$modulepart->$partofdirinoriginalfile->{$lire} || $fuser->rights->$modulepart->$partofdirinoriginalfile->{$read})) $accessallowed = 1;
 			if ($fuser->rights->$modulepart->{$lire} || $fuser->rights->$modulepart->{$read}) $accessallowed = 1;
 			//}
-			$original_file = $conf->$modulepart->multidir_output[$entity].'/'.$original_file;
+			if (is_array($conf->$modulepart->multidir_output) && array_key_exists($entity, $conf->$modulepart->multidir_output)) {
+				$original_file = $conf->$modulepart->multidir_output[$entity].'/'.$original_file;
+			} else {
+				$original_file = $conf->$modulepart->dir_output.'/'.$original_file;
+			}
 		}
 
 		// For modules who wants to manage different levels of permissions for documents

From 5c9ad3ec9bad0399314195855ebc57429e67a94f Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Sun, 27 Sep 2020 18:55:09 +0200
Subject: [PATCH 023/101] Update files.lib.php

---
 htdocs/core/lib/files.lib.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php
index ddd20159e09..2d126b4e4f7 100644
--- a/htdocs/core/lib/files.lib.php
+++ b/htdocs/core/lib/files.lib.php
@@ -2992,7 +2992,7 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity,
 			if ($partofdirinoriginalfile && ($fuser->rights->$modulepart->$partofdirinoriginalfile->{$lire} || $fuser->rights->$modulepart->$partofdirinoriginalfile->{$read})) $accessallowed = 1;
 			if ($fuser->rights->$modulepart->{$lire} || $fuser->rights->$modulepart->{$read}) $accessallowed = 1;
 			//}
-			if (is_array($conf->$modulepart->multidir_output) && array_key_exists($entity, $conf->$modulepart->multidir_output)) {
+			if (is_array($conf->$modulepart->multidir_output) && !empty($conf->$modulepart->multidir_output[$entity])) {
 				$original_file = $conf->$modulepart->multidir_output[$entity].'/'.$original_file;
 			} else {
 				$original_file = $conf->$modulepart->dir_output.'/'.$original_file;

From 4a7df013397cdf61bbf8538a87d9cb3a132894be Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Sun, 27 Sep 2020 19:23:52 +0200
Subject: [PATCH 024/101] Fix the MAIN_EXTERNAL_SMTP_SPF_STRING_TO_ADD should
 be MAIN_EXTERNAL_MAIL_SPF_STRING_TO_ADD

---
 htdocs/admin/mails.php        | 16 +++++++++++-----
 htdocs/langs/en_US/admin.lang |  4 ++--
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/htdocs/admin/mails.php b/htdocs/admin/mails.php
index 5fccd2b07c9..305c7f65851 100644
--- a/htdocs/admin/mails.php
+++ b/htdocs/admin/mails.php
@@ -764,11 +764,17 @@ else
 
 		if ($conf->global->MAIN_MAIL_SENDMODE == 'mail')
 		{
-			// MAIN_EXTERNAL_SMTP_CLIENT_IP_ADDRESS is list of IPs where email is sent from. Example: '1.2.3.4, [aaaa:bbbb:cccc:dddd]'.
-			if (!empty($conf->global->MAIN_EXTERNAL_SMTP_CLIENT_IP_ADDRESS))
+			if (!empty($conf->global->MAIN_EXTERNAL_MAIL_SPF_STRING_TO_ADD))
 			{
-				// List of IP show as record to add in SPF if we use the mail method
-				$text .= ($text ? '<br><br>' : '').$langs->trans("WarningPHPMailSPF", $conf->global->MAIN_EXTERNAL_SMTP_CLIENT_IP_ADDRESS);
+				// List of string to add in SPF if the setup use the mail method
+				$text .= ($text ? '<br><br>' : '').$langs->trans("WarningPHPMailSPF", $conf->global->MAIN_EXTERNAL_MAIL_SPF_STRING_TO_ADD);
+			} else {
+				// MAIN_EXTERNAL_SMTP_CLIENT_IP_ADDRESS is list of IPs where email is sent from. Example: '1.2.3.4, [aaaa:bbbb:cccc:dddd]'.
+				if (!empty($conf->global->MAIN_EXTERNAL_SMTP_CLIENT_IP_ADDRESS))
+				{
+					// List of IP show as record to add in SPF if we use the mail method
+					$text .= ($text ? '<br><br>' : '').$langs->trans("WarningPHPMailSPF", $conf->global->MAIN_EXTERNAL_SMTP_CLIENT_IP_ADDRESS);
+				}
 			}
 		} else {
 			if (!empty($conf->global->MAIN_EXTERNAL_SMTP_CLIENT_IP_ADDRESS))
@@ -776,7 +782,7 @@ else
 				// List of IP show as record to add as allowed IP if we use the smtp method
 				$text .= ($text ? '<br><br>' : '').$langs->trans("WarningPHPMail2", $conf->global->MAIN_EXTERNAL_SMTP_CLIENT_IP_ADDRESS);
 			}
-			if (!empty($conf->global->MAIN_EXTERNAL_SMTP_SPF_STRING_TO_ADD))
+			if (!empty($conf->global->MAIN_EXTERNAL_SMTP_SPF_STRING_TO_ADD))	// Should be required only if you have set to use your own SMTP and wat to warn users to update their domain name to match your SMTP server.
 			{
 				// List of string to add in SPF if we use the smtp method
 				$text .= ($text ? '<br><br>' : '').$langs->trans("WarningPHPMailSPF", $conf->global->MAIN_EXTERNAL_SMTP_SPF_STRING_TO_ADD);
diff --git a/htdocs/langs/en_US/admin.lang b/htdocs/langs/en_US/admin.lang
index ed10332352c..431ef75ac63 100644
--- a/htdocs/langs/en_US/admin.lang
+++ b/htdocs/langs/en_US/admin.lang
@@ -479,8 +479,8 @@ ModuleCompanyCodeSupplierDigitaria=%s followed by the truncated supplier name by
 Use3StepsApproval=By default, Purchase Orders need to be created and approved by 2 different users (one step/user to create and one step/user to approve. Note that if user has both permission to create and approve, one step/user will be enough). You can ask with this option to introduce a third step/user approval, if amount is higher than a dedicated value (so 3 steps will be necessary: 1=validation, 2=first approval and 3=second approval if amount is enough).<br>Set this to empty if one approval (2 steps) is enough, set it to a very low value (0.1) if a second approval (3 steps) is always required.
 UseDoubleApproval=Use a 3 steps approval when amount (without tax) is higher than...
 WarningPHPMail=WARNING: It is often better to setup outgoing emails to use the email server of your provider instead of the default setup. Some email providers (like Yahoo) do not allow you to send an email from another server than their own server. Your current setup uses the server of the application to send email and not the server of your email provider, so some recipients (the one compatible with the restrictive DMARC protocol), will ask your email provider if they can accept your email and some email providers (like Yahoo) may respond "no" because the server is not theirs, so few of your sent Emails may not be accepted (be careful also of your email provider's sending quota).<br>If your Email provider (like Yahoo) has this restriction, you must change Email setup to choose the other method "SMTP server" and enter the SMTP server and credentials provided by your Email provider.
-WarningPHPMail2=If your email SMTP provider need to restrict email client to some IP addresses (very rare), this is the IP address of the mail user agent (MUA) for your ERP CRM application: <strong>%s</strong>.
-WarningPHPMailSPF=If the domain name in your sender email address is protected by SPF (ask you email provider), you must include the following IPs in the SPF record of the DNS of your domain: <strong>%s</strong>.
+WarningPHPMail2=If your email SMTP provider need to restrict email client to some IP addresses (for example with some SMTP relay like smtp-relay.google.com), this is the IP address of the mail user agent (MUA) for your ERP CRM application: <strong>%s</strong>.
+WarningPHPMailSPF=If the domain name in your sender email address is protected by a SPF record (ask you domain name registar), you must add the following IPs in the SPF record of the DNS of your domain: <strong>%s</strong>.
 ClickToShowDescription=Click to show description
 DependsOn=This module needs the module(s)
 RequiredBy=This module is required by module(s)

From 80641e54c98affb95646a3bc0ac7e2ef2264526b Mon Sep 17 00:00:00 2001
From: andreubisquerra <jove@bisquerra.com>
Date: Sun, 27 Sep 2020 22:19:49 +0200
Subject: [PATCH 025/101] Footer removed

---
 htdocs/takepos/css/pos.css.php | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/htdocs/takepos/css/pos.css.php b/htdocs/takepos/css/pos.css.php
index e320142ff35..503ae0123f9 100644
--- a/htdocs/takepos/css/pos.css.php
+++ b/htdocs/takepos/css/pos.css.php
@@ -674,7 +674,7 @@ div#moreinfo, div#infowarehouse {
 .modal {
   display: none; /* Hidden by default */
   position: fixed;
-  z-index: 1;
+  z-index: 20;
   left: 0;
   top: 0;
   width: 100%;
@@ -707,12 +707,6 @@ div#moreinfo, div#infowarehouse {
 
 .modal-body {padding: 2px 16px;}
 
-.modal-footer {
-  padding: 2px 16px;
-  background-color: #2b4161;
-  color: white;
-}
-
 .modal-content {
   position: relative;
   background-color: #fefefe;
@@ -741,4 +735,4 @@ div#moreinfo, div#infowarehouse {
   cursor: pointer;
   text-align: center;
   margin: 2px;
-}
\ No newline at end of file
+}

From 57b7666bf163c064d21583c043b2e374f72a5c66 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Sun, 27 Sep 2020 22:20:24 +0200
Subject: [PATCH 026/101] FIX #14326

---
 htdocs/bom/bom_card.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/htdocs/bom/bom_card.php b/htdocs/bom/bom_card.php
index bd5e6fe7789..591e9a69d88 100644
--- a/htdocs/bom/bom_card.php
+++ b/htdocs/bom/bom_card.php
@@ -1,5 +1,5 @@
 <?php
-/* Copyright (C) 2017       Laurent Destailleur     <eldy@users.sourceforge.net>
+/* Copyright (C) 2017-2020  Laurent Destailleur     <eldy@users.sourceforge.net>
  * Copyright (C) 2019       Frédéric France         <frederic.france@netlogic.fr>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -183,6 +183,8 @@ if (empty($reshook))
     			unset($_POST['qty']);
     			unset($_POST['qty_frozen']);
     		    unset($_POST['disable_stock_change']);
+
+    		    $object->fetchLines();
     		}
 		}
 	}

From 12b2c33895bad079eda0dc9552959949c5d8485a Mon Sep 17 00:00:00 2001
From: andreubisquerra <jove@bisquerra.com>
Date: Sun, 27 Sep 2020 22:22:56 +0200
Subject: [PATCH 027/101] Footer removed

---
 htdocs/takepos/index.php | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/htdocs/takepos/index.php b/htdocs/takepos/index.php
index 6444a51f3ec..bcc56ff0166 100644
--- a/htdocs/takepos/index.php
+++ b/htdocs/takepos/index.php
@@ -842,7 +842,7 @@ if (empty($conf->global->TAKEPOS_HIDE_HEAD_BAR)) {
 	<div class="modal-content">
 		<div class="modal-header">
 		<span class="close">&times;</span>
-		<h2><?php print $langs->trans("Terminal");?></h2>
+		<h3><?php print $langs->trans("TerminalSelect");?></h3>
 	</div>
 	<div class="modal-body">
 		<button type="button" class="block" onclick="location.href='index.php?setterminal=1'"><?php print $langs->trans("Terminal");?> 1</button>
@@ -853,9 +853,6 @@ if (empty($conf->global->TAKEPOS_HIDE_HEAD_BAR)) {
 		}
 		?>
 	</div>
-	<div class="modal-footer">
-		<h3><?php print $langs->trans("TerminalSelect");?></h3>
-	</div>
 </div>
 
 </div>

From bf167ca91d2e66786b81bff2953551d3a905631a Mon Sep 17 00:00:00 2001
From: Alexandre SPANGARO <aspangaro.dolibarr@gmail.com>
Date: Mon, 28 Sep 2020 09:40:55 +0200
Subject: [PATCH 028/101] Fix unused variable

---
 htdocs/accountancy/admin/productaccount.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/accountancy/admin/productaccount.php b/htdocs/accountancy/admin/productaccount.php
index 79bfef57d3a..08b81ddaabb 100644
--- a/htdocs/accountancy/admin/productaccount.php
+++ b/htdocs/accountancy/admin/productaccount.php
@@ -602,7 +602,7 @@ if ($result)
 			// Accounting account buy intra (In EEC)
 			print '<td class="left">';
 			//$defaultvalue=GETPOST('codeventil_' . $product_static->id,'alpha');        This is id and we need a code
-			if (empty($defaultvalue)) $defaultvalue = $compta_prodbuy_intra;
+			if (empty($defaultvalue)) $defaultvalue = $compta_prodbuy;
 			$codesell = length_accountg($obj->accountancy_code_buy_intra);
 			//var_dump($defaultvalue.' - '.$codesell.' - '.$compta_prodsell);
 			if (!empty($obj->aaid)) $defaultvalue = ''; // Do not suggest default new value is code is already valid
@@ -612,7 +612,7 @@ if ($result)
 			// Accounting account buy export (Out of EEC)
 			print '<td class="left">';
 			//$defaultvalue=GETPOST('codeventil_' . $product_static->id,'alpha');        This is id and we need a code
-			if (empty($defaultvalue)) $defaultvalue = $compta_prodbuy_export;
+			if (empty($defaultvalue)) $defaultvalue = $compta_prodbuy;
 			$codesell = length_accountg($obj->accountancy_code_buy_export);
 			//var_dump($defaultvalue.' - '.$codesell.' - '.$compta_prodsell);
 			if (!empty($obj->aaid)) $defaultvalue = ''; // Do not suggest default new value is code is already valid

From 17347bf575627d71069ee93dd3f54d6021f44f0f Mon Sep 17 00:00:00 2001
From: Alexandre SPANGARO <aspangaro.dolibarr@gmail.com>
Date: Mon, 28 Sep 2020 11:08:27 +0200
Subject: [PATCH 029/101] New Add column vat rate in page to define accounting
 account on product/service

---
 htdocs/accountancy/admin/productaccount.php | 28 +++++++++++++++------
 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/htdocs/accountancy/admin/productaccount.php b/htdocs/accountancy/admin/productaccount.php
index 08b81ddaabb..d88800016a8 100644
--- a/htdocs/accountancy/admin/productaccount.php
+++ b/htdocs/accountancy/admin/productaccount.php
@@ -57,6 +57,7 @@ $changeaccount_sell = GETPOST('changeaccount_sell', 'array');
 $search_ref = GETPOST('search_ref', 'alpha');
 $search_label = GETPOST('search_label', 'alpha');
 $search_desc = GETPOST('search_desc', 'alpha');
+$search_vat = GETPOST('search_vat', 'alpha');
 $search_current_account = GETPOST('search_current_account', 'alpha');
 $search_current_account_valid = GETPOST('search_current_account_valid', 'alpha');
 if ($search_current_account_valid == '') $search_current_account_valid = 'withoutvalidaccount';
@@ -102,6 +103,7 @@ if (GETPOST('button_removefilter_x', 'alpha') || GETPOST('button_removefilter.x'
     $search_ref = '';
     $search_label = '';
     $search_desc = '';
+	$search_vat = '';
     $search_onsell = '';
     $search_onpurchase = '';
     $search_current_account = '';
@@ -136,7 +138,7 @@ if ($action == 'update') {
 		if (!empty($chk_prod)) {
 			$accounting = new AccountingAccount($db);
 
-			//$msg .= '<div><span  class="accountingprocessing">' . count($chk_prod) . ' ' . $langs->trans("SelectedLines") . '</span></div>';
+			//$msg .= '<div><span class="accountingprocessing">' . count($chk_prod) . ' ' . $langs->trans("SelectedLines") . '</span></div>';
 			$arrayofdifferentselectedvalues = array();
 
 			$cpt = 0; $ok = 0; $ko = 0;
@@ -152,7 +154,7 @@ if ($action == 'update') {
 				}
 				if ($result <= 0) {
 					// setEventMessages(null, $accounting->errors, 'errors');
-					$msg .= '<div><font color="red">'.$langs->trans("ErrorDB").' : '.$langs->trans("Product").' '.$productid.' '.$langs->trans("NotVentilatedinAccount").' : id='.$accounting_account_id.'<br/> <pre>'.$sql.'</pre></font></div>';
+					$msg .= '<div><span style="color:red">'.$langs->trans("ErrorDB").' : '.$langs->trans("Product").' '.$productid.' '.$langs->trans("NotVentilatedinAccount").' : id='.$accounting_account_id.'<br/> <pre>'.$sql.'</pre></span></div>';
 					$ko++;
 				} else {
 					$db->begin();
@@ -243,7 +245,7 @@ $pcgverid = $conf->global->CHARTOFACCOUNTS;
 $pcgvercode = dol_getIdFromCode($db, $pcgverid, 'accounting_system', 'rowid', 'pcg_version');
 if (empty($pcgvercode)) $pcgvercode = $pcgverid;
 
-$sql = "SELECT p.rowid, p.ref, p.label, p.description, p.tosell, p.tobuy,";
+$sql = "SELECT p.rowid, p.ref, p.label, p.description, p.tosell, p.tobuy, p.tva_tx,";
 $sql .= " p.accountancy_code_sell, p.accountancy_code_sell_intra, p.accountancy_code_sell_export,";
 $sql .= " p.accountancy_code_buy, p.accountancy_code_buy_intra, p.accountancy_code_buy_export,";
 $sql .= " p.tms, p.fk_product_type as product_type,";
@@ -311,6 +313,9 @@ if (strlen(trim($search_label))) {
 if (strlen(trim($search_desc))) {
 	$sql .= natural_search("p.description", $search_desc);
 }
+if (strlen(trim($search_vat))) {
+	$sql .= natural_search("p.tva_tx", price2num($search_vat), 1);
+}
 if ($search_onsell != '' && $search_onsell != '-1') $sql .= natural_search('p.tosell', $search_onsell, 1);
 if ($search_onpurchase != '' && $search_onpurchase != '-1') $sql .= natural_search('p.tobuy', $search_onpurchase, 1);
 
@@ -343,6 +348,7 @@ if ($result)
     if ($search_ref > 0) $param .= "&search_desc=".urlencode($search_ref);
     if ($search_label > 0) $param .= "&search_desc=".urlencode($search_label);
     if ($search_desc > 0) $param .= "&search_desc=".urlencode($search_desc);
+	if ($search_vat > 0) $param .= '&search_vat='.urlencode($search_vat);
     if ($search_current_account > 0) $param .= "&search_current_account=".urlencode($search_current_account);
     if ($search_current_account_valid && $search_current_account_valid != '-1') $param .= "&search_current_account_valid=".urlencode($search_current_account_valid);
     if ($accounting_product_mode) $param .= '&accounting_product_mode='.urlencode($accounting_product_mode);
@@ -411,6 +417,8 @@ if ($result)
 	print '<tr class="liste_titre_filter">';
 	print '<td class="liste_titre"><input type="text" class="flat" size="8" name="search_ref" value="'.dol_escape_htmltag($search_ref).'"></td>';
 	print '<td class="liste_titre"><input type="text" class="flat" size="10" name="search_label" value="'.dol_escape_htmltag($search_label).'"></td>';
+	print '<td class="liste_titre right"><input type="text" class="flat maxwidth50 right" size="5" name="search_vat" placeholder="%" value="'.dol_escape_htmltag($search_vat).'"></td>';
+
 	if (!empty($conf->global->ACCOUNTANCY_SHOW_PROD_DESC)) print '<td class="liste_titre"><input type="text" class="flat" size="20" name="search_desc" value="'.dol_escape_htmltag($search_desc).'"></td>';
 	// On sell
 	if ($accounting_product_mode == 'ACCOUNTANCY_SELL' || $accounting_product_mode == 'ACCOUNTANCY_SELL_INTRA' || $accounting_product_mode == 'ACCOUNTANCY_SELL_EXPORT') {
@@ -437,7 +445,8 @@ if ($result)
 	print_liste_field_titre("Ref", $_SERVER["PHP_SELF"], "p.ref", "", $param, '', $sortfield, $sortorder);
 	print_liste_field_titre("Label", $_SERVER["PHP_SELF"], "p.label", "", $param, '', $sortfield, $sortorder);
     if (!empty($conf->global->ACCOUNTANCY_SHOW_PROD_DESC)) print_liste_field_titre("Description", $_SERVER["PHP_SELF"], "p.description", "", $param, '', $sortfield, $sortorder);
-    // On sell / On purchase
+	print_liste_field_titre("VATRate", $_SERVER["PHP_SELF"], "p.tva_tx", "", $param, '', $sortfield, $sortorder, 'right ');
+	// On sell / On purchase
     if ($accounting_product_mode == 'ACCOUNTANCY_SELL') {
         print_liste_field_titre("OnSell", $_SERVER["PHP_SELF"], "p.tosell", "", $param, '', $sortfield, $sortorder, 'center ');
         $fieldtosortaccount = "p.accountancy_code_sell";
@@ -553,11 +562,16 @@ if ($result)
 		{
 		    // TODO ADJUST DESCRIPTION SIZE
     		// print '<td class="left">' . $obj->description . '</td>';
-    		// TODO: we shoul set a user defined value to adjust user square / wide screen size
-    		$trunclengh = empty($conf->global->ACCOUNTING_LENGTH_DESCRIPTION) ? 32 : $conf->global->ACCOUNTING_LENGTH_DESCRIPTION;
-    		print '<td>'.nl2br(dol_trunc($obj->description, $trunclengh)).'</td>';
+    		// TODO: we should set a user defined value to adjust user square / wide screen size
+    		$trunclength = empty($conf->global->ACCOUNTING_LENGTH_DESCRIPTION) ? 32 : $conf->global->ACCOUNTING_LENGTH_DESCRIPTION;
+    		print '<td>'.nl2br(dol_trunc($obj->description, $trunclength)).'</td>';
 		}
 
+		// VAT
+		print '<td class="right">';
+		print vatrate($obj->tva_tx);
+		print '</td>';
+
 		if ($accounting_product_mode == 'ACCOUNTANCY_SELL' || $accounting_product_mode == 'ACCOUNTANCY_SELL_INTRA' || $accounting_product_mode == 'ACCOUNTANCY_SELL_EXPORT')
 			print '<td class="center">'.$product_static->getLibStatut(3, 0).'</td>';
 

From 988a532bed7502235120246146deaa26a9807229 Mon Sep 17 00:00:00 2001
From: atm-greg <gregory.blemand@atm-consulting.fr>
Date: Mon, 28 Sep 2020 16:37:17 +0200
Subject: [PATCH 030/101] fix br

---
 htdocs/comm/action/card.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index d158528ce0f..07bc0dd481b 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -1697,7 +1697,7 @@ if ($id > 0)
 							print $langs->trans("Done");
 							print ' </span>';
 						}
-						print '<br />';
+						print '<br>';
 					}
 				}
 			}
@@ -2009,7 +2009,7 @@ if ($id > 0)
         				print $langs->trans("Done");
         				print ' </span>';
         			}
-        			print '<br />';
+        			print '<br>';
         		}
         	}
 

From de5e6cf546bd0a1dd93d77b83d69e0ce076eb441 Mon Sep 17 00:00:00 2001
From: Florian <florianspk@gmail.com>
Date: Mon, 28 Sep 2020 17:04:45 +0200
Subject: [PATCH 031/101] Add 2 new field typeObject and ObjectId to website

---
 .../install/mysql/migration/11.0.0-12.0.0.sql |  2 ++
 .../install/mysql/tables/llx_website_page.sql |  4 ++-
 htdocs/website/class/websitepage.class.php    | 19 ++++++++++++++
 htdocs/website/index.php                      | 25 ++++++++++++++++++-
 4 files changed, 48 insertions(+), 2 deletions(-)
 create mode 100644 htdocs/install/mysql/migration/11.0.0-12.0.0.sql

diff --git a/htdocs/install/mysql/migration/11.0.0-12.0.0.sql b/htdocs/install/mysql/migration/11.0.0-12.0.0.sql
new file mode 100644
index 00000000000..98413f39d82
--- /dev/null
+++ b/htdocs/install/mysql/migration/11.0.0-12.0.0.sql
@@ -0,0 +1,2 @@
+ALTER TABLE llx_website_page Add COLUMN fk_typeobject varchar(255);
+ALTER TABLE llx_website_page Add COLUMN fk_object varchar(255);
diff --git a/htdocs/install/mysql/tables/llx_website_page.sql b/htdocs/install/mysql/tables/llx_website_page.sql
index 840e12e0141..156aff0b5a6 100644
--- a/htdocs/install/mysql/tables/llx_website_page.sql
+++ b/htdocs/install/mysql/tables/llx_website_page.sql
@@ -38,5 +38,7 @@ CREATE TABLE llx_website_page
     fk_user_modif integer,
     date_creation datetime,
 	tms           timestamp,
-    import_key    varchar(14)      -- import key
+    import_key    varchar(14),      -- import key
+    fk_typeobject varchar(255),
+    fk_object varchar(255)
 ) ENGINE=innodb;
diff --git a/htdocs/website/class/websitepage.class.php b/htdocs/website/class/websitepage.class.php
index abdb8d323eb..a0297e11693 100644
--- a/htdocs/website/class/websitepage.class.php
+++ b/htdocs/website/class/websitepage.class.php
@@ -102,6 +102,15 @@ class WebsitePage extends CommonObject
 	const STATUS_DRAFT = 0;
 	const STATUS_VALIDATED = 1;
 
+	/**
+	 * @var string path type object
+	 */
+	public $fk_typeobject;
+	/**
+	 * @var string path name object
+	 */
+	public $fk_object;
+
 
 
 	// BEGIN MODULEBUILDER PROPERTIES
@@ -131,6 +140,8 @@ class WebsitePage extends CommonObject
 		'fk_user_modif'  =>array('type'=>'integer', 'label'=>'UserModif', 'enabled'=>1, 'visible'=>-1, 'position'=>511),
 		//'fk_user_valid' =>array('type'=>'integer',      'label'=>'UserValidation',        'enabled'=>1, 'visible'=>-1, 'position'=>512),
 		'import_key'     =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>-1, 'index'=>1, 'position'=>1000, 'notnull'=>-1),
+		'fk_typeobject' => array('type' => 'varchar(255)','label' => 'ObjectType', 'enabled'=>1, 'visible'=>1, 'position'=>46, 'searchall'=>0, 'help'=>''),
+		'fk_object' => array('type' => 'varchar(255)','label' => 'ObjectId', 'enabled'=>1, 'visible'=>1, 'position'=>47, 'searchall'=>0, 'help'=>'')
 	);
 	// END MODULEBUILDER PROPERTIES
 
@@ -197,6 +208,8 @@ class WebsitePage extends CommonObject
 		$sql .= " t.tms as date_modification,";
 		$sql .= " t.fk_user_creat,";
 		$sql .= " t.fk_user_modif";
+		$sql .= " t.fk_typeobject,";
+		$sql .= " t.fk_object";
 		$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' as t';
 		//$sql .= ' WHERE entity IN ('.getEntity('website').')';       // entity is on website level
 		$sql .= ' WHERE 1 = 1';
@@ -244,6 +257,8 @@ class WebsitePage extends CommonObject
 				$this->date_modification = $this->db->jdate($obj->date_modification);
 				$this->fk_user_creat = $obj->fk_user_creat;
 				$this->fk_user_modif = $obj->fk_user_modif;
+				$this->fk_typeobject = $obj->fk_typeobject;
+				$this->fk_object = $obj->fk_object;
 			}
 			$this->db->free($resql);
 
@@ -298,6 +313,8 @@ class WebsitePage extends CommonObject
 		$sql .= " t.tms as date_modification,";
 		$sql .= " t.fk_user_creat,";
 		$sql .= " t.fk_user_modif";
+		$sql .= " t.fk_typeobject,";
+		$sql .= " t.fk_object";
 		$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' as t';
 		$sql .= ' WHERE t.fk_website = '.$websiteid;
 		// Manage filter
@@ -349,6 +366,8 @@ class WebsitePage extends CommonObject
 				$record->date_modification = $this->db->jdate($obj->date_modification);
 				$record->fk_user_creat = $obj->fk_user_creat;
 				$record->fk_user_modif = $obj->fk_user_modif;
+				$record->fk_typeobject = $obj->fk_typeobject;
+				$record->fk_object = $obj->fk_object;
 				//var_dump($record->id);
 				$records[$record->id] = $record;
 			}
diff --git a/htdocs/website/index.php b/htdocs/website/index.php
index 72fd6d0b70e..0d6df4694b2 100644
--- a/htdocs/website/index.php
+++ b/htdocs/website/index.php
@@ -825,6 +825,12 @@ if ($action == 'addcontainer')
 
 	if (!$error)
 	{
+		if (GETPOSTISSET('WEBSITE_OBJECTCLASS')){
+			$objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTCLASS');
+		}
+		if (GETPOSTISSET('WEBSITE_OBJECTID')){
+			$objectpage->fk_object = GETPOST('WEBSITE_OBJECTID');
+		}
 		$pageid = $objectpage->create($user);
 		if ($pageid <= 0) {
 			$error++;
@@ -1412,7 +1418,12 @@ if ($action == 'updatemeta')
 		$objectpage->lang = GETPOST('WEBSITE_LANG', 'aZ09');
 		$objectpage->htmlheader = trim(GETPOST('htmlheader', 'none'));
 		$objectpage->fk_page = (GETPOST('pageidfortranslation', 'int') > 0 ? GETPOST('pageidfortranslation', 'int') : 0);
-
+		if(GETPOSTISSET('WEBSITE_OBJECTCLASS')){
+			$objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTCLASS', 'aZ09');
+		}
+		if(GETPOSTISSET('WEBSITE_OBJECTID')){
+			$objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTID','aZ09');
+		}
 		$newdatecreation = dol_mktime(GETPOST('datecreationhour', 'int'), GETPOST('datecreationmin', 'int'), GETPOST('datecreationsec', 'int'), GETPOST('datecreationmonth', 'int'), GETPOST('datecreationday', 'int'), GETPOST('datecreationyear', 'int'));
 		if ($newdatecreation) $objectpage->date_creation = $newdatecreation;
 
@@ -3119,6 +3130,18 @@ if ($action == 'editmeta' || $action == 'createcontainer')
 	print '<input type="text" class="flat minwidth300" name="WEBSITE_ALIASALT" value="'.dol_escape_htmltag($pagealiasalt).'">';
 	print '</td></tr>';
 
+	print '<tr><td class="titlefieldcreate">';
+	print 'ObjectClass';
+	print '</td><td>';
+	print '<input type="text" class="flat minwidth300" name="WEBSITE_OBJECTCLASS" placeholder="/path/class/ObjectClass.class.php" >';
+	print '</td></tr>';
+
+	print '<tr><td class="titlefieldcreate">';
+	print 'ObjectID';
+	print '</td><td>';
+	print '<input type="text" class="flat minwidth300" name="WEBSITE_OBJECTID" >';
+	print '</td></tr>';
+
 	$fuser = new User($db);
 
 	print '<tr><td>';

From 6c1700d84a7dc3396222459ccae107700b688df2 Mon Sep 17 00:00:00 2001
From: "Sekan, Tobias" <tobias.sekan@startmail.com>
Date: Mon, 28 Sep 2020 08:12:12 +0200
Subject: [PATCH 032/101] Fix contratcs are always zero on statistics board

---
 htdocs/contrat/class/contrat.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/contrat/class/contrat.class.php b/htdocs/contrat/class/contrat.class.php
index 1153f89689d..58be7fdcb45 100644
--- a/htdocs/contrat/class/contrat.class.php
+++ b/htdocs/contrat/class/contrat.class.php
@@ -2329,7 +2329,7 @@ class Contrat extends CommonObject
 		{
 			while ($obj = $this->db->fetch_object($resql))
 			{
-				$this->nb["Contracts"] = $obj->nb;
+				$this->nb["contracts"] = $obj->nb;
 			}
             $this->db->free($resql);
 			return 1;

From bdb38da9d3370b4ab20fa532990ad7fdf577a01f Mon Sep 17 00:00:00 2001
From: Florian <florian@inovea-conseil.com>
Date: Mon, 28 Sep 2020 18:17:23 +0200
Subject: [PATCH 033/101] Add 2 new field typeObject and ObjectId to website

---
 .../install/mysql/migration/11.0.0-12.0.0.sql |  3 +++
 .../install/mysql/tables/llx_website_page.sql |  4 ++-
 htdocs/website/class/websitepage.class.php    | 22 ++++++++++++++--
 htdocs/website/index.php                      | 25 ++++++++++++++++++-
 4 files changed, 50 insertions(+), 4 deletions(-)

diff --git a/htdocs/install/mysql/migration/11.0.0-12.0.0.sql b/htdocs/install/mysql/migration/11.0.0-12.0.0.sql
index 994e5d89495..23830014690 100644
--- a/htdocs/install/mysql/migration/11.0.0-12.0.0.sql
+++ b/htdocs/install/mysql/migration/11.0.0-12.0.0.sql
@@ -335,3 +335,6 @@ insert into llx_c_tva(rowid,fk_pays,taux,recuperableonly,note,active) values (72
 insert into llx_c_tva(rowid,fk_pays,taux,recuperableonly,localtax1,localtax1_type,note,active) values (722, 72,   '18','0', '0.9', '1', 'VAT Rate 18+0.9', 1);
 
 ALTER TABLE llx_expedition ADD COLUMN billed smallint    DEFAULT 0;
+
+ALTER TABLE llx_website_page Add COLUMN fk_typeobject varchar(255);
+ALTER TABLE llx_website_page Add COLUMN fk_object varchar(255);
diff --git a/htdocs/install/mysql/tables/llx_website_page.sql b/htdocs/install/mysql/tables/llx_website_page.sql
index bacbc8e802b..ae339cfd119 100644
--- a/htdocs/install/mysql/tables/llx_website_page.sql
+++ b/htdocs/install/mysql/tables/llx_website_page.sql
@@ -39,5 +39,7 @@ CREATE TABLE llx_website_page
     author_alias  varchar(64),
     date_creation datetime,
 	tms           timestamp,
-    import_key    varchar(14)      -- import key
+    import_key    varchar(14),      -- import k
+    fk_typeobject varchar(255),
+    fk_object varchar(255)
 ) ENGINE=innodb;
diff --git a/htdocs/website/class/websitepage.class.php b/htdocs/website/class/websitepage.class.php
index b5e29e04176..a3563418873 100644
--- a/htdocs/website/class/websitepage.class.php
+++ b/htdocs/website/class/websitepage.class.php
@@ -104,6 +104,14 @@ class WebsitePage extends CommonObject
 	 */
 	public $author_alias;
 
+   /**
+     * @var string path type object
+     */
+    public $fk_typeobject;
+    /**
+     * @var string path name object
+     */
+    public $fk_object;
 
 	const STATUS_DRAFT = 0;
 	const STATUS_VALIDATED = 1;
@@ -161,6 +169,8 @@ class WebsitePage extends CommonObject
 		'fk_user_modif'  =>array('type'=>'integer', 'label'=>'UserModif', 'enabled'=>1, 'visible'=>-1, 'position'=>512),
 		//'fk_user_valid' =>array('type'=>'integer',      'label'=>'UserValidation',        'enabled'=>1, 'visible'=>-1, 'position'=>512),
 		'import_key'     =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>-1, 'index'=>1, 'position'=>1000, 'notnull'=>-1),
+		'fk_typeobject' => array('type' => 'varchar(255)','label' => 'ObjectType', 'enabled'=>1, 'visible'=>1, 'position'=>46, 'searchall'=>0, 'help'=>''),
+	    'fk_object' => array('type' => 'varchar(255)','label' => 'ObjectId', 'enabled'=>1, 'visible'=>1, 'position'=>47, 'searchall'=>0, 'help'=>'')
 	);
 	// END MODULEBUILDER PROPERTIES
 
@@ -260,7 +270,9 @@ class WebsitePage extends CommonObject
 		$sql .= " t.fk_user_creat,";
 		$sql .= " t.author_alias,";
 		$sql .= " t.fk_user_modif,";
-		$sql .= " t.import_key";
+		$sql .= " t.import_key,";
+		$sql .= " t.fk_typeobject,";
+        $sql .= " t.fk_object";
 		$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' as t';
 		//$sql .= ' WHERE entity IN ('.getEntity('website').')';       // entity is on website level
 		$sql .= ' WHERE 1 = 1';
@@ -319,6 +331,8 @@ class WebsitePage extends CommonObject
 				$this->author_alias = $obj->author_alias;
 				$this->fk_user_modif = $obj->fk_user_modif;
 				$this->import_key = $obj->import_key;
+				$this->fk_typeobject = $obj->fk_typeobject;
+                $this->fk_object = $obj->fk_object;
 			}
 			$this->db->free($resql);
 
@@ -374,7 +388,9 @@ class WebsitePage extends CommonObject
 		$sql .= " t.fk_user_creat,";
 		$sql .= " t.author_alias,";
 		$sql .= " t.fk_user_modif,";
-		$sql .= " t.import_key";
+		$sql .= " t.import_key,";
+		$sql .= " t.fk_typeobject,";
+        $sql .= " t.fk_object";
 		$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' as t';
 		$sql .= ' WHERE t.fk_website = '.$websiteid;
 		// Manage filter
@@ -443,6 +459,8 @@ class WebsitePage extends CommonObject
 				$record->author_alias = $obj->author_alias;
 				$record->fk_user_modif = $obj->fk_user_modif;
 				$record->import_key = $obj->import_key;
+				$record->fk_typeobject = $obj->fk_typeobject;
+				$record->fk_object = $obj->fk_object;
 				//var_dump($record->id);
 				$records[$record->id] = $record;
 			}
diff --git a/htdocs/website/index.php b/htdocs/website/index.php
index a36f33ee682..e62887407d6 100644
--- a/htdocs/website/index.php
+++ b/htdocs/website/index.php
@@ -981,6 +981,12 @@ if ($action == 'addcontainer')
 
 	if (!$error)
 	{
+		if (GETPOSTISSET('WEBSITE_OBJECTCLASS')){
+            $objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTCLASS');
+        }
+        if (GETPOSTISSET('WEBSITE_OBJECTID')){
+            $objectpage->fk_object = GETPOST('WEBSITE_OBJECTID');
+        }
 		$pageid = $objectpage->create($user);
 		if ($pageid <= 0) {
 			$error++;
@@ -1657,7 +1663,12 @@ if ($action == 'updatemeta')
 		$objectpage->htmlheader = trim(GETPOST('htmlheader', 'none'));
 		$objectpage->fk_page = (GETPOST('pageidfortranslation', 'int') > 0 ? GETPOST('pageidfortranslation', 'int') : 0);
 		$objectpage->author_alias = trim(GETPOST('WEBSITE_AUTHORALIAS', 'alphanohtml'));
-
+		if(GETPOSTISSET('WEBSITE_OBJECTCLASS')){
+            $objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTCLASS', 'alpha');
+        }
+        if(GETPOSTISSET('WEBSITE_OBJECTID')){
+            $objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTID','aZ09');
+        }
 		$newdatecreation = dol_mktime(GETPOST('datecreationhour', 'int'), GETPOST('datecreationmin', 'int'), GETPOST('datecreationsec', 'int'), GETPOST('datecreationmonth', 'int'), GETPOST('datecreationday', 'int'), GETPOST('datecreationyear', 'int'));
 		if ($newdatecreation) $objectpage->date_creation = $newdatecreation;
 
@@ -3578,6 +3589,18 @@ if ($action == 'editmeta' || $action == 'createcontainer')
 		print "</td></tr>";
 	}
 
+	print '<tr><td class="titlefieldcreate">';
+    print 'ObjectClass';
+    print '</td><td>';
+    print '<input type="text" class="flat minwidth300" name="WEBSITE_OBJECTCLASS" placeholder="/path/class/ObjectClass.class.php" >';
+    print '</td></tr>';
+
+    print '<tr><td class="titlefieldcreate">';
+    print 'ObjectID';
+    print '</td><td>';
+    print '<input type="text" class="flat minwidth300" name="WEBSITE_OBJECTID" >';
+    print '</td></tr>';
+
 
 	$fuser = new User($db);
 

From dfba9a06ad59391489db79f88d3da2c1037c7976 Mon Sep 17 00:00:00 2001
From: Nicolas <info@inovea-conseil.com>
Date: Mon, 28 Sep 2020 20:39:02 +0200
Subject: [PATCH 034/101] NEW Field to link website page to an other object

---
 htdocs/install/mysql/migration/11.0.0-12.0.0.sql |  3 ---
 htdocs/install/mysql/migration/12.0.0-13.0.0.sql |  3 +++
 htdocs/install/mysql/tables/llx_website_page.sql |  4 ++--
 htdocs/website/class/websitepage.class.php       |  8 +++++---
 htdocs/website/index.php                         | 12 ++++--------
 5 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/htdocs/install/mysql/migration/11.0.0-12.0.0.sql b/htdocs/install/mysql/migration/11.0.0-12.0.0.sql
index 23830014690..994e5d89495 100644
--- a/htdocs/install/mysql/migration/11.0.0-12.0.0.sql
+++ b/htdocs/install/mysql/migration/11.0.0-12.0.0.sql
@@ -335,6 +335,3 @@ insert into llx_c_tva(rowid,fk_pays,taux,recuperableonly,note,active) values (72
 insert into llx_c_tva(rowid,fk_pays,taux,recuperableonly,localtax1,localtax1_type,note,active) values (722, 72,   '18','0', '0.9', '1', 'VAT Rate 18+0.9', 1);
 
 ALTER TABLE llx_expedition ADD COLUMN billed smallint    DEFAULT 0;
-
-ALTER TABLE llx_website_page Add COLUMN fk_typeobject varchar(255);
-ALTER TABLE llx_website_page Add COLUMN fk_object varchar(255);
diff --git a/htdocs/install/mysql/migration/12.0.0-13.0.0.sql b/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
index e76948808bb..e177d53d6cc 100644
--- a/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
+++ b/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
@@ -330,3 +330,6 @@ ALTER TABLE llx_bank ADD COLUMN origin_type varchar(64) NULL;
 ALTER TABLE llx_bank ADD COLUMN import_key varchar(14);
 
 ALTER TABLE llx_menu MODIFY COLUMN enabled text;
+
+ALTER TABLE llx_website_page ADD COLUMN fk_typeobject varchar(255);
+ALTER TABLE llx_website_page ADD COLUMN fk_object varchar(255);
diff --git a/htdocs/install/mysql/tables/llx_website_page.sql b/htdocs/install/mysql/tables/llx_website_page.sql
index ae339cfd119..ec2d6f4c72b 100644
--- a/htdocs/install/mysql/tables/llx_website_page.sql
+++ b/htdocs/install/mysql/tables/llx_website_page.sql
@@ -39,7 +39,7 @@ CREATE TABLE llx_website_page
     author_alias  varchar(64),
     date_creation datetime,
 	tms           timestamp,
-    import_key    varchar(14),      -- import k
+    import_key    varchar(14),      -- import key
     fk_typeobject varchar(255),
-    fk_object varchar(255)
+    fk_object     varchar(255)
 ) ENGINE=innodb;
diff --git a/htdocs/website/class/websitepage.class.php b/htdocs/website/class/websitepage.class.php
index a3563418873..aa256960f0f 100644
--- a/htdocs/website/class/websitepage.class.php
+++ b/htdocs/website/class/websitepage.class.php
@@ -3,6 +3,7 @@
  * Copyright (C) 2014       Juanjo Menent       <jmenent@2byte.es>
  * Copyright (C) 2015       Florian Henry       <florian.henry@open-concept.pro>
  * Copyright (C) 2015       Raphaël Doursenaud  <rdoursenaud@gpcsolutions.fr>
+ * Copyright (C) 2020 	   Nicolas ZABOURI		<info@inovea-conseil.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -104,12 +105,13 @@ class WebsitePage extends CommonObject
 	 */
 	public $author_alias;
 
-   /**
-     * @var string path type object
+   	/**
+     * @var string path of external object
      */
     public $fk_typeobject;
+
     /**
-     * @var string path name object
+     * @var string id of external object
      */
     public $fk_object;
 
diff --git a/htdocs/website/index.php b/htdocs/website/index.php
index ce3f41676a0..add9e07eff5 100644
--- a/htdocs/website/index.php
+++ b/htdocs/website/index.php
@@ -1,5 +1,6 @@
 <?php
 /* Copyright (C) 2016-2020 Laurent Destailleur  <eldy@users.sourceforge.net>
+ * Copyright (C) 2020 	   Nicolas ZABOURI		<info@inovea-conseil.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -941,7 +942,8 @@ if ($action == 'addcontainer')
 		$objectpage->keywords = str_replace(array('<', '>'), '', GETPOST('WEBSITE_KEYWORDS', 'alphanohtml'));
 		$objectpage->htmlheader = GETPOST('htmlheader', 'none');
 		$objectpage->author_alias = GETPOST('WEBSITE_AUTHORALIAS', 'alphanohtml');
-
+		$objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTCLASS');
+		$objectpage->fk_object = GETPOST('WEBSITE_OBJECTID');
 		$substitutionarray = array();
 		$substitutionarray['__WEBSITE_CREATE_BY__'] = $user->getFullName($langs);
 
@@ -981,12 +983,6 @@ if ($action == 'addcontainer')
 
 	if (!$error)
 	{
-		if (GETPOSTISSET('WEBSITE_OBJECTCLASS')){
-            $objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTCLASS');
-        }
-        if (GETPOSTISSET('WEBSITE_OBJECTID')){
-            $objectpage->fk_object = GETPOST('WEBSITE_OBJECTID');
-        }
 		$pageid = $objectpage->create($user);
 		if ($pageid <= 0) {
 			$error++;
@@ -3592,7 +3588,7 @@ if ($action == 'editmeta' || $action == 'createcontainer')
 	print '<tr><td class="titlefieldcreate">';
     print 'ObjectClass';
     print '</td><td>';
-    print '<input type="text" class="flat minwidth300" name="WEBSITE_OBJECTCLASS" placeholder="/path/class/ObjectClass.class.php" >';
+    print '<input type="text" class="flat minwidth300" name="WEBSITE_OBJECTCLASS" placeholder="ClassName::/path/class/ObjectClass.class.php" >';
     print '</td></tr>';
 
     print '<tr><td class="titlefieldcreate">';

From 43c167f0c8a21bb96dea59a19e11182cdc9f4322 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Mon, 28 Sep 2020 20:47:36 +0200
Subject: [PATCH 035/101] Fix init var

---
 htdocs/core/class/CMailFile.class.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/htdocs/core/class/CMailFile.class.php b/htdocs/core/class/CMailFile.class.php
index 2c158fefc39..709b0f25189 100644
--- a/htdocs/core/class/CMailFile.class.php
+++ b/htdocs/core/class/CMailFile.class.php
@@ -1544,6 +1544,7 @@ class CMailFile
 		$i = 0;
 		foreach ($arrayaddress as $val)
 		{
+			$regs = array();
 			if (preg_match('/^(.*)<(.*)>$/i', trim($val), $regs))
 			{
 				$name  = trim($regs[1]);

From 848ee9decf4370f4be63faabb2ba996ecf517f09 Mon Sep 17 00:00:00 2001
From: Nicolas <info@inovea-conseil.com>
Date: Mon, 28 Sep 2020 20:49:51 +0200
Subject: [PATCH 036/101] FIX Stickler error

---
 htdocs/website/index.php | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/htdocs/website/index.php b/htdocs/website/index.php
index add9e07eff5..5de0f2c1007 100644
--- a/htdocs/website/index.php
+++ b/htdocs/website/index.php
@@ -1659,12 +1659,9 @@ if ($action == 'updatemeta')
 		$objectpage->htmlheader = trim(GETPOST('htmlheader', 'none'));
 		$objectpage->fk_page = (GETPOST('pageidfortranslation', 'int') > 0 ? GETPOST('pageidfortranslation', 'int') : 0);
 		$objectpage->author_alias = trim(GETPOST('WEBSITE_AUTHORALIAS', 'alphanohtml'));
-		if(GETPOSTISSET('WEBSITE_OBJECTCLASS')){
-            $objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTCLASS', 'alpha');
-        }
-        if(GETPOSTISSET('WEBSITE_OBJECTID')){
-            $objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTID','aZ09');
-        }
+		$objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTCLASS', 'alpha');
+        $objectpage->fk_object = GETPOST('WEBSITE_OBJECTID','aZ09');
+
 		$newdatecreation = dol_mktime(GETPOST('datecreationhour', 'int'), GETPOST('datecreationmin', 'int'), GETPOST('datecreationsec', 'int'), GETPOST('datecreationmonth', 'int'), GETPOST('datecreationday', 'int'), GETPOST('datecreationyear', 'int'));
 		if ($newdatecreation) $objectpage->date_creation = $newdatecreation;
 

From e58d0d4af4eabba6f1197904035e551b00d0666a Mon Sep 17 00:00:00 2001
From: Nicolas <info@inovea-conseil.com>
Date: Mon, 28 Sep 2020 20:56:19 +0200
Subject: [PATCH 037/101] FIX Stickler error

---
 htdocs/website/index.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/website/index.php b/htdocs/website/index.php
index 5de0f2c1007..29dd6c44929 100644
--- a/htdocs/website/index.php
+++ b/htdocs/website/index.php
@@ -1660,7 +1660,7 @@ if ($action == 'updatemeta')
 		$objectpage->fk_page = (GETPOST('pageidfortranslation', 'int') > 0 ? GETPOST('pageidfortranslation', 'int') : 0);
 		$objectpage->author_alias = trim(GETPOST('WEBSITE_AUTHORALIAS', 'alphanohtml'));
 		$objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTCLASS', 'alpha');
-        $objectpage->fk_object = GETPOST('WEBSITE_OBJECTID','aZ09');
+        $objectpage->fk_object = GETPOST('WEBSITE_OBJECTID', 'aZ09');
 
 		$newdatecreation = dol_mktime(GETPOST('datecreationhour', 'int'), GETPOST('datecreationmin', 'int'), GETPOST('datecreationsec', 'int'), GETPOST('datecreationmonth', 'int'), GETPOST('datecreationday', 'int'), GETPOST('datecreationyear', 'int'));
 		if ($newdatecreation) $objectpage->date_creation = $newdatecreation;

From 572b012344731dba71c1cb8ab63cd41f4b75c159 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric?= <35066297+c3do@users.noreply.github.com>
Date: Mon, 28 Sep 2020 22:06:15 +0200
Subject: [PATCH 038/101] Fix API $includeparentid when get product

---
 htdocs/product/class/api_products.class.php | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/htdocs/product/class/api_products.class.php b/htdocs/product/class/api_products.class.php
index a90c9dd5b1b..6c75d96fe89 100644
--- a/htdocs/product/class/api_products.class.php
+++ b/htdocs/product/class/api_products.class.php
@@ -72,15 +72,16 @@ class Products extends DolibarrApi
      * @param  int    $id                  ID of product
      * @param  int    $includestockdata    Load also information about stock (slower)
      * @param  bool   $includesubproducts  Load information about subproducts
+	 * @param  bool   $includeparentid     Load also ID of parent product (if product is a variant of a parent product)
      * @return array|mixed                 Data without useless information
      *
      * @throws RestException 401
      * @throws RestException 403
      * @throws RestException 404
      */
-    public function get($id, $includestockdata = 0, $includesubproducts = false)
+    public function get($id, $includestockdata = 0, $includesubproducts = false, $includeparentid = false)
     {
-        return $this->_fetch($id, '', '', '', $includestockdata, $includesubproducts);
+        return $this->_fetch($id, '', '', '', $includestockdata, $includesubproducts, $includeparentid);
     }
 
     /**
@@ -91,6 +92,7 @@ class Products extends DolibarrApi
      * @param  string $ref                Ref of element
      * @param  int    $includestockdata   Load also information about stock (slower)
      * @param  bool   $includesubproducts Load information about subproducts
+	 * @param  bool   $includeparentid    Load also ID of parent product (if product is a variant of a parent product)
      *
      * @return array|mixed                 Data without useless information
      *
@@ -100,9 +102,9 @@ class Products extends DolibarrApi
      * @throws RestException 403
      * @throws RestException 404
      */
-    public function getByRef($ref, $includestockdata = 0, $includesubproducts = false)
+    public function getByRef($ref, $includestockdata = 0, $includesubproducts = false, $includeparentid = false)
     {
-        return $this->_fetch('', $ref, '', '', $includestockdata, $includesubproducts);
+        return $this->_fetch('', $ref, '', '', $includestockdata, $includesubproducts, $includeparentid);
     }
 
     /**
@@ -113,6 +115,7 @@ class Products extends DolibarrApi
      * @param  string $ref_ext            Ref_ext of element
      * @param  int    $includestockdata   Load also information about stock (slower)
      * @param  bool   $includesubproducts Load information about subproducts
+	 * @param  bool   $includeparentid    Load also ID of parent product (if product is a variant of a parent product)
      *
      * @return array|mixed Data without useless information
      *
@@ -122,9 +125,9 @@ class Products extends DolibarrApi
      * @throws RestException 403
      * @throws RestException 404
      */
-    public function getByRefExt($ref_ext, $includestockdata = 0, $includesubproducts = false)
+    public function getByRefExt($ref_ext, $includestockdata = 0, $includesubproducts = false, $includeparentid = false)
     {
-        return $this->_fetch('', '', $ref_ext, '', $includestockdata, $includesubproducts);
+        return $this->_fetch('', '', $ref_ext, '', $includestockdata, $includesubproducts, $includeparentid);
     }
 
     /**
@@ -135,6 +138,7 @@ class Products extends DolibarrApi
      * @param  string $barcode            Barcode of element
      * @param  int    $includestockdata   Load also information about stock (slower)
      * @param  bool   $includesubproducts Load information about subproducts
+	 * @param  bool   $includeparentid    Load also ID of parent product (if product is a variant of a parent product)
      *
      * @return array|mixed Data without useless information
      *
@@ -144,9 +148,9 @@ class Products extends DolibarrApi
      * @throws RestException 403
      * @throws RestException 404
      */
-    public function getByBarcode($barcode, $includestockdata = 0, $includesubproducts = false)
+    public function getByBarcode($barcode, $includestockdata = 0, $includesubproducts = false, $includeparentid = false)
     {
-        return $this->_fetch('', '', '', $barcode, $includestockdata, $includesubproducts);
+        return $this->_fetch('', '', '', $barcode, $includestockdata, $includesubproducts, $includeparentid);
     }
 
     /**

From 9662c4110aa4c3287a4df58e50cdfdfe524bc99a Mon Sep 17 00:00:00 2001
From: bahfir abbes <bafbes@gmail.com>
Date: Tue, 29 Sep 2020 01:26:18 +0100
Subject: [PATCH 039/101] new:bankline_prepare_head for bank lines

---
 htdocs/compta/bank/line.php      | 14 ++-----
 htdocs/core/lib/payments.lib.php | 63 +++++++++++++++++++++++++-------
 2 files changed, 53 insertions(+), 24 deletions(-)

diff --git a/htdocs/compta/bank/line.php b/htdocs/compta/bank/line.php
index 7502d4644f5..7548b65bb1c 100644
--- a/htdocs/compta/bank/line.php
+++ b/htdocs/compta/bank/line.php
@@ -32,6 +32,7 @@
 require '../../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/compta/bank/class/account.class.php';
 require_once DOL_DOCUMENT_ROOT.'/categories/class/categorie.class.php';
+require_once DOL_DOCUMENT_ROOT.'/core/lib/payments.lib.php';
 
 // Load translation files required by the page
 $langs->loadLangs(array('banks', 'categories', 'compta', 'bills', 'other'));
@@ -246,16 +247,7 @@ foreach ($cats as $cat) {
     $arrayselected[] = $cat->id;
 }
 
-$tabs = array(
-    array(
-        DOL_URL_ROOT.'/compta/bank/line.php?rowid='.$rowid,
-        $langs->trans('BankTransaction')
-    ),
-    array(
-        DOL_URL_ROOT.'/compta/bank/info.php?rowid='.$rowid,
-        $langs->trans('Info')
-    )
-);
+$head = bankline_prepare_head($rowid);
 
 
 $sql = "SELECT b.rowid,b.dateo as do,b.datev as dv, b.amount, b.label, b.rappro,";
@@ -296,7 +288,7 @@ if ($result)
         print '<input type="hidden" name="orig_account" value="'.$orig_account.'">';
         print '<input type="hidden" name="id" value="'.$acct->id.'">';
 
-        dol_fiche_head($tabs, 0, $langs->trans('LineRecord'), 0, 'accountline', 0);
+        dol_fiche_head($head, 'bankline', $langs->trans('LineRecord'), 0, 'account', 0);
 
         $linkback = '<a href="'.DOL_URL_ROOT.'/compta/bank/bankentries_list.php?restore_lastsearch_values=1">'.$langs->trans("BackToList").'</a>';
 
diff --git a/htdocs/core/lib/payments.lib.php b/htdocs/core/lib/payments.lib.php
index 969eb05328c..02b5727e174 100644
--- a/htdocs/core/lib/payments.lib.php
+++ b/htdocs/core/lib/payments.lib.php
@@ -2,6 +2,7 @@
 /**
  * Copyright (C) 2013	    Marcos García	        <marcosgdf@gmail.com>
  * Copyright (C) 2018       Frédéric France         <frederic.france@netlogic.fr>
+ * Copyright (C) 2020       Abbes Bahfir            <bafbes@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -28,15 +29,15 @@
 function payment_prepare_head(Paiement $object)
 {
 
-	global $langs, $conf;
+    global $langs, $conf;
 
-	$h = 0;
-	$head = array();
+    $h = 0;
+    $head = array();
 
-	$head[$h][0] = DOL_URL_ROOT.'/compta/paiement/card.php?id='.$object->id;
-	$head[$h][1] = $langs->trans("Payment");
-	$head[$h][2] = 'payment';
-	$h++;
+    $head[$h][0] = DOL_URL_ROOT.'/compta/paiement/card.php?id='.$object->id;
+    $head[$h][1] = $langs->trans("Payment");
+    $head[$h][2] = 'payment';
+    $h++;
 
     // Show more tabs from modules
     // Entries must be declared in modules descriptor with line
@@ -44,14 +45,50 @@ function payment_prepare_head(Paiement $object)
     // $this->tabs = array('entity:-tabname);   												to remove a tab
     complete_head_from_modules($conf, $langs, $object, $head, $h, 'payment');
 
-	$head[$h][0] = DOL_URL_ROOT.'/compta/paiement/info.php?id='.$object->id;
-	$head[$h][1] = $langs->trans("Info");
-	$head[$h][2] = 'info';
-	$h++;
+    $head[$h][0] = DOL_URL_ROOT.'/compta/paiement/info.php?id='.$object->id;
+    $head[$h][1] = $langs->trans("Info");
+    $head[$h][2] = 'info';
+    $h++;
 
-	complete_head_from_modules($conf, $langs, $object, $head, $h, 'payment', 'remove');
+    complete_head_from_modules($conf, $langs, $object, $head, $h, 'payment', 'remove');
 
-	return $head;
+    return $head;
+}
+
+/**
+ * Returns an array with the tabs for the "Bannkline" section
+ * It loads tabs from modules looking for the entity payment
+ *
+ * @param Bankline $object Current payment object
+ * @return array Tabs for the Bankline section
+ */
+function bankline_prepare_head($id)
+{
+
+    global $langs, $conf;
+
+    $h = 0;
+    $head = array();
+
+    $head[$h][0] = DOL_URL_ROOT.'/compta/bank/line.php?rowid='.$id;
+    $head[$h][1] = $langs->trans('BankTransaction');
+    $head[$h][2] = 'bankline';
+    $h++;
+
+    // Show more tabs from modules
+    // Entries must be declared in modules descriptor with line
+    // $this->tabs = array('entity:+tabname:Title:@mymodule:/mymodule/mypage.php?id=__ID__');   to add new tab
+    // $this->tabs = array('entity:-tabname);   												to remove a tab
+    complete_head_from_modules($conf, $langs, null, $head, $h, 'bankline');
+
+    $head[$h][0] = DOL_URL_ROOT.'/compta/bank/info.php?rowid='.$id;
+    $head[$h][1] = $langs->trans("Info");
+    $head[$h][2] = 'info';
+    $h++;
+
+    complete_head_from_modules($conf, $langs, null, $head, $h, 'bankline', 'remove');
+
+    return $head;
 }
 
 /**

From 2d4e2ee378f03c2668dfca2aeba0f282bd412746 Mon Sep 17 00:00:00 2001
From: "Sekan, Tobias" <tobias.sekan@startmail.com>
Date: Tue, 29 Sep 2020 10:00:14 +0200
Subject: [PATCH 040/101] Use object field for list fields (project)

---
 htdocs/projet/class/project.class.php | 94 +++++++++++++++++----------
 htdocs/projet/list.php                | 70 ++++++++++++--------
 2 files changed, 102 insertions(+), 62 deletions(-)

diff --git a/htdocs/projet/class/project.class.php b/htdocs/projet/class/project.class.php
index 30a2a0c242b..54a8b56fe23 100644
--- a/htdocs/projet/class/project.class.php
+++ b/htdocs/projet/class/project.class.php
@@ -150,6 +150,66 @@ class Project extends CommonObject
 	 */
 	public $lines;
 
+	/**
+	 *  'type' if the field format ('integer', 'integer:ObjectClass:PathToClass[:AddCreateButtonOrNot[:Filter]]', 'varchar(x)', 'double(24,8)', 'real', 'price', 'text', 'html', 'date', 'datetime', 'timestamp', 'duration', 'mail', 'phone', 'url', 'password')
+	 *         Note: Filter can be a string like "(t.ref:like:'SO-%') or (t.date_creation:<:'20160101') or (t.nature:is:NULL)"
+	 *  'label' the translation key.
+	 *  'enabled' is a condition when the field must be managed.
+	 *  'position' is the sort order of field.
+	 *  'notnull' is set to 1 if not null in database. Set to -1 if we must set data to null if empty ('' or 0).
+	 *  'visible' says if field is visible in list (Examples: 0=Not visible, 1=Visible on list and create/update/view forms, 2=Visible on list only, 3=Visible on create/update/view form only (not list), 4=Visible on list and update/view form only (not create). 5=Visible on list and view only (not create/not update). Using a negative value means field is not shown by default on list but can be selected for viewing)
+	 *  'noteditable' says if field is not editable (1 or 0)
+	 *  'default' is a default value for creation (can still be overwrote by the Setup of Default Values if field is editable in creation form). Note: If default is set to '(PROV)' and field is 'ref', the default value will be set to '(PROVid)' where id is rowid when a new record is created.
+	 *  'index' if we want an index in database.
+	 *  'foreignkey'=>'tablename.field' if the field is a foreign key (it is recommanded to name the field fk_...).
+	 *  'searchall' is 1 if we want to search in this field when making a search from the quick search button.
+	 *  'isameasure' must be set to 1 if you want to have a total on list for this field. Field type must be summable like integer or double(24,8).
+	 *  'css' is the CSS style to use on field. For example: 'maxwidth200'
+	 *  'help' is a string visible as a tooltip on field
+	 *  'showoncombobox' if value of the field must be visible into the label of the combobox that list record
+	 *  'disabled' is 1 if we want to have the field locked by a 'disabled' attribute. In most cases, this is never set into the definition of $fields into class, but is set dynamically by some part of code.
+	 *  'arraykeyval' to set list of value if type is a list of predefined values. For example: array("0"=>"Draft","1"=>"Active","-1"=>"Cancel")
+	 *  'comment' is not used. You can store here any text of your choice. It is not used by application.
+	 *
+	 *  Note: To have value dynamic, you can set value to 0 in definition and edit the value on the fly into the constructor.
+	 */
+
+	// BEGIN MODULEBUILDER PROPERTIES
+	/**
+	 * @var array  Array with all fields and their property. Do not use it as a static var. It may be modified by constructor.
+	 */
+	public $fields=array(
+		'rowid' =>array('type'=>'integer', 'label'=>'ID', 'enabled'=>1, 'visible'=>0, 'notnull'=>1, 'position'=>10),
+		'fk_soc' =>array('type'=>'integer', 'label'=>'Fk soc', 'enabled'=>1, 'visible'=>0, 'position'=>15),
+		'datec' =>array('type'=>'datetime', 'label'=>'DateCreationShort', 'enabled'=>1, 'visible'=>1, 'position'=>20),
+		'tms' =>array('type'=>'timestamp', 'label'=>'DateModificationShort', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>25),
+		'dateo' =>array('type'=>'date', 'label'=>'DateStart', 'enabled'=>1, 'visible'=>1, 'position'=>30),
+		'datee' =>array('type'=>'date', 'label'=>'DateEnd', 'enabled'=>1, 'visible'=>1, 'position'=>35),
+		'ref' =>array('type'=>'varchar(50)', 'label'=>'Ref', 'enabled'=>1, 'visible'=>1, 'showoncombobox'=>1, 'position'=>40, 'searchall'=>1),
+		'entity' =>array('type'=>'integer', 'label'=>'Entity', 'default'=>1, 'enabled'=>1, 'visible'=>0, 'notnull'=>1, 'position'=>45),
+		'title' =>array('type'=>'varchar(255)', 'label'=>'Label', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>50, 'showoncombobox'=>1, 'searchall'=>1),
+		'description' =>array('type'=>'text', 'label'=>'Description', 'enabled'=>1, 'visible'=>3, 'position'=>55, 'searchall'=>1),
+		'fk_user_creat' =>array('type'=>'integer', 'label'=>'Fk user creat', 'enabled'=>1, 'visible'=>0, 'notnull'=>1, 'position'=>60),
+		'public' =>array('type'=>'integer', 'label'=>'Visibility', 'enabled'=>1, 'visible'=>1, 'position'=>65),
+		'fk_statut' =>array('type'=>'smallint(6)', 'label'=>'Status', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>500),
+		'fk_opp_status' =>array('type'=>'integer', 'label'=>'OpportunityStatusShort', 'enabled'=>1, 'visible'=>1, 'position'=>75),
+		'opp_percent' =>array('type'=>'double(5,2)', 'label'=>'OpportunityProbabilityShort', 'enabled'=>1, 'visible'=>1, 'position'=>80),
+		'note_private' =>array('type'=>'text', 'label'=>'NotePrivate', 'enabled'=>1, 'visible'=>3, 'position'=>85, 'searchall'=>1),
+		'note_public' =>array('type'=>'text', 'label'=>'NotePublic', 'enabled'=>1, 'visible'=>3, 'position'=>90, 'searchall'=>1),
+		'model_pdf' =>array('type'=>'varchar(255)', 'label'=>'Model pdf', 'enabled'=>1, 'visible'=>0, 'position'=>95),
+		'budget_amount' =>array('type'=>'double(24,8)', 'label'=>'Budget', 'enabled'=>1, 'visible'=>1, 'position'=>100),
+		'date_close' =>array('type'=>'datetime', 'label'=>'Date close', 'enabled'=>1, 'visible'=>0, 'position'=>105),
+		'fk_user_close' =>array('type'=>'integer', 'label'=>'Fk user close', 'enabled'=>1, 'visible'=>0, 'position'=>110),
+		'opp_amount' =>array('type'=>'double(24,8)', 'label'=>'OpportunityAmountShort', 'enabled'=>1, 'visible'=>1, 'position'=>115),
+		'import_key' =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>0, 'position'=>120),
+		'fk_user_modif' =>array('type'=>'integer', 'label'=>'Fk user modif', 'enabled'=>1, 'visible'=>0, 'position'=>125),
+		'usage_bill_time' =>array('type'=>'integer', 'label'=>'UsageBillTimeShort', 'enabled'=>1, 'visible'=>1, 'position'=>130),
+		'usage_opportunity' =>array('type'=>'integer', 'label'=>'UsageOpportunity', 'enabled'=>1, 'visible'=>1, 'position'=>135),
+		'usage_task' =>array('type'=>'integer', 'label'=>'UsageTasks', 'enabled'=>1, 'visible'=>1, 'position'=>140),
+		'usage_organize_event' =>array('type'=>'integer', 'label'=>'Usage organize event', 'enabled'=>1, 'visible'=>0, 'position'=>145),
+	);
+	// END MODULEBUILDER PROPERTIES
+
 	/**
 	 * Draft status
 	 */
@@ -165,40 +225,6 @@ class Project extends CommonObject
 	 */
 	const STATUS_CLOSED = 2;
 
-
-	public $fields = array(
-		'rowid' =>array('type'=>'integer', 'label'=>'ID', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>10),
-		'fk_soc' =>array('type'=>'integer', 'label'=>'Fk soc', 'enabled'=>1, 'visible'=>-1, 'position'=>15),
-		'datec' =>array('type'=>'datetime', 'label'=>'Datec', 'enabled'=>1, 'visible'=>-1, 'position'=>20),
-		'tms' =>array('type'=>'timestamp', 'label'=>'Tms', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>25),
-		'dateo' =>array('type'=>'date', 'label'=>'Dateo', 'enabled'=>1, 'visible'=>-1, 'position'=>30),
-		'datee' =>array('type'=>'date', 'label'=>'Datee', 'enabled'=>1, 'visible'=>-1, 'position'=>35),
-		'ref' =>array('type'=>'varchar(50)', 'label'=>'Ref', 'enabled'=>1, 'visible'=>-1, 'showoncombobox'=>1, 'position'=>40),
-		'entity' =>array('type'=>'integer', 'label'=>'Entity', 'default'=>1, 'enabled'=>1, 'visible'=>-2, 'notnull'=>1, 'position'=>45),
-		'title' =>array('type'=>'varchar(255)', 'label'=>'Title', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>50, 'showoncombobox'=>1),
-		'description' =>array('type'=>'text', 'label'=>'Description', 'enabled'=>1, 'visible'=>-1, 'position'=>55),
-		'fk_user_creat' =>array('type'=>'integer', 'label'=>'Fk user creat', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>60),
-		'public' =>array('type'=>'integer', 'label'=>'Public', 'enabled'=>1, 'visible'=>-1, 'position'=>65),
-		'fk_statut' =>array('type'=>'smallint(6)', 'label'=>'Fk statut', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>500),
-		'fk_opp_status' =>array('type'=>'integer', 'label'=>'Fk opp status', 'enabled'=>1, 'visible'=>-1, 'position'=>75),
-		'opp_percent' =>array('type'=>'double(5,2)', 'label'=>'Opp percent', 'enabled'=>1, 'visible'=>-1, 'position'=>80),
-		'note_private' =>array('type'=>'text', 'label'=>'NotePrivate', 'enabled'=>1, 'visible'=>0, 'position'=>85),
-		'note_public' =>array('type'=>'text', 'label'=>'NotePublic', 'enabled'=>1, 'visible'=>0, 'position'=>90),
-		'model_pdf' =>array('type'=>'varchar(255)', 'label'=>'Model pdf', 'enabled'=>1, 'visible'=>0, 'position'=>95),
-		'budget_amount' =>array('type'=>'double(24,8)', 'label'=>'Budget amount', 'enabled'=>1, 'visible'=>-1, 'position'=>100),
-		'date_close' =>array('type'=>'datetime', 'label'=>'Date close', 'enabled'=>1, 'visible'=>-1, 'position'=>105),
-		'fk_user_close' =>array('type'=>'integer', 'label'=>'Fk user close', 'enabled'=>1, 'visible'=>-1, 'position'=>110),
-		'opp_amount' =>array('type'=>'double(24,8)', 'label'=>'Opp amount', 'enabled'=>1, 'visible'=>-1, 'position'=>115),
-		'email_msgid' => array('type'=>'varchar(255)', 'label'=>'EmailMsgID', 'visible'=>-2, 'enabled'=>1, 'position'=>540, 'notnull'=>-1, 'help'=>'EmailMsgIDDesc'),
-		'import_key' =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>-1, 'position'=>120),
-		'fk_user_modif' =>array('type'=>'integer', 'label'=>'Fk user modif', 'enabled'=>1, 'visible'=>-1, 'position'=>125),
-		'usage_bill_time' =>array('type'=>'integer', 'label'=>'Usage bill time', 'enabled'=>1, 'visible'=>-1, 'position'=>130),
-		'usage_opportunity' =>array('type'=>'integer', 'label'=>'Usage opportunity', 'enabled'=>1, 'visible'=>-1, 'position'=>135),
-		'usage_task' =>array('type'=>'integer', 'label'=>'Usage task', 'enabled'=>1, 'visible'=>-1, 'position'=>140),
-		'usage_organize_event' =>array('type'=>'integer', 'label'=>'Usage organize event', 'enabled'=>1, 'visible'=>-1, 'position'=>145),
-	);
-
-
 	/**
 	 *  Constructor
 	 *
diff --git a/htdocs/projet/list.php b/htdocs/projet/list.php
index 8a7645941d5..40e247131b6 100644
--- a/htdocs/projet/list.php
+++ b/htdocs/projet/list.php
@@ -123,34 +123,48 @@ $extrafields->fetch_name_optionals_label($object->table_element);
 $search_array_options = $extrafields->getOptionalsFromPost($object->table_element, '', 'search_');
 
 // List of fields to search into when doing a "search in all"
-$fieldstosearchall = array(
-	'p.ref'=>"Ref",
-	'p.title'=>"Label",
-	's.nom'=>"ThirdPartyName",
-	"p.note_public"=>"NotePublic"
-);
-if (empty($user->socid)) $fieldstosearchall["p.note_private"] = "NotePrivate";
+$fieldstosearchall = array();
+foreach ($object->fields as $key => $val)
+{
+	if (empty($val['searchall'])) {
+		continue;
+	}
+
+	// don't allow search in private notes for external users when doing "search in all"
+	if (!empty($user->socid) && $key == "note_private") {
+		continue;
+	}
+
+	$fieldstosearchall['p.'.$key] = $val['label'];
+}
+
+// Add none object fields for "search in all"
+$fieldstosearchall['s.nom'] = "ThirdPartyName";
+
+// Definition of fields for list
+$arrayfields = array();
+foreach ($object->fields as $key => $val)
+{
+	// If $val['visible']==0, then we never show the field
+	if (empty($val['visible'])) {
+		continue;
+	}
+
+	// visibility based on global settings
+	if(empty($conf->global->PROJECT_USE_OPPORTUNITIES) && $key == 'fk_opp_status') continue;
+	if(empty($conf->global->PROJECT_USE_OPPORTUNITIES) && $key == 'opp_percent') continue;
+	if(empty($conf->global->PROJECT_USE_OPPORTUNITIES) && $key == 'opp_amount') continue;
+	if(empty($conf->global->PROJECT_USE_OPPORTUNITIES) && $key == 'usage_opportunity') continue;
+	if(!empty($conf->global->PROJECT_HIDE_TASKS) && $key == 'usage_bill_time') continue;
+	if(!empty($conf->global->PROJECT_HIDE_TASKS) && $key == 'usage_task') continue;
+
+	$arrayfields['p.'.$key] = array(
+		'label'=>$val['label'],
+		'checked'=>(($val['visible'] < 0) ? 0 : 1),
+		'enabled'=>($val['enabled'] && ($val['visible'] != 3)),
+		'position'=>$val['position']);
+}
 
-$arrayfields = array(
-	'p.ref'=>array('label'=>$langs->trans("Ref"), 'checked'=>1, 'position'=>10),
-	'p.title'=>array('label'=>$langs->trans("Label"), 'checked'=>1, 'position'=>11),
-	's.nom'=>array('label'=>$langs->trans("ThirdParty"), 'checked'=>1, 'enabled'=>(empty($conf->societe->enabled) ? 0 : 1), 'position'=>20),
-	'commercial'=>array('label'=>$langs->trans("SaleRepresentativesOfThirdParty"), 'checked'=>0, 'css'=>'tdoverflowmax100', 'position'=>21),
-	'p.dateo'=>array('label'=>$langs->trans("DateStart"), 'checked'=>1, 'position'=>100),
-	'p.datee'=>array('label'=>$langs->trans("DateEnd"), 'checked'=>1, 'position'=>101),
-	'p.public'=>array('label'=>$langs->trans("Visibility"), 'checked'=>1, 'position'=>102),
-	'p.opp_amount'=>array('label'=>$langs->trans("OpportunityAmountShort"), 'checked'=>1, 'enabled'=>($conf->global->PROJECT_USE_OPPORTUNITIES ? 1 : 0), 'position'=>103),
-	'p.fk_opp_status'=>array('label'=>$langs->trans("OpportunityStatusShort"), 'checked'=>1, 'enabled'=>($conf->global->PROJECT_USE_OPPORTUNITIES ? 1 : 0), 'position'=>104),
-	'p.opp_percent'=>array('label'=>$langs->trans("OpportunityProbabilityShort"), 'checked'=>1, 'enabled'=>($conf->global->PROJECT_USE_OPPORTUNITIES ? 1 : 0), 'position'=>105),
-    'opp_weighted_amount'=>array('label'=>$langs->trans('OpportunityWeightedAmountShort'), 'checked'=>0, 'enabled'=>($conf->global->PROJECT_USE_OPPORTUNITIES ? 1 : 0), 'position'=>106),
-    'p.budget_amount'=>array('label'=>$langs->trans("Budget"), 'checked'=>0, 'position'=>110),
-	'p.usage_opportunity'=>array('label'=>$langs->trans("UsageOpportunity"), 'checked'=>0, 'enabled'=>($conf->global->PROJECT_USE_OPPORTUNITIES ? 1 : 0), 'position'=>115),
-	'p.usage_task'=>array('label'=>$langs->trans("UsageTasks"), 'checked'=>0, 'enabled'=>($conf->global->PROJECT_HIDE_TASKS ? 0 : 1), 'position'=>116),
-	'p.usage_bill_time'=>array('label'=>$langs->trans("UsageBillTimeShort"), 'checked'=>0, 'enabled'=>($conf->global->PROJECT_HIDE_TASKS ? 0 : 1), 'position'=>117),
-	'p.datec'=>array('label'=>$langs->trans("DateCreationShort"), 'checked'=>0, 'position'=>500),
-	'p.tms'=>array('label'=>$langs->trans("DateModificationShort"), 'checked'=>0, 'position'=>500),
-	'p.fk_statut'=>array('label'=>$langs->trans("Status"), 'checked'=>1, 'position'=>1000),
-);
 // Extra fields
 if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label']) > 0)
 {
@@ -160,7 +174,7 @@ if (is_array($extrafields->attributes[$object->table_element]['label']) && count
 			$arrayfields["ef.".$key] = array('label'=>$extrafields->attributes[$object->table_element]['label'][$key], 'checked'=>(($extrafields->attributes[$object->table_element]['list'][$key] < 0) ? 0 : 1), 'position'=>$extrafields->attributes[$object->table_element]['pos'][$key], 'enabled'=>(abs($extrafields->attributes[$object->table_element]['list'][$key]) != 3 && $extrafields->attributes[$object->table_element]['perms'][$key]));
 	}
 }
-$object->fields = dol_sort_array($object->fields, 'position');
+
 $arrayfields = dol_sort_array($arrayfields, 'position');
 
 

From c0a3aa2b5ba0a88e0ec5e84dfc50205aa16f4738 Mon Sep 17 00:00:00 2001
From: "Sekan, Tobias" <tobias.sekan@startmail.com>
Date: Tue, 29 Sep 2020 12:00:54 +0200
Subject: [PATCH 041/101] add mising elements from last commit

---
 htdocs/projet/list.php | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/htdocs/projet/list.php b/htdocs/projet/list.php
index 40e247131b6..07da8cba855 100644
--- a/htdocs/projet/list.php
+++ b/htdocs/projet/list.php
@@ -130,7 +130,7 @@ foreach ($object->fields as $key => $val)
 		continue;
 	}
 
-	// don't allow search in private notes for external users when doing "search in all"
+	// Don't allow search in private notes for external users when doing "search in all"
 	if (!empty($user->socid) && $key == "note_private") {
 		continue;
 	}
@@ -138,7 +138,7 @@ foreach ($object->fields as $key => $val)
 	$fieldstosearchall['p.'.$key] = $val['label'];
 }
 
-// Add none object fields for "search in all"
+// Add none object fields to "search in all"
 $fieldstosearchall['s.nom'] = "ThirdPartyName";
 
 // Definition of fields for list
@@ -150,7 +150,7 @@ foreach ($object->fields as $key => $val)
 		continue;
 	}
 
-	// visibility based on global settings
+	// Visibility based on global settings
 	if(empty($conf->global->PROJECT_USE_OPPORTUNITIES) && $key == 'fk_opp_status') continue;
 	if(empty($conf->global->PROJECT_USE_OPPORTUNITIES) && $key == 'opp_percent') continue;
 	if(empty($conf->global->PROJECT_USE_OPPORTUNITIES) && $key == 'opp_amount') continue;
@@ -165,6 +165,11 @@ foreach ($object->fields as $key => $val)
 		'position'=>$val['position']);
 }
 
+// Add none object fields to fields for list
+$arrayfields['s.nom'] = array('label'=>$langs->trans("ThirdParty"), 'checked'=>1, 'enabled'=>(empty($conf->societe->enabled) ? 0 : 1));
+$arrayfields['commercial'] = array('label'=>$langs->trans("SaleRepresentativesOfThirdParty"), 'checked'=>0);
+$arrayfields['opp_weighted_amount'] = array('label'=>$langs->trans('OpportunityWeightedAmountShort'), 'checked'=>0, 'enabled'=>(empty($conf->global->PROJECT_USE_OPPORTUNITIES) ? 0 : 1), 'position'=>106);
+
 // Extra fields
 if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label']) > 0)
 {

From 3e612d2a9448497c0a304d0f3ae61b2de948e418 Mon Sep 17 00:00:00 2001
From: Tim Otte <otte@meuser.it>
Date: Tue, 29 Sep 2020 12:13:41 +0200
Subject: [PATCH 042/101] Added support for styling in lines

---
 htdocs/core/class/extrafields.class.php |  3 +++
 htdocs/includes/odtphp/Segment.php      | 10 +++-------
 htdocs/includes/odtphp/odf.php          | 24 ++++++++++++++++++++----
 3 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php
index b2f8905aba9..dcac977566b 100644
--- a/htdocs/core/class/extrafields.class.php
+++ b/htdocs/core/class/extrafields.class.php
@@ -2097,6 +2097,9 @@ class ExtraFields
 					if (!GETPOSTISSET($keysuffix."options_".$key.$keyprefix)) continue; // Value was not provided, we should not set it.
 					$value_arr = GETPOST($keysuffix."options_".$key.$keyprefix);
 					$value_key = price2num($value_arr);
+				} elseif (in_array($key_type, array('text'))) {
+					if (!GETPOSTISSET($keysuffix."options_".$key.$keyprefix)) continue; // Value was not provided, we should not set it.
+					$value_key = GETPOST($keysuffix."options_".$key.$keyprefix, 'alpha');
 				} else {
 					if (!GETPOSTISSET($keysuffix."options_".$key.$keyprefix)) continue; // Value was not provided, we should not set it.
 					$value_key = GETPOST($keysuffix."options_".$key.$keyprefix);
diff --git a/htdocs/includes/odtphp/Segment.php b/htdocs/includes/odtphp/Segment.php
index cd8bec8c4ff..ca8797ba577 100644
--- a/htdocs/includes/odtphp/Segment.php
+++ b/htdocs/includes/odtphp/Segment.php
@@ -231,14 +231,10 @@ class Segment implements IteratorAggregate, Countable
             //throw new SegmentException("var $key not found in {$this->getName()}");
         }
 
-		$value=$this->odf->htmlToUTFAndPreOdf($value);
+        $tag = $this->odf->getConfig('DELIMITER_LEFT') . $key . $this->odf->getConfig('DELIMITER_RIGHT');
 
-		$value = $encode ? htmlspecialchars($value) : $value;
-		$value = ($charset == 'ISO-8859') ? utf8_encode($value) : $value;
-
-		$value=$this->odf->preOdfToOdf($value);
-
-        $this->vars[$this->odf->getConfig('DELIMITER_LEFT') . $key . $this->odf->getConfig('DELIMITER_RIGHT')] = $value;
+		$this->vars[$tag] = $this->odf->convertVarToOdf($value, $encode, $charset);
+        
         return $this;
     }
     /**
diff --git a/htdocs/includes/odtphp/odf.php b/htdocs/includes/odtphp/odf.php
index 45e442462b4..88341da4adf 100644
--- a/htdocs/includes/odtphp/odf.php
+++ b/htdocs/includes/odtphp/odf.php
@@ -141,7 +141,23 @@ class Odf
 			//}
 		}
 
+		$this->vars[$tag] = $this->convertVarToOdf($value, $encode, $charset);
+		
+		return $this;
+	}
+
+	/**
+     * Replaces html tags in odt tags and returns a compatible string
+     * @param string   $key        Name of the variable within the template
+	 * @param string   $value      Replacement value
+	 * @param bool     $encode     If true, special XML characters are encoded
+	 * @param string   $charset    Charset
+     * @return string
+     */
+	public function convertVarToOdf($value, $encode = true, $charset = 'ISO-8859')
+	{
 		$value = ($charset == 'ISO-8859') ? utf8_encode($value) : $value;
+		$convertedValue = $value;
 
 		// Check if the value includes html tags
 		if ($this->_hasHtmlTag($value) === true) {
@@ -155,7 +171,7 @@ class Odf
 				'<style:style style:name="supText" style:family="text"><style:text-properties style:text-position="super 58%" /></style:style>'
 			);
 	
-			$this->vars[$tag] = $this->_replaceHtmlWithOdtTag($this->_getDataFromHtml($value), $customStyles, $fontDeclarations);
+			$convertedValue = $this->_replaceHtmlWithOdtTag($this->_getDataFromHtml($value), $customStyles, $fontDeclarations);
 	
 			foreach ($customStyles as $key => $val) {
 				array_push($automaticStyles, '<style:style style:name="customStyle' . $key . '" style:family="text">' . $val . '</style:style>');
@@ -179,9 +195,9 @@ class Odf
 			}
 			$this->contentXml = str_replace('</office:font-face-decls>', $fonts . '</office:font-face-decls>', $this->contentXml);
 		}
-		else $this->vars[$tag] = preg_replace('/(\r\n|\r|\n)/i', "<text:line-break/>", $value);
-		
-		return $this;
+		else $convertedValue = preg_replace('/(\r\n|\r|\n)/i', "<text:line-break/>", $value);
+
+		return $convertedValue;
 	}
 
 	/**

From 4611333ee6f7cc600e48430bebd6ebde601bc137 Mon Sep 17 00:00:00 2001
From: Tim Otte <otte@meuser.it>
Date: Tue, 29 Sep 2020 12:17:25 +0200
Subject: [PATCH 043/101] Added support for styling in lines

---
 htdocs/includes/odtphp/Segment.php | 10 +++-------
 htdocs/includes/odtphp/odf.php     | 24 ++++++++++++++++++++----
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/htdocs/includes/odtphp/Segment.php b/htdocs/includes/odtphp/Segment.php
index cd8bec8c4ff..ca8797ba577 100644
--- a/htdocs/includes/odtphp/Segment.php
+++ b/htdocs/includes/odtphp/Segment.php
@@ -231,14 +231,10 @@ class Segment implements IteratorAggregate, Countable
             //throw new SegmentException("var $key not found in {$this->getName()}");
         }
 
-		$value=$this->odf->htmlToUTFAndPreOdf($value);
+        $tag = $this->odf->getConfig('DELIMITER_LEFT') . $key . $this->odf->getConfig('DELIMITER_RIGHT');
 
-		$value = $encode ? htmlspecialchars($value) : $value;
-		$value = ($charset == 'ISO-8859') ? utf8_encode($value) : $value;
-
-		$value=$this->odf->preOdfToOdf($value);
-
-        $this->vars[$this->odf->getConfig('DELIMITER_LEFT') . $key . $this->odf->getConfig('DELIMITER_RIGHT')] = $value;
+		$this->vars[$tag] = $this->odf->convertVarToOdf($value, $encode, $charset);
+        
         return $this;
     }
     /**
diff --git a/htdocs/includes/odtphp/odf.php b/htdocs/includes/odtphp/odf.php
index 45e442462b4..88341da4adf 100644
--- a/htdocs/includes/odtphp/odf.php
+++ b/htdocs/includes/odtphp/odf.php
@@ -141,7 +141,23 @@ class Odf
 			//}
 		}
 
+		$this->vars[$tag] = $this->convertVarToOdf($value, $encode, $charset);
+		
+		return $this;
+	}
+
+	/**
+     * Replaces html tags in odt tags and returns a compatible string
+     * @param string   $key        Name of the variable within the template
+	 * @param string   $value      Replacement value
+	 * @param bool     $encode     If true, special XML characters are encoded
+	 * @param string   $charset    Charset
+     * @return string
+     */
+	public function convertVarToOdf($value, $encode = true, $charset = 'ISO-8859')
+	{
 		$value = ($charset == 'ISO-8859') ? utf8_encode($value) : $value;
+		$convertedValue = $value;
 
 		// Check if the value includes html tags
 		if ($this->_hasHtmlTag($value) === true) {
@@ -155,7 +171,7 @@ class Odf
 				'<style:style style:name="supText" style:family="text"><style:text-properties style:text-position="super 58%" /></style:style>'
 			);
 	
-			$this->vars[$tag] = $this->_replaceHtmlWithOdtTag($this->_getDataFromHtml($value), $customStyles, $fontDeclarations);
+			$convertedValue = $this->_replaceHtmlWithOdtTag($this->_getDataFromHtml($value), $customStyles, $fontDeclarations);
 	
 			foreach ($customStyles as $key => $val) {
 				array_push($automaticStyles, '<style:style style:name="customStyle' . $key . '" style:family="text">' . $val . '</style:style>');
@@ -179,9 +195,9 @@ class Odf
 			}
 			$this->contentXml = str_replace('</office:font-face-decls>', $fonts . '</office:font-face-decls>', $this->contentXml);
 		}
-		else $this->vars[$tag] = preg_replace('/(\r\n|\r|\n)/i', "<text:line-break/>", $value);
-		
-		return $this;
+		else $convertedValue = preg_replace('/(\r\n|\r|\n)/i', "<text:line-break/>", $value);
+
+		return $convertedValue;
 	}
 
 	/**

From 82b3b5612d0ba37ab0b79811789679cfe2597650 Mon Sep 17 00:00:00 2001
From: Tim Otte <otte@meuser.it>
Date: Tue, 29 Sep 2020 12:19:19 +0200
Subject: [PATCH 044/101] Update extrafields.class.php

That change should not be included in the PR
---
 htdocs/core/class/extrafields.class.php | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php
index dcac977566b..b2f8905aba9 100644
--- a/htdocs/core/class/extrafields.class.php
+++ b/htdocs/core/class/extrafields.class.php
@@ -2097,9 +2097,6 @@ class ExtraFields
 					if (!GETPOSTISSET($keysuffix."options_".$key.$keyprefix)) continue; // Value was not provided, we should not set it.
 					$value_arr = GETPOST($keysuffix."options_".$key.$keyprefix);
 					$value_key = price2num($value_arr);
-				} elseif (in_array($key_type, array('text'))) {
-					if (!GETPOSTISSET($keysuffix."options_".$key.$keyprefix)) continue; // Value was not provided, we should not set it.
-					$value_key = GETPOST($keysuffix."options_".$key.$keyprefix, 'alpha');
 				} else {
 					if (!GETPOSTISSET($keysuffix."options_".$key.$keyprefix)) continue; // Value was not provided, we should not set it.
 					$value_key = GETPOST($keysuffix."options_".$key.$keyprefix);

From 1f8f2c0cc39e22637f755766eb98f2ffb5b8afcd Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Tue, 29 Sep 2020 13:13:47 +0200
Subject: [PATCH 045/101] NEW Add 2 rules for emailcollector: Message send/not
 sent from Dolibarr

---
 htdocs/admin/emailcollector_card.php          |  8 +++---
 .../core/modules/modEmailCollector.class.php  | 27 ++++++++++---------
 .../class/emailcollector.class.php            |  2 ++
 .../class/emailcollectorfilter.class.php      |  2 +-
 htdocs/langs/en_US/admin.lang                 |  4 ++-
 5 files changed, 26 insertions(+), 17 deletions(-)

diff --git a/htdocs/admin/emailcollector_card.php b/htdocs/admin/emailcollector_card.php
index 9d5dcbc32e3..1420cc0263e 100644
--- a/htdocs/admin/emailcollector_card.php
+++ b/htdocs/admin/emailcollector_card.php
@@ -496,6 +496,8 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 		'X3'=>'---',
 		'withtrackingid'=>array('label'=>'WithDolTrackingID', 'data-noparam'=>1),
 		'withouttrackingid'=>array('label'=>'WithoutDolTrackingID', 'data-noparam'=>1),
+		'withtrackingidinmsgid'=>array('label'=>'WithDolTrackingIDInMsgId', 'data-noparam'=>1),
+		'withouttrackingidinmsgid'=>array('label'=>'WithoutDolTrackingIDInMsgId', 'data-noparam'=>1),
 		'X4'=>'---',
 		'isnotanswer'=>array('label'=>'IsNotAnAnswer', 'data-noparam'=>1),
 		'isanswer'=>array('label'=>'IsAnAnswer', 'data-noparam'=>1)
@@ -538,7 +540,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 		print '</td>';
 		print '<td>'.$rulefilter['rulevalue'].'</td>';
 		print '<td class="right">';
-		print ' <a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deletefilter&filterid='.$rulefilter['id'].'">'.img_delete().'</a>';
+		print ' <a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deletefilter&filterid='.$rulefilter['id'].'&token='.urlencode(newToken()).'">'.img_delete().'</a>';
 		print '</td>';
 		print '</tr>';
 	}
@@ -630,7 +632,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 		// Delete
 		print '<td class="right nowraponall">';
 		print '<a class="editfielda marginrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=editoperation&operationid='.$ruleaction['id'].'">'.img_edit().'</a>';
-		print ' <a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deleteoperation&operationid='.$ruleaction['id'].'">'.img_delete().'</a>';
+		print ' <a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deleteoperation&operationid='.$ruleaction['id'].'&token='.urlencode(newToken()).'">'.img_delete().'</a>';
 		print '</td>';
 		print '</tr>';
 		$i++;
@@ -677,7 +679,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 				print '<div class="inline-block divButAction"><a class="butActionRefused" href="#" title="'.dol_escape_htmltag($langs->trans("NoOperations")).'">'.$langs->trans("CollectNow").'</a></div>';
 			}
 
-			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a></div>';
+			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=delete&token='.urlencode(newToken()).'">'.$langs->trans('Delete').'</a></div>';
 		}
 		print '</div>'."\n";
 	}
diff --git a/htdocs/core/modules/modEmailCollector.class.php b/htdocs/core/modules/modEmailCollector.class.php
index befebc84fea..86bf582edf2 100644
--- a/htdocs/core/modules/modEmailCollector.class.php
+++ b/htdocs/core/modules/modEmailCollector.class.php
@@ -306,23 +306,26 @@ class modEmailCollector extends DolibarrModules
 			}
 		} else dol_print_error($this->db);
 
-		$tmpsql = "SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Answers' and entity = ".$conf->entity;
+		$tmpsql = "SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_Out' and entity = ".$conf->entity;
 		$tmpresql = $this->db->query($tmpsql);
 		if ($tmpresql) {
 			if ($this->db->num_rows($tmpresql) == 0) {
-				$descriptionA1 = 'This collector will scan your mailbox "Sent" directory to find emails that was sent as an answer of a Ticket (Module Ticket must be enabled) directly from your email browser instead of from Dolibarr. If such an email is found, the event of answer is recorded into Dolibarr.';
+				$descriptionA1 = 'This collector will scan your mailbox "Sent" directory to find emails that was sent as an answer of another email directly from your email software and not from Dolibarr. If such an email is found, the event of answer is recorded into Dolibarr.';
 
 				$sqlforexampleA1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollector (entity, ref, label, description, source_directory, date_creation, fk_user_creat, status)";
-				$sqlforexampleA1 .= " VALUES (".$conf->entity.", 'Collect_Ticket_Answers', 'Example to collect answers to tickets', '".$this->db->escape($descriptionA1)."', 'Sent', '".$this->db->idate(dol_now())."', ".$user->id.", 0)";
-				/*
-				 $sqlforexampleA2 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
-				 $sqlforexampleA2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Requets' and entity = ".$conf->entity."), 'withouttrackingid', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
-				 $sqlforexampleA3 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, rulevalue, date_creation, fk_user_creat, status)";
-				 $sqlforexampleA3 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Requets' and entity = ".$conf->entity."), 'to', 'support@example.com', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
-				 $sqlforexampleA4 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectoraction (fk_emailcollector, type, date_creation, fk_user_creat, status)";
-				 $sqlforexampleA4 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Ticket_Requets' and entity = ".$conf->entity."), 'ticket', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
-				 */
+				$sqlforexampleA1 .= " VALUES (".$conf->entity.", 'Collect_Responses_Out', 'Example to collect answers to emails done from email software', '".$this->db->escape($descriptionA1)."', 'Sent', '".$this->db->idate(dol_now())."', ".$user->id.", 0)";
+
+				$sqlforexampleFilterA1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
+				$sqlforexampleFilterA1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_Out' and entity = ".$conf->entity."), 'isanswer', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+				$sqlforexampleFilterA2 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectorfilter (fk_emailcollector, type, date_creation, fk_user_creat, status)";
+				$sqlforexampleFilterA2 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_Out' and entity = ".$conf->entity."), 'withouttrackingidinmsgid', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+				$sqlforexampleActionA1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollectoraction (fk_emailcollector, type, date_creation, fk_user_creat, status)";
+				$sqlforexampleActionA1 .= " VALUES ((SELECT rowid FROM ".MAIN_DB_PREFIX."emailcollector_emailcollector WHERE ref = 'Collect_Responses_Out' and entity = ".$conf->entity."), 'recordevent', '".$this->db->idate(dol_now())."', ".$user->id.", 1)";
+
 				$sql[] = $sqlforexampleA1;
+				$sql[] = $sqlforexampleFilterA1;
+				$sql[] = $sqlforexampleFilterA2;
+				$sql[] = $sqlforexampleActionA1;
 			}
 		}
 
@@ -330,7 +333,7 @@ class modEmailCollector extends DolibarrModules
 		$tmpresql = $this->db->query($tmpsql);
 		if ($tmpresql) {
 			if ($this->db->num_rows($tmpresql) == 0) {
-				$descriptionB1 = 'This collector will scan your mailbox to find all emails that are an answer of an email sent from your application. An event with the email response will be recorded at the good place (Module Agenda must be enabled). For example, if your send a commercial proposal, order or invoice by email and your customer answers your email, the system will automatically find the answer and add it into your ERP.';
+				$descriptionB1 = 'This collector will scan your mailbox to find all emails that are an answer of an email sent from your application. An event (Module Agenda must be enabled) with the email response will be recorded at the good place. For example, if your send a commercial proposal, order, invoice or message for a ticket by email from the application, and your customer answers your email, the system will automatically find the answer and add it into your ERP.';
 
 				$sqlforexampleB1 = "INSERT INTO ".MAIN_DB_PREFIX."emailcollector_emailcollector (entity, ref, label, description, source_directory, date_creation, fk_user_creat, status)";
 				$sqlforexampleB1 .= " VALUES (".$conf->entity.", 'Collect_Responses_In', 'Example to collect any input email responses', '".$this->db->escape($descriptionB1)."', 'INBOX', '".$this->db->idate(dol_now())."', ".$user->id.", 0)";
diff --git a/htdocs/emailcollector/class/emailcollector.class.php b/htdocs/emailcollector/class/emailcollector.class.php
index b070b69b4c9..943b7c73fb3 100644
--- a/htdocs/emailcollector/class/emailcollector.class.php
+++ b/htdocs/emailcollector/class/emailcollector.class.php
@@ -1006,6 +1006,8 @@ class EmailCollector extends CommonObject
 			if ($rule['type'] == 'smaller') $search .= ($search ? ' ' : '').'SMALLER "'.str_replace('"', '', $rule['rulevalue']).'"';
 			if ($rule['type'] == 'larger')  $search .= ($search ? ' ' : '').'LARGER "'.str_replace('"', '', $rule['rulevalue']).'"';
 
+			if ($rule['type'] == 'withtrackingidinmsgid') { $searchfilterdoltrackid++; $searchhead .= '/Message-ID.*@'.preg_quote($host, '/').'/'; }
+			if ($rule['type'] == 'withouttrackingidinmsgid') { $searchfilterdoltrackid++; $searchhead .= '/Message-ID.*@'.preg_quote($host, '/').'/'; }
 			if ($rule['type'] == 'withtrackingid') { $searchfilterdoltrackid++; $searchhead .= '/References.*@'.preg_quote($host, '/').'/'; }
 			if ($rule['type'] == 'withouttrackingid') { $searchfilternodoltrackid++; $searchhead .= '! /References.*@'.preg_quote($host, '/').'/'; }
 
diff --git a/htdocs/emailcollector/class/emailcollectorfilter.class.php b/htdocs/emailcollector/class/emailcollectorfilter.class.php
index 40c8a91d235..cb8db05fa34 100644
--- a/htdocs/emailcollector/class/emailcollectorfilter.class.php
+++ b/htdocs/emailcollector/class/emailcollectorfilter.class.php
@@ -165,7 +165,7 @@ class EmailCollectorFilter extends CommonObject
 			$this->errors[] = $langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("Type"));
 			return -1;
 		}
-		if (!in_array($this->type, array('seen', 'unseen', 'unanswered', 'answered', 'withtrackingid', 'withouttrackingid', 'isanswer', 'isnotanswer')) && empty($this->rulevalue))
+		if (!in_array($this->type, array('seen', 'unseen', 'unanswered', 'answered', 'withtrackingidinmsgid', 'withouttrackingidinmsgid', 'withtrackingid', 'withouttrackingid', 'isanswer', 'isnotanswer')) && empty($this->rulevalue))
 		{
 			$langs->load("errors");
 			$this->errors[] = $langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("SearchString"));
diff --git a/htdocs/langs/en_US/admin.lang b/htdocs/langs/en_US/admin.lang
index 1498639d731..63ce07f7d79 100644
--- a/htdocs/langs/en_US/admin.lang
+++ b/htdocs/langs/en_US/admin.lang
@@ -1988,6 +1988,8 @@ LoadThirdPartyFromName=Load third party searching on %s (load only)
 LoadThirdPartyFromNameOrCreate=Load third party searching on %s (create if not found)
 WithDolTrackingID=Message from a conversation initiated by a first email sent from Dolibarr
 WithoutDolTrackingID=Message from a conversation initiated by a first email NOT sent from Dolibarr
+WithDolTrackingIDInMsgId=Message sent from Dolibarr
+WithoutDolTrackingIDInMsgId=Message NOT sent from Dolibarr
 CreateCandidature=Create candidature
 FormatZip=Zip
 MainMenuCode=Menu entry code (mainmenu)
@@ -2030,7 +2032,7 @@ ImportSetup=Setup of module Import
 InstanceUniqueID=Unique ID of the instance
 SmallerThan=Smaller than
 LargerThan=Larger than
-IfTrackingIDFoundEventWillBeLinked=Note that If a tracking ID of an object is found into incoming email, or if the email is an answer of an email aready collected and linked to an object, the event will be automatically linked to the known related object too.
+IfTrackingIDFoundEventWillBeLinked=Note that If a tracking ID of an object is found into email, or if the email is an answer of an email aready collected and linked to an object, the created event will be automatically linked to the known related object.
 WithGMailYouCanCreateADedicatedPassword=With a GMail account, if you enabled the 2 steps validation, it is recommanded to create a dedicated second password for the application instead of using your own account passsword from https://myaccount.google.com/.
 EmailCollectorTargetDir=It may be a desired behaviour to move the email into another tag/directory when it was processed successfully. Just set name of directory here to use this feature (Do NOT use special characters in name). Note that you must also use a read/write login account.
 EmailCollectorLoadThirdPartyHelp=You can use this action to use the email content to find and load an existing thirdparty in your database. The found (or created) thirdparty will be used for following actions that need it. In the parameter field you can use for example 'EXTRACT:BODY:Name:\s([^\s]*)' if you want to extract the name of the thirdparty from a string 'Name: name to find' found into the body. 

From 1ed6312f4b0d83131ac8f74f2f3b41b74a796d3b Mon Sep 17 00:00:00 2001
From: atm-greg <gregory.blemand@atm-consulting.fr>
Date: Tue, 29 Sep 2020 14:08:49 +0200
Subject: [PATCH 046/101] add modification of the notifications

---
 htdocs/comm/action/card.php | 136 +++++++++++++++++++++++++++++-------
 1 file changed, 109 insertions(+), 27 deletions(-)

diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index 07bc0dd481b..94119fbee5c 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -393,7 +393,7 @@ if (empty($reshook) && $action == 'add')
 				$moreparam = '';
 				if ($user->id != $object->userownerid) $moreparam = "filtert=-1"; // We force to remove filter so created record is visible when going back to per user view.
 
-                //Create reminder
+                //Create reminders
                 if ($addreminder == 'on'){
                     $actionCommReminder = new ActionCommReminder($db);
 
@@ -639,9 +639,51 @@ if (empty($reshook) && $action == 'update')
 				$categories = GETPOST('categories', 'array');
 				$object->setCategories($categories);
 
+				$object->loadReminders();
+				if (!empty($object->reminders))
+				{
+					foreach ($object->reminders as $reminder)
+					{
+						$reminder->delete($user);
+					}
+					$object->reminders = array();
+				}
+
+				//Create reminders
+				if ($addreminder == 'on'){
+					$actionCommReminder = new ActionCommReminder($db);
+
+					$dateremind = dol_time_plus_duree($datep, -$offsetvalue, $offsetunit);
+
+					$actionCommReminder->dateremind = $dateremind;
+					$actionCommReminder->typeremind = $remindertype;
+					$actionCommReminder->offsetunit = $offsetunit;
+					$actionCommReminder->offsetvalue = $offsetvalue;
+					$actionCommReminder->status = $actionCommReminder::STATUS_TODO;
+					$actionCommReminder->fk_actioncomm = $object->id;
+					if ($remindertype == 'email') $actionCommReminder->fk_email_template = $modelmail;
+
+					// the notification must be created for every user assigned to the event
+					foreach ($object->userassigned as $userassigned)
+					{
+						$actionCommReminder->fk_user = $userassigned['id'];
+						$res = $actionCommReminder->create($user);
+
+						if ($res <= 0){
+							// If error
+							$langs->load("errors");
+							$error = $langs->trans('ErrorReminderActionCommCreation');
+							setEventMessages($error, null, 'errors');
+							$action = 'create'; $donotclearsession = 1;
+							break;
+						}
+					}
+				}
+
 				unset($_SESSION['assignedtouser']);
 
-				$db->commit();
+				if (!$error) $db->commit();
+				else $db->rollback();
 			} else {
 				setEventMessages($object->error, $object->errors, 'errors');
 				$db->rollback();
@@ -1673,38 +1715,78 @@ if ($id > 0)
 
 			print '<hr>';
 
-			print '<table class="border tableforfield centpercent">';
-
-			print '<tr><td class="titlefieldcreate nowrap">'.$langs->trans("Reminders").'</td><td>';
-
 			if (count($object->reminders) > 0) {
-				if (count($object->reminders) > 0) {
-					$tmpuserstatic = new User($db);
+				$checked = 'checked';
+				$keys = array_keys($object->reminders);
+				$firstreminderId = array_shift($keys);
 
-					foreach ($object->reminders as $actioncommreminderid => $actioncommreminder) {
-						print $TRemindTypes[$actioncommreminder->typeremind];
-						if ($actioncommreminder->fk_user > 0) {
-							$tmpuserstatic->fetch($actioncommreminder->fk_user);
-							print ' ('.$tmpuserstatic->getNomUrl(0, '', 0, 0, 16).')';
-						}
-						print ' - '.$actioncommreminder->offsetvalue.' '.$TDurationTypes[$actioncommreminder->offsetunit];
-						if ($actioncommreminder->status == $actioncommreminder::STATUS_TODO) {
-							print ' - <span class="opacitymedium">';
-							print $langs->trans("NotSent");
-							print ' </span>';
-						} elseif ($actioncommreminder->status == $actioncommreminder::STATUS_DONE) {
-							print ' - <span class="opacitymedium">';
-							print $langs->trans("Done");
-							print ' </span>';
-						}
-						print '<br>';
-					}
-				}
+				$actionCommReminder = $object->reminders[$firstreminderId];
+
+			}
+			else
+			{
+				$checked = '';
+				$actionCommReminder = new ActionCommReminder($db);
+				$actionCommReminder->offsetvalue = 10;
+				$actionCommReminder->offsetunit = 'i';
+				$actionCommReminder->typeremind = 'email';
 			}
 
+			print '<tr><td>'.$langs->trans("AddReminder").'</td><td colspan="3"><input type="checkbox" id="addreminder" name="addreminder" '.$checked.'></td></tr>';
+
+			print '<div class="reminderparameters" '.(empty($checked) ? 'style="display: none;"' : '').'>';
+
+			print '<table class="border centpercent">';
+
+			//Reminder
+			print '<tr><td class="titlefieldcreate nowrap">'.$langs->trans("ReminderTime").'</td><td colspan="3">';
+			print '<input type="number" name="offsetvalue" value="'.$actionCommReminder->offsetvalue.'" size="5">';
+			print '</td></tr>';
+
+			//Time Type
+			print '<tr><td class="titlefieldcreate nowrap">'.$langs->trans("TimeType").'</td><td colspan="3">';
+			print $form->selectTypeDuration('offsetunit', $actionCommReminder->offsetunit);
+			print '</td></tr>';
+
+			//Reminder Type
+			$TRemindTypes = array();
+			if (!empty($conf->global->AGENDA_REMINDER_EMAIL)) $TRemindTypes['email'] = $langs->trans('EMail');
+			if (!empty($conf->global->AGENDA_REMINDER_BROWSER)) $TRemindTypes['browser'] = $langs->trans('BrowserPush');
+			print '<tr><td class="titlefieldcreate nowrap">'.$langs->trans("ReminderType").'</td><td colspan="3">';
+			print $form->selectarray('selectremindertype', $TRemindTypes, $actionCommReminder->typeremind);
+			print '</td></tr>';
+
+			$hide = '';
+			if ($actionCommReminder->typeremind == 'browser') $hide = 'style="display:none;"';
+
+			//Mail Model
+			print '<tr '.$hide.'><td class="titlefieldcreate nowrap">'.$langs->trans("EMailTemplates").'</td><td colspan="3">';
+			print $form->selectModelMail('actioncommsend', 'actioncomm_send', 1);
 			print '</td></tr>';
 
 			print '</table>';
+
+			print "\n".'<script type="text/javascript">';
+			print '$(document).ready(function () {
+	            		$("#addreminder").click(function(){
+	            		    if (this.checked) {
+	            		      $(".reminderparameters").show();
+                            } else {
+                            $(".reminderparameters").hide();
+                            }
+	            		 });
+
+	            		$("#selectremindertype").change(function(){
+	            	        var selected_option = $("#selectremindertype option:selected").val();
+	            		    if(selected_option == "email") {
+	            		        $("#select_actioncommsendmodel_mail").closest("tr").show();
+	            		    } else {
+	            			    $("#select_actioncommsendmodel_mail").closest("tr").hide();
+	            		    };
+	            		});
+
+                   })';
+			print '</script>'."\n";
 		}
 
 		dol_fiche_end();

From a61f79c039e081eced1ad0420a46f7a4799b95d6 Mon Sep 17 00:00:00 2001
From: atm-greg <gregory.blemand@atm-consulting.fr>
Date: Tue, 29 Sep 2020 14:10:24 +0200
Subject: [PATCH 047/101] only update reminders if event is not past

---
 htdocs/comm/action/card.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index 94119fbee5c..3818f459893 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -640,7 +640,7 @@ if (empty($reshook) && $action == 'update')
 				$object->setCategories($categories);
 
 				$object->loadReminders();
-				if (!empty($object->reminders))
+				if (!empty($object->reminders) && $object->datep > dol_now())
 				{
 					foreach ($object->reminders as $reminder)
 					{
@@ -650,7 +650,7 @@ if (empty($reshook) && $action == 'update')
 				}
 
 				//Create reminders
-				if ($addreminder == 'on'){
+				if ($addreminder == 'on' && $object->datep > dol_now()){
 					$actionCommReminder = new ActionCommReminder($db);
 
 					$dateremind = dol_time_plus_duree($datep, -$offsetvalue, $offsetunit);

From c8e11f9eaee88ef504a3ea2fe7a6145de67e0b33 Mon Sep 17 00:00:00 2001
From: "Sekan, Tobias" <tobias.sekan@startmail.com>
Date: Tue, 29 Sep 2020 14:59:16 +0200
Subject: [PATCH 048/101] Use object fileds on contact list

---
 htdocs/contact/class/contact.class.php | 81 ++++++++++++++--------
 htdocs/contact/list.php                | 95 +++++++++++++++-----------
 2 files changed, 106 insertions(+), 70 deletions(-)

diff --git a/htdocs/contact/class/contact.class.php b/htdocs/contact/class/contact.class.php
index 0c2c3bf56ce..289a4a94495 100644
--- a/htdocs/contact/class/contact.class.php
+++ b/htdocs/contact/class/contact.class.php
@@ -60,6 +60,29 @@ class Contact extends CommonObject
 	 */
 	public $picto = 'contact';
 
+	/**
+	 *  'type' if the field format ('integer', 'integer:ObjectClass:PathToClass[:AddCreateButtonOrNot[:Filter]]', 'varchar(x)', 'double(24,8)', 'real', 'price', 'text', 'html', 'date', 'datetime', 'timestamp', 'duration', 'mail', 'phone', 'url', 'password')
+	 *         Note: Filter can be a string like "(t.ref:like:'SO-%') or (t.date_creation:<:'20160101') or (t.nature:is:NULL)"
+	 *  'label' the translation key.
+	 *  'enabled' is a condition when the field must be managed.
+	 *  'position' is the sort order of field.
+	 *  'notnull' is set to 1 if not null in database. Set to -1 if we must set data to null if empty ('' or 0).
+	 *  'visible' says if field is visible in list (Examples: 0=Not visible, 1=Visible on list and create/update/view forms, 2=Visible on list only, 3=Visible on create/update/view form only (not list), 4=Visible on list and update/view form only (not create). 5=Visible on list and view only (not create/not update). Using a negative value means field is not shown by default on list but can be selected for viewing)
+	 *  'noteditable' says if field is not editable (1 or 0)
+	 *  'default' is a default value for creation (can still be overwrote by the Setup of Default Values if field is editable in creation form). Note: If default is set to '(PROV)' and field is 'ref', the default value will be set to '(PROVid)' where id is rowid when a new record is created.
+	 *  'index' if we want an index in database.
+	 *  'foreignkey'=>'tablename.field' if the field is a foreign key (it is recommanded to name the field fk_...).
+	 *  'searchall' is 1 if we want to search in this field when making a search from the quick search button.
+	 *  'isameasure' must be set to 1 if you want to have a total on list for this field. Field type must be summable like integer or double(24,8).
+	 *  'css' is the CSS style to use on field. For example: 'maxwidth200'
+	 *  'help' is a string visible as a tooltip on field
+	 *  'showoncombobox' if value of the field must be visible into the label of the combobox that list record
+	 *  'disabled' is 1 if we want to have the field locked by a 'disabled' attribute. In most cases, this is never set into the definition of $fields into class, but is set dynamically by some part of code.
+	 *  'arraykeyval' to set list of value if type is a list of predefined values. For example: array("0"=>"Draft","1"=>"Active","-1"=>"Cancel")
+	 *  'comment' is not used. You can store here any text of your choice. It is not used by application.
+	 *
+	 *  Note: To have value dynamic, you can set value to 0 in definition and edit the value on the fly into the constructor.
+	 */
 
 	// BEGIN MODULEBUILDER PROPERTIES
 	/**
@@ -67,40 +90,38 @@ class Contact extends CommonObject
 	 */
 	public $fields = array(
 		'rowid' =>array('type'=>'integer', 'label'=>'TechnicalID', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>10),
-		'datec' =>array('type'=>'datetime', 'label'=>'DateCreation', 'enabled'=>1, 'visible'=>-1, 'position'=>15),
-		'tms' =>array('type'=>'timestamp', 'label'=>'DateModification', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>20),
-		'fk_soc' =>array('type'=>'integer', 'label'=>'ThirdParty', 'enabled'=>1, 'visible'=>-1, 'position'=>25),
+		'datec' =>array('type'=>'datetime', 'label'=>'DateCreation', 'enabled'=>1, 'visible'=>0, 'position'=>15),
+		'tms' =>array('type'=>'timestamp', 'label'=>'DateModification', 'enabled'=>1, 'visible'=>0, 'notnull'=>1, 'position'=>20),
+		'fk_soc' =>array('type'=>'integer', 'label'=>'ThirdParty', 'enabled'=>1, 'visible'=>-1, 'position'=>25, 'searchall'=>1),
 		'entity' =>array('type'=>'integer', 'label'=>'Entity', 'default'=>1, 'enabled'=>1, 'visible'=>0, 'notnull'=>1, 'position'=>30, 'index'=>1),
 		'ref_ext' =>array('type'=>'varchar(255)', 'label'=>'Ref ext', 'enabled'=>1, 'visible'=>0, 'position'=>35),
-		'civility' =>array('type'=>'varchar(6)', 'label'=>'Civility', 'enabled'=>1, 'visible'=>-1, 'position'=>40),
-		'lastname' =>array('type'=>'varchar(50)', 'label'=>'Lastname', 'enabled'=>1, 'visible'=>-1, 'position'=>45, 'showoncombobox'=>1),
-		'firstname' =>array('type'=>'varchar(50)', 'label'=>'Firstname', 'enabled'=>1, 'visible'=>-1, 'position'=>50, 'showoncombobox'=>1),
-		'address' =>array('type'=>'varchar(255)', 'label'=>'Address', 'enabled'=>1, 'visible'=>-1, 'position'=>55),
-		'zip' =>array('type'=>'varchar(25)', 'label'=>'Zip', 'enabled'=>1, 'visible'=>-1, 'position'=>60),
-		'town' =>array('type'=>'text', 'label'=>'Town', 'enabled'=>1, 'visible'=>-1, 'position'=>65),
-		'fk_departement' =>array('type'=>'integer', 'label'=>'Fk departement', 'enabled'=>1, 'visible'=>-1, 'position'=>70),
-		'fk_pays' =>array('type'=>'integer', 'label'=>'Fk pays', 'enabled'=>1, 'visible'=>-1, 'position'=>75),
+		'civility' =>array('type'=>'varchar(6)', 'label'=>'Civility', 'enabled'=>1, 'visible'=>3, 'position'=>40),
+		'lastname' =>array('type'=>'varchar(50)', 'label'=>'Lastname', 'enabled'=>1, 'visible'=>1, 'position'=>45, 'showoncombobox'=>1, 'searchall'=>1),
+		'firstname' =>array('type'=>'varchar(50)', 'label'=>'Firstname', 'enabled'=>1, 'visible'=>1, 'position'=>50, 'showoncombobox'=>1, 'searchall'=>1),
+		'address' =>array('type'=>'varchar(255)', 'label'=>'Address', 'enabled'=>1, 'visible'=>3, 'position'=>55),
+		'zip' =>array('type'=>'varchar(25)', 'label'=>'Zip', 'enabled'=>1, 'visible'=>1, 'position'=>60),
+		'town' =>array('type'=>'text', 'label'=>'Town', 'enabled'=>1, 'visible'=>1, 'position'=>65),
+		'fk_departement' =>array('type'=>'integer', 'label'=>'Fk departement', 'enabled'=>1, 'visible'=>0, 'position'=>70),
+		'fk_pays' =>array('type'=>'integer', 'label'=>'Fk pays', 'enabled'=>1, 'visible'=>0, 'position'=>75),
 		'birthday' =>array('type'=>'date', 'label'=>'Birthday', 'enabled'=>1, 'visible'=>-1, 'position'=>80),
 		'poste' =>array('type'=>'varchar(80)', 'label'=>'PostOrFunction', 'enabled'=>1, 'visible'=>-1, 'position'=>85),
-		'phone' =>array('type'=>'varchar(30)', 'label'=>'Phone', 'enabled'=>1, 'visible'=>-1, 'position'=>90),
-		'phone_perso' =>array('type'=>'varchar(30)', 'label'=>'Phone perso', 'enabled'=>1, 'visible'=>-1, 'position'=>95),
-		'phone_mobile' =>array('type'=>'varchar(30)', 'label'=>'Phone mobile', 'enabled'=>1, 'visible'=>-1, 'position'=>100),
-		'fax' =>array('type'=>'varchar(30)', 'label'=>'Fax', 'enabled'=>1, 'visible'=>-1, 'position'=>105),
-		'email' =>array('type'=>'varchar(255)', 'label'=>'Email', 'enabled'=>1, 'visible'=>-1, 'position'=>110),
-		'socialnetworks' =>array('type'=>'text', 'label'=>'SocialNetworks', 'enabled'=>1, 'visible'=>-1, 'position'=>115),
-		'photo' =>array('type'=>'varchar(255)', 'label'=>'Photo', 'enabled'=>1, 'visible'=>-1, 'position'=>170),
-		'priv' =>array('type'=>'smallint(6)', 'label'=>'Private', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>175),
-		'fk_stcomm' =>array('type'=>'integer', 'label'=>'Fk stcommcontact', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>220),
-		'fk_prospectlevel' =>array('type'=>'varchar(12)', 'label'=>'ProspectLevel', 'enabled'=>1, 'visible'=>-1, 'position'=>255),
-		'no_email' =>array('type'=>'smallint(6)', 'label'=>'No email', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>180),
-		'fk_user_creat' =>array('type'=>'integer', 'label'=>'UserAuthor', 'enabled'=>1, 'visible'=>-1, 'position'=>185),
-		'fk_user_modif' =>array('type'=>'integer', 'label'=>'UserModif', 'enabled'=>1, 'visible'=>-1, 'position'=>190),
-		'note_private' =>array('type'=>'text', 'label'=>'NotePrivate', 'enabled'=>1, 'visible'=>0, 'position'=>195),
-		'note_public' =>array('type'=>'text', 'label'=>'NotePublic', 'enabled'=>1, 'visible'=>0, 'position'=>200),
-		'default_lang' =>array('type'=>'varchar(6)', 'label'=>'Default lang', 'enabled'=>1, 'visible'=>-1, 'position'=>205),
-		'canvas' =>array('type'=>'varchar(32)', 'label'=>'Canvas', 'enabled'=>1, 'visible'=>-1, 'position'=>210),
-		'statut' =>array('type'=>'tinyint(4)', 'label'=>'Statut', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>500),
-		'import_key' =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>-2, 'position'=>1000),
+		'phone' =>array('type'=>'varchar(30)', 'label'=>'Phone', 'enabled'=>1, 'visible'=>1, 'position'=>90, 'searchall'=>1),
+		'phone_perso' =>array('type'=>'varchar(30)', 'label'=>'PhonePerso', 'enabled'=>1, 'visible'=>1, 'position'=>95, 'searchall'=>1),
+		'phone_mobile' =>array('type'=>'varchar(30)', 'label'=>'PhoneMobile', 'enabled'=>1, 'visible'=>1, 'position'=>100, 'searchall'=>1),
+		'fax' =>array('type'=>'varchar(30)', 'label'=>'Fax', 'enabled'=>1, 'visible'=>1, 'position'=>105, 'searchall'=>1),
+		'email' =>array('type'=>'varchar(255)', 'label'=>'Email', 'enabled'=>1, 'visible'=>1, 'position'=>110, 'searchall'=>1),
+		'socialnetworks' =>array('type'=>'text', 'label'=>'SocialNetworks', 'enabled'=>1, 'visible'=>3, 'position'=>115),
+		'photo' =>array('type'=>'varchar(255)', 'label'=>'Photo', 'enabled'=>1, 'visible'=>3, 'position'=>170),
+		'priv' =>array('type'=>'smallint(6)', 'label'=>'ContactVisibility', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>175),
+		'no_email' =>array('type'=>'smallint(6)', 'label'=>'No_Email', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>180),
+		'fk_user_creat' =>array('type'=>'integer', 'label'=>'UserAuthor', 'enabled'=>1, 'visible'=>0, 'position'=>185),
+		'fk_user_modif' =>array('type'=>'integer', 'label'=>'UserModif', 'enabled'=>1, 'visible'=>0, 'position'=>190),
+		'note_private' =>array('type'=>'text', 'label'=>'NotePrivate', 'enabled'=>1, 'visible'=>0, 'position'=>195, 'searchall'=>1),
+		'note_public' =>array('type'=>'text', 'label'=>'NotePublic', 'enabled'=>1, 'visible'=>0, 'position'=>200, 'searchall'=>1),
+		'default_lang' =>array('type'=>'varchar(6)', 'label'=>'Default lang', 'enabled'=>1, 'visible'=>0, 'position'=>205),
+		'canvas' =>array('type'=>'varchar(32)', 'label'=>'Canvas', 'enabled'=>1, 'visible'=>0, 'position'=>210),
+		'statut' =>array('type'=>'tinyint(4)', 'label'=>'Status', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>500),
+		'import_key' =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>0, 'position'=>1000),
 	);
 
 	public $civility_id; // In fact we store civility_code
diff --git a/htdocs/contact/list.php b/htdocs/contact/list.php
index 1332bc5e100..e8493e59ba3 100644
--- a/htdocs/contact/list.php
+++ b/htdocs/contact/list.php
@@ -149,46 +149,60 @@ $extrafields->fetch_name_optionals_label($object->table_element);
 $search_array_options = $extrafields->getOptionalsFromPost($object->table_element, '', 'search_');
 
 // List of fields to search into when doing a "search in all"
-$fieldstosearchall = array(
-	'p.lastname'=>'Lastname',
-	'p.firstname'=>'Firstname',
-	'p.email'=>'EMail',
-	's.nom'=>"ThirdParty",
-	'p.phone'=>"Phone",
-	'p.phone_perso'=>"PhonePerso",
-	'p.phone_mobile'=>"PhoneMobile",
-	'p.fax'=>"Fax",
-	'p.note_public'=>"NotePublic",
-	'p.note_private'=>"NotePrivate",
-);
+$fieldstosearchall = array();
+foreach ($object->fields as $key => $val)
+{
+	// don't allow search in private notes for external users when doing "search in all"
+	if (!empty($user->socid) && $key == "note_private") {
+		continue;
+	}
+
+	if (empty($val['searchall'])) {
+		continue;
+	}
+
+	$fieldstosearchall['p.'.$key] = $val['label'];
+}
+
+// Add none object fields for "search in all"
+if (empty($conf->global->SOCIETE_DISABLE_CONTACTS))	{
+	$fieldstosearchall['s.nom'] = $fieldstosearchall['p.fk_soc'];
+	unset($fieldstosearchall['p.fk_soc']);
+}
 
 // Definition of fields for list
-$arrayfields = array(
-	'p.rowid'=>array('label'=>"TechnicalID", 'position'=>1, 'checked'=>($conf->global->MAIN_SHOW_TECHNICAL_ID ? 1 : 0), 'enabled'=>($conf->global->MAIN_SHOW_TECHNICAL_ID ? 1 : 0)),
-	'p.lastname'=>array('label'=>"Lastname", 'position'=>2, 'checked'=>1),
-	'p.firstname'=>array('label'=>"Firstname", 'position'=>3, 'checked'=>1),
-	'p.poste'=>array('label'=>"PostOrFunction", 'position'=>10, 'checked'=>1),
-	'p.town'=>array('label'=>"Town", 'position'=>20, 'checked'=>0),
-	'p.zip'=>array('label'=>"Zip", 'position'=>21, 'checked'=>0),
-	'country.code_iso'=>array('label'=>"Country", 'position'=>22, 'checked'=>0),
-	'p.phone'=>array('label'=>"Phone", 'position'=>30, 'checked'=>1),
-	'p.phone_perso'=>array('label'=>"PhonePerso", 'position'=>31, 'checked'=>0),
-	'p.phone_mobile'=>array('label'=>"PhoneMobile", 'position'=>32, 'checked'=>1),
-	'p.fax'=>array('label'=>"Fax", 'position'=>33, 'checked'=>0),
-	'p.email'=>array('label'=>"EMail", 'position'=>40, 'checked'=>1),
-	'p.no_email'=>array('label'=>"No_Email", 'position'=>41, 'checked'=>0, 'enabled'=>(!empty($conf->mailing->enabled))),
-	'p.thirdparty'=>array('label'=>"ThirdParty", 'position'=>50, 'checked'=>1, 'enabled'=>empty($conf->global->SOCIETE_DISABLE_CONTACTS)),
-	'p.priv'=>array('label'=>"ContactVisibility", 'checked'=>1, 'position'=>200),
-	'p.datec'=>array('label'=>"DateCreationShort", 'checked'=>0, 'position'=>500),
-	'p.tms'=>array('label'=>"DateModificationShort", 'checked'=>0, 'position'=>500),
-	'p.statut'=>array('label'=>"Status", 'checked'=>1, 'position'=>1000),
-	'p.import_key'=>array('label'=>"ImportId", 'checked'=>0, 'position'=>1100),
-);
+$arrayfields = array();
+foreach ($object->fields as $key => $val) {
+	// If $val['visible']==0, then we never show the field
+	if (empty($val['visible'])) {
+		continue;
+	}
+
+	// Visibility based on global settings
+	if ($key == 'rowid' && !empty($conf->global->MAIN_SHOW_TECHNICAL_ID)) continue;
+	if ($key == 'no_email' && empty($conf->mailing->enabled)) continue;
+	
+	$arrayfields['p.'.$key] = array(
+		'label'=>$val['label'],
+		'checked'=>(($val['visible'] < 0) ? 0 : 1),
+		'enabled'=>($val['enabled'] && ($val['visible'] != 3)),
+		'position'=>$val['position']);
+}
+
+// Add none object fields to fields for list
+$arrayfields['country.code_iso'] = array('label'=>"Country", 'position'=>22, 'checked'=>0);
+if (empty($conf->global->SOCIETE_DISABLE_CONTACTS))	{
+	$arrayfields['s.nom'] = $arrayfields['p.fk_soc'];
+	unset($arrayfields['p.fk_soc']);
+}
 if (!empty($conf->global->THIRDPARTY_ENABLE_PROSPECTION_ON_ALTERNATIVE_ADRESSES)) {
 	$arrayfields['p.fk_prospectcontactlevel'] = array('label'=>"ProspectLevelShort", 'checked'=>1, 'position'=>210);
 	$arrayfields['p.fk_stcommcontact'] = array('label'=>"StatusProsp", 'checked'=>1, 'position'=>215);
 }
 
+// Special overrides for object files
+$arrayfields['p.rowid']['checked'] = ($conf->global->MAIN_SHOW_TECHNICAL_ID ? 1 : 0);
+
 if (!empty($conf->socialnetworks->enabled)) {
 	foreach ($socialnetworks as $key => $value) {
 		if ($value['active']) {
@@ -398,7 +412,7 @@ if (strlen($search_firstlast_only)) $sql .= natural_search(array('p.lastname', '
 if ($search_id > 0)                 $sql .= natural_search("p.rowid", $search_id, 1);
 if ($search_lastname)               $sql .= natural_search('p.lastname', $search_lastname);
 if ($search_firstname)              $sql .= natural_search('p.firstname', $search_firstname);
-if ($search_societe)                $sql .= natural_search('s.nom', $search_societe);
+if ($search_societe)                $sql .= natural_search((empty($conf->global->SOCIETE_DISABLE_CONTACTS) ? 's.nom' : 'p.fk_soc'), $search_societe);
 if ($search_country)                $sql .= " AND p.fk_pays IN (".$search_country.')';
 if (strlen($search_poste))          $sql .= natural_search('p.poste', $search_poste);
 if (strlen($search_phone_perso))    $sql .= natural_search('p.phone_perso', $search_phone_perso);
@@ -725,7 +739,7 @@ if (!empty($conf->socialnetworks->enabled)) {
 		}
 	}
 }
-if (!empty($arrayfields['p.thirdparty']['checked']))
+if (!empty($arrayfields['p.fk_soc']['checked']) || !empty($arrayfields['s.nom']['checked']))
 {
 	print '<td class="liste_titre">';
 	print '<input class="flat" type="text" name="search_societe" size="8" value="'.dol_escape_htmltag($search_societe).'">';
@@ -823,10 +837,11 @@ if (!empty($conf->socialnetworks->enabled)) {
 		}
 	}
 }
-if (!empty($arrayfields['p.thirdparty']['checked']))          print_liste_field_titre($arrayfields['p.thirdparty']['label'], $_SERVER["PHP_SELF"], "s.nom", $begin, $param, '', $sortfield, $sortorder);
-if (!empty($arrayfields['p.priv']['checked']))                print_liste_field_titre($arrayfields['p.priv']['label'], $_SERVER["PHP_SELF"], "p.priv", $begin, $param, '', $sortfield, $sortorder, 'center ');
-if (!empty($arrayfields['p.fk_prospectcontactlevel']['checked'])) 	print_liste_field_titre($arrayfields['p.fk_prospectcontactlevel']['label'], $_SERVER["PHP_SELF"], "p.fk_prospectcontactlevel", "", $param, '', $sortfield, $sortorder, 'center ');
-if (!empty($arrayfields['p.fk_stcommcontact']['checked'])) 			print_liste_field_titre($arrayfields['p.fk_stcommcontact']['label'], $_SERVER["PHP_SELF"], "p.fk_stcommcontact", "", $param, '', $sortfield, $sortorder, 'center ');
+if (!empty($arrayfields['p.fk_soc']['checked']))					print_liste_field_titre($arrayfields['p.fk_soc']['label'], $_SERVER["PHP_SELF"], "p.fk_soc", $begin, $param, '', $sortfield, $sortorder);
+if (!empty($arrayfields['s.nom']['checked']))						print_liste_field_titre($arrayfields['s.nom']['label'], $_SERVER["PHP_SELF"], "s.nom", $begin, $param, '', $sortfield, $sortorder);
+if (!empty($arrayfields['p.priv']['checked']))						print_liste_field_titre($arrayfields['p.priv']['label'], $_SERVER["PHP_SELF"], "p.priv", $begin, $param, '', $sortfield, $sortorder, 'center ');
+if (!empty($arrayfields['p.fk_prospectcontactlevel']['checked']))	print_liste_field_titre($arrayfields['p.fk_prospectcontactlevel']['label'], $_SERVER["PHP_SELF"], "p.fk_prospectcontactlevel", "", $param, '', $sortfield, $sortorder, 'center ');
+if (!empty($arrayfields['p.fk_stcommcontact']['checked']))			print_liste_field_titre($arrayfields['p.fk_stcommcontact']['label'], $_SERVER["PHP_SELF"], "p.fk_stcommcontact", "", $param, '', $sortfield, $sortorder, 'center ');
 // Extra fields
 include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_title.tpl.php';
 // Hook fields
@@ -987,7 +1002,7 @@ while ($i < min($num, $limit))
 		}
 	}
 	// Company
-	if (!empty($arrayfields['p.thirdparty']['checked']))
+	if (!empty($arrayfields['p.fk_soc']['checked']) || !empty($arrayfields['s.nom']['checked']))
 	{
 		print '<td>';
 		if ($obj->socid)

From ce8d240d8f871edaa41651d5796043fea73bed7e Mon Sep 17 00:00:00 2001
From: stickler-ci <support@stickler-ci.com>
Date: Tue, 29 Sep 2020 13:06:23 +0000
Subject: [PATCH 049/101] Fixing style errors.

---
 htdocs/contact/list.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/contact/list.php b/htdocs/contact/list.php
index e8493e59ba3..af2fc2f7269 100644
--- a/htdocs/contact/list.php
+++ b/htdocs/contact/list.php
@@ -181,7 +181,7 @@ foreach ($object->fields as $key => $val) {
 	// Visibility based on global settings
 	if ($key == 'rowid' && !empty($conf->global->MAIN_SHOW_TECHNICAL_ID)) continue;
 	if ($key == 'no_email' && empty($conf->mailing->enabled)) continue;
-	
+
 	$arrayfields['p.'.$key] = array(
 		'label'=>$val['label'],
 		'checked'=>(($val['visible'] < 0) ? 0 : 1),

From babcc3bc910229b2eff852d9a4f06c5377c522f1 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Tue, 29 Sep 2020 16:39:47 +0200
Subject: [PATCH 050/101] Update line.php

---
 htdocs/compta/bank/line.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/compta/bank/line.php b/htdocs/compta/bank/line.php
index 7548b65bb1c..4e2998792d8 100644
--- a/htdocs/compta/bank/line.php
+++ b/htdocs/compta/bank/line.php
@@ -288,7 +288,7 @@ if ($result)
         print '<input type="hidden" name="orig_account" value="'.$orig_account.'">';
         print '<input type="hidden" name="id" value="'.$acct->id.'">';
 
-        dol_fiche_head($head, 'bankline', $langs->trans('LineRecord'), 0, 'account', 0);
+        dol_fiche_head($head, 'bankline', $langs->trans('LineRecord'), 0, 'accountline', 0);
 
         $linkback = '<a href="'.DOL_URL_ROOT.'/compta/bank/bankentries_list.php?restore_lastsearch_values=1">'.$langs->trans("BackToList").'</a>';
 

From ac897b5b4d62750f94e8d2e8ff518789fb0b1092 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Tue, 29 Sep 2020 17:06:08 +0200
Subject: [PATCH 051/101] Fix css

---
 htdocs/takepos/css/pos.css.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/htdocs/takepos/css/pos.css.php b/htdocs/takepos/css/pos.css.php
index 503ae0123f9..973bbabba2d 100644
--- a/htdocs/takepos/css/pos.css.php
+++ b/htdocs/takepos/css/pos.css.php
@@ -716,7 +716,8 @@ div#moreinfo, div#infowarehouse {
   width: 40%;
   box-shadow: 0 4px 8px 0 rgba(0,0,0,0.2),0 6px 20px 0 rgba(0,0,0,0.19);
   animation-name: animatetop;
-  animation-duration: 0.4s
+  animation-duration: 0.4s;
+  min-width: 200px;
 }
 
 @keyframes animatetop {

From 9ed6092ed8379eb1deff429cbc840b888dd1a592 Mon Sep 17 00:00:00 2001
From: bomuux <bomuux@gmail.com>
Date: Tue, 29 Sep 2020 19:56:22 +0200
Subject: [PATCH 052/101] Bug: ActionComm::ref_ext is not saved properly

ActionComm::ref_ext is considered to be a timestamp in ActionComm::create(), (but not in ActionComm::create()).
Correction to consider it a string.
---
 htdocs/comm/action/class/actioncomm.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php
index c6fd2183459..97896448a3f 100644
--- a/htdocs/comm/action/class/actioncomm.class.php
+++ b/htdocs/comm/action/class/actioncomm.class.php
@@ -495,7 +495,7 @@ class ActionComm extends CommonObject
 		$sql .= ((isset($this->durationp) && $this->durationp >= 0 && $this->durationp != '') ? "'".$this->db->escape($this->durationp)."'" : "null").", "; // deprecated
 		$sql .= (isset($this->type_id) ? $this->type_id : "null").",";
 		$sql .= ($code ? ("'".$this->db->escape($code)."'") : "null").", ";
-		$sql .= ($this->ref_ext ? ("'".$this->db->idate($this->ref_ext)."'") : "null").", ";
+		$sql .= (!empty($this->ref_ext) ? "'".$this->db->escape($this->ref_ext)."'" : "null").", ";
 		$sql .= ((isset($this->socid) && $this->socid > 0) ? $this->socid : "null").", ";
 		$sql .= ((isset($this->fk_project) && $this->fk_project > 0) ? $this->fk_project : "null").", ";
 		$sql .= " '".$this->db->escape($this->note_private)."', ";

From 82da38df65e53f0a9834f697c6c598ca66812901 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Tue, 29 Sep 2020 19:57:10 +0200
Subject: [PATCH 053/101] Removed dead code

---
 htdocs/admin/pdf.php | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/htdocs/admin/pdf.php b/htdocs/admin/pdf.php
index 95487fc0bc3..363edca6c80 100644
--- a/htdocs/admin/pdf.php
+++ b/htdocs/admin/pdf.php
@@ -89,18 +89,6 @@ if ($action == 'update')
 	exit;
 }
 
-if ($action == 'activate_pdfsecurity')
-{
-	dolibarr_set_const($db, "PDF_SECURITY_ENCRYPTION", "1", 'chaine', 0, '', $conf->entity);
-	header("Location: ".$_SERVER["PHP_SELF"]."?mainmenu=home&leftmenu=setup");
-	exit;
-} elseif ($action == 'disable_pdfsecurity')
-{
-	dolibarr_del_const($db, "PDF_SECURITY_ENCRYPTION", $conf->entity);
-	header("Location: ".$_SERVER["PHP_SELF"]."?mainmenu=home&leftmenu=setup");
-	exit;
-}
-
 
 
 /*

From 879d0413985bd48704f7b1ff4f21e23cd0d1e3e0 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Tue, 29 Sep 2020 20:48:40 +0200
Subject: [PATCH 054/101] Can force the typeof check of GETPOST into $fields
 for type text.

---
 htdocs/core/actions_addupdatedelete.inc.php        |  9 +++++++--
 htdocs/core/class/commonobject.class.php           |  6 +++---
 htdocs/core/tpl/commonfields_edit.tpl.php          | 14 +++++++++++---
 .../template/class/myobject.class.php              |  2 +-
 4 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/htdocs/core/actions_addupdatedelete.inc.php b/htdocs/core/actions_addupdatedelete.inc.php
index 4d4c12ce473..cee75415eee 100644
--- a/htdocs/core/actions_addupdatedelete.inc.php
+++ b/htdocs/core/actions_addupdatedelete.inc.php
@@ -141,8 +141,13 @@ if ($action == 'update' && !empty($permissiontoadd))
 		if (in_array($key, array('rowid', 'entity', 'date_creation', 'tms', 'fk_user_creat', 'fk_user_modif', 'import_key'))) continue;
 
 		// Set value to update
-		if (in_array($object->fields[$key]['type'], array('text', 'html'))) {
-			$value = GETPOST($key, 'restricthtml');
+		if (preg_match('/^(text|html)/', $object->fields[$key]['type'])) {
+			$tmparray = explode(':', $object->fields[$key]['type']);
+			if (!empty($tmparray[1])) {
+				$value = GETPOST($key, $tmparray[1]);
+			} else {
+				$value = GETPOST($key, 'restricthtml');
+			}
 		} elseif ($object->fields[$key]['type'] == 'date') {
 			$value = dol_mktime(12, 0, 0, GETPOST($key.'month'), GETPOST($key.'day'), GETPOST($key.'year'));
 		} elseif ($object->fields[$key]['type'] == 'datetime') {
diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php
index 384c778d602..46567edf369 100644
--- a/htdocs/core/class/commonobject.class.php
+++ b/htdocs/core/class/commonobject.class.php
@@ -5800,7 +5800,7 @@ abstract class CommonObject
 		} elseif (in_array($type, array('mail', 'phone', 'url')))
 		{
 			$out = '<input type="text" class="flat '.$morecss.'" name="'.$keyprefix.$key.$keysuffix.'" id="'.$keyprefix.$key.$keysuffix.'" value="'.dol_escape_htmltag($value).'" '.($moreparam ? $moreparam : '').($autofocusoncreate ? ' autofocus' : '').'>';
-		} elseif ($type == 'text')
+		} elseif (preg_match('/^text/', $type))
 		{
 			if (!preg_match('/search_/', $keyprefix))		// If keyprefix is search_ or search_options_, we must just use a simple text field
 			{
@@ -5810,7 +5810,7 @@ abstract class CommonObject
 			} else {
 				$out = '<input type="text" class="flat '.$morecss.' maxwidthonsmartphone" name="'.$keyprefix.$key.$keysuffix.'" id="'.$keyprefix.$key.$keysuffix.'" value="'.dol_escape_htmltag($value).'" '.($moreparam ? $moreparam : '').'>';
 			}
-		} elseif ($type == 'html')
+		} elseif (preg_match('/^html/', $type))
 		{
 			if (!preg_match('/search_/', $keyprefix))		// If keyprefix is search_ or search_options_, we must just use a simple text field
 			{
@@ -6584,7 +6584,7 @@ abstract class CommonObject
 					return 'Error bad setup of extrafield';
 				}
 			} else $value = '';
-		} elseif ($type == 'text' || $type == 'html')
+		} elseif (preg_match('/^(text|html)/', $type))
 		{
 			$value = dol_htmlentitiesbr($value);
 		} elseif ($type == 'password')
diff --git a/htdocs/core/tpl/commonfields_edit.tpl.php b/htdocs/core/tpl/commonfields_edit.tpl.php
index ace640d9b79..ad1a3bd2330 100644
--- a/htdocs/core/tpl/commonfields_edit.tpl.php
+++ b/htdocs/core/tpl/commonfields_edit.tpl.php
@@ -45,15 +45,23 @@ foreach ($object->fields as $key => $val)
 	print '<tr><td';
 	print ' class="titlefieldcreate';
 	if ($val['notnull'] > 0) print ' fieldrequired';
-	if ($val['type'] == 'text' || $val['type'] == 'html') print ' tdtop';
+	if (preg_match('/^(text|html)/', $val['type'])) print ' tdtop';
 	print '">';
 	if (!empty($val['help'])) print $form->textwithpicto($langs->trans($val['label']), $langs->trans($val['help']));
 	else print $langs->trans($val['label']);
 	print '</td>';
 	print '<td>';
 	if (in_array($val['type'], array('int', 'integer'))) $value = GETPOSTISSET($key) ?GETPOST($key, 'int') : $object->$key;
-	elseif ($val['type'] == 'text' || $val['type'] == 'html') $value = GETPOSTISSET($key) ?GETPOST($key, 'restricthtml') : $object->$key;
-	else $value = GETPOSTISSET($key) ?GETPOST($key, 'alpha') : $object->$key;
+	elseif (preg_match('/^(text|html)/', $val['type'])) {
+		$tmparray = explode(':', $val['type']);
+		if (!empty($tmparray[1])) {
+			$check = $tmparray[1];
+		} else {
+			$check = 'restricthtml';
+		}
+		$value = GETPOSTISSET($key) ? GETPOST($key, $check) : $object->$key;
+	}
+	else $value = GETPOSTISSET($key) ? GETPOST($key, 'alpha') : $object->$key;
 	//var_dump($val.' '.$key.' '.$value);
 	if ($val['noteditable']) print $object->showOutputField($val, $key, $value, '', '', '', 0);
 	else print $object->showInputField($val, $key, $value, '', '', '', 0);
diff --git a/htdocs/modulebuilder/template/class/myobject.class.php b/htdocs/modulebuilder/template/class/myobject.class.php
index 399dd3b10b8..8465f804d5c 100644
--- a/htdocs/modulebuilder/template/class/myobject.class.php
+++ b/htdocs/modulebuilder/template/class/myobject.class.php
@@ -70,7 +70,7 @@ class MyObject extends CommonObject
 
 
 	/**
-	 *  'type' if the field format ('integer', 'integer:ObjectClass:PathToClass[:AddCreateButtonOrNot[:Filter]]', 'varchar(x)', 'double(24,8)', 'real', 'price', 'text', 'html', 'date', 'datetime', 'timestamp', 'duration', 'mail', 'phone', 'url', 'password')
+	 *  'type' if the field format ('integer', 'integer:ObjectClass:PathToClass[:AddCreateButtonOrNot[:Filter]]', 'varchar(x)', 'double(24,8)', 'real', 'price', 'text', 'text:none', 'html', 'date', 'datetime', 'timestamp', 'duration', 'mail', 'phone', 'url', 'password')
 	 *         Note: Filter can be a string like "(t.ref:like:'SO-%') or (t.date_creation:<:'20160101') or (t.nature:is:NULL)"
 	 *  'label' the translation key.
 	 *  'enabled' is a condition when the field must be managed (Example: 1 or '$conf->global->MY_SETUP_PARAM)

From 1e176fad8fed1d8e89c9009f5e2cf0fc2069b51d Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Tue, 29 Sep 2020 21:28:07 +0200
Subject: [PATCH 055/101] Fix GETPOST on array

---
 htdocs/core/class/html.formmail.class.php | 18 ++++++++++--------
 htdocs/core/lib/functions.lib.php         | 10 ++++++++--
 2 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/htdocs/core/class/html.formmail.class.php b/htdocs/core/class/html.formmail.class.php
index fcd7199137c..e2749c5e183 100644
--- a/htdocs/core/class/html.formmail.class.php
+++ b/htdocs/core/class/html.formmail.class.php
@@ -653,7 +653,7 @@ class FormMail extends Form
 						$out .= ' &lt;'.$this->tomail.'&gt;';
 						if ($this->withtofree)
 						{
-							$out .= '<br>'.$langs->trans("and").' <input class="minwidth200" id="sendto" name="sendto" value="'.(!is_array($this->withto) && !is_numeric($this->withto) ? (isset($_REQUEST["sendto"]) ? $_REQUEST["sendto"] : $this->withto) : "").'" />';
+							$out .= '<br>'.$langs->trans("and").' <input class="minwidth200" id="sendto" name="sendto" value="'.(!is_array($this->withto) && !is_numeric($this->withto) ? (GETPOSTISSET("sendto") ? GETPOST("sendto") : $this->withto) : "").'" />';
 						}
 					} else {
 						// Note withto may be a text like 'AllRecipientSelected'
@@ -663,7 +663,7 @@ class FormMail extends Form
 					// The free input of email
 					if (!empty($this->withtofree))
 					{
-						$out .= '<input class="minwidth200" id="sendto" name="sendto" value="'.(($this->withtofree && !is_numeric($this->withtofree)) ? $this->withtofree : (!is_array($this->withto) && !is_numeric($this->withto) ? (isset($_REQUEST["sendto"]) ? $_REQUEST["sendto"] : $this->withto) : "")).'" />';
+						$out .= '<input class="minwidth200" id="sendto" name="sendto" value="'.(($this->withtofree && !is_numeric($this->withtofree)) ? $this->withtofree : (!is_array($this->withto) && !is_numeric($this->withto) ? (GETPOSTISSET("sendto") ? GETPOST("sendto") : $this->withto) : "")).'" />';
 					}
 					// The select combo
 					if (!empty($this->withto) && is_array($this->withto))
@@ -675,7 +675,9 @@ class FormMail extends Form
 						{
 							$tmparray[$key] = dol_htmlentities($tmparray[$key], null, 'UTF-8', true);
 						}
-						$withtoselected = GETPOST("receiver", 'restricthtml'); // Array of selected value
+
+						$withtoselected = GETPOST("receiver", 'array'); // Array of selected value
+
 						if (empty($withtoselected) && count($tmparray) == 1 && GETPOST('action', 'aZ09') == 'presend')
 						{
 							$withtoselected = array_keys($tmparray);
@@ -699,7 +701,7 @@ class FormMail extends Form
 				{
 					$tmparray[$key] = dol_htmlentities($tmparray[$key], null, 'UTF-8', true);
 				}
-				$withtoselected = GETPOST("receiveruser", 'restricthtml'); // Array of selected value
+				$withtoselected = GETPOST("receiveruser", 'array'); // Array of selected value
 				if (empty($withtoselected) && count($tmparray) == 1 && GETPOST('action', 'aZ09') == 'presend')
 				{
 					$withtoselected = array_keys($tmparray);
@@ -743,7 +745,7 @@ class FormMail extends Form
 						{
 							$tmparray[$key] = dol_htmlentities($tmparray[$key], null, 'UTF-8', true);
 						}
-						$withtoccselected = GETPOST("receivercc"); // Array of selected value
+						$withtoccselected = GETPOST("receivercc", 'array'); // Array of selected value
 						$out .= $form->multiselectarray("receivercc", $tmparray, $withtoccselected, null, null, 'inline-block minwidth500', null, "");
 					}
 				}
@@ -763,7 +765,7 @@ class FormMail extends Form
 				{
 					$tmparray[$key] = dol_htmlentities($tmparray[$key], null, 'UTF-8', true);
 				}
-				$withtoselected = GETPOST("receiverccuser", 'restricthtml'); // Array of selected value
+				$withtoselected = GETPOST("receiverccuser", 'array'); // Array of selected value
 				if (empty($withtoselected) && count($tmparray) == 1 && GETPOST('action', 'aZ09') == 'presend')
 				{
 					$withtoselected = array_keys($tmparray);
@@ -1060,7 +1062,7 @@ class FormMail extends Form
 		if (!empty($this->withtocccreadonly)) {
 			$out .= (!is_array($this->withtoccc) && !is_numeric($this->withtoccc)) ? $this->withtoccc : "";
 		} else {
-			$out .= '<input class="minwidth200" id="sendtoccc" name="sendtoccc" value="'.(GETPOST("sendtoccc", "alpha") ? GETPOST("sendtoccc", "alpha") : ((!is_array($this->withtoccc) && !is_numeric($this->withtoccc)) ? $this->withtoccc : '')).'" />';
+			$out .= '<input class="minwidth200" id="sendtoccc" name="sendtoccc" value="'.(GETPOSTISSET("sendtoccc") ? GETPOST("sendtoccc", "alpha") : ((!is_array($this->withtoccc) && !is_numeric($this->withtoccc)) ? $this->withtoccc : '')).'" />';
 			if (!empty($this->withtoccc) && is_array($this->withtoccc)) {
 				$out .= " ".$langs->trans("and")."/".$langs->trans("or")." ";
 				// multiselect array convert html entities into options tags, even if we dont want this, so we encode them a second time
@@ -1068,7 +1070,7 @@ class FormMail extends Form
 				foreach ($tmparray as $key => $val) {
 					$tmparray[$key] = dol_htmlentities($tmparray[$key], null, 'UTF-8', true);
 				}
-				$withtocccselected = GETPOST("receiverccc"); // Array of selected value
+				$withtocccselected = GETPOST("receiverccc", 'array'); // Array of selected value
 				$out .= $form->multiselectarray("receiverccc", $tmparray, $withtocccselected, null, null, null, null, "90%");
 			}
 		}
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index f34f2997af2..4fe156b249b 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -545,12 +545,18 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null
 	}
 
 	// Check rule
-	if ($check == 'array') {
+	if (preg_match('/^array/', $check)) {	// If 'array' or 'array:restricthtml' or 'array:aZ09'
 		if (!is_array($out) || empty($out)) {
 			$out = array();
 		} else {
+			$tmparray = explode(':', $check);
+			if (!empty($tmparray[1])) {
+				$tmpcheck = $tmparray[1];
+			} else {
+				$tmpcheck = 'alphanohtml';
+			}
 			foreach ($out as $outkey => $outval) {
-				$out[$outkey] = checkVal($outval, 'alphanohtml', $filter, $options);
+				$out[$outkey] = checkVal($outval, $tmpcheck, $filter, $options);
 			}
 		}
 	}

From f063a144c12e991d716cacbe18e3c5ff5e76e9e5 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Tue, 29 Sep 2020 21:51:39 +0200
Subject: [PATCH 056/101] NEW Can add event to log into blockedlog module with
 a constant.

---
 htdocs/blockedlog/class/blockedlog.class.php               | 7 +++++++
 .../interface_50_modBlockedlog_ActionsBlockedLog.class.php | 1 +
 2 files changed, 8 insertions(+)

diff --git a/htdocs/blockedlog/class/blockedlog.class.php b/htdocs/blockedlog/class/blockedlog.class.php
index 7bb252394c3..b8d0304c5eb 100644
--- a/htdocs/blockedlog/class/blockedlog.class.php
+++ b/htdocs/blockedlog/class/blockedlog.class.php
@@ -185,6 +185,13 @@ class BlockedLog
 		// $conf->global->BANK_ENABLE_POS_CASHCONTROL must be set to 1 by all POS modules
 		$moduleposenabled = ($conf->cashdesk->enabled || $conf->takepos->enabled || !empty($conf->global->BANK_ENABLE_POS_CASHCONTROL));
 		if ($moduleposenabled) $this->trackedevents['CASHCONTROL_VALIDATE'] = 'logCASHCONTROL_VALIDATE';
+
+		if (!empty($conf->global->BLOCKEDLOG_ADD_ACTIONS_SUPPORTED)) {
+			$tmparrayofmoresupportedevents = explode(',', $conf->global->BLOCKEDLOG_ADD_ACTIONS_SUPPORTED);
+			foreach ($tmparrayofmoresupportedevents as $val) {
+				$this->trackedevents[$val] = 'log'.$val;
+			}
+		}
 	}
 
 	/**
diff --git a/htdocs/core/triggers/interface_50_modBlockedlog_ActionsBlockedLog.class.php b/htdocs/core/triggers/interface_50_modBlockedlog_ActionsBlockedLog.class.php
index 19eab2e5974..0800d66eea3 100644
--- a/htdocs/core/triggers/interface_50_modBlockedlog_ActionsBlockedLog.class.php
+++ b/htdocs/core/triggers/interface_50_modBlockedlog_ActionsBlockedLog.class.php
@@ -83,6 +83,7 @@ class InterfaceActionsBlockedLog extends DolibarrTriggers
 		    || $action === 'CASHCONTROL_VALIDATE'
 		    || (in_array($object->element, array('facture', 'supplier_invoice')) && $action === 'DOC_DOWNLOAD' && $object->statut != 0)
 		    || (in_array($object->element, array('facture', 'supplier_invoice')) && $action === 'DOC_PREVIEW' && $object->statut != 0)
+			|| (!empty($conf->global->BLOCKEDLOG_ADD_ACTIONS_SUPPORTED) && in_array($action, explode(',', $conf->global->BLOCKEDLOG_ADD_ACTIONS_SUPPORTED)))
 		)
 		{
 			$qualified++;

From fc62ca57b5efae1713a0c19e1345950632157612 Mon Sep 17 00:00:00 2001
From: Alexandre SPANGARO <aspangaro.dolibarr@gmail.com>
Date: Wed, 30 Sep 2020 06:37:48 +0200
Subject: [PATCH 057/101] Remove old code

---
 htdocs/accountancy/admin/defaultaccounts.php | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/htdocs/accountancy/admin/defaultaccounts.php b/htdocs/accountancy/admin/defaultaccounts.php
index 84ea304a74d..3d03dc9c4b6 100644
--- a/htdocs/accountancy/admin/defaultaccounts.php
+++ b/htdocs/accountancy/admin/defaultaccounts.php
@@ -101,22 +101,6 @@ if ($conf->societe->enabled) {
 /*
  * Actions
  */
-
-$accounting_mode = empty($conf->global->ACCOUNTING_MODE) ? 'RECETTES-DEPENSES' : $conf->global->ACCOUNTING_MODE;
-
-if (GETPOST('change_chart', 'alpha'))
-{
-    $chartofaccounts = GETPOST('chartofaccounts', 'int');
-
-    if (!empty($chartofaccounts)) {
-        if (!dolibarr_set_const($db, 'CHARTOFACCOUNTS', $chartofaccounts, 'chaine', 0, '', $conf->entity)) {
-            $error++;
-        }
-    } else {
-        $error++;
-    }
-}
-
 if ($action == 'update') {
 	$error = 0;
 

From ed26f077835da70c627e5644943af2dd0f279d6c Mon Sep 17 00:00:00 2001
From: Alexandre SPANGARO <aspangaro.dolibarr@gmail.com>
Date: Wed, 30 Sep 2020 06:46:23 +0200
Subject: [PATCH 058/101] FIX If salaries subledger account not defined, put
 only in the general account

---
 htdocs/accountancy/journal/bankjournal.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/htdocs/accountancy/journal/bankjournal.php b/htdocs/accountancy/journal/bankjournal.php
index 4dd5df83152..7062c25b108 100644
--- a/htdocs/accountancy/journal/bankjournal.php
+++ b/htdocs/accountancy/journal/bankjournal.php
@@ -180,10 +180,10 @@ if ($result) {
 	$account_supplier			= (($conf->global->ACCOUNTING_ACCOUNT_SUPPLIER != "") ? $conf->global->ACCOUNTING_ACCOUNT_SUPPLIER : 'NotDefined'); // NotDefined is a reserved word
 	$account_customer			= (($conf->global->ACCOUNTING_ACCOUNT_CUSTOMER != "") ? $conf->global->ACCOUNTING_ACCOUNT_CUSTOMER : 'NotDefined'); // NotDefined is a reserved word
 	$account_employee			= (!empty($conf->global->SALARIES_ACCOUNTING_ACCOUNT_PAYMENT) ? $conf->global->SALARIES_ACCOUNTING_ACCOUNT_PAYMENT : 'NotDefined'); // NotDefined is a reserved word
-	$account_pay_vat = (!empty($conf->global->ACCOUNTING_VAT_PAY_ACCOUNT) ? $conf->global->ACCOUNTING_VAT_PAY_ACCOUNT : 'NotDefined'); // NotDefined is a reserved word
-	$account_pay_donation = (!empty($conf->global->DONATION_ACCOUNTINGACCOUNT) ? $conf->global->DONATION_ACCOUNTINGACCOUNT : 'NotDefined'); // NotDefined is a reserved word
-	$account_pay_subscription = (!empty($conf->global->ADHERENT_SUBSCRIPTION_ACCOUNTINGACCOUNT) ? $conf->global->ADHERENT_SUBSCRIPTION_ACCOUNTINGACCOUNT : 'NotDefined'); // NotDefined is a reserved word
-	$account_transfer = (!empty($conf->global->ACCOUNTING_ACCOUNT_TRANSFER_CASH) ? $conf->global->ACCOUNTING_ACCOUNT_TRANSFER_CASH : 'NotDefined'); // NotDefined is a reserved word
+	$account_pay_vat			= (!empty($conf->global->ACCOUNTING_VAT_PAY_ACCOUNT) ? $conf->global->ACCOUNTING_VAT_PAY_ACCOUNT : 'NotDefined'); // NotDefined is a reserved word
+	$account_pay_donation		= (!empty($conf->global->DONATION_ACCOUNTINGACCOUNT) ? $conf->global->DONATION_ACCOUNTINGACCOUNT : 'NotDefined'); // NotDefined is a reserved word
+	$account_pay_subscription	= (!empty($conf->global->ADHERENT_SUBSCRIPTION_ACCOUNTINGACCOUNT) ? $conf->global->ADHERENT_SUBSCRIPTION_ACCOUNTINGACCOUNT : 'NotDefined'); // NotDefined is a reserved word
+	$account_transfer			= (!empty($conf->global->ACCOUNTING_ACCOUNT_TRANSFER_CASH) ? $conf->global->ACCOUNTING_ACCOUNT_TRANSFER_CASH : 'NotDefined'); // NotDefined is a reserved word
 
 	$tabcompany = array();
 	$tabuser = array();
@@ -237,7 +237,7 @@ if ($result) {
 		);
 
 		// Set accountancy code for user
-		$compta_user = (!empty($obj->accountancy_code) ? $obj->accountancy_code : $account_employee);
+		$compta_user = (!empty($obj->accountancy_code) ? $obj->accountancy_code : '');
 
 		$tabuser[$obj->rowid] = array(
 				'id' => $obj->userid,

From 6c46b2e8dea5d0826361ac352095088124498912 Mon Sep 17 00:00:00 2001
From: "Sekan, Tobias" <tobias.sekan@startmail.com>
Date: Wed, 30 Sep 2020 11:45:29 +0200
Subject: [PATCH 059/101] Address feedback

---
 htdocs/contact/class/contact.class.php | 54 ++++++++++++++------------
 htdocs/contact/list.php                | 22 +++--------
 2 files changed, 35 insertions(+), 41 deletions(-)

diff --git a/htdocs/contact/class/contact.class.php b/htdocs/contact/class/contact.class.php
index 289a4a94495..d05fd04673d 100644
--- a/htdocs/contact/class/contact.class.php
+++ b/htdocs/contact/class/contact.class.php
@@ -90,20 +90,20 @@ class Contact extends CommonObject
 	 */
 	public $fields = array(
 		'rowid' =>array('type'=>'integer', 'label'=>'TechnicalID', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>10),
-		'datec' =>array('type'=>'datetime', 'label'=>'DateCreation', 'enabled'=>1, 'visible'=>0, 'position'=>15),
-		'tms' =>array('type'=>'timestamp', 'label'=>'DateModification', 'enabled'=>1, 'visible'=>0, 'notnull'=>1, 'position'=>20),
-		'fk_soc' =>array('type'=>'integer', 'label'=>'ThirdParty', 'enabled'=>1, 'visible'=>-1, 'position'=>25, 'searchall'=>1),
-		'entity' =>array('type'=>'integer', 'label'=>'Entity', 'default'=>1, 'enabled'=>1, 'visible'=>0, 'notnull'=>1, 'position'=>30, 'index'=>1),
-		'ref_ext' =>array('type'=>'varchar(255)', 'label'=>'Ref ext', 'enabled'=>1, 'visible'=>0, 'position'=>35),
+		'datec' =>array('type'=>'datetime', 'label'=>'DateCreation', 'enabled'=>1, 'visible'=>-1, 'position'=>15),
+		'tms' =>array('type'=>'timestamp', 'label'=>'DateModification', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>20),
+		'fk_soc' =>array('type'=>'integer', 'label'=>'ThirdParty', 'enabled'=>1, 'visible'=>1, 'position'=>25, 'searchall'=>1),
+		'entity' =>array('type'=>'integer', 'label'=>'Entity', 'default'=>1, 'enabled'=>1, 'visible'=>3, 'notnull'=>1, 'position'=>30, 'index'=>1),
+		'ref_ext' =>array('type'=>'varchar(255)', 'label'=>'Ref ext', 'enabled'=>1, 'visible'=>3, 'position'=>35),
 		'civility' =>array('type'=>'varchar(6)', 'label'=>'Civility', 'enabled'=>1, 'visible'=>3, 'position'=>40),
 		'lastname' =>array('type'=>'varchar(50)', 'label'=>'Lastname', 'enabled'=>1, 'visible'=>1, 'position'=>45, 'showoncombobox'=>1, 'searchall'=>1),
 		'firstname' =>array('type'=>'varchar(50)', 'label'=>'Firstname', 'enabled'=>1, 'visible'=>1, 'position'=>50, 'showoncombobox'=>1, 'searchall'=>1),
-		'address' =>array('type'=>'varchar(255)', 'label'=>'Address', 'enabled'=>1, 'visible'=>3, 'position'=>55),
+		'address' =>array('type'=>'varchar(255)', 'label'=>'Address', 'enabled'=>1, 'visible'=>-1, 'position'=>55),
 		'zip' =>array('type'=>'varchar(25)', 'label'=>'Zip', 'enabled'=>1, 'visible'=>1, 'position'=>60),
 		'town' =>array('type'=>'text', 'label'=>'Town', 'enabled'=>1, 'visible'=>1, 'position'=>65),
-		'fk_departement' =>array('type'=>'integer', 'label'=>'Fk departement', 'enabled'=>1, 'visible'=>0, 'position'=>70),
-		'fk_pays' =>array('type'=>'integer', 'label'=>'Fk pays', 'enabled'=>1, 'visible'=>0, 'position'=>75),
-		'birthday' =>array('type'=>'date', 'label'=>'Birthday', 'enabled'=>1, 'visible'=>-1, 'position'=>80),
+		'fk_departement' =>array('type'=>'integer', 'label'=>'Fk departement', 'enabled'=>1, 'visible'=>3, 'position'=>70),
+		'fk_pays' =>array('type'=>'integer', 'label'=>'Fk pays', 'enabled'=>1, 'visible'=>3, 'position'=>75),
+		'birthday' =>array('type'=>'date', 'label'=>'Birthday', 'enabled'=>1, 'visible'=>3, 'position'=>80),
 		'poste' =>array('type'=>'varchar(80)', 'label'=>'PostOrFunction', 'enabled'=>1, 'visible'=>-1, 'position'=>85),
 		'phone' =>array('type'=>'varchar(30)', 'label'=>'Phone', 'enabled'=>1, 'visible'=>1, 'position'=>90, 'searchall'=>1),
 		'phone_perso' =>array('type'=>'varchar(30)', 'label'=>'PhonePerso', 'enabled'=>1, 'visible'=>1, 'position'=>95, 'searchall'=>1),
@@ -114,14 +114,14 @@ class Contact extends CommonObject
 		'photo' =>array('type'=>'varchar(255)', 'label'=>'Photo', 'enabled'=>1, 'visible'=>3, 'position'=>170),
 		'priv' =>array('type'=>'smallint(6)', 'label'=>'ContactVisibility', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>175),
 		'no_email' =>array('type'=>'smallint(6)', 'label'=>'No_Email', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>180),
-		'fk_user_creat' =>array('type'=>'integer', 'label'=>'UserAuthor', 'enabled'=>1, 'visible'=>0, 'position'=>185),
-		'fk_user_modif' =>array('type'=>'integer', 'label'=>'UserModif', 'enabled'=>1, 'visible'=>0, 'position'=>190),
-		'note_private' =>array('type'=>'text', 'label'=>'NotePrivate', 'enabled'=>1, 'visible'=>0, 'position'=>195, 'searchall'=>1),
-		'note_public' =>array('type'=>'text', 'label'=>'NotePublic', 'enabled'=>1, 'visible'=>0, 'position'=>200, 'searchall'=>1),
-		'default_lang' =>array('type'=>'varchar(6)', 'label'=>'Default lang', 'enabled'=>1, 'visible'=>0, 'position'=>205),
-		'canvas' =>array('type'=>'varchar(32)', 'label'=>'Canvas', 'enabled'=>1, 'visible'=>0, 'position'=>210),
+		'fk_user_creat' =>array('type'=>'integer', 'label'=>'UserAuthor', 'enabled'=>1, 'visible'=>3, 'position'=>185),
+		'fk_user_modif' =>array('type'=>'integer', 'label'=>'UserModif', 'enabled'=>1, 'visible'=>3, 'position'=>190),
+		'note_private' =>array('type'=>'text', 'label'=>'NotePrivate', 'enabled'=>1, 'visible'=>3, 'position'=>195, 'searchall'=>1),
+		'note_public' =>array('type'=>'text', 'label'=>'NotePublic', 'enabled'=>1, 'visible'=>3, 'position'=>200, 'searchall'=>1),
+		'default_lang' =>array('type'=>'varchar(6)', 'label'=>'Default lang', 'enabled'=>1, 'visible'=>3, 'position'=>205),
+		'canvas' =>array('type'=>'varchar(32)', 'label'=>'Canvas', 'enabled'=>1, 'visible'=>3, 'position'=>210),
 		'statut' =>array('type'=>'tinyint(4)', 'label'=>'Status', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>500),
-		'import_key' =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>0, 'position'=>1000),
+		'import_key' =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>-1, 'position'=>1000),
 	);
 
 	public $civility_id; // In fact we store civility_code
@@ -249,16 +249,22 @@ class Contact extends CommonObject
 		global $conf, $langs;
 
 		$this->db = $db;
-
-		if (empty($conf->global->MAIN_SHOW_TECHNICAL_ID) && isset($this->fields['rowid'])) $this->fields['rowid']['visible'] = 0;
-		if (empty($conf->mailing->enabled)) $this->fields['no_email']['enabled'] = 0;
-		if (!empty($conf->global->SOCIETE_DISABLE_CONTACTS)) $this->fields['thirdparty']['enabled'] = 0;
-		if (empty($conf->global->THIRDPARTY_ENABLE_PROSPECTION_ON_ALTERNATIVE_ADRESSES)) {	// Default behaviour
-			$this->field['fk_stcomm']['enabled'] = 0;
-			$this->field['fk_prospectlevel']['enabled'] = 0;
-		}
 		$this->statut = 1; // By default, status is enabled
 
+		if (empty($conf->global->MAIN_SHOW_TECHNICAL_ID))		$this->fields['rowid']['visible'] = 0;
+		if (empty($conf->mailing->enabled))						$this->fields['no_email']['enabled'] = 0;
+
+		// typical ['s.nom'] is used for third-parties
+		if (empty($conf->global->SOCIETE_DISABLE_CONTACTS)) {
+			$this->fields['fk_soc']['enabled'] = 0;
+			$this->fields['fk_soc']['searchall'] = 0;
+		}
+
+		if (empty($conf->global->THIRDPARTY_ENABLE_PROSPECTION_ON_ALTERNATIVE_ADRESSES)) {	// Default behaviour
+			$this->field['fk_stcommcontact']['enabled'] = 0;
+			$this->field['fk_prospectcontactlevel']['enabled'] = 0;
+		}
+
 		// Unset fields that are disabled
 		foreach ($this->fields as $key => $val)
 		{
diff --git a/htdocs/contact/list.php b/htdocs/contact/list.php
index e8493e59ba3..a6130c3e47a 100644
--- a/htdocs/contact/list.php
+++ b/htdocs/contact/list.php
@@ -166,8 +166,7 @@ foreach ($object->fields as $key => $val)
 
 // Add none object fields for "search in all"
 if (empty($conf->global->SOCIETE_DISABLE_CONTACTS))	{
-	$fieldstosearchall['s.nom'] = $fieldstosearchall['p.fk_soc'];
-	unset($fieldstosearchall['p.fk_soc']);
+	$fieldstosearchall['s.nom'] = "ThirdParty";
 }
 
 // Definition of fields for list
@@ -178,10 +177,6 @@ foreach ($object->fields as $key => $val) {
 		continue;
 	}
 
-	// Visibility based on global settings
-	if ($key == 'rowid' && !empty($conf->global->MAIN_SHOW_TECHNICAL_ID)) continue;
-	if ($key == 'no_email' && empty($conf->mailing->enabled)) continue;
-	
 	$arrayfields['p.'.$key] = array(
 		'label'=>$val['label'],
 		'checked'=>(($val['visible'] < 0) ? 0 : 1),
@@ -192,16 +187,8 @@ foreach ($object->fields as $key => $val) {
 // Add none object fields to fields for list
 $arrayfields['country.code_iso'] = array('label'=>"Country", 'position'=>22, 'checked'=>0);
 if (empty($conf->global->SOCIETE_DISABLE_CONTACTS))	{
-	$arrayfields['s.nom'] = $arrayfields['p.fk_soc'];
-	unset($arrayfields['p.fk_soc']);
+	$arrayfields['s.nom'] = array('label'=>"ThirdParty", 'position'=>25, 'checked'=>1);
 }
-if (!empty($conf->global->THIRDPARTY_ENABLE_PROSPECTION_ON_ALTERNATIVE_ADRESSES)) {
-	$arrayfields['p.fk_prospectcontactlevel'] = array('label'=>"ProspectLevelShort", 'checked'=>1, 'position'=>210);
-	$arrayfields['p.fk_stcommcontact'] = array('label'=>"StatusProsp", 'checked'=>1, 'position'=>215);
-}
-
-// Special overrides for object files
-$arrayfields['p.rowid']['checked'] = ($conf->global->MAIN_SHOW_TECHNICAL_ID ? 1 : 0);
 
 if (!empty($conf->socialnetworks->enabled)) {
 	foreach ($socialnetworks as $key => $value) {
@@ -214,6 +201,7 @@ if (!empty($conf->socialnetworks->enabled)) {
 		}
 	}
 }
+
 // Extra fields
 if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label']) > 0)
 {
@@ -409,10 +397,10 @@ if (strlen($search_phone))          $sql .= natural_search(array('p.phone', 'p.p
 if (strlen($search_cti))            $sql .= natural_search(array('p.phone', 'p.phone_perso', 'p.phone_mobile'), $search_cti);
 if (strlen($search_firstlast_only)) $sql .= natural_search(array('p.lastname', 'p.firstname'), $search_firstlast_only);
 
-if ($search_id > 0)                 $sql .= natural_search("p.rowid", $search_id, 1);
+if ($search_id > 0)                 $sql .= natural_search('p.rowid', $search_id, 1);
 if ($search_lastname)               $sql .= natural_search('p.lastname', $search_lastname);
 if ($search_firstname)              $sql .= natural_search('p.firstname', $search_firstname);
-if ($search_societe)                $sql .= natural_search((empty($conf->global->SOCIETE_DISABLE_CONTACTS) ? 's.nom' : 'p.fk_soc'), $search_societe);
+if ($search_societe)                $sql .= natural_search(empty($conf->global->SOCIETE_DISABLE_CONTACTS) ? 's.nom' : 'p.fk_soc', $search_societe);
 if ($search_country)                $sql .= " AND p.fk_pays IN (".$search_country.')';
 if (strlen($search_poste))          $sql .= natural_search('p.poste', $search_poste);
 if (strlen($search_phone_perso))    $sql .= natural_search('p.phone_perso', $search_phone_perso);

From a3da2afe7ab307d121029990a727210a8c9cbc0e Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 30 Sep 2020 11:58:40 +0200
Subject: [PATCH 060/101] Add option MAIN_LIST_ALLOW_PUBLIC_NOTES + 
 MAIN_LIST_ALLOW_PRIVATE_NOTES

---
 htdocs/comm/propal/list.php    | 32 ++++++++++++++++++++++++++++++++
 htdocs/commande/list.php       | 34 +++++++++++++++++++++++++++++++++-
 htdocs/compta/facture/list.php | 32 ++++++++++++++++++++++++++++++++
 htdocs/fichinter/list.php      | 34 +++++++++++++++++++++++++++++++++-
 4 files changed, 130 insertions(+), 2 deletions(-)

diff --git a/htdocs/comm/propal/list.php b/htdocs/comm/propal/list.php
index dde38d98489..e50078993f8 100644
--- a/htdocs/comm/propal/list.php
+++ b/htdocs/comm/propal/list.php
@@ -183,6 +183,8 @@ $arrayfields = array(
 	'p.datec'=>array('label'=>"DateCreation", 'checked'=>0, 'position'=>500),
 	'p.tms'=>array('label'=>"DateModificationShort", 'checked'=>0, 'position'=>500),
 	'p.date_cloture'=>array('label'=>"DateClosing", 'checked'=>0, 'position'=>500),
+	'p.note_public'=>array('label'=>'NotePublic', 'checked'=>0, 'position'=>510, 'enabled'=>(empty($conf->global->MAIN_LIST_ALLOW_PUBLIC_NOTES))),
+	'p.note_private'=>array('label'=>'NotePrivate', 'checked'=>0, 'position'=>511, 'enabled'=>(empty($conf->global->MAIN_LIST_ALLOW_PRIVATE_NOTES))),
 	'p.fk_statut'=>array('label'=>"Status", 'checked'=>1, 'position'=>1000),
 );
 // Extra fields
@@ -791,6 +793,18 @@ if ($resql)
 		print '<td class="liste_titre">';
 		print '</td>';
 	}
+	if (!empty($arrayfields['p.note_public']['checked']))
+	{
+		// Note public
+		print '<td class="liste_titre">';
+		print '</td>';
+	}
+	if (!empty($arrayfields['p.note_private']['checked']))
+	{
+		// Note private
+		print '<td class="liste_titre">';
+		print '</td>';
+	}
 	// Status
 	if (!empty($arrayfields['p.fk_statut']['checked']))
 	{
@@ -846,6 +860,8 @@ if ($resql)
 	if (!empty($arrayfields['p.datec']['checked']))     		print_liste_field_titre($arrayfields['p.datec']['label'], $_SERVER["PHP_SELF"], "p.datec", "", $param, 'align="center" class="nowrap"', $sortfield, $sortorder);
 	if (!empty($arrayfields['p.tms']['checked']))       		print_liste_field_titre($arrayfields['p.tms']['label'], $_SERVER["PHP_SELF"], "p.tms", "", $param, 'align="center" class="nowrap"', $sortfield, $sortorder);
 	if (!empty($arrayfields['p.date_cloture']['checked']))		print_liste_field_titre($arrayfields['p.date_cloture']['label'], $_SERVER["PHP_SELF"], "p.date_cloture", "", $param, 'align="center" class="nowrap"', $sortfield, $sortorder);
+	if (!empty($arrayfields['p.note_public']['checked']))       print_liste_field_titre($arrayfields['p.note_public']['label'], $_SERVER["PHP_SELF"], "p.note_public", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
+	if (!empty($arrayfields['p.note_private']['checked']))      print_liste_field_titre($arrayfields['p.note_private']['label'], $_SERVER["PHP_SELF"], "p.note_private", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
 	if (!empty($arrayfields['p.fk_statut']['checked']))			print_liste_field_titre($arrayfields['p.fk_statut']['label'], $_SERVER["PHP_SELF"], "p.fk_statut", "", $param, 'class="right"', $sortfield, $sortorder);
 	print_liste_field_titre($selectedfields, $_SERVER["PHP_SELF"], "", '', '', 'align="center"', $sortfield, $sortorder, 'maxwidthsearch ');
 	print '</tr>'."\n";
@@ -1226,6 +1242,22 @@ if ($resql)
 			print '</td>';
 			if (!$i) $totalarray['nbfield']++;
 		}
+		// Note public
+		if (!empty($arrayfields['p.note_public']['checked']))
+		{
+			print '<td class="center">';
+			print dol_escape_htmltag($obj->note_public);
+			print '</td>';
+			if (!$i) $totalarray['nbfield']++;
+		}
+		// Note private
+		if (!empty($arrayfields['p.note_private']['checked']))
+		{
+			print '<td class="center">';
+			print dol_escape_htmltag($obj->note_private);
+			print '</td>';
+			if (!$i) $totalarray['nbfield']++;
+		}
 		// Status
 		if (!empty($arrayfields['p.fk_statut']['checked']))
 		{
diff --git a/htdocs/commande/list.php b/htdocs/commande/list.php
index 921e1de185b..1acd515a49a 100644
--- a/htdocs/commande/list.php
+++ b/htdocs/commande/list.php
@@ -158,6 +158,8 @@ $arrayfields = array(
 	'c.datec'=>array('label'=>"DateCreation", 'checked'=>0, 'position'=>500),
 	'c.tms'=>array('label'=>"DateModificationShort", 'checked'=>0, 'position'=>500),
     'c.date_cloture'=>array('label'=>"DateClosing", 'checked'=>0, 'position'=>500),
+	'c.note_public'=>array('label'=>'NotePublic', 'checked'=>0, 'position'=>510, 'enabled'=>(empty($conf->global->MAIN_LIST_ALLOW_PUBLIC_NOTES))),
+	'c.note_private'=>array('label'=>'NotePrivate', 'checked'=>0, 'position'=>511, 'enabled'=>(empty($conf->global->MAIN_LIST_ALLOW_PRIVATE_NOTES))),
 	'c.fk_statut'=>array('label'=>"Status", 'checked'=>1, 'position'=>1000),
 	'c.facture'=>array('label'=>"Billed", 'checked'=>1, 'position'=>1000, 'enabled'=>(empty($conf->global->WORKFLOW_BILL_ON_SHIPMENT)))
 );
@@ -270,7 +272,7 @@ $sql .= " typent.code as typent_code,";
 $sql .= " state.code_departement as state_code, state.nom as state_name,";
 $sql .= ' c.rowid, c.ref, c.total_ht, c.tva as total_tva, c.total_ttc, c.ref_client, c.fk_user_author,';
 $sql .= ' c.fk_multicurrency, c.multicurrency_code, c.multicurrency_tx, c.multicurrency_total_ht, c.multicurrency_total_tva as multicurrency_total_vat, c.multicurrency_total_ttc,';
-$sql .= ' c.date_valid, c.date_commande, c.note_private, c.date_livraison as date_delivery, c.fk_statut, c.facture as billed,';
+$sql .= ' c.date_valid, c.date_commande, c.note_public, c.note_private, c.date_livraison as date_delivery, c.fk_statut, c.facture as billed,';
 $sql .= ' c.date_creation as date_creation, c.tms as date_update, c.date_cloture as date_cloture,';
 $sql .= " p.rowid as project_id, p.ref as project_ref, p.title as project_label,";
 $sql .= " u.login";
@@ -792,6 +794,18 @@ if ($resql)
 		print '<td class="liste_titre">';
 		print '</td>';
 	}
+	// Note public
+	if (!empty($arrayfields['c.note_public']['checked']))
+	{
+		print '<td class="liste_titre">';
+		print '</td>';
+	}
+	// Note private
+	if (!empty($arrayfields['c.note_private']['checked']))
+	{
+		print '<td class="liste_titre">';
+		print '</td>';
+	}
 	// Status
 	if (!empty($arrayfields['c.fk_statut']['checked']))
 	{
@@ -855,6 +869,8 @@ if ($resql)
 	if (!empty($arrayfields['c.datec']['checked']))     print_liste_field_titre($arrayfields['c.datec']['label'], $_SERVER["PHP_SELF"], "c.date_creation", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
 	if (!empty($arrayfields['c.tms']['checked']))       print_liste_field_titre($arrayfields['c.tms']['label'], $_SERVER["PHP_SELF"], "c.tms", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
 	if (!empty($arrayfields['c.date_cloture']['checked']))       print_liste_field_titre($arrayfields['c.date_cloture']['label'], $_SERVER["PHP_SELF"], "c.date_cloture", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
+	if (!empty($arrayfields['c.note_public']['checked'])) print_liste_field_titre($arrayfields['c.note_public']['label'], $_SERVER["PHP_SELF"], "c.note_public", "", $param, '', $sortfield, $sortorder, 'right ');
+	if (!empty($arrayfields['c.note_private']['checked'])) print_liste_field_titre($arrayfields['c.note_private']['label'], $_SERVER["PHP_SELF"], "c.note_private", "", $param, '', $sortfield, $sortorder, 'right ');
 	if (!empty($arrayfields['c.fk_statut']['checked'])) print_liste_field_titre($arrayfields['c.fk_statut']['label'], $_SERVER["PHP_SELF"], "c.fk_statut", "", $param, '', $sortfield, $sortorder, 'right ');
 	if (!empty($arrayfields['c.facture']['checked']))   print_liste_field_titre($arrayfields['c.facture']['label'], $_SERVER["PHP_SELF"], 'c.facture', '', $param, '', $sortfield, $sortorder, 'center ');
 	print_liste_field_titre($selectedfields, $_SERVER["PHP_SELF"], "", '', $param, '', $sortfield, $sortorder, 'maxwidthsearch center ');
@@ -1243,6 +1259,22 @@ if ($resql)
 			print '</td>';
 			if (!$i) $totalarray['nbfield']++;
 		}
+		// Note public
+		if (!empty($arrayfields['c.note_public']['checked']))
+		{
+			print '<td align="center" class="nowrap">';
+			print dol_escape_htmltag($obj->note_public);
+			print '</td>';
+			if (!$i) $totalarray['nbfield']++;
+		}
+		// Note private
+		if (!empty($arrayfields['c.note_private']['checked']))
+		{
+			print '<td align="center" class="nowrap">';
+			print dol_escape_htmltag($obj->note_private);
+			print '</td>';
+			if (!$i) $totalarray['nbfield']++;
+		}
 		// Status
 		if (!empty($arrayfields['c.fk_statut']['checked']))
 		{
diff --git a/htdocs/compta/facture/list.php b/htdocs/compta/facture/list.php
index bbcdd2ab895..607afbc943f 100644
--- a/htdocs/compta/facture/list.php
+++ b/htdocs/compta/facture/list.php
@@ -205,6 +205,8 @@ $arrayfields = array(
 	'multicurrency_rtp'=>array('label'=>'MulticurrencyRemainderToPay', 'checked'=>0, 'enabled'=>(empty($conf->multicurrency->enabled) ? 0 : 1), 'position'=>220), // Not enabled by default because slow
 	'f.datec'=>array('label'=>"DateCreation", 'checked'=>0, 'position'=>500),
 	'f.tms'=>array('label'=>"DateModificationShort", 'checked'=>0, 'position'=>500),
+	'f.note_public'=>array('label'=>'NotePublic', 'checked'=>0, 'position'=>510, 'enabled'=>(empty($conf->global->MAIN_LIST_ALLOW_PUBLIC_NOTES))),
+	'f.note_private'=>array('label'=>'NotePrivate', 'checked'=>0, 'position'=>511, 'enabled'=>(empty($conf->global->MAIN_LIST_ALLOW_PRIVATE_NOTES))),
 	'f.fk_statut'=>array('label'=>"Status", 'checked'=>1, 'position'=>1000),
 );
 
@@ -1037,6 +1039,18 @@ if ($resql)
 		print '<td class="liste_titre">';
 		print '</td>';
 	}
+	if (!empty($arrayfields['f.note_public']['checked']))
+	{
+		// Note public
+		print '<td class="liste_titre">';
+		print '</td>';
+	}
+	if (!empty($arrayfields['f.note_private']['checked']))
+	{
+		// Note private
+		print '<td class="liste_titre">';
+		print '</td>';
+	}
 	// Status
 	if (!empty($arrayfields['f.fk_statut']['checked']))
 	{
@@ -1097,6 +1111,8 @@ if ($resql)
 	if (!empty($arrayfields['f.datec']['checked']))     print_liste_field_titre($arrayfields['f.datec']['label'], $_SERVER["PHP_SELF"], "f.datec", "", $param, 'align="center" class="nowrap"', $sortfield, $sortorder);
 	if (!empty($arrayfields['f.tms']['checked']))       print_liste_field_titre($arrayfields['f.tms']['label'], $_SERVER["PHP_SELF"], "f.tms", "", $param, 'align="center" class="nowrap"', $sortfield, $sortorder);
 	if (!empty($arrayfields['f.date_closing']['checked']))       print_liste_field_titre($arrayfields['f.date_closing']['label'], $_SERVER["PHP_SELF"], "f.date_closing", "", $param, 'align="center" class="nowrap"', $sortfield, $sortorder);
+	if (!empty($arrayfields['f.note_public']['checked']))       print_liste_field_titre($arrayfields['f.note_public']['label'], $_SERVER["PHP_SELF"], "f.note_public", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
+	if (!empty($arrayfields['f.note_private']['checked']))       print_liste_field_titre($arrayfields['f.note_private']['label'], $_SERVER["PHP_SELF"], "f.note_private", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
 	if (!empty($arrayfields['f.fk_statut']['checked'])) print_liste_field_titre($arrayfields['f.fk_statut']['label'], $_SERVER["PHP_SELF"], "f.fk_statut,f.paye,f.type,dynamount_payed", "", $param, 'class="right"', $sortfield, $sortorder);
 	print_liste_field_titre($selectedfields, $_SERVER["PHP_SELF"], "", '', '', 'align="center"', $sortfield, $sortorder, 'maxwidthsearch ');
 	print "</tr>\n";
@@ -1555,6 +1571,22 @@ if ($resql)
 				print '</td>';
 				if (!$i) $totalarray['nbfield']++;
 			}
+			// Note public
+			if (!empty($arrayfields['f.note_public']['checked']))
+			{
+				print '<td class="center">';
+				print dol_escape_htmltag($obj->note_public);
+				print '</td>';
+				if (!$i) $totalarray['nbfield']++;
+			}
+			// Note private
+			if (!empty($arrayfields['f.note_private']['checked']))
+			{
+				print '<td class="center">';
+				print dol_escape_htmltag($obj->note_private);
+				print '</td>';
+				if (!$i) $totalarray['nbfield']++;
+			}
 			// Status
 			if (!empty($arrayfields['f.fk_statut']['checked']))
 			{
diff --git a/htdocs/fichinter/list.php b/htdocs/fichinter/list.php
index e9814ce481c..f6b95678f9d 100644
--- a/htdocs/fichinter/list.php
+++ b/htdocs/fichinter/list.php
@@ -109,6 +109,8 @@ $arrayfields = array(
 	'f.description'=>array('label'=>'Description', 'checked'=>1),
 	'f.datec'=>array('label'=>'DateCreation', 'checked'=>0, 'position'=>500),
 	'f.tms'=>array('label'=>'DateModificationShort', 'checked'=>0, 'position'=>500),
+	'f.note_public'=>array('label'=>'NotePublic', 'checked'=>0, 'position'=>510, 'enabled'=>(empty($conf->global->MAIN_LIST_ALLOW_PUBLIC_NOTES))),
+	'f.note_private'=>array('label'=>'NotePrivate', 'checked'=>0, 'position'=>511, 'enabled'=>(empty($conf->global->MAIN_LIST_ALLOW_PRIVATE_NOTES))),
 	'f.fk_statut'=>array('label'=>'Status', 'checked'=>1, 'position'=>1000),
 	'fd.description'=>array('label'=>"DescriptionOfLine", 'checked'=>1, 'enabled'=>empty($conf->global->FICHINTER_DISABLE_DETAILS) ? 1 : 0),
 	'fd.date'=>array('label'=>'DateOfLine', 'checked'=>1, 'enabled'=>empty($conf->global->FICHINTER_DISABLE_DETAILS) ? 1 : 0),
@@ -201,7 +203,7 @@ foreach ($arrayfields as $tmpkey => $tmpval)
 }
 
 $sql = "SELECT";
-$sql .= " f.ref, f.rowid, f.fk_statut as status, f.description, f.datec as date_creation, f.tms as date_update, f.note_private,";
+$sql .= " f.ref, f.rowid, f.fk_statut as status, f.description, f.datec as date_creation, f.tms as date_update, f.note_public, f.note_private,";
 if (empty($conf->global->FICHINTER_DISABLE_DETAILS) && $atleastonefieldinlines) $sql .= " fd.rowid as lineid, fd.description as descriptiondetail, fd.date as dp, fd.duree,";
 $sql .= " s.nom as name, s.rowid as socid, s.client, s.fournisseur, s.email, s.status as thirdpartystatus";
 if (!empty($conf->projet->enabled)) {
@@ -418,6 +420,18 @@ if ($resql)
 		print '<td class="liste_titre">';
 		print '</td>';
 	}
+	if (!empty($arrayfields['f.note_public']['checked']))
+	{
+		// Note public
+		print '<td class="liste_titre">';
+		print '</td>';
+	}
+	if (!empty($arrayfields['f.note_private']['checked']))
+	{
+		// Note private
+		print '<td class="liste_titre">';
+		print '</td>';
+	}
 	// Status
 	if (!empty($arrayfields['f.fk_statut']['checked']))
 	{
@@ -462,6 +476,8 @@ if ($resql)
 	print $hookmanager->resPrint;
 	if (!empty($arrayfields['f.datec']['checked']))     print_liste_field_titre($arrayfields['f.datec']['label'], $_SERVER["PHP_SELF"], "f.datec", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
 	if (!empty($arrayfields['f.tms']['checked']))       print_liste_field_titre($arrayfields['f.tms']['label'], $_SERVER["PHP_SELF"], "f.tms", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
+	if (!empty($arrayfields['f.note_public']['checked']))       print_liste_field_titre($arrayfields['f.note_public']['label'], $_SERVER["PHP_SELF"], "f.note_public", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
+	if (!empty($arrayfields['f.note_private']['checked']))       print_liste_field_titre($arrayfields['f.note_private']['label'], $_SERVER["PHP_SELF"], "f.note_private", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
 	if (!empty($arrayfields['f.fk_statut']['checked'])) print_liste_field_titre($arrayfields['f.fk_statut']['label'], $_SERVER["PHP_SELF"], "f.fk_statut", "", $param, '', $sortfield, $sortorder, 'right ');
 	if (!empty($arrayfields['fd.description']['checked'])) print_liste_field_titre($arrayfields['fd.description']['label'], $_SERVER["PHP_SELF"], '');
 	if (!empty($arrayfields['fd.date']['checked']))        print_liste_field_titre($arrayfields['fd.date']['label'], $_SERVER["PHP_SELF"], "fd.date", "", $param, '', $sortfield, $sortorder, 'center ');
@@ -587,6 +603,22 @@ if ($resql)
 			print '</td>';
 			if (!$i) $totalarray['nbfield']++;
 		}
+		// Note public
+		if (!empty($arrayfields['f.note_public']['checked']))
+		{
+			print '<td class="center">';
+			print dol_escape_htmltag($obj->note_public);
+			print '</td>';
+			if (!$i) $totalarray['nbfield']++;
+		}
+		// Note private
+		if (!empty($arrayfields['f.note_private']['checked']))
+		{
+			print '<td class="center">';
+			print dol_escape_htmltag($obj->note_private);
+			print '</td>';
+			if (!$i) $totalarray['nbfield']++;
+		}
 		// Status
 		if (!empty($arrayfields['f.fk_statut']['checked']))
 		{

From 805f06fe313c350a66838ee8cfab757e83229515 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 30 Sep 2020 12:54:05 +0200
Subject: [PATCH 061/101] Add token for GET on page to setup journal.

---
 htdocs/accountancy/admin/journals_list.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/htdocs/accountancy/admin/journals_list.php b/htdocs/accountancy/admin/journals_list.php
index a09a38c959c..687ca02c91d 100644
--- a/htdocs/accountancy/admin/journals_list.php
+++ b/htdocs/accountancy/admin/journals_list.php
@@ -22,6 +22,8 @@
  * \brief		Setup page to configure journals
  */
 
+if (! defined('CSRFCHECK_WITH_TOKEN'))     define('CSRFCHECK_WITH_TOKEN','1');		// Force use of CSRF protection with tokens even for GET
+
 require '../../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formadmin.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
@@ -636,19 +638,19 @@ if ($id)
 
 					// Active
 					print '<td class="nowrap center">';
-					if ($canbedisabled) print '<a href="'.$url.'action='.$acts[$obj->active].'">'.$actl[$obj->active].'</a>';
+					if ($canbedisabled) print '<a href="'.$url.'action='.$acts[$obj->active].'&token='.newToken().'">'.$actl[$obj->active].'</a>';
 					else print $langs->trans("AlwaysActive");
 					print "</td>";
 
 					// Modify link
-					if ($canbemodified) print '<td class="center"><a class="reposition editfielda" href="'.$url.'action=edit">'.img_edit().'</a></td>';
+					if ($canbemodified) print '<td class="center"><a class="reposition editfielda" href="'.$url.'action=edit&token='.newToken().'">'.img_edit().'</a></td>';
 					else print '<td>&nbsp;</td>';
 
 					// Delete link
 					if ($iserasable)
 					{
 						print '<td class="center">';
-						if ($user->admin) print '<a href="'.$url.'action=delete">'.img_delete().'</a>';
+						if ($user->admin) print '<a href="'.$url.'action=delete&token='.newToken().'">'.img_delete().'</a>';
 						//else print '<a href="#">'.img_delete().'</a>';    // Some dictionary can be edited by other profile than admin
 						print '</td>';
 					} else print '<td>&nbsp;</td>';

From 3187c38ba32bce763d4292f687a4aaab2f21ddc3 Mon Sep 17 00:00:00 2001
From: davidNDU <david.bensel@gmail.com>
Date: Wed, 30 Sep 2020 14:37:47 +0300
Subject: [PATCH 062/101] Add object Methods with module builder, add/modify
 user rights and left side menu

---
 htdocs/modulebuilder/template/class/myobject.class.php      | 6 ++++++
 .../modules/mymodule/doc/pdf_standard_myobject.modules.php  | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/htdocs/modulebuilder/template/class/myobject.class.php b/htdocs/modulebuilder/template/class/myobject.class.php
index 8465f804d5c..18ca9b5ea20 100644
--- a/htdocs/modulebuilder/template/class/myobject.class.php
+++ b/htdocs/modulebuilder/template/class/myobject.class.php
@@ -116,6 +116,7 @@ class MyObject extends CommonObject
 		'fk_user_creat' => array('type'=>'integer:User:user/class/user.class.php', 'label'=>'UserAuthor', 'enabled'=>1, 'visible'=>-2, 'notnull'=> 1, 'position'=>510, 'foreignkey'=>'user.rowid'),
 		'fk_user_modif' => array('type'=>'integer:User:user/class/user.class.php', 'label'=>'UserModif', 'enabled'=>1, 'visible'=>-2, 'notnull'=>-1, 'position'=>511),
 		//'fk_user_valid' => array('type'=>'integer:User:user/class/user.class.php',      'label'=>'UserValidation',        'enabled'=>1, 'visible'=>-1, 'position'=>512),
+		'last_main_doc' => array('type'=>'varchar(255)', 'label'=>'LastMainDoc', 'enabled'=>1, 'visible'=>0, 'notnull'=>0, 'position'=>600),
 		'import_key'    => array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>-2, 'notnull'=>-1, 'index'=>0, 'position'=>1000),
 		'model_pdf' 	=> array('type'=>'varchar(255)', 'label'=>'Model pdf', 'enabled'=>1, 'visible'=>0, 'notnull'=>-1, 'position'=>1010),
 		'status'        => array('type'=>'smallint', 'label'=>'Status', 'enabled'=>1, 'visible'=>1, 'notnull'=> 1, 'default'=>0, 'index'=>1, 'position'=>1000, 'arrayofkeyval'=>array(0=>'Draft', 1=>'Validated', 9=>'Canceled')),
@@ -171,6 +172,11 @@ class MyObject extends CommonObject
 	 */
 	public $fk_user_modif;
 
+	/**
+	 * @var string public $last_main_doc
+	 */
+	public $last_main_doc;
+
 	/**
 	 * @var string import_key
 	 */
diff --git a/htdocs/modulebuilder/template/core/modules/mymodule/doc/pdf_standard_myobject.modules.php b/htdocs/modulebuilder/template/core/modules/mymodule/doc/pdf_standard_myobject.modules.php
index f8fc8466349..694263e2ec5 100644
--- a/htdocs/modulebuilder/template/core/modules/mymodule/doc/pdf_standard_myobject.modules.php
+++ b/htdocs/modulebuilder/template/core/modules/mymodule/doc/pdf_standard_myobject.modules.php
@@ -899,7 +899,7 @@ class pdf_standard_myobject extends ModelePDFMyObject
 		pdf_pagehead($pdf, $outputlangs, $this->page_hauteur);
 
 		// Show Draft Watermark
-		if ($object->statut == Facture::STATUS_DRAFT && (!empty($conf->global->FACTURE_DRAFT_WATERMARK)))
+		if ($object->statut == $object::STATUS_DRAFT && (!empty($conf->global->FACTURE_DRAFT_WATERMARK)))
         {
 		      pdf_watermark($pdf, $outputlangs, $this->page_hauteur, $this->page_largeur, 'mm', $conf->global->FACTURE_DRAFT_WATERMARK);
         }
@@ -959,7 +959,7 @@ class pdf_standard_myobject extends ModelePDFMyObject
 		$pdf->SetXY($posx, $posy);
 		$pdf->SetTextColor(0, 0, 60);
 		$textref = $outputlangs->transnoentities("Ref")." : ".$outputlangs->convToOutputCharset($object->ref);
-		if ($object->statut == Facture::STATUS_DRAFT)
+		if ($object->statut == $object::STATUS_DRAFT)
 		{
 			$pdf->SetTextColor(128, 0, 0);
 			$textref .= ' - '.$outputlangs->transnoentities("NotValidated");

From 6b539dfad0f15a4b3a35c0d0a3c7686ad9a68740 Mon Sep 17 00:00:00 2001
From: Florian HENRY <florian.henry@open-concept.pro>
Date: Wed, 30 Sep 2020 13:53:27 +0200
Subject: [PATCH 063/101] fix remove php warning non-numeric value

---
 htdocs/product/stock/replenish.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/htdocs/product/stock/replenish.php b/htdocs/product/stock/replenish.php
index 98b9f54b2ff..9ad848cf535 100644
--- a/htdocs/product/stock/replenish.php
+++ b/htdocs/product/stock/replenish.php
@@ -768,6 +768,7 @@ while ($i < ($limit ? min($num, $limit) : $num))
 			}
 		}
 
+		$stockwarehouse=0;
 		if ($usevirtualstock)
 		{
 			// If option to increase/decrease is not on an object validation, virtual stock may differs from physical stock.
@@ -793,8 +794,8 @@ while ($i < ($limit ? min($num, $limit) : $num))
 
 		$desiredstock = $objp->desiredstock;
 		$alertstock = $objp->seuil_stock_alerte;
-		$desiredstockwarehouse = ($objp->desiredstockpse ? $objp->desiredstockpse : '');
-		$alertstockwarehouse = ($objp->seuil_stock_alertepse ? $objp->seuil_stock_alertepse : '');
+		$desiredstockwarehouse = ($objp->desiredstockpse ? $objp->desiredstockpse : 0);
+		$alertstockwarehouse = ($objp->seuil_stock_alertepse ? $objp->seuil_stock_alertepse : 0);
 
 		$warning = '';
 		if ($alertstock && ($stock < $alertstock))

From 27c90abc0b79e85f5cd2abce637576e0053161b1 Mon Sep 17 00:00:00 2001
From: "Sekan, Tobias" <tobias.sekan@startmail.com>
Date: Wed, 30 Sep 2020 14:54:24 +0200
Subject: [PATCH 064/101] address feedback

---
 htdocs/projet/class/project.class.php | 36 +++++++++++++++++++--------
 htdocs/projet/list.php                | 14 ++---------
 2 files changed, 28 insertions(+), 22 deletions(-)

diff --git a/htdocs/projet/class/project.class.php b/htdocs/projet/class/project.class.php
index 54a8b56fe23..a4a419a44ba 100644
--- a/htdocs/projet/class/project.class.php
+++ b/htdocs/projet/class/project.class.php
@@ -179,34 +179,34 @@ class Project extends CommonObject
 	 * @var array  Array with all fields and their property. Do not use it as a static var. It may be modified by constructor.
 	 */
 	public $fields=array(
-		'rowid' =>array('type'=>'integer', 'label'=>'ID', 'enabled'=>1, 'visible'=>0, 'notnull'=>1, 'position'=>10),
-		'fk_soc' =>array('type'=>'integer', 'label'=>'Fk soc', 'enabled'=>1, 'visible'=>0, 'position'=>15),
+		'rowid' =>array('type'=>'integer', 'label'=>'ID', 'enabled'=>1, 'visible'=>-1, 'notnull'=>1, 'position'=>10),
+		'fk_soc' =>array('type'=>'integer', 'label'=>'Fk soc', 'enabled'=>1, 'visible'=>3, 'position'=>15),
 		'datec' =>array('type'=>'datetime', 'label'=>'DateCreationShort', 'enabled'=>1, 'visible'=>1, 'position'=>20),
 		'tms' =>array('type'=>'timestamp', 'label'=>'DateModificationShort', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>25),
 		'dateo' =>array('type'=>'date', 'label'=>'DateStart', 'enabled'=>1, 'visible'=>1, 'position'=>30),
 		'datee' =>array('type'=>'date', 'label'=>'DateEnd', 'enabled'=>1, 'visible'=>1, 'position'=>35),
 		'ref' =>array('type'=>'varchar(50)', 'label'=>'Ref', 'enabled'=>1, 'visible'=>1, 'showoncombobox'=>1, 'position'=>40, 'searchall'=>1),
-		'entity' =>array('type'=>'integer', 'label'=>'Entity', 'default'=>1, 'enabled'=>1, 'visible'=>0, 'notnull'=>1, 'position'=>45),
+		'entity' =>array('type'=>'integer', 'label'=>'Entity', 'default'=>1, 'enabled'=>1, 'visible'=>3, 'notnull'=>1, 'position'=>45),
 		'title' =>array('type'=>'varchar(255)', 'label'=>'Label', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>50, 'showoncombobox'=>1, 'searchall'=>1),
 		'description' =>array('type'=>'text', 'label'=>'Description', 'enabled'=>1, 'visible'=>3, 'position'=>55, 'searchall'=>1),
-		'fk_user_creat' =>array('type'=>'integer', 'label'=>'Fk user creat', 'enabled'=>1, 'visible'=>0, 'notnull'=>1, 'position'=>60),
+		'fk_user_creat' =>array('type'=>'integer', 'label'=>'Fk user creat', 'enabled'=>1, 'visible'=>3, 'notnull'=>1, 'position'=>60),
 		'public' =>array('type'=>'integer', 'label'=>'Visibility', 'enabled'=>1, 'visible'=>1, 'position'=>65),
 		'fk_statut' =>array('type'=>'smallint(6)', 'label'=>'Status', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>500),
 		'fk_opp_status' =>array('type'=>'integer', 'label'=>'OpportunityStatusShort', 'enabled'=>1, 'visible'=>1, 'position'=>75),
 		'opp_percent' =>array('type'=>'double(5,2)', 'label'=>'OpportunityProbabilityShort', 'enabled'=>1, 'visible'=>1, 'position'=>80),
 		'note_private' =>array('type'=>'text', 'label'=>'NotePrivate', 'enabled'=>1, 'visible'=>3, 'position'=>85, 'searchall'=>1),
 		'note_public' =>array('type'=>'text', 'label'=>'NotePublic', 'enabled'=>1, 'visible'=>3, 'position'=>90, 'searchall'=>1),
-		'model_pdf' =>array('type'=>'varchar(255)', 'label'=>'Model pdf', 'enabled'=>1, 'visible'=>0, 'position'=>95),
+		'model_pdf' =>array('type'=>'varchar(255)', 'label'=>'Model pdf', 'enabled'=>1, 'visible'=>3, 'position'=>95),
 		'budget_amount' =>array('type'=>'double(24,8)', 'label'=>'Budget', 'enabled'=>1, 'visible'=>1, 'position'=>100),
-		'date_close' =>array('type'=>'datetime', 'label'=>'Date close', 'enabled'=>1, 'visible'=>0, 'position'=>105),
-		'fk_user_close' =>array('type'=>'integer', 'label'=>'Fk user close', 'enabled'=>1, 'visible'=>0, 'position'=>110),
+		'date_close' =>array('type'=>'datetime', 'label'=>'Date close', 'enabled'=>1, 'visible'=>3, 'position'=>105),
+		'fk_user_close' =>array('type'=>'integer', 'label'=>'Fk user close', 'enabled'=>1, 'visible'=>3, 'position'=>110),
 		'opp_amount' =>array('type'=>'double(24,8)', 'label'=>'OpportunityAmountShort', 'enabled'=>1, 'visible'=>1, 'position'=>115),
-		'import_key' =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>0, 'position'=>120),
-		'fk_user_modif' =>array('type'=>'integer', 'label'=>'Fk user modif', 'enabled'=>1, 'visible'=>0, 'position'=>125),
+		'import_key' =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>3, 'position'=>120),
+		'fk_user_modif' =>array('type'=>'integer', 'label'=>'Fk user modif', 'enabled'=>1, 'visible'=>3, 'position'=>125),
 		'usage_bill_time' =>array('type'=>'integer', 'label'=>'UsageBillTimeShort', 'enabled'=>1, 'visible'=>1, 'position'=>130),
 		'usage_opportunity' =>array('type'=>'integer', 'label'=>'UsageOpportunity', 'enabled'=>1, 'visible'=>1, 'position'=>135),
 		'usage_task' =>array('type'=>'integer', 'label'=>'UsageTasks', 'enabled'=>1, 'visible'=>1, 'position'=>140),
-		'usage_organize_event' =>array('type'=>'integer', 'label'=>'Usage organize event', 'enabled'=>1, 'visible'=>0, 'position'=>145),
+		'usage_organize_event' =>array('type'=>'integer', 'label'=>'Usage organize event', 'enabled'=>1, 'visible'=>3, 'position'=>145),
 	);
 	// END MODULEBUILDER PROPERTIES
 
@@ -236,6 +236,22 @@ class Project extends CommonObject
 
 		$this->statuts_short = array(0 => 'Draft', 1 => 'Opened', 2 => 'Closed');
 		$this->statuts_long = array(0 => 'Draft', 1 => 'Opened', 2 => 'Closed');
+		
+		global $conf;
+
+		if (empty($conf->global->MAIN_SHOW_TECHNICAL_ID)) $this->fields['rowid']['visible'] = 0;
+
+		if (!empty($conf->global->PROJECT_USE_OPPORTUNITIES)) {
+			$this->fields['fk_opp_status']['enabled'] = 0;
+			$this->fields['opp_percent']['enabled'] = 0;
+			$this->fields['opp_amount']['enabled'] = 0;
+			$this->fields['usage_opportunity']['enabled'] = 0;
+		}
+
+		if (empty($conf->global->PROJECT_HIDE_TASKS)) {
+			$this->fields['usage_bill_time']['visible'] = 0;
+			$this->fields['usage_task']['visible'] = 0;
+		}
 	}
 
 	/**
diff --git a/htdocs/projet/list.php b/htdocs/projet/list.php
index 07da8cba855..40690ab1833 100644
--- a/htdocs/projet/list.php
+++ b/htdocs/projet/list.php
@@ -124,8 +124,7 @@ $search_array_options = $extrafields->getOptionalsFromPost($object->table_elemen
 
 // List of fields to search into when doing a "search in all"
 $fieldstosearchall = array();
-foreach ($object->fields as $key => $val)
-{
+foreach ($object->fields as $key => $val) {
 	if (empty($val['searchall'])) {
 		continue;
 	}
@@ -143,21 +142,12 @@ $fieldstosearchall['s.nom'] = "ThirdPartyName";
 
 // Definition of fields for list
 $arrayfields = array();
-foreach ($object->fields as $key => $val)
-{
+foreach ($object->fields as $key => $val) {
 	// If $val['visible']==0, then we never show the field
 	if (empty($val['visible'])) {
 		continue;
 	}
 
-	// Visibility based on global settings
-	if(empty($conf->global->PROJECT_USE_OPPORTUNITIES) && $key == 'fk_opp_status') continue;
-	if(empty($conf->global->PROJECT_USE_OPPORTUNITIES) && $key == 'opp_percent') continue;
-	if(empty($conf->global->PROJECT_USE_OPPORTUNITIES) && $key == 'opp_amount') continue;
-	if(empty($conf->global->PROJECT_USE_OPPORTUNITIES) && $key == 'usage_opportunity') continue;
-	if(!empty($conf->global->PROJECT_HIDE_TASKS) && $key == 'usage_bill_time') continue;
-	if(!empty($conf->global->PROJECT_HIDE_TASKS) && $key == 'usage_task') continue;
-
 	$arrayfields['p.'.$key] = array(
 		'label'=>$val['label'],
 		'checked'=>(($val['visible'] < 0) ? 0 : 1),

From fd8e7fdfe31504523c81ac9d5beeab2545b899c6 Mon Sep 17 00:00:00 2001
From: stickler-ci <support@stickler-ci.com>
Date: Wed, 30 Sep 2020 12:57:36 +0000
Subject: [PATCH 065/101] Fixing style errors.

---
 htdocs/projet/class/project.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/projet/class/project.class.php b/htdocs/projet/class/project.class.php
index a4a419a44ba..cc7e57a89df 100644
--- a/htdocs/projet/class/project.class.php
+++ b/htdocs/projet/class/project.class.php
@@ -236,7 +236,7 @@ class Project extends CommonObject
 
 		$this->statuts_short = array(0 => 'Draft', 1 => 'Opened', 2 => 'Closed');
 		$this->statuts_long = array(0 => 'Draft', 1 => 'Opened', 2 => 'Closed');
-		
+
 		global $conf;
 
 		if (empty($conf->global->MAIN_SHOW_TECHNICAL_ID)) $this->fields['rowid']['visible'] = 0;

From 259737f08218d11dd53ff30434911708e5d93154 Mon Sep 17 00:00:00 2001
From: lvessiller <lvessiller@open-dsi.fr>
Date: Wed, 30 Sep 2020 15:09:45 +0200
Subject: [PATCH 066/101] FIX set paid on total discount of a product in cash
 desk

---
 htdocs/takepos/invoice.php | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/htdocs/takepos/invoice.php b/htdocs/takepos/invoice.php
index 2b8b0f21921..e1afc524cb1 100644
--- a/htdocs/takepos/invoice.php
+++ b/htdocs/takepos/invoice.php
@@ -153,22 +153,23 @@ if ($action == 'valid' && $user->rights->facture->creer)
 	    $res = $invoice->validate($user);
 	}
 
-	$remaintopay = $invoice->getRemainToPay();
-
 	// Add the payment
-	if ($res >= 0 && $remaintopay > 0) {
-		$payment = new Paiement($db);
-		$payment->datepaye = $now;
-		$payment->fk_account = $bankaccount;
-		$payment->amounts[$invoice->id] = $amountofpayment;
+	if ($res >= 0) {
+		$remaintopay = $invoice->getRemainToPay();
+		if ($remaintopay > 0) {
+			$payment = new Paiement($db);
+			$payment->datepaye = $now;
+			$payment->fk_account = $bankaccount;
+			$payment->amounts[$invoice->id] = $amountofpayment;
 
-		$payment->paiementid = $paiementid;
-		$payment->num_payment = $invoice->ref;
+			$payment->paiementid = $paiementid;
+			$payment->num_payment = $invoice->ref;
 
-		$payment->create($user);
-		$payment->addPaymentToBank($user, 'payment', '(CustomerInvoicePayment)', $bankaccount, '', '');
+			$payment->create($user);
+			$payment->addPaymentToBank($user, 'payment', '(CustomerInvoicePayment)', $bankaccount, '', '');
+			$remaintopay = $invoice->getRemainToPay();    // Recalculate remain to pay after the payment is recorded
+		}
 
-		$remaintopay = $invoice->getRemainToPay();	// Recalculate remain to pay after the payment is recorded
 		if ($remaintopay == 0) {
 			dol_syslog("Invoice is paid, so we set it to status Paid");
 			$result = $invoice->set_paid($user);

From f442dac2c92bc0db1fcf5709d36a71004152344d Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 30 Sep 2020 15:13:28 +0200
Subject: [PATCH 067/101] Add token on most GET url for admin action

---
 htdocs/accountancy/admin/index.php            | 36 +++++++++----------
 htdocs/accountancy/bookkeeping/list.php       |  4 +--
 htdocs/adherents/admin/website.php            |  4 +--
 htdocs/admin/agenda_other.php                 |  8 ++---
 htdocs/admin/agenda_reminder.php              | 12 +++----
 htdocs/admin/bank.php                         | 14 ++++----
 htdocs/admin/barcode.php                      |  4 +--
 htdocs/admin/bom.php                          |  8 ++---
 htdocs/admin/chequereceipts.php               |  2 +-
 htdocs/admin/commande.php                     | 18 +++++-----
 htdocs/admin/contract.php                     |  6 ++--
 htdocs/admin/defaultvalues.php                |  4 +--
 htdocs/admin/ecm.php                          |  4 +--
 htdocs/admin/expedition.php                   |  6 ++--
 htdocs/admin/expensereport.php                |  8 ++---
 htdocs/admin/facture.php                      |  8 ++---
 htdocs/admin/fichinter.php                    |  8 ++---
 htdocs/admin/holiday.php                      |  6 ++--
 htdocs/admin/livraison.php                    |  8 ++---
 htdocs/admin/mailman.php                      |  4 +--
 htdocs/admin/modules.php                      |  2 +-
 htdocs/admin/mrp.php                          |  8 ++---
 htdocs/admin/payment.php                      |  2 +-
 htdocs/admin/paymentbybanktransfer.php        |  4 +--
 htdocs/admin/prelevement.php                  |  4 +--
 htdocs/admin/propal.php                       | 12 +++----
 htdocs/admin/reception_setup.php              |  8 ++---
 htdocs/admin/security.php                     |  2 +-
 htdocs/admin/security_other.php               |  8 ++---
 htdocs/admin/spip.php                         |  4 +--
 htdocs/admin/stock.php                        |  6 ++--
 htdocs/admin/supplier_invoice.php             |  8 ++---
 htdocs/admin/supplier_order.php               | 10 +++---
 htdocs/admin/supplier_payment.php             |  8 ++---
 htdocs/admin/supplier_proposal.php            | 12 +++----
 htdocs/admin/ticket.php                       |  2 +-
 htdocs/admin/ticket_public.php                |  4 +--
 htdocs/admin/translation.php                  |  4 +--
 htdocs/admin/user.php                         | 10 +++---
 htdocs/admin/usergroup.php                    |  6 ++--
 htdocs/admin/workflow.php                     |  4 +--
 htdocs/api/admin/index.php                    |  4 +--
 htdocs/bom/bom_card.php                       |  6 ++--
 htdocs/comm/card.php                          |  2 +-
 htdocs/compta/prelevement/card.php            |  6 ++--
 htdocs/contact/card.php                       |  2 +-
 htdocs/contact/list.php                       |  2 +-
 htdocs/core/lib/ajax.lib.php                  |  4 +--
 .../modules/printing/printgcp.modules.php     |  2 +-
 .../modules/printing/printipp.modules.php     |  2 +-
 htdocs/don/admin/donation.php                 |  6 ++--
 htdocs/don/card.php                           |  4 +--
 htdocs/expensereport/card.php                 | 18 +++++-----
 htdocs/margin/admin/margin.php                |  8 ++---
 htdocs/modulebuilder/admin/setup.php          |  4 +--
 htdocs/modulebuilder/index.php                |  2 +-
 htdocs/modulebuilder/template/admin/setup.php |  8 ++---
 htdocs/paypal/admin/paypal.php                |  4 +--
 htdocs/printing/admin/printing.php            |  4 +--
 htdocs/product/admin/product.php              | 10 +++---
 htdocs/projet/admin/project.php               | 14 ++++----
 htdocs/recruitment/admin/public_interface.php |  4 +--
 htdocs/recruitment/admin/setup.php            |  8 ++---
 .../recruitment/admin/setup_candidatures.php  |  8 ++---
 htdocs/societe/admin/societe.php              | 32 ++++++++---------
 htdocs/societe/list.php                       |  2 +-
 htdocs/societe/paymentmodes.php               |  6 ++--
 htdocs/takepos/admin/receipt.php              |  6 ++--
 htdocs/takepos/admin/setup.php                |  2 +-
 htdocs/theme/eldy/btn.inc.php                 |  4 ++-
 htdocs/ticket/class/actions_ticket.class.php  |  2 +-
 htdocs/website/index.php                      | 10 +++---
 72 files changed, 249 insertions(+), 247 deletions(-)

diff --git a/htdocs/accountancy/admin/index.php b/htdocs/accountancy/admin/index.php
index e5c104298bf..516af988334 100644
--- a/htdocs/accountancy/admin/index.php
+++ b/htdocs/accountancy/admin/index.php
@@ -237,11 +237,11 @@ print "</tr>\n";
 print '<tr>';
 print '<td>'.$langs->trans("ACCOUNTING_ENABLE_EXPORT_DRAFT_JOURNAL").'</td>';
 if (!empty($conf->global->ACCOUNTING_ENABLE_EXPORT_DRAFT_JOURNAL)) {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setenabledraftexport&value=0">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&enabledraftexport&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 	print '</a></td>';
 } else {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setenabledraftexport&value=1">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&enabledraftexport&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 	print '</a></td>';
 }
@@ -251,11 +251,11 @@ print '</tr>';
 print '<tr class="oddeven">';
 print '<td>'.$langs->trans("BANK_DISABLE_DIRECT_INPUT").'</td>';
 if (!empty($conf->global->BANK_DISABLE_DIRECT_INPUT)) {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisabledirectinput&value=0">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&disabledirectinput&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 	print '</a></td>';
 } else {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisabledirectinput&value=1">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&disabledirectinput&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 	print '</a></td>';
 }
@@ -264,11 +264,11 @@ print '</tr>';
 print '<tr class="oddeven">';
 print '<td>'.$langs->trans("ACCOUNTANCY_COMBO_FOR_AUX").'</td>';
 if (!empty($conf->global->ACCOUNTANCY_COMBO_FOR_AUX)) {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setenablesubsidiarylist&value=0">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&enablesubsidiarylist&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 	print '</a></td>';
 } else {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setenablesubsidiarylist&value=1">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&enablesubsidiarylist&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 	print '</a></td>';
 }
@@ -277,11 +277,11 @@ print '</tr>';
 print '<tr class="oddeven">';
 print '<td>'.$langs->trans("ACCOUNTING_MANAGE_ZERO").'</td>';
 if (!empty($conf->global->ACCOUNTING_MANAGE_ZERO)) {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setmanagezero&value=0">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&managezero&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 	print '</a></td>';
 } else {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setmanagezero&value=1">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&managezero&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 	print '</a></td>';
 }
@@ -317,11 +317,11 @@ print "</tr>\n";
 print '<tr class="oddeven">';
 print '<td>'.$langs->trans("ACCOUNTING_LIST_SORT_VENTILATION_TODO").'</td>';
 if (!empty($conf->global->ACCOUNTING_LIST_SORT_VENTILATION_TODO)) {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setlistsorttodo&value=0">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&listsorttodo&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 	print '</a></td>';
 } else {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setlistsorttodo&value=1">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&listsorttodo&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 	print '</a></td>';
 }
@@ -330,11 +330,11 @@ print '</tr>';
 print '<tr class="oddeven">';
 print '<td>'.$langs->trans("ACCOUNTING_LIST_SORT_VENTILATION_DONE").'</td>';
 if (!empty($conf->global->ACCOUNTING_LIST_SORT_VENTILATION_DONE)) {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setlistsortdone&value=0">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&listsortdone&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 	print '</a></td>';
 } else {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setlistsortdone&value=1">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&listsortdone&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 	print '</a></td>';
 }
@@ -366,11 +366,11 @@ foreach ($list_binding as $key)
 print '<tr class="oddeven">';
 print '<td>'.$langs->trans("ACCOUNTING_DISABLE_BINDING_ON_SALES").'</td>';
 if (!empty($conf->global->ACCOUNTING_DISABLE_BINDING_ON_SALES)) {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisablebindingonsales&value=0">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&disablebindingonsales&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 	print '</a></td>';
 } else {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisablebindingonsales&value=1">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&disablebindingonsales&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 	print '</a></td>';
 }
@@ -379,11 +379,11 @@ print '</tr>';
 print '<tr class="oddeven">';
 print '<td>'.$langs->trans("ACCOUNTING_DISABLE_BINDING_ON_PURCHASES").'</td>';
 if (!empty($conf->global->ACCOUNTING_DISABLE_BINDING_ON_PURCHASES)) {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisablebindingonpurchases&value=0">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&disablebindingonpurchases&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 	print '</a></td>';
 } else {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisablebindingonpurchases&value=1">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&disablebindingonpurchases&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 	print '</a></td>';
 }
@@ -392,11 +392,11 @@ print '</tr>';
 print '<tr class="oddeven">';
 print '<td>'.$langs->trans("ACCOUNTING_DISABLE_BINDING_ON_EXPENSEREPORTS").'</td>';
 if (!empty($conf->global->ACCOUNTING_DISABLE_BINDING_ON_EXPENSEREPORTS)) {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisablebindingonexpensereports&value=0">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&disablebindingonexpensereports&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 	print '</a></td>';
 } else {
-	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisablebindingonexpensereports&value=1">';
+	print '<td class="right"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?token='.newToken().'&disablebindingonexpensereports&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 	print '</a></td>';
 }
diff --git a/htdocs/accountancy/bookkeeping/list.php b/htdocs/accountancy/bookkeeping/list.php
index 5ae9c3d4742..813dbd4a37f 100644
--- a/htdocs/accountancy/bookkeeping/list.php
+++ b/htdocs/accountancy/bookkeeping/list.php
@@ -630,9 +630,9 @@ else $buttonLabel = $langs->trans("ExportList");
 
 // Button re-export
 if (!empty($conf->global->ACCOUNTING_REEXPORT)) {
-    $newcardbutton = '<a class="valignmiddle" href="'.$_SERVER['PHP_SELF'].'?action=setreexport&value=0'.($param ? '&'.$param : '').'">'.img_picto($langs->trans("Activated"), 'switch_on').'</a> ';
+    $newcardbutton = '<a class="valignmiddle" href="'.$_SERVER['PHP_SELF'].'?action=setreexport&token='.newToken().'&value=0'.($param ? '&'.$param : '').'">'.img_picto($langs->trans("Activated"), 'switch_on').'</a> ';
 } else {
-    $newcardbutton = '<a class="valignmiddle" href="'.$_SERVER['PHP_SELF'].'?action=setreexport&value=1'.($param ? '&'.$param : '').'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a> ';
+    $newcardbutton = '<a class="valignmiddle" href="'.$_SERVER['PHP_SELF'].'?action=setreexport&token='.newToken().'&value=1'.($param ? '&'.$param : '').'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a> ';
 }
 $newcardbutton .= '<span class="valignmiddle marginrightonly">'.$langs->trans("IncludeDocsAlreadyExported").'</span>';
 
diff --git a/htdocs/adherents/admin/website.php b/htdocs/adherents/admin/website.php
index 64f16f8ef57..d030c73f530 100644
--- a/htdocs/adherents/admin/website.php
+++ b/htdocs/adherents/admin/website.php
@@ -137,12 +137,12 @@ print '<span class="opacitymedium">'.$langs->trans("BlankSubscriptionFormDesc").
 $enabledisablehtml = $langs->trans("EnablePublicSubscriptionForm").' ';
 if (empty($conf->global->MEMBER_ENABLE_PUBLIC)) {
 	// Button off, click to enable
-	$enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMEMBER_ENABLE_PUBLIC&value=1'.$param.'">';
+	$enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMEMBER_ENABLE_PUBLIC&token='.newToken().'&value=1'.$param.'">';
 	$enabledisablehtml .= img_picto($langs->trans("Disabled"), 'switch_off');
 	$enabledisablehtml .= '</a>';
 } else {
 	// Button on, click to disable
-	$enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMEMBER_ENABLE_PUBLIC&value=0'.$param.'">';
+	$enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMEMBER_ENABLE_PUBLIC&token='.newToken().'&value=0'.$param.'">';
 	$enabledisablehtml .= img_picto($langs->trans("Activated"), 'switch_on');
 	$enabledisablehtml .= '</a>';
 }
diff --git a/htdocs/admin/agenda_other.php b/htdocs/admin/agenda_other.php
index cd7e1752274..48368af45f2 100644
--- a/htdocs/admin/agenda_other.php
+++ b/htdocs/admin/agenda_other.php
@@ -268,7 +268,7 @@ if ($conf->global->MAIN_FEATURES_LEVEL >= 2)
             				print "</td>";
             			} else {
             				print '<td class="center">'."\n";
-            				print '<a href="'.$_SERVER["PHP_SELF"].'?action=setmodel&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=action">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+            				print '<a href="'.$_SERVER["PHP_SELF"].'?action=setmodel&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=action">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
             				print "</td>";
             			}
 
@@ -278,7 +278,7 @@ if ($conf->global->MAIN_FEATURES_LEVEL >= 2)
             			{
             				print img_picto($langs->trans("Default"), 'on');
             			} else {
-            				print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=action"" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+            				print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=action"" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
             			}
             			print '</td>';
 
@@ -325,9 +325,9 @@ print '<td class="right">'."\n";
 //print ajax_constantonoff('AGENDA_USE_EVENT_TYPE');	Do not use ajax here, we need to reload page to change other combo list
 if (empty($conf->global->AGENDA_USE_EVENT_TYPE))
 {
-	print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_AGENDA_USE_EVENT_TYPE">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+	print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_AGENDA_USE_EVENT_TYPE&amp;token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 } else {
-	print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_AGENDA_USE_EVENT_TYPE">'.img_picto($langs->trans("Enabled"), 'switch_on').'</a>';
+	print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_AGENDA_USE_EVENT_TYPE&amp;token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'switch_on').'</a>';
 }
 print '</td></tr>'."\n";
 
diff --git a/htdocs/admin/agenda_reminder.php b/htdocs/admin/agenda_reminder.php
index 982387b2ed6..e4b3c59781c 100644
--- a/htdocs/admin/agenda_reminder.php
+++ b/htdocs/admin/agenda_reminder.php
@@ -189,10 +189,10 @@ if ($conf->global->MAIN_FEATURES_LEVEL == 2)
 	print '<td class="right">'."\n";
 
 	if (empty($conf->global->AGENDA_REMINDER_EMAIL)) {
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_AGENDA_REMINDER_EMAIL">'.img_picto($langs->trans('Disabled'), 'switch_off').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_AGENDA_REMINDER_EMAIL&amp;token='.newToken().'">'.img_picto($langs->trans('Disabled'), 'switch_off').'</a>';
 		print '</td></tr>'."\n";
 	} else {
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_AGENDA_REMINDER_EMAIL">'.img_picto($langs->trans('Enabled'), 'switch_on').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_AGENDA_REMINDER_EMAIL&amp;token='.newToken().'">'.img_picto($langs->trans('Enabled'), 'switch_on').'</a>';
 		print '</td></tr>'."\n";
 	}
 }
@@ -206,10 +206,10 @@ if ($conf->global->MAIN_FEATURES_LEVEL == 2)
     print '<td class="right">'."\n";
 
     if (empty($conf->global->AGENDA_REMINDER_BROWSER)) {
-        print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_AGENDA_REMINDER_BROWSER">'.img_picto($langs->trans('Disabled'), 'switch_off').'</a>';
+        print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_AGENDA_REMINDER_BROWSER&amp;token='.newToken().'">'.img_picto($langs->trans('Disabled'), 'switch_off').'</a>';
         print '</td></tr>'."\n";
     } else {
-        print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_AGENDA_REMINDER_BROWSER">'.img_picto($langs->trans('Enabled'), 'switch_on').'</a>';
+        print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_AGENDA_REMINDER_BROWSER&amp;token='.newToken().'">'.img_picto($langs->trans('Enabled'), 'switch_on').'</a>';
         print '</td></tr>'."\n";
 
         print '<tr class="oddeven">'."\n";
@@ -218,9 +218,9 @@ if ($conf->global->MAIN_FEATURES_LEVEL == 2)
         print '<td class="right">'."\n";
 
         if (empty($conf->global->AGENDA_REMINDER_BROWSER_SOUND)) {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_AGENDA_REMINDER_BROWSER_SOUND">'.img_picto($langs->trans('Disabled'), 'switch_off').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_AGENDA_REMINDER_BROWSER_SOUND&amp;token='.newToken().'">'.img_picto($langs->trans('Disabled'), 'switch_off').'</a>';
         } else {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_AGENDA_REMINDER_BROWSER_SOUND">'.img_picto($langs->trans('Enabled'), 'switch_on').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_AGENDA_REMINDER_BROWSER_SOUND&amp;token='.newToken().'">'.img_picto($langs->trans('Enabled'), 'switch_on').'</a>';
         }
 
         print '</td></tr>'."\n";
diff --git a/htdocs/admin/bank.php b/htdocs/admin/bank.php
index 6f669d900ba..772ef604ab5 100644
--- a/htdocs/admin/bank.php
+++ b/htdocs/admin/bank.php
@@ -258,7 +258,7 @@ while ($i < $nbofbank) {
 		print img_picto($langs->trans("Activated"), 'on');
 		print '</td>';
 	} else {
-		print '<td class="center"><a href="'.$_SERVER['PHP_SELF'].'?action=setbankorder&amp;value='.$i.'">';
+		print '<td class="center"><a href="'.$_SERVER['PHP_SELF'].'?action=setbankorder&amp;token='.newToken().'&amp;value='.$i.'">';
 		print img_picto($langs->trans("Disabled"), 'off');
 		print '</a></td>';
 	}
@@ -350,13 +350,13 @@ foreach ($dirmodels as $reldir) {
 								// Active
 								if (in_array($name, $def)) {
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&value='.$name.'">';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'">';
 									print img_picto($langs->trans("Enabled"), 'switch_on');
 									print '</a>';
 									print '</td>';
 								} else {
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;value='.$name.'&amp;token='.newToken().'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 									print "</td>";
 								}
 
@@ -365,7 +365,7 @@ foreach ($dirmodels as $reldir) {
 								if ($conf->global->BANKADDON_PDF == $name) {
 									print img_picto($langs->trans("Default"), 'on');
 								} else {
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 								}
 								print '</td>';
 
@@ -424,13 +424,13 @@ print "</td>";
 // Active
 if ($conf->global->BANK_COLORIZE_MOVEMENT) {
 	print '<td class="center">'."\n";
-	print '<a href="'.$_SERVER["PHP_SELF"].'?action=unsetbankcolorizemovement">';
+	print '<a href="'.$_SERVER["PHP_SELF"].'?action=unsetbankcolorizemovement&amp;token='.newToken().'">';
 	print img_picto($langs->trans("Enabled"), 'switch_on');
 	print '</a>';
 	print '</td>';
 } else {
 	print '<td class="center">'."\n";
-	print '<a href="'.$_SERVER["PHP_SELF"].'?action=setbankcolorizemovement">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+	print '<a href="'.$_SERVER["PHP_SELF"].'?action=setbankcolorizemovement&amp;token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 	print "</td>";
 }
 
@@ -483,7 +483,7 @@ print '</td>';
 // Active
 if ($conf->global->BANK_REPORT_LAST_NUM_RELEVE) {
 	print '<td class="center">'."\n";
-	print '<a href="'.$_SERVER["PHP_SELF"].'?action=unsetreportlastnumreleve">';
+	print '<a href="'.$_SERVER["PHP_SELF"].'?action=unsetreportlastnumreleve&amp;token='.newToken().'">';
 	print img_picto($langs->trans("Enabled"), 'switch_on');
 	print '</a>';
 	print '</td>';
diff --git a/htdocs/admin/barcode.php b/htdocs/admin/barcode.php
index cddb91d0d49..529e3289a31 100644
--- a/htdocs/admin/barcode.php
+++ b/htdocs/admin/barcode.php
@@ -396,11 +396,11 @@ if ($conf->product->enabled)
 
 	    			if ($conf->global->BARCODE_PRODUCT_ADDON_NUM == "$file")
 	    			{
-	    				print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setbarcodeproductoff&amp;value='.$file.'">';
+	    				print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setbarcodeproductoff&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
 	    				print img_picto($langs->trans("Activated"), 'switch_on');
 	    				print '</a></td>';
 	    			} else {
-	    				print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setbarcodeproducton&amp;value='.$file.'">';
+	    				print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setbarcodeproducto&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
 	    				print img_picto($langs->trans("Disabled"), 'switch_off');
 	    				print '</a></td>';
 	    			}
diff --git a/htdocs/admin/bom.php b/htdocs/admin/bom.php
index 50c919a628a..3f331286aa2 100644
--- a/htdocs/admin/bom.php
+++ b/htdocs/admin/bom.php
@@ -242,7 +242,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$file.'">';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
 							print img_picto($langs->trans("Disabled"), 'switch_off');
 							print '</a>';
 						}
@@ -370,13 +370,13 @@ foreach ($dirmodels as $reldir)
 								if (in_array($name, $def))
 								{
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&value='.$name.'">';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'">';
 									print img_picto($langs->trans("Enabled"), 'switch_on');
 									print '</a>';
 									print '</td>';
 								} else {
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 									print "</td>";
 								}
 
@@ -386,7 +386,7 @@ foreach ($dirmodels as $reldir)
 								{
 									print img_picto($langs->trans("Default"), 'on');
 								} else {
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 								}
 								print '</td>';
 
diff --git a/htdocs/admin/chequereceipts.php b/htdocs/admin/chequereceipts.php
index 096ffbe02c8..6de752518c0 100644
--- a/htdocs/admin/chequereceipts.php
+++ b/htdocs/admin/chequereceipts.php
@@ -178,7 +178,7 @@ foreach ($dirmodels as $reldir)
 							{
 								print img_picto($langs->trans("Activated"), 'switch_on');
 							} else {
-								print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&value='.preg_replace('/\.php$/', '', $file).'&scan_dir='.$module->scandir.'&label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+								print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&token='.newToken().'&value='.preg_replace('/\.php$/', '', $file).'&scan_dir='.$module->scandir.'&label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 							}
 							print '</td>';
 
diff --git a/htdocs/admin/commande.php b/htdocs/admin/commande.php
index 288eac6de92..b920d9e6f9e 100644
--- a/htdocs/admin/commande.php
+++ b/htdocs/admin/commande.php
@@ -307,7 +307,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$file.'">';
+							print '<a href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
 							print img_picto($langs->trans("Disabled"), 'switch_off');
 							print '</a>';
 						}
@@ -441,7 +441,7 @@ foreach ($dirmodels as $reldir)
 									print '</td>';
 								} else {
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 									print "</td>";
 								}
 
@@ -451,7 +451,7 @@ foreach ($dirmodels as $reldir)
 								{
 									print img_picto($langs->trans("Default"), 'on');
 								} else {
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 								}
 								print '</td>';
 
@@ -670,10 +670,10 @@ print '<td>'.$langs->trans("ShippableOrderIconInList").'</td>';
 print '<td>&nbsp</td>';
 print '<td class="center">';
 if (!empty($conf->global->SHIPPABLE_ORDER_ICON_IN_LIST)) {
-    print '<a href="'.$_SERVER['PHP_SELF'].'?action=setshippableiconinlist&value=0">';
+    print '<a href="'.$_SERVER['PHP_SELF'].'?action=setshippableiconinlist&amp;token='.newToken().'&amp;value=0">';
     print img_picto($langs->trans("Activated"),'switch_on');
 } else {
-    print '<a href="'.$_SERVER['PHP_SELF'].'?action=setshippableiconinlist&value=1">';
+    print '<a href="'.$_SERVER['PHP_SELF'].'?action=setshippableiconinlist&amp;token='.newToken().'&amp;value=1">';
     print img_picto($langs->trans("Disabled"),'switch_off');
 }
 print '</a></td>';
@@ -695,11 +695,11 @@ if ($conf->banque->enabled)
     {
         if (empty($conf->global->BANK_ASK_PAYMENT_BANK_DURING_ORDER))
         {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_ORDER&amp;value=1">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_ORDER&amp;token='.newToken().'&amp;value=1">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
         }
         else
         {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_ORDER&amp;value=0">'.img_picto($langs->trans("Enabled"),'switch_on').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_ORDER&amp;token='.newToken().'&amp;value=0">'.img_picto($langs->trans("Enabled"),'switch_on').'</a>';
         }
     }
     print '</td></tr>';
@@ -725,11 +725,11 @@ if ($conf->stock->enabled)
     {
         if (empty($conf->global->WAREHOUSE_ASK_WAREHOUSE_DURING_ORDER))
         {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_WAREHOUSE_ASK_WAREHOUSE_DURING_ORDER&amp;value=1">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_WAREHOUSE_ASK_WAREHOUSE_DURING_ORDER&amp;token='.newToken().'&amp;value=1">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
         }
         else
         {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_WAREHOUSE_ASK_WAREHOUSE_DURING_ORDER&amp;value=0">'.img_picto($langs->trans("Enabled"),'switch_on').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_WAREHOUSE_ASK_WAREHOUSE_DURING_ORDER&amp;token='.newToken().'&amp;value=0">'.img_picto($langs->trans("Enabled"),'switch_on').'</a>';
         }
     }
     print '</td></tr>';
diff --git a/htdocs/admin/contract.php b/htdocs/admin/contract.php
index 971596d1c06..e8440963f9f 100644
--- a/htdocs/admin/contract.php
+++ b/htdocs/admin/contract.php
@@ -238,7 +238,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$file.'">';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
 							print img_picto($langs->trans("Disabled"), 'switch_off');
 							print '</a>';
 						}
@@ -371,7 +371,7 @@ foreach ($dirmodels as $reldir)
 									print '</td>';
 								} else {
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 									print "</td>";
 								}
 
@@ -381,7 +381,7 @@ foreach ($dirmodels as $reldir)
 								{
 									print img_picto($langs->trans("Default"), 'on');
 								} else {
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 								}
 								print '</td>';
 
diff --git a/htdocs/admin/defaultvalues.php b/htdocs/admin/defaultvalues.php
index f4e33bb7259..453f10bf837 100644
--- a/htdocs/admin/defaultvalues.php
+++ b/htdocs/admin/defaultvalues.php
@@ -190,12 +190,12 @@ $enabledisablehtml .= $langs->trans("EnableDefaultValues").' ';
 if (empty($conf->global->MAIN_ENABLE_DEFAULT_VALUES))
 {
     // Button off, click to enable
-    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMAIN_ENABLE_DEFAULT_VALUES&value=1'.$param.'">';
+    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMAIN_ENABLE_DEFAULT_VALUES&amp;token='.newToken().'&amp;value=1'.$param.'">';
     $enabledisablehtml .= img_picto($langs->trans("Disabled"), 'switch_off');
     $enabledisablehtml .= '</a>';
 } else {
     // Button on, click to disable
-    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMAIN_ENABLE_DEFAULT_VALUES&value=0'.$param.'">';
+    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMAIN_ENABLE_DEFAULT_VALUES&amp;token='.newToken().'&amp;value=0'.$param.'">';
     $enabledisablehtml .= img_picto($langs->trans("Activated"), 'switch_on');
     $enabledisablehtml .= '</a>';
 }
diff --git a/htdocs/admin/ecm.php b/htdocs/admin/ecm.php
index 145dfc6cbf8..76bf86993e2 100644
--- a/htdocs/admin/ecm.php
+++ b/htdocs/admin/ecm.php
@@ -92,10 +92,10 @@ if ($conf->use_javascript_ajax)
 } else {
 	if (empty($conf->global->ECM_AUTO_TREE_ENABLED))
 	{
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_ECM_AUTO_TREE_ENABLED">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_ECM_AUTO_TREE_ENABLED&amp;token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 	} elseif (!empty($conf->global->USER_MAIL_REQUIRED))
 	{
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_ECM_AUTO_TREE_ENABLED">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_ECM_AUTO_TREE_ENABLED&amp;token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
 	}
 }
 print '</td></tr>';
diff --git a/htdocs/admin/expedition.php b/htdocs/admin/expedition.php
index cf01d287d23..56f4f5a9be2 100644
--- a/htdocs/admin/expedition.php
+++ b/htdocs/admin/expedition.php
@@ -245,7 +245,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmodel&amp;value='.$file.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmodel&amp;token='.newToken().'&amp;value='.$file.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
 							print img_picto($langs->trans("Disabled"), 'switch_off');
 							print '</a>';
 						}
@@ -379,7 +379,7 @@ foreach ($dirmodels as $reldir)
 									print '</td>';
 								} else {
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 									print "</td>";
 								}
 
@@ -389,7 +389,7 @@ foreach ($dirmodels as $reldir)
 								{
 									print img_picto($langs->trans("Default"), 'on');
 								} else {
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 								}
 								print '</td>';
 
diff --git a/htdocs/admin/expensereport.php b/htdocs/admin/expensereport.php
index 13b1b0277a6..3ac71cfa6b0 100644
--- a/htdocs/admin/expensereport.php
+++ b/htdocs/admin/expensereport.php
@@ -248,7 +248,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$file.'">';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
 							print img_picto($langs->trans("Disabled"), 'switch_off');
 							print '</a>';
 						}
@@ -371,13 +371,13 @@ foreach ($dirmodels as $reldir)
 		    				if (in_array($name, $def))
 		    				{
 		    					print '<td class="center">'."\n";
-		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
+		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
 		    					print img_picto($langs->trans("Enabled"), 'switch_on');
 		    					print '</a>';
 		    					print "</td>";
 		    				} else {
 		    					print '<td class="center">'."\n";
-		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 		    					print "</td>";
 		    				}
 
@@ -387,7 +387,7 @@ foreach ($dirmodels as $reldir)
 		    				{
 		    					print img_picto($langs->trans("Default"), 'on');
 		    				} else {
-		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 		    				}
 		    				print '</td>';
 
diff --git a/htdocs/admin/facture.php b/htdocs/admin/facture.php
index fe84cf12478..0c12f11b4a3 100644
--- a/htdocs/admin/facture.php
+++ b/htdocs/admin/facture.php
@@ -324,7 +324,7 @@ foreach ($dirmodels as $reldir)
 							{
 								print img_picto($langs->trans("Activated"), 'switch_on');
 							} else {
-								print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&value='.preg_replace('/\.php$/', '', $file).'&scan_dir='.$module->scandir.'&label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+								print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&token='.newToken().'&value='.preg_replace('/\.php$/', '', $file).'&scan_dir='.$module->scandir.'&label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 							}
 							print '</td>';
 
@@ -500,13 +500,13 @@ foreach ($dirmodels as $reldir)
 								if (in_array($name, $def))
 								{
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&value='.$name.'">';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'">';
 									print img_picto($langs->trans("Enabled"), 'switch_on');
 									print '</a>';
 									print '</td>';
 								} else {
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&scan_dir='.$module->scandir.'&label='.urlencode($module->name).'">'.img_picto($langs->trans("SetAsDefault"), 'switch_off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("SetAsDefault"), 'switch_off').'</a>';
 									print "</td>";
 								}
 
@@ -516,7 +516,7 @@ foreach ($dirmodels as $reldir)
 								{
 									print img_picto($langs->trans("Default"), 'on');
 								} else {
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&scan_dir='.$module->scandir.'&label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("SetAsDefault"), 'off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("SetAsDefault"), 'off').'</a>';
 								}
 								print '</td>';
 
diff --git a/htdocs/admin/fichinter.php b/htdocs/admin/fichinter.php
index df97e9875a0..5199165d4f4 100644
--- a/htdocs/admin/fichinter.php
+++ b/htdocs/admin/fichinter.php
@@ -301,7 +301,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$classname.'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.$classname.'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 						}
 						print '</td>';
 
@@ -425,13 +425,13 @@ foreach ($dirmodels as $reldir)
 		    				if (in_array($name, $def))
 		    				{
 		    					print "<td align=\"center\">\n";
-		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
+		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
 		    					print img_picto($langs->trans("Enabled"), 'switch_on');
 		    					print '</a>';
 		    					print "</td>";
 		    				} else {
 		    					print "<td align=\"center\">\n";
-		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 		    					print "</td>";
 		    				}
 
@@ -441,7 +441,7 @@ foreach ($dirmodels as $reldir)
 		    				{
 		    					print img_picto($langs->trans("Default"), 'on');
 		    				} else {
-		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 		    				}
 		    				print '</td>';
 
diff --git a/htdocs/admin/holiday.php b/htdocs/admin/holiday.php
index bac8e99e70f..23a0cec8130 100644
--- a/htdocs/admin/holiday.php
+++ b/htdocs/admin/holiday.php
@@ -238,7 +238,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$file.'">';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
 							print img_picto($langs->trans("Disabled"), 'switch_off');
 							print '</a>';
 						}
@@ -384,7 +384,7 @@ foreach ($dirmodels as $reldir)
 									print '</td>';
 								} else {
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 									print "</td>";
 								}
 
@@ -394,7 +394,7 @@ foreach ($dirmodels as $reldir)
 								{
 									print img_picto($langs->trans("Default"), 'on');
 								} else {
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 								}
 								print '</td>';
 
diff --git a/htdocs/admin/livraison.php b/htdocs/admin/livraison.php
index 4073b0a59a9..f3477e151a2 100644
--- a/htdocs/admin/livraison.php
+++ b/htdocs/admin/livraison.php
@@ -241,7 +241,7 @@ foreach ($dirmodels as $reldir)
                         {
                             print img_picto($langs->trans("Activated"), 'switch_on');
                         } else {
-                            print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$file.'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+                            print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.urlencode($file).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
                         }
                         print '</td>';
 
@@ -366,13 +366,13 @@ foreach ($dirmodels as $reldir)
 		    				if (in_array($name, $def))
 		    				{
 		    					print "<td align=\"center\">\n";
-		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
+		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
 		    					print img_picto($langs->trans("Enabled"), 'switch_on');
 		    					print '</a>';
 		    					print "</td>";
 		    				} else {
 		    					print "<td align=\"center\">\n";
-		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 		    					print "</td>";
 		    				}
 
@@ -382,7 +382,7 @@ foreach ($dirmodels as $reldir)
 		    				{
 		    					print img_picto($langs->trans("Default"), 'on');
 		    				} else {
-		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+		    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 		    				}
 		    				print '</td>';
 
diff --git a/htdocs/admin/mailman.php b/htdocs/admin/mailman.php
index cbc908f973f..d9d3ae8142d 100644
--- a/htdocs/admin/mailman.php
+++ b/htdocs/admin/mailman.php
@@ -156,7 +156,7 @@ if (!empty($conf->global->ADHERENT_USE_MAILMAN))
     dol_fiche_head($head, 'mailman', $langs->trans("Setup"), -1, 'user');
 
     //$link=img_picto($langs->trans("Active"),'tick').' ';
-    $link = '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=unset&value=0&name=ADHERENT_USE_MAILMAN">';
+    $link = '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=unset&token='.newToken().'&value=0&name=ADHERENT_USE_MAILMAN">';
     //$link.=$langs->trans("Disable");
     $link .= img_picto($langs->trans("Activated"), 'switch_on');
     $link .= '</a>';
@@ -206,7 +206,7 @@ if (!empty($conf->global->ADHERENT_USE_MAILMAN))
 } else {
     dol_fiche_head($head, 'mailman', $langs->trans("Setup"), 0, 'user');
 
-    $link = '<a href="'.$_SERVER["PHP_SELF"].'?action=set&value=1&name=ADHERENT_USE_MAILMAN">';
+    $link = '<a href="'.$_SERVER["PHP_SELF"].'?action=set&token='.newToken().'&value=1&name=ADHERENT_USE_MAILMAN">';
     //$link.=img_$langs->trans("Activate")
     $link .= img_picto($langs->trans("Disabled"), 'switch_off');
     $link .= '</a>';
diff --git a/htdocs/admin/modules.php b/htdocs/admin/modules.php
index 38cfe37265b..c61e352aad8 100644
--- a/htdocs/admin/modules.php
+++ b/htdocs/admin/modules.php
@@ -797,7 +797,7 @@ if ($mode == 'common' || $mode == 'commonkanban')
 					}
 				}
 				$codeenabledisable .= '<!-- Message to show: '.$warningmessage.' -->'."\n";
-				$codeenabledisable .= '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$objMod->numero.'&amp;module_position='.$module_position.'&amp;action=set&amp;value='.$modName.'&amp;mode='.$mode.$param.'"';
+				$codeenabledisable .= '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$objMod->numero.'&amp;token='.newToken().'&amp;module_position='.$module_position.'&amp;action=set&amp;value='.$modName.'&amp;mode='.$mode.$param.'"';
 				if ($warningmessage) $codeenabledisable .= ' onclick="return confirm(\''.dol_escape_js($warningmessage).'\');"';
 				$codeenabledisable .= '>';
 				$codeenabledisable .= img_picto($langs->trans("Disabled"), 'switch_off');
diff --git a/htdocs/admin/mrp.php b/htdocs/admin/mrp.php
index 10e992c7ac2..863633176bd 100644
--- a/htdocs/admin/mrp.php
+++ b/htdocs/admin/mrp.php
@@ -243,7 +243,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$file.'">';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
 							print img_picto($langs->trans("Disabled"), 'switch_off');
 							print '</a>';
 						}
@@ -371,13 +371,13 @@ foreach ($dirmodels as $reldir)
 								if (in_array($name, $def))
 								{
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&value='.$name.'">';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'">';
 									print img_picto($langs->trans("Enabled"), 'switch_on');
 									print '</a>';
 									print '</td>';
 								} else {
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 									print "</td>";
 								}
 
@@ -387,7 +387,7 @@ foreach ($dirmodels as $reldir)
 								{
 									print img_picto($langs->trans("Default"), 'on');
 								} else {
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 								}
 								print '</td>';
 
diff --git a/htdocs/admin/payment.php b/htdocs/admin/payment.php
index 926c102c25a..92b5c9511d5 100644
--- a/htdocs/admin/payment.php
+++ b/htdocs/admin/payment.php
@@ -182,7 +182,7 @@ foreach ($dirmodels as $reldir)
                             {
                                 print img_picto($langs->trans("Activated"), 'switch_on');
                             } else {
-                                print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&value='.preg_replace('/\.php$/', '', $file).'&scan_dir='.$module->scandir.'&label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+                                print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmo&token='.newToken().'&value='.preg_replace('/\.php$/', '', $file).'&scan_dir='.$module->scandir.'&label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
                             }
                             print '</td>';
 
diff --git a/htdocs/admin/paymentbybanktransfer.php b/htdocs/admin/paymentbybanktransfer.php
index 4056ce238e3..d85f79257d0 100644
--- a/htdocs/admin/paymentbybanktransfer.php
+++ b/htdocs/admin/paymentbybanktransfer.php
@@ -299,7 +299,7 @@ foreach ($dirmodels as $reldir)
                                 else
                                 {
                                     print '<td class="center">'."\n";
-                                    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
+                                    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
                                     print "</td>";
                                 }
 
@@ -311,7 +311,7 @@ foreach ($dirmodels as $reldir)
                                 }
                                 else
                                 {
-                                    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"),'off').'</a>';
+                                    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"),'off').'</a>';
                                 }
                                 print '</td>';
 
diff --git a/htdocs/admin/prelevement.php b/htdocs/admin/prelevement.php
index 24d4a379f83..1e1bee11ad4 100644
--- a/htdocs/admin/prelevement.php
+++ b/htdocs/admin/prelevement.php
@@ -306,7 +306,7 @@ foreach ($dirmodels as $reldir)
                                 else
                                 {
                                     print '<td class="center">'."\n";
-                                    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
+                                    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
                                     print "</td>";
                                 }
 
@@ -318,7 +318,7 @@ foreach ($dirmodels as $reldir)
                                 }
                                 else
                                 {
-                                    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"),'off').'</a>';
+                                    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"),'off').'</a>';
                                 }
                                 print '</td>';
 
diff --git a/htdocs/admin/propal.php b/htdocs/admin/propal.php
index 843cf0cfd55..3b574956cd0 100644
--- a/htdocs/admin/propal.php
+++ b/htdocs/admin/propal.php
@@ -266,7 +266,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$file.'">';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
 							print img_picto($langs->trans("Disabled"), 'switch_off');
 							print '</a>';
 						}
@@ -395,13 +395,13 @@ foreach ($dirmodels as $reldir)
 	                            if (in_array($name, $def))
 	                            {
 	                            	print '<td class="center">'."\n";
-	                            	print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;value='.$name.'">';
+	                            	print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'">';
 	                            	print img_picto($langs->trans("Enabled"), 'switch_on');
 	                            	print '</a>';
 	                            	print '</td>';
 	                            } else {
 	                                print "<td align=\"center\">\n";
-	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 	                                print "</td>";
 	                            }
 
@@ -411,7 +411,7 @@ foreach ($dirmodels as $reldir)
 	                            {
 	                                print img_picto($langs->trans("Default"), 'on');
 	                            } else {
-	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 	                            }
 	                            print '</td>';
 
@@ -661,11 +661,11 @@ if ($conf->banque->enabled)
     {
         if (empty($conf->global->BANK_ASK_PAYMENT_BANK_DURING_PROPOSAL))
         {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_PROPOSAL&amp;value=1">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_PROPOSAL&amp;token='.newToken().'&amp;value=1">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
         }
         else
         {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_PROPOSAL&amp;value=0">'.img_picto($langs->trans("Enabled"),'switch_on').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_PROPOSAL&amp;token='.newToken().'&amp;value=0">'.img_picto($langs->trans("Enabled"),'switch_on').'</a>';
         }
     }
     print '</td></tr>';
diff --git a/htdocs/admin/reception_setup.php b/htdocs/admin/reception_setup.php
index 60833669753..f84d9a3a7f9 100644
--- a/htdocs/admin/reception_setup.php
+++ b/htdocs/admin/reception_setup.php
@@ -250,7 +250,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmodel&amp;value='.$file.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmodel&amp;token='.newToken().'&amp;value='.urlencode($file).'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
 							print img_picto($langs->trans("Disabled"), 'switch_off');
 							print '</a>';
 						}
@@ -379,13 +379,13 @@ foreach ($dirmodels as $reldir)
 								if (in_array($name, $def))
 								{
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&value='.$name.'">';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'">';
 									print img_picto($langs->trans("Enabled"), 'switch_on');
 									print '</a>';
 									print '</td>';
 								} else {
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 									print "</td>";
 								}
 
@@ -395,7 +395,7 @@ foreach ($dirmodels as $reldir)
 								{
 									print img_picto($langs->trans("Default"), 'on');
 								} else {
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 								}
 								print '</td>';
 
diff --git a/htdocs/admin/security.php b/htdocs/admin/security.php
index aa23a24c526..f25cdf25958 100644
--- a/htdocs/admin/security.php
+++ b/htdocs/admin/security.php
@@ -265,7 +265,7 @@ foreach ($arrayhandler as $key => $module)
         {
             print img_picto('', 'tick');
         } else {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=setgeneraterule&amp;value='.$key.'">'.$langs->trans("Activate").'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=setgeneraterule&amp;token='.newToken().'&amp;value='.$key.'">'.$langs->trans("Activate").'</a>';
         }
         print "</td></tr>\n";
 	}
diff --git a/htdocs/admin/security_other.php b/htdocs/admin/security_other.php
index 686c0ddc21c..4eb6af14843 100644
--- a/htdocs/admin/security_other.php
+++ b/htdocs/admin/security_other.php
@@ -115,9 +115,9 @@ if (function_exists("imagecreatefrompng"))
 	} else {
 		if (empty($conf->global->MAIN_SECURITY_ENABLECAPTCHA))
 		{
-			print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_MAIN_SECURITY_ENABLECAPTCHA">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+			print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_MAIN_SECURITY_ENABLECAPTCHA&amp;token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 		} else {
-			print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_MAIN_SECURITY_ENABLECAPTCHA">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
+			print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_MAIN_SECURITY_ENABLECAPTCHA&amp;token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
 		}
 	}
 } else {
@@ -136,9 +136,9 @@ if (!empty($conf->use_javascript_ajax))
 } else {
 	if (empty($conf->global->MAIN_USE_ADVANCED_PERMS))
 	{
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_MAIN_USE_ADVANCED_PERMS">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_MAIN_USE_ADVANCED_PERMS&amp;token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 	} else {
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_MAIN_USE_ADVANCED_PERMS">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_MAIN_USE_ADVANCED_PERMS&amp;token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
 	}
 }
 print "</td></tr>";
diff --git a/htdocs/admin/spip.php b/htdocs/admin/spip.php
index 34c83dbd434..ca44caac258 100644
--- a/htdocs/admin/spip.php
+++ b/htdocs/admin/spip.php
@@ -129,7 +129,7 @@ if (!empty($conf->global->ADHERENT_USE_SPIP))
 	dol_fiche_head($head, 'spip', $langs->trans("Setup"), -1, 'user');
 
     //$link=img_picto($langs->trans("Active"),'tick').' ';
-    $link = '<a href="'.$_SERVER["PHP_SELF"].'?action=unset&value=0&name=ADHERENT_USE_SPIP">';
+    $link = '<a href="'.$_SERVER["PHP_SELF"].'?action=unset&token='.newToken().'&value=0&name=ADHERENT_USE_SPIP">';
     //$link.=$langs->trans("Disable");
     $link .= img_picto($langs->trans("Activated"), 'switch_on');
     $link .= '</a>';
@@ -154,7 +154,7 @@ if (!empty($conf->global->ADHERENT_USE_SPIP))
 } else {
     dol_fiche_head($head, 'spip', $langs->trans("Setup"), 0, 'user');
 
-    $link = '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value=1&name=ADHERENT_USE_SPIP">';
+    $link = '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value=1&amp;name=ADHERENT_USE_SPIP">';
     //$link.=$langs->trans("Activate");
     $link .= img_picto($langs->trans("Disabled"), 'switch_off');
     $link .= '</a>';
diff --git a/htdocs/admin/stock.php b/htdocs/admin/stock.php
index 6983c228007..20b1252456e 100644
--- a/htdocs/admin/stock.php
+++ b/htdocs/admin/stock.php
@@ -594,13 +594,13 @@ foreach ($dirmodels as $reldir)
 								if (in_array($name, $def))
 								{
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&value='.$name.'">';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'">';
 									print img_picto($langs->trans("Enabled"), 'switch_on');
 									print '</a>';
 									print '</td>';
 								} else {
 									print '<td class="center">'."\n";
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 									print "</td>";
 								}
 
@@ -610,7 +610,7 @@ foreach ($dirmodels as $reldir)
 								{
 									print img_picto($langs->trans("Default"), 'on');
 								} else {
-									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+									print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 								}
 								print '</td>';
 
diff --git a/htdocs/admin/supplier_invoice.php b/htdocs/admin/supplier_invoice.php
index 9b618fa3d31..c4f2e48ff4a 100644
--- a/htdocs/admin/supplier_invoice.php
+++ b/htdocs/admin/supplier_invoice.php
@@ -261,7 +261,7 @@ foreach ($dirmodels as $reldir)
                         {
                             print img_picto($langs->trans("Activated"), 'switch_on');
                         } else {
-                            print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$file.'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+                            print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.urlencode($file).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
                         }
                         print '</td>';
 
@@ -395,7 +395,7 @@ foreach ($dirmodels as $reldir)
                         print "</td>";
                     } else {
                         print '<td class="center">'."\n";
-                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=invoice_supplier">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=invoice_supplier">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
                         print "</td>";
                     }
 
@@ -405,9 +405,9 @@ foreach ($dirmodels as $reldir)
                     {
                         //print img_picto($langs->trans("Default"),'on');
                         // Even if choice is the default value, we allow to disable it: For supplier invoice, we accept to have no doc generation at all
-                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=unsetdoc&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=invoice_supplier"" alt="'.$langs->trans("Disable").'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
+                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=unsetdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=invoice_supplier"" alt="'.$langs->trans("Disable").'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
                     } else {
-                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=invoice_supplier"" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=invoice_supplier"" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
                     }
                     print '</td>';
 
diff --git a/htdocs/admin/supplier_order.php b/htdocs/admin/supplier_order.php
index c7026ca7327..9afa2bb2d1f 100644
--- a/htdocs/admin/supplier_order.php
+++ b/htdocs/admin/supplier_order.php
@@ -284,7 +284,7 @@ foreach ($dirmodels as $reldir)
                         {
                             print img_picto($langs->trans("Activated"), 'switch_on');
                         } else {
-                            print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$file.'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+                            print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.urlencode($file).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
                         }
                         print '</td>';
 
@@ -410,7 +410,7 @@ foreach ($dirmodels as $reldir)
                         print "</td>";
                     } else {
                         print '<td class="center">'."\n";
-                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=order_supplier">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=order_supplier">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
                         print "</td>";
                     }
 
@@ -420,7 +420,7 @@ foreach ($dirmodels as $reldir)
                     {
                         print img_picto($langs->trans("Default"), 'on');
                     } else {
-                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=order_supplier"" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=order_supplier"" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
                     }
                     print '</td>';
 
@@ -493,11 +493,11 @@ if ($conf->banque->enabled)
     {
         if (empty($conf->global->BANK_ASK_PAYMENT_BANK_DURING_ORDER))
         {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_SUPPLIER_ORDER&amp;value=1">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_SUPPLIER_ORDER&amp;token='.newToken().'&amp;value=1">'.img_picto($langs->trans("Disabled"),'switch_off').'</a>';
         }
         else
         {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_SUPPLIER_ORDER&amp;value=0">'.img_picto($langs->trans("Enabled"),'switch_on').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_SUPPLIER_ORDER&amp;token='.newToken().'&amp;value=0">'.img_picto($langs->trans("Enabled"),'switch_on').'</a>';
         }
     }
     print '</td></tr>';
diff --git a/htdocs/admin/supplier_payment.php b/htdocs/admin/supplier_payment.php
index 5541b8ff895..003c0247f20 100644
--- a/htdocs/admin/supplier_payment.php
+++ b/htdocs/admin/supplier_payment.php
@@ -267,7 +267,7 @@ foreach ($dirmodels as $reldir)
                             {
                                 print img_picto($langs->trans("Activated"), 'switch_on');
                             } else {
-                                print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&value='.preg_replace('/\.php$/', '', $file).'&scandir='.$module->scandir.'&label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+                                print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&token='.newToken().'&value='.preg_replace('/\.php$/', '', $file).'&scandir='.$module->scandir.'&label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
                             }
                             print '</td>';
 
@@ -382,7 +382,7 @@ foreach ($dirmodels as $reldir)
                         print "</td>";
                     } else {
                         print '<td class="center">'."\n";
-                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=SUPPLIER_PAYMENT">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=SUPPLIER_PAYMENT">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
                         print "</td>";
                     }
 
@@ -392,9 +392,9 @@ foreach ($dirmodels as $reldir)
                     {
                         //print img_picto($langs->trans("Default"),'on');
                         // Even if choice is the default value, we allow to disable it: For supplier invoice, we accept to have no doc generation at all
-                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=unsetdoc&amp;value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=SUPPLIER_PAYMENT"" alt="'.$langs->trans("Disable").'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
+                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=unsetdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=SUPPLIER_PAYMENT"" alt="'.$langs->trans("Disable").'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
                     } else {
-                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=SUPPLIER_PAYMENT"" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+                        print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'&amp;type=SUPPLIER_PAYMENT"" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
                     }
                     print '</td>';
 
diff --git a/htdocs/admin/supplier_proposal.php b/htdocs/admin/supplier_proposal.php
index f2110687042..7bf34fa669a 100644
--- a/htdocs/admin/supplier_proposal.php
+++ b/htdocs/admin/supplier_proposal.php
@@ -261,7 +261,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value='.$file.'">';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
 							print img_picto($langs->trans("Disabled"), 'switch_off');
 							print '</a>';
 						}
@@ -388,13 +388,13 @@ foreach ($dirmodels as $reldir)
 	                            if (in_array($name, $def))
 	                            {
 	                            	print '<td class="center">'."\n";
-	                            	print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;value='.$name.'">';
+	                            	print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'">';
 	                            	print img_picto($langs->trans("Enabled"), 'switch_on');
 	                            	print '</a>';
 	                            	print '</td>';
 	                            } else {
 	                                print "<td align=\"center\">\n";
-	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 	                                print "</td>";
 	                            }
 
@@ -404,7 +404,7 @@ foreach ($dirmodels as $reldir)
 	                            {
 	                                print img_picto($langs->trans("Default"), 'on');
 	                            } else {
-	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 	                            }
 	                            print '</td>';
 
@@ -516,9 +516,9 @@ if ($conf->banque->enabled)
     } else {
         if (empty($conf->global->BANK_ASK_PAYMENT_BANK_DURING_SUPPLIER_PROPOSAL))
         {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_SUPPLIER_PROPOSAL&amp;value=1">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_SUPPLIER_PROPOSAL&amp;token='.newToken().'&amp;value=1">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
         } else {
-            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_SUPPLIER_PROPOSAL&amp;value=0">'.img_picto($langs->trans("Enabled"), 'switch_on').'</a>';
+            print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_BANK_ASK_PAYMENT_BANK_DURING_SUPPLIER_PROPOSAL&amp;token='.newToken().'&amp;value=0">'.img_picto($langs->trans("Enabled"), 'switch_on').'</a>';
         }
     }
     print '</td></tr>';
diff --git a/htdocs/admin/ticket.php b/htdocs/admin/ticket.php
index 4dd8a6fa5c1..b30dd9c5f13 100644
--- a/htdocs/admin/ticket.php
+++ b/htdocs/admin/ticket.php
@@ -253,7 +253,7 @@ foreach ($dirmodels as $reldir) {
 						if ($conf->global->TICKET_ADDON == 'mod_'.$classname) {
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value=mod_'.$classname.'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value=mod_'.$classname.'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 						}
 						print '</td>';
 
diff --git a/htdocs/admin/ticket_public.php b/htdocs/admin/ticket_public.php
index 02e6e6916ee..011de9422bf 100644
--- a/htdocs/admin/ticket_public.php
+++ b/htdocs/admin/ticket_public.php
@@ -182,12 +182,12 @@ $enabledisablehtml = $langs->trans("TicketsActivatePublicInterface").' ';
 if (empty($conf->global->TICKET_ENABLE_PUBLIC_INTERFACE))
 {
     // Button off, click to enable
-    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setTICKET_ENABLE_PUBLIC_INTERFACE&value=1'.$param.'">';
+    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setTICKET_ENABLE_PUBLIC_INTERFACE&token='.newToken().'&value=1'.$param.'">';
     $enabledisablehtml .= img_picto($langs->trans("Disabled"), 'switch_off');
     $enabledisablehtml .= '</a>';
 } else {
     // Button on, click to disable
-    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setTICKET_ENABLE_PUBLIC_INTERFACE&value=0'.$param.'">';
+    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setTICKET_ENABLE_PUBLIC_INTERFACE&token='.newToken().'&value=0'.$param.'">';
     $enabledisablehtml .= img_picto($langs->trans("Activated"), 'switch_on');
     $enabledisablehtml .= '</a>';
 }
diff --git a/htdocs/admin/translation.php b/htdocs/admin/translation.php
index 9259ac420b7..17c4592f382 100644
--- a/htdocs/admin/translation.php
+++ b/htdocs/admin/translation.php
@@ -197,12 +197,12 @@ $enabledisablehtml .= $langs->trans("EnableOverwriteTranslation").' ';
 if (empty($conf->global->MAIN_ENABLE_OVERWRITE_TRANSLATION))
 {
     // Button off, click to enable
-    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMAIN_ENABLE_OVERWRITE_TRANSLATION&value=1'.$param.'">';
+    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMAIN_ENABLE_OVERWRITE_TRANSLATION&token='.newToken().'&value=1'.$param.'">';
     $enabledisablehtml .= img_picto($langs->trans("Disabled"), 'switch_off');
     $enabledisablehtml .= '</a>';
 } else {
     // Button on, click to disable
-    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMAIN_ENABLE_OVERWRITE_TRANSLATION&value=0'.$param.'">';
+    $enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setMAIN_ENABLE_OVERWRITE_TRANSLATION&token='.newToken().'&value=0'.$param.'">';
     $enabledisablehtml .= img_picto($langs->trans("Activated"), 'switch_on');
     $enabledisablehtml .= '</a>';
 }
diff --git a/htdocs/admin/user.php b/htdocs/admin/user.php
index 723a4bb0063..620efb0540e 100644
--- a/htdocs/admin/user.php
+++ b/htdocs/admin/user.php
@@ -155,9 +155,9 @@ if ($conf->use_javascript_ajax)
 } else {
 	if (empty($conf->global->USER_MAIL_REQUIRED))
 	{
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_USER_MAIL_REQUIRED">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_USER_MAIL_REQUIRED&amp;token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 	} else {
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_USER_MAIL_REQUIRED">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_USER_MAIL_REQUIRED&amp;token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
 	}
 }
 print '</td></tr>';
@@ -269,13 +269,13 @@ foreach ($dirmodels as $reldir)
 	                            if (in_array($name, $def))
 	                            {
 	                            	print '<td class="center">'."\n";
-	                            	print '<a href="'.$_SERVER["PHP_SELF"].'?action=del_default&value='.$name.'">';
+	                            	print '<a href="'.$_SERVER["PHP_SELF"].'?action=del_default&amp;token='.newToken().'&amp;value='.$name.'">';
 	                            	print img_picto($langs->trans("Enabled"), 'switch_on');
 	                            	print '</a>';
 	                            	print '</td>';
 	                            } else {
 	                                print '<td class="center">'."\n";
-	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=set_default&value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=set_default&amp;token='.newToken().'&amp;value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 	                                print "</td>";
 	                            }
 
@@ -285,7 +285,7 @@ foreach ($dirmodels as $reldir)
 	                            {
 	                                print img_picto($langs->trans("Default"), 'on');
 	                            } else {
-	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 	                            }
 	                            print '</td>';
 
diff --git a/htdocs/admin/usergroup.php b/htdocs/admin/usergroup.php
index 0b372bf3518..9ae01790bb2 100644
--- a/htdocs/admin/usergroup.php
+++ b/htdocs/admin/usergroup.php
@@ -201,13 +201,13 @@ foreach ($dirmodels as $reldir)
 	                            if (in_array($name, $def))
 	                            {
 	                            	print '<td class="center">'."\n";
-	                            	print '<a href="'.$_SERVER["PHP_SELF"].'?action=del_default&value='.$name.'">';
+	                            	print '<a href="'.$_SERVER["PHP_SELF"].'?action=del_default&amp;token='.newToken().'&amp;value='.$name.'">';
 	                            	print img_picto($langs->trans("Enabled"), 'switch_on');
 	                            	print '</a>';
 	                            	print '</td>';
 	                            } else {
 	                                print '<td class="center">'."\n";
-	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=set_default&value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=set_default&amp;token='.newToken().'&amp;value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 	                                print "</td>";
 	                            }
 
@@ -217,7 +217,7 @@ foreach ($dirmodels as $reldir)
 	                            {
 	                                print img_picto($langs->trans("Default"), 'on');
 	                            } else {
-	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scandir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 	                            }
 	                            print '</td>';
 
diff --git a/htdocs/admin/workflow.php b/htdocs/admin/workflow.php
index dddcaf91c81..a8bcbcf8172 100644
--- a/htdocs/admin/workflow.php
+++ b/htdocs/admin/workflow.php
@@ -219,11 +219,11 @@ foreach ($workflowcodes as $key => $params) {
 		print ajax_constantonoff($key);
 	} else {
 		if (!empty($conf->global->$key)) {
-			print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=del'.$key.'">';
+			print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=del'.$key.'&amp;token='.newToken().'">';
 			print img_picto($langs->trans("Activated"), 'switch_on');
 			print '</a>';
 		} else {
-			print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=set'.$key.'">';
+			print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=set'.$key.'&amp;token='.newToken().'">';
 			print img_picto($langs->trans("Disabled"), 'switch_off');
 			print '</a>';
 		}
diff --git a/htdocs/api/admin/index.php b/htdocs/api/admin/index.php
index 8cc22578f2a..a7eab61211d 100644
--- a/htdocs/api/admin/index.php
+++ b/htdocs/api/admin/index.php
@@ -112,11 +112,11 @@ print '<td>'.$langs->trans("ApiProductionMode").'</td>';
 $production_mode = (empty($conf->global->API_PRODUCTION_MODE) ?false:true);
 if ($production_mode)
 {
-    print '<td><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setproductionmode&value='.($i + 1).'&status=0">';
+    print '<td><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setproductionmode&token='.newToken().'&value='.($i + 1).'&status=0">';
     print img_picto($langs->trans("Activated"), 'switch_on');
     print '</a></td>';
 } else {
-    print '<td><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setproductionmode&value='.($i + 1).'&status=1">';
+    print '<td><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setproductionmode&token='.newToken().'&value='.($i + 1).'&status=1">';
     print img_picto($langs->trans("Disabled"), 'switch_off');
     print '</a></td>';
 }
diff --git a/htdocs/bom/bom_card.php b/htdocs/bom/bom_card.php
index 1e59943a794..cf452d6b8da 100644
--- a/htdocs/bom/bom_card.php
+++ b/htdocs/bom/bom_card.php
@@ -610,7 +610,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 			{
 				if ($permissiontoadd)
 				{
-					print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=setdraft">'.$langs->trans("SetToDraft").'</a>';
+					print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=setdraft&token='.newToken().'">'.$langs->trans("SetToDraft").'</a>';
 				}
 			}
 
@@ -619,7 +619,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 			{
 				if ($permissiontoadd)
 				{
-					print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=edit">'.$langs->trans("Modify").'</a>'."\n";
+					print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=edit&amp;token='.newToken().'">'.$langs->trans("Modify").'</a>'."\n";
 				} else {
 					print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotEnoughPermissions")).'">'.$langs->trans('Modify').'</a>'."\n";
 				}
@@ -632,7 +632,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 				{
 					if (is_array($object->lines) && count($object->lines) > 0)
 					{
-						print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=validate">'.$langs->trans("Validate").'</a>';
+						print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=validate&amp;token='.newToken().'">'.$langs->trans("Validate").'</a>';
 					} else {
 						$langs->load("errors");
 						print '<a class="butActionRefused" href="" title="'.$langs->trans("ErrorAddAtLeastOneLineFirst").'">'.$langs->trans("Validate").'</a>';
diff --git a/htdocs/comm/card.php b/htdocs/comm/card.php
index 18bd6b22ce0..8df97d1031f 100644
--- a/htdocs/comm/card.php
+++ b/htdocs/comm/card.php
@@ -560,7 +560,7 @@ if ($object->id > 0)
         {
 			$titlealt = 'default';
 			if (!empty($val['code']) && !in_array($val['code'], array('ST_NO', 'ST_NEVER', 'ST_TODO', 'ST_PEND', 'ST_DONE'))) $titlealt = $val['label'];
-			if ($object->stcomm_id != $val['id']) print '<a class="pictosubstatus reposition" href="'.$_SERVER["PHP_SELF"].'?socid='.$object->id.'&stcomm='.$val['code'].'&action=setstcomm">'.img_action($titlealt, $val['code'], $val['picto']).'</a>';
+			if ($object->stcomm_id != $val['id']) print '<a class="pictosubstatus reposition" href="'.$_SERVER["PHP_SELF"].'?socid='.$object->id.'&stcomm='.$val['code'].'&action=setstcomm&token='.newToken().'">'.img_action($titlealt, $val['code'], $val['picto']).'</a>';
 		}
         print '</div></td></tr>';
         print "</table>";
diff --git a/htdocs/compta/prelevement/card.php b/htdocs/compta/prelevement/card.php
index ad105c5e364..2691e14504d 100644
--- a/htdocs/compta/prelevement/card.php
+++ b/htdocs/compta/prelevement/card.php
@@ -317,15 +317,15 @@ if ($id > 0 || $ref)
 
 		if (empty($object->date_trans) && $user->rights->prelevement->bons->send)
 		{
-			print "<a class=\"butAction\" href=\"card.php?action=settransmitted&id=".$object->id."\">".$langs->trans("SetToStatusSent")."</a>";
+			print "<a class=\"butAction\" href=\"card.php?action=settransmitted&token='.newToken().'&id=".$object->id."\">".$langs->trans("SetToStatusSent")."</a>";
 		}
 
 		if (!empty($object->date_trans) && $object->date_credit == 0)
 		{
-			print "<a class=\"butAction\" href=\"card.php?action=setcredited&id=".$object->id."\">".$langs->trans("ClassCredited")."</a>";
+			print "<a class=\"butAction\" href=\"card.php?action=setcredited&token='.newToken().'&id=".$object->id."\">".$langs->trans("ClassCredited")."</a>";
 		}
 
-		print "<a class=\"butActionDelete\" href=\"card.php?action=delete&id=".$object->id."\">".$langs->trans("Delete")."</a>";
+		print "<a class=\"butActionDelete\" href=\"card.php?action=delete&token='.newToken().'&id=".$object->id."\">".$langs->trans("Delete")."</a>";
 
 		print "</div>";
 	}
diff --git a/htdocs/contact/card.php b/htdocs/contact/card.php
index 8428b257fac..9f242b52666 100644
--- a/htdocs/contact/card.php
+++ b/htdocs/contact/card.php
@@ -1392,7 +1392,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action))
 				foreach ($object->cacheprospectstatus as $key => $val) {
 					$titlealt = 'default';
 					if (!empty($val['code']) && !in_array($val['code'], array('ST_NO', 'ST_NEVER', 'ST_TODO', 'ST_PEND', 'ST_DONE'))) $titlealt = $val['label'];
-					if ($object->stcomm_id != $val['id']) print '<a class="pictosubstatus" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&stcomm='.$val['code'].'&action=setstcomm">'.img_action($titlealt, $val['code'], $val['picto']).'</a>';
+					if ($object->stcomm_id != $val['id']) print '<a class="pictosubstatus" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&stcomm='.$val['code'].'&action=setstcomm&token='.newToken().'">'.img_action($titlealt, $val['code'], $val['picto']).'</a>';
 				}
 				print '</div></td></tr>';
 
diff --git a/htdocs/contact/list.php b/htdocs/contact/list.php
index 0f4f01a0916..1b5bd81046d 100644
--- a/htdocs/contact/list.php
+++ b/htdocs/contact/list.php
@@ -1021,7 +1021,7 @@ while ($i < min($num, $limit))
 		foreach ($contactstatic->cacheprospectstatus as $key => $val) {
 			$titlealt = 'default';
 			if (!empty($val['code']) && !in_array($val['code'], array('ST_NO', 'ST_NEVER', 'ST_TODO', 'ST_PEND', 'ST_DONE'))) $titlealt = $val['label'];
-			if ($obj->stcomm_id != $val['id']) print '<a class="pictosubstatus" href="'.$_SERVER["PHP_SELF"].'?stcommcontactid='.$obj->rowid.'&stcomm='.$val['code'].'&action=setstcomm'.$param.($page ? '&page='.urlencode($page) : '').'">'.img_action($titlealt, $val['code'], $val['picto']).'</a>';
+			if ($obj->stcomm_id != $val['id']) print '<a class="pictosubstatus" href="'.$_SERVER["PHP_SELF"].'?stcommcontactid='.$obj->rowid.'&stcomm='.$val['code'].'&action=setstcomm&token='.newToken().$param.($page ? '&page='.urlencode($page) : '').'">'.img_action($titlealt, $val['code'], $val['picto']).'</a>';
 		}
 		print '</div></div></td>';
 		if (!$i) $totalarray['nbfield']++;
diff --git a/htdocs/core/lib/ajax.lib.php b/htdocs/core/lib/ajax.lib.php
index 6b77003e52e..10fa477600a 100644
--- a/htdocs/core/lib/ajax.lib.php
+++ b/htdocs/core/lib/ajax.lib.php
@@ -504,8 +504,8 @@ function ajax_constantonoff($code, $input = array(), $entity = null, $revertonof
 
 	if (empty($conf->use_javascript_ajax) || $forcenoajax)
 	{
-		if (empty($conf->global->$code)) print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_'.$code.'&entity='.$entity.'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
-		else print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_'.$code.'&entity='.$entity.'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
+		if (empty($conf->global->$code)) print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_'.$code.'&token='.newToken().'&entity='.$entity.'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+		else print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_'.$code.'&token='.newToken().'&entity='.$entity.'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
 	} else {
 		$out = "\n<!-- Ajax code to switch constant ".$code." -->".'
 		<script>
diff --git a/htdocs/core/modules/printing/printgcp.modules.php b/htdocs/core/modules/printing/printgcp.modules.php
index fc7fef9a158..4b707f0772f 100644
--- a/htdocs/core/modules/printing/printgcp.modules.php
+++ b/htdocs/core/modules/printing/printgcp.modules.php
@@ -216,7 +216,7 @@ class printing_printgcp extends PrintingDriver
             if ($conf->global->PRINTING_GCP_DEFAULT == $printer_det['id'])
             {
                 $html .= img_picto($langs->trans("Default"), 'on');
-            } else $html .= '<a href="'.$_SERVER["PHP_SELF"].'?action=setvalue&amp;mode=test&amp;varname=PRINTING_GCP_DEFAULT&amp;driver=printgcp&amp;value='.urlencode($printer_det['id']).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+            } else $html .= '<a href="'.$_SERVER["PHP_SELF"].'?action=setvalue&amp;token='.newToken().'&amp;mode=test&amp;varname=PRINTING_GCP_DEFAULT&amp;driver=printgcp&amp;value='.urlencode($printer_det['id']).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
             $html .= '</td>';
             $html .= '</tr>'."\n";
         }
diff --git a/htdocs/core/modules/printing/printipp.modules.php b/htdocs/core/modules/printing/printipp.modules.php
index bd51b2c170e..6b0e528aa1e 100644
--- a/htdocs/core/modules/printing/printipp.modules.php
+++ b/htdocs/core/modules/printing/printipp.modules.php
@@ -190,7 +190,7 @@ class printing_printipp extends PrintingDriver
             if ($conf->global->PRINTIPP_URI_DEFAULT == $value) {
                 $html .= img_picto($langs->trans("Default"), 'on');
             } else {
-                $html .= '<a href="'.$_SERVER["PHP_SELF"].'?action=setvalue&amp;mode=test&amp;varname=PRINTIPP_URI_DEFAULT&amp;driver=printipp&amp;value='.urlencode($value).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+                $html .= '<a href="'.$_SERVER["PHP_SELF"].'?action=setvalue&amp;token='.newToken().'&amp;mode=test&amp;varname=PRINTIPP_URI_DEFAULT&amp;driver=printipp&amp;value='.urlencode($value).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
             }
             $html .= '</td>';
             $html .= '</tr>'."\n";
diff --git a/htdocs/don/admin/donation.php b/htdocs/don/admin/donation.php
index f686309f63c..6a28424d81b 100644
--- a/htdocs/don/admin/donation.php
+++ b/htdocs/don/admin/donation.php
@@ -261,12 +261,12 @@ if (is_resource($handle))
 						print '</td>';
 					} else {
 						print "<td class=\"center\">\n";
-						print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Enabled"), 'switch_on').'</a>';
+						print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Enabled"), 'switch_on').'</a>';
 						print '</td>';
 					}
 				} else {
 					print "<td class=\"center\">\n";
-					print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+					print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 					print "</td>";
 				}
 
@@ -278,7 +278,7 @@ if (is_resource($handle))
 					print '</td>';
 				} else {
 					print "<td class=\"center\">";
-					print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+					print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 					print '</td>';
 				}
 
diff --git a/htdocs/don/card.php b/htdocs/don/card.php
index 70935e12472..42e45c2cba0 100644
--- a/htdocs/don/card.php
+++ b/htdocs/don/card.php
@@ -787,12 +787,12 @@ if (!empty($id) && $action != 'edit')
 
 	if ($object->statut == 0)
 	{
-		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?rowid='.$object->id.'&action=valid_promesse">'.$langs->trans("ValidPromess").'</a></div>';
+		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?rowid='.$object->id.'&action=valid_promesse&token='.newToken().'">'.$langs->trans("ValidPromess").'</a></div>';
 	}
 
     if (($object->statut == 0 || $object->statut == 1) && $totalpaid == 0 && $object->paid == 0)
     {
-        print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?rowid='.$object->id.'&action=set_cancel">'.$langs->trans("ClassifyCanceled")."</a></div>";
+        print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?rowid='.$object->id.'&action=set_cancel&token='.newToken().'">'.$langs->trans("ClassifyCanceled")."</a></div>";
     }
 
 	// Create payment
diff --git a/htdocs/expensereport/card.php b/htdocs/expensereport/card.php
index fa2e30ed31d..addb13da745 100644
--- a/htdocs/expensereport/card.php
+++ b/htdocs/expensereport/card.php
@@ -2601,7 +2601,7 @@ if ($action != 'create' && $action != 'edit')
 		if ($user->id == $object->fk_user_author || $user->id == $object->fk_user_valid)
 		{
 			// setdraft
-			print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=setdraft&id='.$object->id.'">'.$langs->trans('SetToDraft').'</a></div>';
+			print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=setdraft&token='.newToken().'&id='.$object->id.'">'.$langs->trans('SetToDraft').'</a></div>';
 		}
 	}
 
@@ -2615,7 +2615,7 @@ if ($action != 'create' && $action != 'edit')
 		if (in_array($object->fk_user_author, $user->getAllChildIds(1)))
 		{
 			// set draft
-			print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=setdraft&id='.$object->id.'">'.$langs->trans('SetToDraft').'</a></div>';
+			print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=setdraft&token='.newToken().'&id='.$object->id.'">'.$langs->trans('SetToDraft').'</a></div>';
 		}
 	}
 
@@ -2663,43 +2663,43 @@ if ($action != 'create' && $action != 'edit')
 		//if ((round($remaintopay) == 0 || empty($conf->banque->enabled)) && $object->paid == 0)
 		if ($object->paid == 0)
 		{
-			print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=set_paid">'.$langs->trans("ClassifyPaid")."</a></div>";
+			print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=set_paid&token='.newToken().'">'.$langs->trans("ClassifyPaid")."</a></div>";
 		}
 	}
 
 	if ($user->rights->expensereport->creer && ($user->id == $object->fk_user_author || $user->id == $object->fk_user_valid) && $object->fk_statut == ExpenseReport::STATUS_APPROVED)
 	{
 		// Cancel
-   		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=cancel&id='.$object->id.'">'.$langs->trans('Cancel').'</a></div>';
+   		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=cancel&token='.newToken().'&id='.$object->id.'">'.$langs->trans('Cancel').'</a></div>';
 	}
 
 	// TODO Replace this. It should be SetUnpaid and should go back to status unpaid not canceled.
 	if (($user->rights->expensereport->approve || $user->rights->expensereport->to_paid) && $object->fk_statut == ExpenseReport::STATUS_CLOSED)
 	{
 		// Cancel
-		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=cancel&id='.$object->id.'">'.$langs->trans('Cancel').'</a></div>';
+		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=cancel&token='.newToken().'&id='.$object->id.'">'.$langs->trans('Cancel').'</a></div>';
 	}
 
 	if ($user->rights->expensereport->to_paid && $object->paid && $object->fk_statut == ExpenseReport::STATUS_CLOSED)
 	{
 		// Set unpaid
-		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=set_unpaid&id='.$object->id.'">'.$langs->trans('ClassifyUnPaid').'</a></div>';
+		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=set_unpaid&token='.newToken().'&id='.$object->id.'">'.$langs->trans('ClassifyUnPaid').'</a></div>';
 	}
 
 	// Clone
 	if ($user->rights->expensereport->creer) {
-		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=clone">'.$langs->trans("ToClone").'</a></div>';
+		print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=clone&token='.newToken().'">'.$langs->trans("ToClone").'</a></div>';
 	}
 
 	/* If draft, validated, cancel, and user can create, he can always delete its card before it is approved */
 	if ($user->rights->expensereport->creer && $user->id == $object->fk_user_author && $object->fk_statut < ExpenseReport::STATUS_APPROVED)
 	{
 		// Delete
-		print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&id='.$object->id.'">'.$langs->trans('Delete').'</a></div>';
+		print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&token='.newToken().'&id='.$object->id.'">'.$langs->trans('Delete').'</a></div>';
 	} elseif ($user->rights->expensereport->supprimer && $object->fk_statut != ExpenseReport::STATUS_CLOSED)
 	{
 		// Delete
-		print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&id='.$object->id.'">'.$langs->trans('Delete').'</a></div>';
+		print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&token='.newToken().'&id='.$object->id.'">'.$langs->trans('Delete').'</a></div>';
 	}
 
 	$parameters = array();
diff --git a/htdocs/margin/admin/margin.php b/htdocs/margin/admin/margin.php
index cea00dfdff6..cf2cde3e19d 100644
--- a/htdocs/margin/admin/margin.php
+++ b/htdocs/margin/admin/margin.php
@@ -159,9 +159,9 @@ if (!empty($conf->use_javascript_ajax))
 } else {
 	if (empty($conf->global->DISPLAY_MARGIN_RATES))
 	{
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_DISPLAY_MARGIN_RATES">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_DISPLAY_MARGIN_RATES&amp;token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 	} else {
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_DISPLAY_MARGIN_RATES">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_DISPLAY_MARGIN_RATES&amp;token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
 	}
 }
 print '</td>';
@@ -197,9 +197,9 @@ if (!empty($conf->use_javascript_ajax))
 } else {
 	if (empty($conf->global->ForceBuyingPriceIfNull))
 	{
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_ForceBuyingPriceIfNull">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_ForceBuyingPriceIfNull&amp;token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 	} else {
-		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_ForceBuyingPriceIfNull">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
+		print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_ForceBuyingPriceIfNull&amp;token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
 	}
 }
 print '</td>';
diff --git a/htdocs/modulebuilder/admin/setup.php b/htdocs/modulebuilder/admin/setup.php
index c100c4a1ab0..b7cadf26341 100644
--- a/htdocs/modulebuilder/admin/setup.php
+++ b/htdocs/modulebuilder/admin/setup.php
@@ -123,9 +123,9 @@ if ($conf->global->MAIN_FEATURES_LEVEL >= 2)
 		print ajax_constantonoff('MODULEBUILDER_USE_ABOUT');
 	} else {
 		if (empty($conf->global->MODULEBUILDER_USE_ABOUT)) {
-			print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=set_MODULEBUILDER_USE_ABOUT">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+			print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=set_MODULEBUILDER_USE_ABOUT&amp;token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 		} else {
-			print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=del_MODULEBUILDER_USE_ABOUT">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
+			print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=del_MODULEBUILDER_USE_ABOUT&amp;token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
 		}
 	}
 	print '</td></tr>';
diff --git a/htdocs/modulebuilder/index.php b/htdocs/modulebuilder/index.php
index 2404a81b101..fd9fe7fa798 100644
--- a/htdocs/modulebuilder/index.php
+++ b/htdocs/modulebuilder/index.php
@@ -1714,7 +1714,7 @@ if (is_array($listofmodules) && count($listofmodules) > 0) {
 			$linktoenabledisable .= ' &nbsp; <a href="'.dol_buildpath('/'.$regs[2].'/admin/'.$regs[1], 1).'?save_lastsearch_values=1&backtopage='.urlencode($backtourl).'" title="'.$langs->trans("Setup").'">'.img_picto($langs->trans("Setup"), "setup", 'style="padding-right: 6px"').'</a>';
 		}
 	} else {
-		$linktoenabledisable .= '<a class="reposition asetresetmodule valignmiddle" href="'.$_SERVER["PHP_SELF"].'?id='.$moduleobj->numero.'&action=set&value=mod'.$module.$param.'">';
+		$linktoenabledisable .= '<a class="reposition asetresetmodule valignmiddle" href="'.$_SERVER["PHP_SELF"].'?id='.$moduleobj->numero.'&action=set&token='.newToken().'&value=mod'.$module.$param.'">';
 		$linktoenabledisable .= img_picto($langs->trans("ModuleIsNotActive", $urltomodulesetup), 'switch_off', '', false, 0, 0, '', 'classfortooltip', 1);
 		$linktoenabledisable .= "</a>\n";
 	}
diff --git a/htdocs/modulebuilder/template/admin/setup.php b/htdocs/modulebuilder/template/admin/setup.php
index b0ef752707c..11116fc33f4 100644
--- a/htdocs/modulebuilder/template/admin/setup.php
+++ b/htdocs/modulebuilder/template/admin/setup.php
@@ -321,7 +321,7 @@ foreach ($myTmpObjects as $myTmpObjectKey => $myTmpObjectArray) {
 								{
 									print img_picto($langs->trans("Activated"), 'switch_on');
 								} else {
-									print '<a href="'.$_SERVER["PHP_SELF"].'?action=setmod&object='.strtolower($myTmpObjectKey).'&value='.$file.'">';
+									print '<a href="'.$_SERVER["PHP_SELF"].'?action=setmod&token='.newToken().'&object='.strtolower($myTmpObjectKey).'&value='.urlencode($file).'">';
 									print img_picto($langs->trans("Disabled"), 'switch_off');
 									print '</a>';
 								}
@@ -451,13 +451,13 @@ foreach ($myTmpObjects as $myTmpObjectKey => $myTmpObjectArray) {
 										if (in_array($name, $def))
 										{
 											print '<td class="center">'."\n";
-											print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&value='.$name.'">';
+											print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'">';
 											print img_picto($langs->trans("Enabled"), 'switch_on');
 											print '</a>';
 											print '</td>';
 										} else {
 											print '<td class="center">'."\n";
-											print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+											print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 											print "</td>";
 										}
 
@@ -468,7 +468,7 @@ foreach ($myTmpObjects as $myTmpObjectKey => $myTmpObjectArray) {
 										{
 											print img_picto($langs->trans("Default"), 'on');
 										} else {
-											print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+											print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 										}
 										print '</td>';
 
diff --git a/htdocs/paypal/admin/paypal.php b/htdocs/paypal/admin/paypal.php
index 4c304201c6c..3cf751f7391 100644
--- a/htdocs/paypal/admin/paypal.php
+++ b/htdocs/paypal/admin/paypal.php
@@ -148,10 +148,10 @@ print '<td class="titlefield">';
 print $langs->trans("PaypalLiveEnabled").'</td><td>';
 if (empty($conf->global->PAYPAL_API_SANDBOX))
 {
-    print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setlive&value=0">';
+    print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setlive&token='.newToken().'&value=0">';
     print img_picto($langs->trans("Activated"), 'switch_on');
 } else {
-    print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setlive&value=1">';
+    print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setlive&token='.newToken().'&value=1">';
     print img_picto($langs->trans("Disabled"), 'switch_off');
 }
 print '</td></tr>';
diff --git a/htdocs/printing/admin/printing.php b/htdocs/printing/admin/printing.php
index f76b7d66fbe..2f906c68382 100644
--- a/htdocs/printing/admin/printing.php
+++ b/htdocs/printing/admin/printing.php
@@ -262,9 +262,9 @@ if ($mode == 'config' && $user->admin)
         } else {
             if (empty($conf->global->{$printer->conf}))
             {
-                print '<a href="'.$_SERVER['PHP_SELF'].'?action=setvalue&amp;varname='.$printer->active.'&amp;value=1">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+                print '<a href="'.$_SERVER['PHP_SELF'].'?action=setvalue&amp;token='.newToken().'&amp;varname='.$printer->active.'&amp;value=1">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
             } else {
-                print '<a href="'.$_SERVER['PHP_SELF'].'?action=setvalue&amp;varname='.$printer->active.'&amp;value=0">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
+                print '<a href="'.$_SERVER['PHP_SELF'].'?action=setvalue&amp;token='.newToken().'&amp;varname='.$printer->active.'&amp;value=0">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
             }
         }
         print '<td class="center"><a href="'.$_SERVER['PHP_SELF'].'?mode=setup&amp;driver='.$printer->name.'">'.img_picto('', 'setup').'</a></td>';
diff --git a/htdocs/product/admin/product.php b/htdocs/product/admin/product.php
index f037dfb3d6f..09418b5e896 100644
--- a/htdocs/product/admin/product.php
+++ b/htdocs/product/admin/product.php
@@ -355,7 +355,7 @@ foreach ($dirproduct as $dirroot)
     				$disabled = false;
     				if (!empty($conf->multicompany->enabled) && (is_object($mc) && !empty($mc->sharings['referent']) && $mc->sharings['referent'] == $conf->entity) ? false : true);
     				print '<td class="center">';
-    				if (!$disabled) print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setcodeproduct&value='.$file.'">';
+    				if (!$disabled) print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setcodeproduct&token='.newToken().'&value='.$file.'">';
     				print img_picto($langs->trans("Disabled"), 'switch_off');
     				if (!$disabled) print '</a>';
     				print '</td>';
@@ -463,7 +463,7 @@ foreach ($dirmodels as $reldir)
 	                            	print '</td>';
 	                            } else {
 	                                print '<td class="center">'."\n";
-	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 	                                print "</td>";
 	                            }
 
@@ -473,7 +473,7 @@ foreach ($dirmodels as $reldir)
 	                            {
 	                                print img_picto($langs->trans("Default"), 'on');
 	                            } else {
-	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+	                                print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 	                            }
 	                            print '</td>';
 
@@ -724,10 +724,10 @@ if (!empty($conf->global->PRODUCT_CANVAS_ABILITY))
     					{
     						print img_picto($langs->trans("Active"), 'tick');
     						print '</td><td class="right">';
-    						print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;spe='.$file.'&amp;value=0">'.$langs->trans("Disable").'</a>';
+    						print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;spe='.urlencode($file).'&amp;value=0">'.$langs->trans("Disable").'</a>';
     					} else {
     						print '&nbsp;</td><td class="right">';
-    						print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;spe='.$file.'&amp;value=1">'.$langs->trans("Activate").'</a>';
+    						print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;spe='.urlencode($file).'&amp;value=1">'.$langs->trans("Activate").'</a>';
     					}
 
     					print '</td></tr>';
diff --git a/htdocs/projet/admin/project.php b/htdocs/projet/admin/project.php
index 937a5d28f27..f66d305f688 100644
--- a/htdocs/projet/admin/project.php
+++ b/htdocs/projet/admin/project.php
@@ -360,7 +360,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;value=mod_'.$classname.'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+							print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmod&amp;token='.newToken().'&amp;value=mod_'.$classname.'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 						}
 						print '</td>';
 
@@ -457,7 +457,7 @@ if (empty($conf->global->PROJECT_HIDE_TASKS))
 							{
 								print img_picto($langs->trans("Activated"), 'switch_on');
 							} else {
-								print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmodtask&amp;value=mod_'.$classname.'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+								print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmodtask&amp;token='.newToken().'&amp;value=mod_'.$classname.'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 							}
 							print '</td>';
 
@@ -585,13 +585,13 @@ foreach ($dirmodels as $reldir)
 								if (in_array($name, $def))
 								{
 									print "<td class=\"center\">\n";
-									print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
+									print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">';
 									print img_picto($langs->trans("Enabled"), 'switch_on');
 									print '</a>';
 									print "</td>";
 								} else {
 									print "<td class=\"center\">\n";
-									print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+									print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 									print "</td>";
 								}
 
@@ -601,7 +601,7 @@ foreach ($dirmodels as $reldir)
 								{
 									print img_picto($langs->trans("Default"), 'on');
 								} else {
-									print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+									print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 								}
 								print '</td>';
 
@@ -740,7 +740,7 @@ if (empty($conf->global->PROJECT_HIDE_TASKS))
 										print "</td>";
 									} else {
 										print "<td class=\"center\">\n";
-										print '<a href="'.$_SERVER["PHP_SELF"].'?action=settask&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+										print '<a href="'.$_SERVER["PHP_SELF"].'?action=settask&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 										print "</td>";
 									}
 
@@ -750,7 +750,7 @@ if (empty($conf->global->PROJECT_HIDE_TASKS))
 									{
 										print img_picto($langs->trans("Default"), 'on');
 									} else {
-										print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoctask&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+										print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoctask&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 									}
 									print '</td>';
 
diff --git a/htdocs/recruitment/admin/public_interface.php b/htdocs/recruitment/admin/public_interface.php
index 8f80a7ef48d..1c943ae1085 100644
--- a/htdocs/recruitment/admin/public_interface.php
+++ b/htdocs/recruitment/admin/public_interface.php
@@ -93,12 +93,12 @@ print '<span class="opacitymedium">'.$langs->trans("PublicInterfaceRecruitmentDe
 $enabledisablehtml = $langs->trans("EnablePublicRecruitmentPages").' ';
 if (empty($conf->global->RECRUITMENT_ENABLE_PUBLIC_INTERFACE)) {
 	// Button off, click to enable
-	$enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setRECRUITMENT_ENABLE_PUBLIC_INTERFACE&value=1'.$param.'">';
+	$enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setRECRUITMENT_ENABLE_PUBLIC_INTERFACE&token='.newToken().'&value=1'.$param.'">';
 	$enabledisablehtml .= img_picto($langs->trans("Disabled"), 'switch_off');
 	$enabledisablehtml .= '</a>';
 } else {
 	// Button on, click to disable
-	$enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setRECRUITMENT_ENABLE_PUBLIC_INTERFACE&value=0'.$param.'">';
+	$enabledisablehtml .= '<a class="reposition valignmiddle" href="'.$_SERVER["PHP_SELF"].'?action=setRECRUITMENT_ENABLE_PUBLIC_INTERFACE&token='.newToken().'&value=0'.$param.'">';
 	$enabledisablehtml .= img_picto($langs->trans("Activated"), 'switch_on');
 	$enabledisablehtml .= '</a>';
 }
diff --git a/htdocs/recruitment/admin/setup.php b/htdocs/recruitment/admin/setup.php
index 72d455d7a14..43ffd3af439 100644
--- a/htdocs/recruitment/admin/setup.php
+++ b/htdocs/recruitment/admin/setup.php
@@ -319,7 +319,7 @@ foreach ($myTmpObjects as $myTmpObjectKey => $myTmpObjectArray) {
 								{
 									print img_picto($langs->trans("Activated"), 'switch_on');
 								} else {
-									print '<a href="'.$_SERVER["PHP_SELF"].'?action=setmod&object='.strtolower($myTmpObjectKey).'&value='.$file.'">';
+									print '<a href="'.$_SERVER["PHP_SELF"].'?action=setmod&token='.newToken().'&object='.strtolower($myTmpObjectKey).'&value='.urlencode($file).'">';
 									print img_picto($langs->trans("Disabled"), 'switch_off');
 									print '</a>';
 								}
@@ -450,13 +450,13 @@ foreach ($myTmpObjects as $myTmpObjectKey => $myTmpObjectArray) {
 										if (in_array($name, $def))
 										{
 											print '<td class="center">'."\n";
-											print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&value='.$name.'">';
+											print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'">';
 											print img_picto($langs->trans("Enabled"), 'switch_on');
 											print '</a>';
 											print '</td>';
 										} else {
 											print '<td class="center">'."\n";
-											print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+											print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 											print "</td>";
 										}
 
@@ -467,7 +467,7 @@ foreach ($myTmpObjects as $myTmpObjectKey => $myTmpObjectArray) {
 										{
 											print img_picto($langs->trans("Default"), 'on');
 										} else {
-											print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+											print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 										}
 										print '</td>';
 
diff --git a/htdocs/recruitment/admin/setup_candidatures.php b/htdocs/recruitment/admin/setup_candidatures.php
index e3738f57564..b2b6f25524b 100644
--- a/htdocs/recruitment/admin/setup_candidatures.php
+++ b/htdocs/recruitment/admin/setup_candidatures.php
@@ -319,7 +319,7 @@ foreach ($myTmpObjects as $myTmpObjectKey => $myTmpObjectArray) {
 								{
 									print img_picto($langs->trans("Activated"), 'switch_on');
 								} else {
-									print '<a href="'.$_SERVER["PHP_SELF"].'?action=setmod&object='.strtolower($myTmpObjectKey).'&value='.$file.'">';
+									print '<a href="'.$_SERVER["PHP_SELF"].'?action=setmod&token='.newToken().'&object='.strtolower($myTmpObjectKey).'&value='.urlencode($file).'">';
 									print img_picto($langs->trans("Disabled"), 'switch_off');
 									print '</a>';
 								}
@@ -450,13 +450,13 @@ foreach ($myTmpObjects as $myTmpObjectKey => $myTmpObjectArray) {
 										if (in_array($name, $def))
 										{
 											print '<td class="center">'."\n";
-											print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&value='.$name.'">';
+											print '<a href="'.$_SERVER["PHP_SELF"].'?action=del&amp;token='.newToken().'&amp;value='.$name.'">';
 											print img_picto($langs->trans("Enabled"), 'switch_on');
 											print '</a>';
 											print '</td>';
 										} else {
 											print '<td class="center">'."\n";
-											print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+											print '<a href="'.$_SERVER["PHP_SELF"].'?action=set&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 											print "</td>";
 										}
 
@@ -467,7 +467,7 @@ foreach ($myTmpObjects as $myTmpObjectKey => $myTmpObjectArray) {
 										{
 											print img_picto($langs->trans("Default"), 'on');
 										} else {
-											print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
+											print '<a href="'.$_SERVER["PHP_SELF"].'?action=setdoc&amp;token='.newToken().'&amp;value='.$name.'&amp;scan_dir='.$module->scandir.'&amp;label='.urlencode($module->name).'" alt="'.$langs->trans("Default").'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
 										}
 										print '</td>';
 
diff --git a/htdocs/societe/admin/societe.php b/htdocs/societe/admin/societe.php
index a66f17ca915..d27ebd79207 100644
--- a/htdocs/societe/admin/societe.php
+++ b/htdocs/societe/admin/societe.php
@@ -383,7 +383,7 @@ foreach ($arrayofmodules as $file => $modCodeTiers)
 	} else {
 		$disabled = (!empty($conf->multicompany->enabled) && (is_object($mc) && !empty($mc->sharings['referent']) && $mc->sharings['referent'] != $conf->entity) ? true : false);
 		print '<td class="center">';
-		if (!$disabled) print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setcodeclient&value='.$file.'">';
+		if (!$disabled) print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setcodeclient&amp;token='.newToken().'&amp;value='.$file.'">';
 		print img_picto($langs->trans("Disabled"), 'switch_off');
 		if (!$disabled) print '</a>';
 		print '</td>';
@@ -464,7 +464,7 @@ foreach ($arrayofmodules as $file => $modCodeCompta)
     	print img_picto($langs->trans("Activated"), 'switch_on');
     	print '</td>';
     } else {
-    	print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setcodecompta&value='.$file.'">';
+    	print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setcodecompta&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
     	print img_picto($langs->trans("Disabled"), 'switch_off');
     	print '</a></td>';
     }
@@ -666,33 +666,33 @@ foreach ($profid as $key => $val)
 
 		if ($verif)
 		{
-			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofid&value='.$key.'&status=0">';
+			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofid&token='.newToken().'&value='.$key.'&status=0">';
 			print img_picto($langs->trans("Activated"), 'switch_on');
 			print '</a></td>';
 		} else {
-			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofid&value='.$key.'&status=1">';
+			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofid&token='.newToken().'&value='.$key.'&status=1">';
 			print img_picto($langs->trans("Disabled"), 'switch_off');
 			print '</a></td>';
 		}
 
 		if ($mandatory)
 		{
-			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofidmandatory&value='.$key.'&status=0">';
+			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofidmandatory&token='.newToken().'&value='.$key.'&status=0">';
 			print img_picto($langs->trans("Activated"), 'switch_on');
 			print '</a></td>';
 		} else {
-			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofidmandatory&value='.$key.'&status=1">';
+			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofidmandator&token='.newToken().'&value='.$key.'&status=1">';
 			print img_picto($langs->trans("Disabled"), 'switch_off');
 			print '</a></td>';
 		}
 
 		if ($invoice_mandatory)
 		{
-			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofidinvoicemandatory&value='.$key.'&status=0">';
+			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofidinvoicemandatory&token='.newToken().'&value='.$key.'&status=0">';
 			print img_picto($langs->trans("Activated"), 'switch_on');
 			print '</a></td>';
 		} else {
-			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofidinvoicemandatory&value='.$key.'&status=1">';
+			print '<td class="center"><a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setprofidinvoicemandatory&token='.newToken().'&value='.$key.'&status=1">';
 			print img_picto($langs->trans("Disabled"), 'switch_off');
 			print '</a></td>';
 		}
@@ -776,10 +776,10 @@ print '<td>&nbsp</td>';
 print '<td class="center">';
 if (!empty($conf->global->SOCIETE_ADD_REF_IN_LIST))
 {
-	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaddrefinlist&value=0">';
+	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaddrefinlist&token='.newToken().'&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 } else {
-	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaddrefinlist&value=1">';
+	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaddrefinlist&token='.newToken().'&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 }
 print '</a></td>';
@@ -791,10 +791,10 @@ print '<td>&nbsp</td>';
 print '<td class="center">';
 if (!empty($conf->global->COMPANY_SHOW_ADDRESS_SELECTLIST))
 {
-	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaddadressinlist&value=0">';
+	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaddadressinlist&token='.newToken().'&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 } else {
-	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaddadressinlist&value=1">';
+	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaddadressinlist&token='.newToken().'&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 }
 print '</a></td>';
@@ -808,10 +808,10 @@ print '<td>&nbsp</td>';
 print '<td class="center">';
 if (!empty($conf->global->SOCIETE_ASK_FOR_SHIPPING_METHOD))
 {
-	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaskforshippingmet&value=0">';
+	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaskforshippingmet&token='.newToken().'&value=0">';
 	print img_picto($langs->trans("Activated"), 'switch_on');
 } else {
-	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaskforshippingmet&value=1">';
+	print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setaskforshippingmet&token='.newToken().'&value=1">';
 	print img_picto($langs->trans("Disabled"), 'switch_off');
 }
 print '</a></td>';
@@ -824,10 +824,10 @@ print '<td>&nbsp</td>';
 print '<td class="center">';
 if (!empty($conf->global->SOCIETE_DISABLE_PROSPECTSCUSTOMERS))
 {
-    print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisableprospectcustomer&value=0">';
+    print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisableprospectcustomer&token='.newToken().'&value=0">';
     print img_picto($langs->trans("Activated"), 'switch_on');
 } else {
-    print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisableprospectcustomer&value=1">';
+    print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=setdisableprospectcustomer&token='.newToken().'&value=1">';
     print img_picto($langs->trans("Disabled"), 'switch_off');
 }
 print '</a></td>';
diff --git a/htdocs/societe/list.php b/htdocs/societe/list.php
index ea0b3a55d8e..0534d5d0346 100644
--- a/htdocs/societe/list.php
+++ b/htdocs/societe/list.php
@@ -1258,7 +1258,7 @@ while ($i < min($num, $limit))
 		{
 			$titlealt = 'default';
 			if (!empty($val['code']) && !in_array($val['code'], array('ST_NO', 'ST_NEVER', 'ST_TODO', 'ST_PEND', 'ST_DONE'))) $titlealt = $val['label'];
-			if ($obj->stcomm_id != $val['id']) print '<a class="pictosubstatus" href="' . $_SERVER["PHP_SELF"] . '?stcommsocid=' . $obj->rowid . '&stcomm=' . $val['code'] . '&action=setstcomm' . $param . ($page ? '&page=' . urlencode($page) : '') . '">' . img_action($titlealt, $val['code'], $val['picto']) . '</a>';
+			if ($obj->stcomm_id != $val['id']) print '<a class="pictosubstatus" href="' . $_SERVER["PHP_SELF"] . '?stcommsocid=' . $obj->rowid . '&stcomm=' . $val['code'] . '&action=setstcomm&token='.newToken() . $param . ($page ? '&page=' . urlencode($page) : '') . '">' . img_action($titlealt, $val['code'], $val['picto']) . '</a>';
 		}
 		print '</div></div></td>';
 		if (!$i) $totalarray['nbfield']++;
diff --git a/htdocs/societe/paymentmodes.php b/htdocs/societe/paymentmodes.php
index 26828773753..ed835dfd9a4 100644
--- a/htdocs/societe/paymentmodes.php
+++ b/htdocs/societe/paymentmodes.php
@@ -1067,7 +1067,7 @@ if ($socid && $action != 'edit' && $action != 'create' && $action != 'editcard'
 							print '<td class="center">';
 							if (empty($companypaymentmodetemp->default_rib))
 							{
-								print '<a href="'.DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.$object->id.'&id='.$companypaymentmodetemp->id.'&action=setlocalassourcedefault">';
+								print '<a href="'.DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.$object->id.'&id='.$companypaymentmodetemp->id.'&action=setlocalassourcedefault&token='.newToken().'">';
 								print img_picto($langs->trans("Default"), 'off');
 								print '</a>';
 							} else {
@@ -1225,7 +1225,7 @@ if ($socid && $action != 'edit' && $action != 'create' && $action != 'editcard'
 				if ((empty($customerstripe->invoice_settings) && $customerstripe->default_source != $src->id) ||
 					(!empty($customerstripe->invoice_settings) && $customerstripe->invoice_settings->default_payment_method != $src->id))
 				{
-					print '<a href="'.DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.$object->id.'&source='.$src->id.'&action=setassourcedefault">';
+					print '<a href="'.DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.$object->id.'&source='.$src->id.'&action=setassourcedefault&token='.newToken().'">';
 					print img_picto($langs->trans("Default"), 'off');
 					print '</a>';
 				} else {
@@ -1420,7 +1420,7 @@ if ($socid && $action != 'edit' && $action != 'create' && $action != 'editcard'
 			// Default
 			print '<td class="center" width="70">';
 			if (!$rib->default_rib) {
-				print '<a href="'.$_SERVER["PHP_SELF"].'?socid='.$object->id.'&ribid='.$rib->id.'&action=setasbankdefault">';
+				print '<a href="'.$_SERVER["PHP_SELF"].'?socid='.$object->id.'&ribid='.$rib->id.'&action=setasbankdefault&token='.newToken().'">';
 				print img_picto($langs->trans("Disabled"), 'off');
 				print '</a>';
 			} else {
diff --git a/htdocs/takepos/admin/receipt.php b/htdocs/takepos/admin/receipt.php
index 62e08d2084d..d7162138fe3 100644
--- a/htdocs/takepos/admin/receipt.php
+++ b/htdocs/takepos/admin/receipt.php
@@ -104,7 +104,7 @@ if ($conf->global->TAKEPOS_PRINT_METHOD == "browser")
 {
     print img_picto($langs->trans("Activated"), 'switch_on');
 } else {
-    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmethod&value=browser">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmethod&token='.newToken().'&value=browser">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 }
 print "</td></tr>\n";
 
@@ -121,7 +121,7 @@ if ($conf->global->MAIN_FEATURES_LEVEL >= 1) {
 		if ($conf->global->TAKEPOS_PRINT_METHOD == "receiptprinter") {
 			print img_picto($langs->trans("Activated"), 'switch_on');
 		} else {
-			print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmethod&value=receiptprinter">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+			print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmethod&token='.newToken().'&value=receiptprinter">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 		}
 	} else {
 		print '<span class="opacitymedium">';
@@ -141,7 +141,7 @@ if ($conf->global->TAKEPOS_PRINT_METHOD == "takeposconnector")
 {
     print img_picto($langs->trans("Activated"), 'switch_on');
 } else {
-    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmethod&value=takeposconnector">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
+    print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=setmethod&token='.newToken().'&value=takeposconnector">'.img_picto($langs->trans("Disabled"), 'switch_off').'</a>';
 }
 print "</td></tr>\n";
 print '</table>';
diff --git a/htdocs/takepos/admin/setup.php b/htdocs/takepos/admin/setup.php
index 48c713f4b66..9471e9d1ea4 100644
--- a/htdocs/takepos/admin/setup.php
+++ b/htdocs/takepos/admin/setup.php
@@ -194,7 +194,7 @@ foreach ($dirmodels as $reldir)
 						{
 							print img_picto($langs->trans("Activated"), 'switch_on');
 						} else {
-							print '<a href="'.$_SERVER["PHP_SELF"].'?action=setrefmod&amp;value='.$file.'">';
+							print '<a href="'.$_SERVER["PHP_SELF"].'?action=setrefmod&amp;token='.newToken().'&amp;value='.urlencode($file).'">';
 							print img_picto($langs->trans("Disabled"), 'switch_off');
 							print '</a>';
 						}
diff --git a/htdocs/theme/eldy/btn.inc.php b/htdocs/theme/eldy/btn.inc.php
index c640fc1fb21..c866b187638 100644
--- a/htdocs/theme/eldy/btn.inc.php
+++ b/htdocs/theme/eldy/btn.inc.php
@@ -70,7 +70,6 @@ span.butAction, span.butActionDelete {
 
     margin: 0em <?php echo ($dol_optimize_smallscreen ? '0.6' : '0.9'); ?>em;
     padding: 0.6em <?php echo ($dol_optimize_smallscreen ? '0.6' : '0.7'); ?>em;
-    font-family: <?php print $fontlist ?>;
     display: inline-block;
     text-align: center;
     cursor: pointer;
@@ -277,6 +276,9 @@ div.pagination li:first-child a.btnTitle{
 /* rule to reduce top menu - 2nd reduction: Reduce width of top menu icons again */
 @media only screen and (max-width: <?php echo empty($conf->global->THEME_ELDY_WITDHOFFSET_FOR_REDUC2) ? round($nbtopmenuentries * 69, 0) + 130 : $conf->global->THEME_ELDY_WITDHOFFSET_FOR_REDUC2; ?>px)	/* reduction 2 */
 {
+	.butAction, .butActionRefused, .butActionDelete {
+		font-size: 0.95em;
+	}
 	.btnTitle, a.btnTitle {
 	    display: inline-block;
 	    padding: 4px 4px 4px 4px;
diff --git a/htdocs/ticket/class/actions_ticket.class.php b/htdocs/ticket/class/actions_ticket.class.php
index 9a142ef4ba7..49185f093fc 100644
--- a/htdocs/ticket/class/actions_ticket.class.php
+++ b/htdocs/ticket/class/actions_ticket.class.php
@@ -408,7 +408,7 @@ class ActionsTicket
 				{
 					$urlforbutton = $_SERVER['PHP_SELF'].'?track_id='.$object->track_id.'&action=mark_ticket_read'; // To set as read, we use a dedicated action
 				} else {
-					$urlforbutton = $_SERVER['PHP_SELF'].'?track_id='.$object->track_id.'&action=set_status&new_status='.$status;
+					$urlforbutton = $_SERVER['PHP_SELF'].'?track_id='.$object->track_id.'&action=set_status&token='.newToken().'&new_status='.$status;
 				}
 
 				print '<a class="butAction buttonticket marginbottomonly" href="'.$urlforbutton.'">';
diff --git a/htdocs/website/index.php b/htdocs/website/index.php
index 7614f6cc876..b8e6718fb36 100644
--- a/htdocs/website/index.php
+++ b/htdocs/website/index.php
@@ -2734,10 +2734,10 @@ if (!GETPOST('hide_websitemenu'))
 					//print '<input type="submit" class="button nobordertransp"'.$disabled.' value="'.dol_escape_htmltag($langs->trans("EditWithEditor")).'" name="editcontent">';
 					if (empty($conf->global->WEBSITE_EDITINLINE))
 					{
-						print '<a class="nobordertransp nohoverborder marginleftonlyshort valignmiddle"'.$disabled.' href="'.$_SERVER["PHP_SELF"].'?website='.$object->ref.'&pageid='.$websitepage->id.'&action=seteditinline">'.img_picto($langs->trans("EditInLineOnOff", $langs->transnoentitiesnoconv("Off")), 'switch_off', '', false, 0, 0, '', 'nomarginleft').'</a>';
+						print '<a class="nobordertransp nohoverborder marginleftonlyshort valignmiddle"'.$disabled.' href="'.$_SERVER["PHP_SELF"].'?website='.$object->ref.'&pageid='.$websitepage->id.'&action=seteditinline&token='.newToken().'">'.img_picto($langs->trans("EditInLineOnOff", $langs->transnoentitiesnoconv("Off")), 'switch_off', '', false, 0, 0, '', 'nomarginleft').'</a>';
 					}
 					else {
-						print '<a class="nobordertransp nohoverborder marginleftonlyshort valignmiddle"'.$disabled.' href="'.$_SERVER["PHP_SELF"].'?website='.$object->ref.'&pageid='.$websitepage->id.'&action=unseteditinline">'.img_picto($langs->trans("EditInLineOnOff", $langs->transnoentitiesnoconv("On")), 'switch_on', '', false, 0, 0, '', 'nomarginleft').'</a>';
+						print '<a class="nobordertransp nohoverborder marginleftonlyshort valignmiddle"'.$disabled.' href="'.$_SERVER["PHP_SELF"].'?website='.$object->ref.'&pageid='.$websitepage->id.'&action=unseteditinline&token='.newToken().'">'.img_picto($langs->trans("EditInLineOnOff", $langs->transnoentitiesnoconv("On")), 'switch_on', '', false, 0, 0, '', 'nomarginleft').'</a>';
 					}
 				}
 
@@ -2746,10 +2746,10 @@ if (!GETPOST('hide_websitemenu'))
 				print $langs->trans("ShowSubcontainers");
 				if (empty($conf->global->WEBSITE_SUBCONTAINERSINLINE))
 				{
-					print '<a class="nobordertransp nohoverborder marginleftonlyshort valignmiddle"'.$disabled.' href="'.$_SERVER["PHP_SELF"].'?website='.$object->ref.'&pageid='.$websitepage->id.'&action=setshowsubcontainers">'.img_picto($langs->trans("ShowSubContainersOnOff", $langs->transnoentitiesnoconv("Off")), 'switch_off', '', false, 0, 0, '', 'nomarginleft').'</a>';
+					print '<a class="nobordertransp nohoverborder marginleftonlyshort valignmiddle"'.$disabled.' href="'.$_SERVER["PHP_SELF"].'?website='.$object->ref.'&pageid='.$websitepage->id.'&action=setshowsubcontainers&token='.newToken().'">'.img_picto($langs->trans("ShowSubContainersOnOff", $langs->transnoentitiesnoconv("Off")), 'switch_off', '', false, 0, 0, '', 'nomarginleft').'</a>';
 				}
 				else {
-					print '<a class="nobordertransp nohoverborder marginleftonlyshort valignmiddle"'.$disabled.' href="'.$_SERVER["PHP_SELF"].'?website='.$object->ref.'&pageid='.$websitepage->id.'&action=unsetshowsubcontainers">'.img_picto($langs->trans("ShowSubContainersOnOff", $langs->transnoentitiesnoconv("On")), 'switch_on', '', false, 0, 0, '', 'nomarginleft').'</a>';
+					print '<a class="nobordertransp nohoverborder marginleftonlyshort valignmiddle"'.$disabled.' href="'.$_SERVER["PHP_SELF"].'?website='.$object->ref.'&pageid='.$websitepage->id.'&action=unsetshowsubcontainers&token='.newToken().'">'.img_picto($langs->trans("ShowSubContainersOnOff", $langs->transnoentitiesnoconv("On")), 'switch_on', '', false, 0, 0, '', 'nomarginleft').'</a>';
 				}
 				/*}*/
 				print '</div>';
@@ -2766,7 +2766,7 @@ if (!GETPOST('hide_websitemenu'))
 				else {
 					//$disabled='';
 					//print '<input type="submit" class="button bordertransp"'.$disabled.' value="'.dol_escape_htmltag($langs->trans("SetAsHomePage")).'" name="setashome">';
-					print '<a href="'.$_SERVER["PHP_SEFL"].'?action=setashome&website='.$website->ref.'&pageid='.$pageid.'" class="button bordertransp"'.$disabled.' title="'.dol_escape_htmltag($langs->trans("SetAsHomePage")).'"><span class="fa fa-home valignmiddle btnTitle-icon"><span></a>';
+					print '<a href="'.$_SERVER["PHP_SEFL"].'?action=setashome&token='.newToken().'&website='.$website->ref.'&pageid='.$pageid.'" class="button bordertransp"'.$disabled.' title="'.dol_escape_htmltag($langs->trans("SetAsHomePage")).'"><span class="fa fa-home valignmiddle btnTitle-icon"><span></a>';
 				}
 				print '<input type="submit" class="button bordertransp"'.$disabled.' value="'.dol_escape_htmltag($langs->trans("ClonePage")).'" name="createpagefromclone">';
 				print '<input type="submit" class="buttonDelete bordertransp" name="delete" value="'.$langs->trans("Delete").'"'.($atleastonepage ? '' : ' disabled="disabled"').'>';

From 8ab627e76817f8074700e267a6c3af09ff3db5f5 Mon Sep 17 00:00:00 2001
From: BENKE Charlene <1179011+defrance@users.noreply.github.com>
Date: Wed, 30 Sep 2020 15:17:44 +0200
Subject: [PATCH 068/101] fix typo error

---
 htdocs/fichinter/class/fichinter.class.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/fichinter/class/fichinter.class.php b/htdocs/fichinter/class/fichinter.class.php
index d0bc877d910..930c6e07978 100644
--- a/htdocs/fichinter/class/fichinter.class.php
+++ b/htdocs/fichinter/class/fichinter.class.php
@@ -4,7 +4,7 @@
  * Copyright (C) 2005-2012 Regis Houssin        <regis.houssin@inodbox.com>
  * Copyright (C) 2011-2020 Juanjo Menent        <jmenent@2byte.es>
  * Copyright (C) 2015      Marcos García        <marcosgdf@gmail.com>
- * Copyright (C) 2015      Charlie Benke        <charlie@patas-monkey.com>
+ * Copyright (C) 2015-2020 Charlene Benke       <charlie@patas-monkey.com>
  * Copyright (C) 2018      Nicolas ZABOURI	    <info@inovea-conseil.com>
  * Copyright (C) 2018-2019 Frédéric France      <frederic.france@netlogic.fr>
  *
@@ -810,7 +810,7 @@ class Fichinter extends CommonObject
 		$result .= $linkend;
 
 		global $action;
-		$hookmanager->initHooks(array('intervnetiondao'));
+		$hookmanager->initHooks(array('interventiondao'));
 		$parameters = array('id'=>$this->id, 'getnomurl'=>$result);
 		$reshook = $hookmanager->executeHooks('getNomUrl', $parameters, $this, $action); // Note that $action and $object may have been modified by some hooks
 		if ($reshook > 0) $result = $hookmanager->resPrint;

From 9624a33e531dfa07dfd31c64c7e65ef98f4b623f Mon Sep 17 00:00:00 2001
From: ptibogxiv <support@ptibogxiv.net>
Date: Wed, 30 Sep 2020 15:27:16 +0200
Subject: [PATCH 069/101] FIX date and user cloture / closing display

temporary fix while convert french to english term in dolibarr
---
 htdocs/core/lib/functions2.lib.php | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/htdocs/core/lib/functions2.lib.php b/htdocs/core/lib/functions2.lib.php
index b5a51032bdd..547f1be6620 100644
--- a/htdocs/core/lib/functions2.lib.php
+++ b/htdocs/core/lib/functions2.lib.php
@@ -383,19 +383,20 @@ function dol_print_object_info($object, $usetable = 0)
 	}
 
 	// User close
-	if (!empty($object->user_cloture))
+	if (!empty($object->user_cloture) || !empty($object->user_closing))
 	{
+  if (isset($object->user_cloture) && !empty($object->user_cloture)) $object->user_closing = $object->user_cloture;
 		if ($usetable) print '<tr><td class="titlefield">';
 		print $langs->trans("ClosedBy");
 		if ($usetable) print '</td><td>';
 		else print ': ';
-		if (is_object($object->user_cloture))
+		if (is_object($object->user_closing))
 		{
-			if ($object->user_cloture->id) print $object->user_cloture->getNomUrl(1, '', 0, 0, 0);
+			if ($object->user_closing->id) print $object->user_closing->getNomUrl(1, '', 0, 0, 0);
 			else print $langs->trans("Unknown");
 		} else {
 			$userstatic = new User($db);
-			$userstatic->fetch($object->user_cloture);
+			$userstatic->fetch($object->user_closing);
 			if ($userstatic->id) print $userstatic->getNomUrl(1, '', 0, 0, 0);
 			else print $langs->trans("Unknown");
 		}
@@ -404,14 +405,15 @@ function dol_print_object_info($object, $usetable = 0)
 	}
 
 	// Date close
-	if (!empty($object->date_cloture))
+	if (!empty($object->date_cloture) || !empty($object->date_closing))
 	{
+  if (isset($object->date_cloture) && !empty($object->date_cloture)) $object->date_closing = $object->date_cloture;
 		if ($usetable) print '<tr><td class="titlefield">';
 		print $langs->trans("DateClosing");
 		if ($usetable) print '</td><td>';
 		else print ': ';
-		print dol_print_date($object->date_cloture, 'dayhour');
-		if ($deltadateforuser) print ' '.$langs->trans("CurrentHour").' &nbsp; / &nbsp; '.dol_print_date($object->date_cloture + ($deltadateforuser * 3600), "dayhour").' &nbsp;'.$langs->trans("ClientHour");
+		print dol_print_date($object->date_closing, 'dayhour');
+		if ($deltadateforuser) print ' '.$langs->trans("CurrentHour").' &nbsp; / &nbsp; '.dol_print_date($object->date_closing + ($deltadateforuser * 3600), "dayhour").' &nbsp;'.$langs->trans("ClientHour");
 		if ($usetable) print '</td></tr>';
 		else print '<br>';
 	}

From e14c971b69d007bdb8a4dddbb0848dbbb7c942be Mon Sep 17 00:00:00 2001
From: stickler-ci <support@stickler-ci.com>
Date: Wed, 30 Sep 2020 13:29:20 +0000
Subject: [PATCH 070/101] Fixing style errors.

---
 htdocs/core/lib/functions2.lib.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/core/lib/functions2.lib.php b/htdocs/core/lib/functions2.lib.php
index 547f1be6620..7cc14060aac 100644
--- a/htdocs/core/lib/functions2.lib.php
+++ b/htdocs/core/lib/functions2.lib.php
@@ -385,7 +385,7 @@ function dol_print_object_info($object, $usetable = 0)
 	// User close
 	if (!empty($object->user_cloture) || !empty($object->user_closing))
 	{
-  if (isset($object->user_cloture) && !empty($object->user_cloture)) $object->user_closing = $object->user_cloture;
+		if (isset($object->user_cloture) && !empty($object->user_cloture)) $object->user_closing = $object->user_cloture;
 		if ($usetable) print '<tr><td class="titlefield">';
 		print $langs->trans("ClosedBy");
 		if ($usetable) print '</td><td>';
@@ -407,7 +407,7 @@ function dol_print_object_info($object, $usetable = 0)
 	// Date close
 	if (!empty($object->date_cloture) || !empty($object->date_closing))
 	{
-  if (isset($object->date_cloture) && !empty($object->date_cloture)) $object->date_closing = $object->date_cloture;
+		if (isset($object->date_cloture) && !empty($object->date_cloture)) $object->date_closing = $object->date_cloture;
 		if ($usetable) print '<tr><td class="titlefield">';
 		print $langs->trans("DateClosing");
 		if ($usetable) print '</td><td>';

From 1690468da5cf1587078522e678e79cda124bfa8c Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 30 Sep 2020 18:39:23 +0200
Subject: [PATCH 071/101] Fix delete of profiles

---
 htdocs/exports/class/export.class.php | 2 +-
 htdocs/exports/export.php             | 8 ++++----
 htdocs/imports/class/import.class.php | 2 +-
 htdocs/imports/import.php             | 6 +++---
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/htdocs/exports/class/export.class.php b/htdocs/exports/class/export.class.php
index c7d7f4eea89..a33437166ea 100644
--- a/htdocs/exports/class/export.class.php
+++ b/htdocs/exports/class/export.class.php
@@ -736,7 +736,7 @@ class Export
     {
 		$sql = 'SELECT em.rowid, em.label, em.type, em.field, em.filter';
 		$sql .= ' FROM '.MAIN_DB_PREFIX.'export_model as em';
-		$sql .= ' WHERE em.rowid = '.$id;
+		$sql .= ' WHERE em.rowid = '.((int) $id);
 
 		dol_syslog("Export::fetch", LOG_DEBUG);
 		$result = $this->db->query($sql);
diff --git a/htdocs/exports/export.php b/htdocs/exports/export.php
index a5f11264a43..70e04d46cbb 100644
--- a/htdocs/exports/export.php
+++ b/htdocs/exports/export.php
@@ -302,9 +302,9 @@ if ($step == 5 && $action == 'confirm_deletefile' && $confirm == 'yes')
 
 if ($action == 'deleteprof')
 {
-	if ($_GET["id"])
+	if (GETPOST("id", 'int'))
 	{
-		$objexport->fetch($_GET["id"]);
+		$objexport->fetch(GETPOST('id', 'int'));
 		$result = $objexport->delete($user);
 	}
 }
@@ -1054,7 +1054,7 @@ if ($step == 4 && $datatoexport)
 
 		print '<tr class="oddeven">';
 		print '<td><input name="export_name" size="32" value=""></td><td class="right">';
-        print '<input type="submit" class="button" value="'.$langs->trans("Save").'">';
+        print '<input type="submit" class="button reposition" value="'.$langs->trans("Save").'">';
         print '</td></tr>';
 
         // List of existing export profils
@@ -1074,7 +1074,7 @@ if ($step == 4 && $datatoexport)
 				print '<tr class="oddeven"><td>';
 				print $obj->label;
 				print '</td><td class="right">';
-				print '<a href="'.$_SERVER["PHP_SELF"].'?step='.$step.'&datatoexport='.$datatoexport.'&action=deleteprof&id='.$obj->rowid.'">';
+				print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?step='.$step.'&datatoexport='.$datatoexport.'&action=deleteprof&token='.newToken().'&id='.$obj->rowid.'">';
 				print img_delete();
 				print '</a>';
 				print '</tr>';
diff --git a/htdocs/imports/class/import.class.php b/htdocs/imports/class/import.class.php
index 72d1eb16f66..77128589c25 100644
--- a/htdocs/imports/class/import.class.php
+++ b/htdocs/imports/class/import.class.php
@@ -278,7 +278,7 @@ class Import
 	{
 		$sql = 'SELECT em.rowid, em.field, em.label, em.type';
 		$sql .= ' FROM '.MAIN_DB_PREFIX.'import_model as em';
-		$sql .= ' WHERE em.rowid = '.$id;
+		$sql .= ' WHERE em.rowid = '.((int) $id);
 
 		dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
 		$result = $this->db->query($sql);
diff --git a/htdocs/imports/import.php b/htdocs/imports/import.php
index 9fdc5330103..6fab34557d1 100644
--- a/htdocs/imports/import.php
+++ b/htdocs/imports/import.php
@@ -148,9 +148,9 @@ if ($action == 'builddoc')
 
 if ($action == 'deleteprof')
 {
-	if ($_GET["id"])
+	if (GETPOST("id", 'int'))
 	{
-		$objimport->fetch($_GET["id"]);
+		$objimport->fetch(GETPOST("id", 'int'));
 		$result = $objimport->delete($user);
 	}
 }
@@ -1160,7 +1160,7 @@ if ($step == 4 && $datatoimport)
 				print '<tr class="oddeven"><td>';
 				print $obj->label;
 				print '</td><td style="text-align:right">';
-				print '<a href="'.$_SERVER["PHP_SELF"].'?step='.$step.$param.'&action=deleteprof&id='.$obj->rowid.'&filetoimport='.urlencode($filetoimport).'">';
+				print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?step='.$step.$param.'&action=deleteprof&token='.newToken().'&id='.$obj->rowid.'&filetoimport='.urlencode($filetoimport).'">';
 				print img_delete();
 				print '</a>';
 				print '</tr>';

From 3f1c9999dbe44a4bbf50bd45f0289920210cde59 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 30 Sep 2020 18:44:26 +0200
Subject: [PATCH 072/101] urlencode

---
 htdocs/imports/import.php | 40 +++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/htdocs/imports/import.php b/htdocs/imports/import.php
index 6fab34557d1..8dee2ed0538 100644
--- a/htdocs/imports/import.php
+++ b/htdocs/imports/import.php
@@ -212,9 +212,9 @@ if ($step == 3 && $datatoimport)
 	{
 		$langs->load("other");
 
-		$param = '&datatoimport='.$datatoimport.'&format='.$format;
-		if ($excludefirstline) $param .= '&excludefirstline='.$excludefirstline;
-		if ($endatlinenb) $param .= '&endatlinenb='.$endatlinenb;
+		$param = '&datatoimport='.urlencode($datatoimport).'&format='.urlencode($format);
+		if ($excludefirstline) $param .= '&excludefirstline='.urlencode($excludefirstline);
+		if ($endatlinenb) $param .= '&endatlinenb='.urlencode($endatlinenb);
 
 		$file = $conf->import->dir_temp.'/'.GETPOST('urlfile'); // Do not use urldecode here ($_GET and $_REQUEST are already decoded by PHP).
 		$ret = dol_delete_file($file);
@@ -321,8 +321,8 @@ if ($step == 1 || !$datatoimport)
 	$_SESSION["dol_array_match_file_to_database"] = '';
 
 	$param = '';
-	if ($excludefirstline) $param .= '&excludefirstline='.$excludefirstline;
-	if ($endatlinenb) $param .= '&endatlinenb='.$endatlinenb;
+	if ($excludefirstline) $param .= '&excludefirstline='.urlencode($excludefirstline);
+	if ($endatlinenb) $param .= '&endatlinenb='.urlencode($endatlinenb);
 	if ($separator) $param .= '&separator='.urlencode($separator);
 	if ($enclosure) $param .= '&enclosure='.urlencode($enclosure);
 
@@ -380,9 +380,9 @@ if ($step == 1 || !$datatoimport)
 // STEP 2: Page to select input format file
 if ($step == 2 && $datatoimport)
 {
-	$param = '&datatoimport='.$datatoimport;
-	if ($excludefirstline) $param .= '&excludefirstline='.$excludefirstline;
-	if ($endatlinenb) $param .= '&endatlinenb='.$endatlinenb;
+	$param = '&datatoimport='.urlencode($datatoimport);
+	if ($excludefirstline) $param .= '&excludefirstline='.urlencode($excludefirstline);
+	if ($endatlinenb) $param .= '&endatlinenb='.urlencode($endatlinenb);
 	if ($separator) $param .= '&separator='.urlencode($separator);
 	if ($enclosure) $param .= '&enclosure='.urlencode($enclosure);
 
@@ -460,9 +460,9 @@ if ($step == 2 && $datatoimport)
 // STEP 3: Page to select file
 if ($step == 3 && $datatoimport)
 {
-	$param = '&datatoimport='.$datatoimport.'&format='.$format;
-	if ($excludefirstline) $param .= '&excludefirstline='.$excludefirstline;
-	if ($endatlinenb) $param .= '&endatlinenb='.$endatlinenb;
+	$param = '&datatoimport='.urlencode($datatoimport).'&format='.urlencode($format);
+	if ($excludefirstline) $param .= '&excludefirstline='.urlencode($excludefirstline);
+	if ($endatlinenb) $param .= '&endatlinenb='.urlencode($endatlinenb);
 	if ($separator) $param .= '&separator='.urlencode($separator);
 	if ($enclosure) $param .= '&enclosure='.urlencode($enclosure);
 
@@ -753,9 +753,9 @@ if ($step == 4 && $datatoimport)
 
 	// Now $array_match_file_to_database contains  fieldnb(1,2,3...)=>fielddatabase(key in $array_match_file_to_database)
 
-	$param = '&format='.$format.'&datatoimport='.$datatoimport.'&filetoimport='.urlencode($filetoimport);
-	if ($excludefirstline) $param .= '&excludefirstline='.$excludefirstline;
-	if ($endatlinenb) $param .= '&endatlinenb='.$endatlinenb;
+	$param = '&format='.$format.'&datatoimport='.urlencode($datatoimport).'&filetoimport='.urlencode($filetoimport);
+	if ($excludefirstline) $param .= '&excludefirstline='.urlencode($excludefirstline);
+	if ($endatlinenb) $param .= '&endatlinenb='.urlencode($endatlinenb);
 	if ($separator) $param .= '&separator='.urlencode($separator);
 	if ($enclosure) $param .= '&enclosure='.urlencode($enclosure);
 
@@ -1213,10 +1213,10 @@ if ($step == 5 && $datatoimport)
 
 	$nboflines = $obj->import_get_nb_of_lines($conf->import->dir_temp.'/'.$filetoimport);
 
-	$param = '&leftmenu=import&format='.$format.'&datatoimport='.$datatoimport.'&filetoimport='.urlencode($filetoimport).'&nboflines='.$nboflines.'&separator='.urlencode($separator).'&enclosure='.urlencode($enclosure);
+	$param = '&leftmenu=import&format='.urlencode($format).'&datatoimport='.urlencode($datatoimport).'&filetoimport='.urlencode($filetoimport).'&nboflines='.urlencode($nboflines).'&separator='.urlencode($separator).'&enclosure='.urlencode($enclosure);
 	$param2 = $param; // $param2 = $param without excludefirstline and endatlinenb
-	if ($excludefirstline)		$param .= '&excludefirstline='.$excludefirstline;
-	if ($endatlinenb)			$param .= '&endatlinenb='.$endatlinenb;
+	if ($excludefirstline)		$param .= '&excludefirstline='.urlencode($excludefirstline);
+	if ($endatlinenb)			$param .= '&endatlinenb='.urlencode($endatlinenb);
 	if (!empty($updatekeys))	$param .= '&updatekeys[]='.implode('&updatekeys[]=', $updatekeys);
 
 	llxHeader('', $langs->trans("NewImport"), 'EN:Module_Imports_En|FR:Module_Imports|ES:M&oacute;dulo_Importaciones');
@@ -1642,9 +1642,9 @@ if ($step == 6 && $datatoimport)
 
 	$nboflines = (!empty($_GET["nboflines"]) ? $_GET["nboflines"] : dol_count_nb_of_line($conf->import->dir_temp.'/'.$filetoimport));
 
-	$param = '&format='.$format.'&datatoimport='.$datatoimport.'&filetoimport='.urlencode($filetoimport).'&nboflines='.$nboflines;
-	if ($excludefirstline) $param .= '&excludefirstline='.$excludefirstline;
-	if ($endatlinenb) $param .= '&endatlinenb='.$endatlinenb;
+	$param = '&format='.$format.'&datatoimport='.urlencode($datatoimport).'&filetoimport='.urlencode($filetoimport).'&nboflines='.urlencode($nboflines);
+	if ($excludefirstline) $param .= '&excludefirstline='.urlencode($excludefirstline);
+	if ($endatlinenb) $param .= '&endatlinenb='.urlencode($endatlinenb);
 	if ($separator) $param .= '&separator='.urlencode($separator);
 	if ($enclosure) $param .= '&enclosure='.urlencode($enclosure);
 

From 0355e03f52f85d49d0a791ffa726aec13ed33a9e Mon Sep 17 00:00:00 2001
From: Dushyant Singh <55306442+Dushyantsingh-ds@users.noreply.github.com>
Date: Wed, 30 Sep 2020 22:22:27 -0700
Subject: [PATCH 073/101] Update README.md

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 19a767c8232..9930e592e54 100644
--- a/README.md
+++ b/README.md
@@ -29,8 +29,8 @@ Other licenses apply for some included dependencies. See [COPYRIGHT](https://git
 
 If you have low technical skills and you're looking to install Dolibarr ERP/CRM in just a few clicks, you can use one of the packaged versions:
 
-- [DoliWamp for Windows](https://wiki.dolibarr.org/index.php/Dolibarr_for_Windows_(DoliWamp)
-- [DoliDeb for Debian](https://wiki.dolibarr.org/index.php/Dolibarr_for_Ubuntu_or_Debian
+- [DoliWamp for Windows](https://wiki.dolibarr.org/index.php/Dolibarr_for_Windows_DoliWamp)
+- [DoliDeb for Debian](https://wiki.dolibarr.org/index.php/Dolibarr_for_Ubuntu_or_Debian)
 - DoliRpm for Redhat, Fedora, OpenSuse, Mandriva or Mageia
 
 Releases can be downloaded from [official website](https://www.dolibarr.org/).

From 3460a3486c390d9152ede314785216ed893bb82b Mon Sep 17 00:00:00 2001
From: Dushyant Singh <55306442+Dushyantsingh-ds@users.noreply.github.com>
Date: Wed, 30 Sep 2020 22:24:21 -0700
Subject: [PATCH 074/101] Update README.md

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 9930e592e54..648d5ef003d 100644
--- a/README.md
+++ b/README.md
@@ -77,8 +77,8 @@ If you don't have time to install it yourself, you can try some commercial 'read
 ## UPGRADING
 
 Dolibarr supports upgrading usually wihtout the need for any (commercial) support (depending on if you use any commercial extensions) and supports upgrading all the way from any version after 2.8 without breakage. This is unique in the ERP ecosystem and a benefit our users highly appreciate!
-
-- At first make a backup of your Dolibarr files & than see https://wiki.dolibarr.org/index.php/Installation_-_Upgrade#Upgrade_Dolibarr
+ 
+- At first make a backup of your Dolibarr files & than [see](https://wiki.dolibarr.org/index.php/Installation_-_Upgrade#Upgrade_Dolibarr)
 - Check that your installed PHP version is supported by the new version [see PHP support](./doc/phpmatrix.md).
 - Overwrite all old files from 'dolibarr' directory with files provided into the new version's package.
 - At first next access, Dolibarr will redirect you to the "install/" page to follow the upgrade process.

From 0b35a0729010055a3621b373cf2cd2d1df5f4ff6 Mon Sep 17 00:00:00 2001
From: Ahmad Jamaly Rabib <rabib@metroworks.co.jp>
Date: Thu, 1 Oct 2020 11:52:56 +0600
Subject: [PATCH 075/101] NEW ADDED IMPORT TOOL FOR PROPOSAL MODULE Added
 proposal import functionality in import module

---
 htdocs/core/modules/modPropale.class.php | 169 +++++++++++++++++++++++
 htdocs/imports/class/import.class.php    |   3 +
 htdocs/langs/am_ET/propal.lang           |   4 +
 htdocs/langs/de_DE/propal.lang           |   4 +
 htdocs/langs/en_US/main.lang             |   3 +-
 htdocs/langs/en_US/propal.lang           |   5 +
 htdocs/langs/fr_FR/propal.lang           |   4 +
 htdocs/langs/ja_JP/propal.lang           |   4 +
 htdocs/langs/ko_KR/propal.lang           |   4 +
 htdocs/langs/vi_VN/propal.lang           |   4 +
 htdocs/langs/zh_CN/propal.lang           |   4 +
 11 files changed, 207 insertions(+), 1 deletion(-)

diff --git a/htdocs/core/modules/modPropale.class.php b/htdocs/core/modules/modPropale.class.php
index 007e92e4277..4da02808251 100644
--- a/htdocs/core/modules/modPropale.class.php
+++ b/htdocs/core/modules/modPropale.class.php
@@ -5,6 +5,7 @@
  * Copyright (C) 2004		Benoit Mortier			<benoit.mortier@opensides.be>
  * Copyright (C) 2005-2012	Regis Houssin			<regis.houssin@inodbox.com>
  * Copyright (C) 2012		Juanjo Menent			<jmenent@2byte.es>
+ * Copyright (C) 2020		Ahmad Jamaly Rabib		<rabib@metroworks.co.jp>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -254,6 +255,174 @@ class modPropale extends DolibarrModules
 		$this->export_sql_end[$r] .= ' WHERE c.fk_soc = s.rowid AND c.rowid = cd.fk_propal';
 		$this->export_sql_end[$r] .= ' AND c.entity IN ('.getEntity('propal').')';
 		if (!$user->rights->societe->client->voir) $this->export_sql_end[$r] .= ' AND sc.fk_user = '.$user->id;
+
+		// Imports
+		//--------
+		$r = 0;
+
+		$r++;
+		$this->import_code[$r] = $this->rights_class.'_'.$r;
+		$this->import_label[$r] = 'Proposals';	// Translation key
+		$this->import_icon[$r] = $this->picto;
+		$this->import_entities_array[$r] = [];		// We define here only fields that use another icon that the one defined into import_icon
+		$this->import_tables_array[$r] = ['c' => MAIN_DB_PREFIX . 'propal', 'extra' => MAIN_DB_PREFIX . 'propal_extrafields'];
+		$this->import_tables_creator_array[$r] = ['c'=>'fk_user_author'];	// Fields to store import user id
+		$this->import_fields_array[$r] = [
+			'c.ref' => 'Document Ref*',
+			'c.ref_client' => 'RefCustomer',
+			'c.fk_soc' => 'ThirdPartyName*',
+			'c.datec' => 'DateCreation',
+			'c.datep' => 'DatePropal',
+			'c.fin_validite' => 'DateEndPropal',
+			'c.remise_percent' => 'GlobalDiscount',
+			'c.total_ht' => 'TotalHT',
+			'c.total' => 'TotalTTC',
+			'c.fk_statut' => 'Status*',
+			'c.note_public' => 'Note',
+			'c.date_livraison' => 'DeliveryDate',
+			'c.fk_user_valid' => 'ValidatedById'
+		];
+		if (! empty($conf->multicurrency->enabled)) {
+			$this->import_fields_array[$r]['c.multicurrency_code'] = 'Currency';
+			$this->import_fields_array[$r]['c.multicurrency_tx'] = 'CurrencyRate';
+			$this->import_fields_array[$r]['c.multicurrency_total_ht'] = 'MulticurrencyAmountHT';
+			$this->import_fields_array[$r]['c.multicurrency_total_tva'] = 'MulticurrencyAmountVAT';
+			$this->import_fields_array[$r]['c.multicurrency_total_ttc'] = 'MulticurrencyAmountTTC';
+		}
+		// Add extra fields
+		$import_extrafield_sample = [];
+		$sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE elementtype = 'propal' AND entity IN (0, " . $conf->entity . ")";
+		$resql = $this->db->query($sql);
+		if ($resql) {
+			while ($obj = $this->db->fetch_object($resql)) {
+				$fieldname = 'extra.' . $obj->name;
+				$fieldlabel = ucfirst($obj->label);
+				$this->import_fields_array[$r][$fieldname] = $fieldlabel . ($obj->fieldrequired ? '*' : '');
+				$import_extrafield_sample[$fieldname] = $fieldlabel;
+			}
+		}
+		// End add extra fields
+		$this->import_fieldshidden_array[$r] = ['extra.fk_object' => 'lastrowid-' . MAIN_DB_PREFIX . 'propal'];
+		$this->import_regex_array[$r] = ['c.ref' => '[^ ]'];
+		$import_sample = [
+			'c.ref' => 'PROV0077',
+			'c.ref_client' => 'Client1',
+			'c.fk_soc' => 'MyBigCompany',
+			'c.datec' => '2020-01-01',
+			'c.datep' => '2020-01-01',
+			'c.fin_validite' => '2020-01-01',
+			'c.remise_percent' => '',
+			'c.total_ht' => '0',
+			'c.total' => '0',
+			'c.fk_statut' => '1',
+			'c.note_public' => '',
+			'c.date_livraison' => '2020-01-01',
+			'c.fk_user_valid' => '1',
+			'c.multicurrency_code' => '',
+			'c.multicurrency_tx' => '1',
+			'c.multicurrency_total_ht' => '0',
+			'c.multicurrency_total_tva' => '0',
+			'c.multicurrency_total_ttc' => '0'
+		];
+		$this->import_examplevalues_array[$r] = array_merge($import_sample, $import_extrafield_sample);
+		$this->import_updatekeys_array[$r] = ['c.ref'=>'Ref'];
+		$this->import_convertvalue_array[$r] = [
+			'c.fk_soc' => [
+				'rule' => 'fetchidfromref',
+				'file' => '/societe/class/societe.class.php',
+				'class' => 'Societe',
+				'method' => 'fetch',
+				'element' => 'ThirdParty'
+			]
+		];
+
+		//Import Proposal Lines
+		$r++;
+		$this->import_code[$r] = $this->rights_class.'line_'.$r;
+		$this->import_label[$r] = "ProposalLine";	// Translation key
+		$this->import_icon[$r] = $this->picto;
+		$this->import_entities_array[$r] = [];		// We define here only fields that use another icon that the one defined into import_icon
+		$this->import_tables_array[$r] = [
+			'cd' => MAIN_DB_PREFIX . 'propaldet',
+			'extra' => MAIN_DB_PREFIX . 'propaldet_extrafields'
+		];
+		$this->import_fields_array[$r] = [
+			'cd.fk_propal' => 'Document Ref*',
+			'cd.fk_parent_line' => 'PrParentLine',
+			'cd.fk_product' => 'IdProduct',
+			'cd.label' => 'Label',
+			'cd.description' => 'LineDescription',
+			'cd.product_type' => 'TypeOfLineServiceOrProduct',
+			'cd.tva_tx' => 'LineVATRate',
+			'cd.qty' => 'LineQty',
+			'cd.remise_percent' => 'Reduc. Percent',
+			'cd.remise' => 'Reduc.',
+			'cd.price' => 'Price',
+			'cd.subprice' => 'Sub Price',
+			'cd.total_ht' => 'LineTotalHT',
+			'cd.total_tva' => 'LineTotalVAT',
+			'cd.total_ttc' => 'LineTotalTTC',
+			'cd.date_start' => 'Start Date',
+			'cd.date_end' => 'End Date',
+			'cd.buy_price_ht' => 'LineBuyPriceHT'
+		];
+		if (! empty($conf->multicurrency->enabled)) {
+			$this->import_fields_array[$r]['cd.multicurrency_code'] = 'Currency';
+			$this->import_fields_array[$r]['cd.multicurrency_subprice'] = 'CurrencyRate';
+			$this->import_fields_array[$r]['cd.multicurrency_total_ht'] = 'MulticurrencyAmountHT';
+			$this->import_fields_array[$r]['cd.multicurrency_total_tva'] = 'MulticurrencyAmountVAT';
+			$this->import_fields_array[$r]['cd.multicurrency_total_ttc'] = 'MulticurrencyAmountTTC';
+		}
+		// Add extra fields
+		$import_extrafield_sample = [];
+		$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'propaldet' AND entity IN (0, ".$conf->entity.")";
+		$resql = $this->db->query($sql);
+		if ($resql) {
+			while ($obj = $this->db->fetch_object($resql)) {
+				$fieldname = 'extra.' . $obj->name;
+				$fieldlabel = ucfirst($obj->label);
+				$this->import_fields_array[$r][$fieldname] = $fieldlabel . ($obj->fieldrequired ? '*' : '');
+				$import_extrafield_sample[$fieldname] = $fieldlabel;
+			}
+		}
+		// End add extra fields
+		$this->import_fieldshidden_array[$r] = ['extra.fk_object' => 'lastrowid-' . MAIN_DB_PREFIX . 'propaldet'];
+		$this->import_regex_array[$r] = ['cd.product_type' => '[0|1]$'];
+		$import_sample = [
+			'cd.fk_propal' => 'PROV(0001)',
+			'cd.fk_parent_line' => '',
+			'cd.fk_product' => '',
+			'cd.label' => '',
+			'cd.description' => 'Line description',
+			'cd.product_type' => '1',
+			'cd.tva_tx' => '0',
+			'cd.qty' => '2',
+			'cd.remise_percent' => '0',
+			'cd.remise' => '0',
+			'cd.price' => '',
+			'cd.subprice' => '5000',
+			'cd.total_ht' => '10000',
+			'cd.total_tva' => '0',
+			'cd.total_ttc' => '10100',
+			'cd.date_start' => '',
+			'cd.date_end' => '',
+			'cd.buy_price_ht' => '7000',
+			'cd.multicurrency_code' => 'JPY',
+			'cd.multicurrency_tx' => '1',
+			'cd.multicurrency_total_ht' => '10000',
+			'cd.multicurrency_total_tva' => '0',
+			'cd.multicurrency_total_ttc' => '10100'
+		];
+		$this->import_examplevalues_array[$r] = array_merge($import_sample, $import_extrafield_sample);
+		$this->import_updatekeys_array[$r] = ['cd.fk_propal' => 'Quotation Id', 'cd.fk_product' => 'Product Id'];
+		$this->import_convertvalue_array[$r] = [
+			'cd.fk_propal' => [
+				'rule'=>'fetchidfromref',
+				'file'=>'/comm/propal/class/propal.class.php',
+				'class'=>'Propal',
+				'method'=>'fetch'
+			]
+		];
 	}
 
 
diff --git a/htdocs/imports/class/import.class.php b/htdocs/imports/class/import.class.php
index 72d1eb16f66..f3e3d988c5b 100644
--- a/htdocs/imports/class/import.class.php
+++ b/htdocs/imports/class/import.class.php
@@ -1,6 +1,7 @@
 <?php
 /* Copyright (C) 2011       Laurent Destailleur <eldy@users.sourceforge.net>
  * Copyright (C) 2016       Raphaël Doursenaud  <rdoursenaud@gpcsolutions.fr>
+ * Copyright (C) 2020		Ahmad Jamaly Rabib	<rabib@metroworks.co.jp>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -101,6 +102,8 @@ class Import
 				// Defined if module is enabled
 				$enabled = true;
 				$part = strtolower(preg_replace('/^mod/i', '', $modulename));
+				// Adds condition for propal module
+				if ($part === 'propale') $part = 'propal';
 				if (empty($conf->$part->enabled)) $enabled = false;
 
 				if (empty($enabled)) continue;
diff --git a/htdocs/langs/am_ET/propal.lang b/htdocs/langs/am_ET/propal.lang
index 273996ab1b1..95085002f66 100644
--- a/htdocs/langs/am_ET/propal.lang
+++ b/htdocs/langs/am_ET/propal.lang
@@ -85,3 +85,7 @@ ProposalCustomerSignature=Written acceptance, company stamp, date and signature
 ProposalsStatisticsSuppliers=Vendor proposals statistics
 CaseFollowedBy=Case followed by
 SignedOnly=Signed only
+IdProposal=Proposal ID
+IdProduct=Product ID
+PrParentLine=Proposal Parent Line
+LineBuyPriceHT=Buy Price Amount net of tax for line
diff --git a/htdocs/langs/de_DE/propal.lang b/htdocs/langs/de_DE/propal.lang
index 78e3e09a746..0956cf4900f 100644
--- a/htdocs/langs/de_DE/propal.lang
+++ b/htdocs/langs/de_DE/propal.lang
@@ -85,3 +85,7 @@ ProposalCustomerSignature=Bei Beauftragung: Name in Klarschrift, Ort, Datum, Unt
 ProposalsStatisticsSuppliers=Statistik Lieferantenanfragen
 CaseFollowedBy=Fall gefolgt von
 SignedOnly=nur signiert
+IdProposal=Angebots-ID
+IdProduct=Produkt ID
+PrParentLine=Übergeordnete Zeile des Vorschlags
+LineBuyPriceHT=Kaufpreis Betrag abzüglich Steuern für Linie
diff --git a/htdocs/langs/en_US/main.lang b/htdocs/langs/en_US/main.lang
index 0289b381b23..427a5a80d45 100644
--- a/htdocs/langs/en_US/main.lang
+++ b/htdocs/langs/en_US/main.lang
@@ -371,6 +371,7 @@ MulticurrencyPaymentAmount=Payment amount, original currency
 MulticurrencyAmountHT=Amount (excl. tax), original currency
 MulticurrencyAmountTTC=Amount (inc. of tax), original currency
 MulticurrencyAmountVAT=Amount tax, original currency
+MulticurrencySubPrice=Amount sub price multi currency
 AmountLT1=Amount tax 2
 AmountLT2=Amount tax 3
 AmountLT1ES=Amount RE
@@ -1094,4 +1095,4 @@ PublicVendorName=Public name of vendor
 DateOfBirth=Date of birth
 SecurityTokenHasExpiredSoActionHasBeenCanceledPleaseRetry=Security token has expired, so action has been canceled. Please try again.
 UpToDate=Up-to-date
-OutOfDate=Out-of-date
\ No newline at end of file
+OutOfDate=Out-of-date
diff --git a/htdocs/langs/en_US/propal.lang b/htdocs/langs/en_US/propal.lang
index c68574d9ae2..557df2f840f 100644
--- a/htdocs/langs/en_US/propal.lang
+++ b/htdocs/langs/en_US/propal.lang
@@ -84,3 +84,8 @@ ProposalCustomerSignature=Written acceptance, company stamp, date and signature
 ProposalsStatisticsSuppliers=Vendor proposals statistics
 CaseFollowedBy=Case followed by
 SignedOnly=Signed only
+IdProposal=Proposal ID
+IdProduct=Product ID
+PrParentLine=Proposal Parent Line
+LineBuyPriceHT=Buy Price Amount net of tax for line
+
diff --git a/htdocs/langs/fr_FR/propal.lang b/htdocs/langs/fr_FR/propal.lang
index 03981e2b17d..64199c5248d 100644
--- a/htdocs/langs/fr_FR/propal.lang
+++ b/htdocs/langs/fr_FR/propal.lang
@@ -98,3 +98,7 @@ ConfirmMassValidationQuestion = Voulez-vous confirmer la validation des devis br
 ConfirmMassSignatureQuestion = Voulez-vous confirmer la signature des devis ouvert selectionnés ?
 PropNoProductOrService = devis ne contient pas de produits ni de services
 PropsNoProductOrService = devis ne contiennent pas de produits ni de services
+IdProposal=ID de proposition
+IdProduct=ID produit
+PrParentLine=Ligne parent de proposition
+LineBuyPriceHT=Prix ​​d'achat Montant net de taxe pour la ligne
diff --git a/htdocs/langs/ja_JP/propal.lang b/htdocs/langs/ja_JP/propal.lang
index d2065e007a3..373ac4a2ce2 100644
--- a/htdocs/langs/ja_JP/propal.lang
+++ b/htdocs/langs/ja_JP/propal.lang
@@ -85,3 +85,7 @@ ProposalCustomerSignature=承諾書、会社印、日付、署名
 ProposalsStatisticsSuppliers=Vendor proposals statistics
 CaseFollowedBy=Case followed by
 SignedOnly=Signed only
+IdProposal=提案番号
+IdProduct=製品番号
+PrParentLine=提案親ライン
+LineBuyPriceHT=購入価格ラインの税控除後の金額
diff --git a/htdocs/langs/ko_KR/propal.lang b/htdocs/langs/ko_KR/propal.lang
index 93708eb0955..26a86464f91 100644
--- a/htdocs/langs/ko_KR/propal.lang
+++ b/htdocs/langs/ko_KR/propal.lang
@@ -85,3 +85,7 @@ ProposalCustomerSignature=Written acceptance, company stamp, date and signature
 ProposalsStatisticsSuppliers=Vendor proposals statistics
 CaseFollowedBy=Case followed by
 SignedOnly=Signed only
+IdProposal=Proposal ID
+IdProduct=Product ID
+PrParentLine=Proposal Parent Line
+LineBuyPriceHT=Buy Price Amount net of tax for line
diff --git a/htdocs/langs/vi_VN/propal.lang b/htdocs/langs/vi_VN/propal.lang
index 2a99f2a5577..a9e808d9f5a 100644
--- a/htdocs/langs/vi_VN/propal.lang
+++ b/htdocs/langs/vi_VN/propal.lang
@@ -85,3 +85,7 @@ ProposalCustomerSignature=Văn bản chấp nhận, dấu công ty, ngày và ch
 ProposalsStatisticsSuppliers=Thống kê đề xuất nhà cung cấp
 CaseFollowedBy=Theo bởi trường hợp
 SignedOnly=Signed only
+IdProposal=ID đề xuất
+IdProduct=ID sản phẩm
+PrParentLine=Dòng mẹ đề xuất
+LineBuyPriceHT=Giá mua Số lượng ròng của thuế cho dòng
diff --git a/htdocs/langs/zh_CN/propal.lang b/htdocs/langs/zh_CN/propal.lang
index 2c782854e14..79d10f5e2ba 100644
--- a/htdocs/langs/zh_CN/propal.lang
+++ b/htdocs/langs/zh_CN/propal.lang
@@ -85,3 +85,7 @@ ProposalCustomerSignature=书面接受,公司盖章,日期和签名
 ProposalsStatisticsSuppliers=Vendor proposals statistics
 CaseFollowedBy=Case followed by
 SignedOnly=Signed only
+IdProposal=提案编号
+IdProduct=产品编号
+PrParentLine=提案父行
+LineBuyPriceHT=购买价格扣除税额

From 91f0429bd29d08d14c84435d5b9327faf85d9816 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 09:34:10 +0200
Subject: [PATCH 076/101] Fix mention for france, only for FR country

---
 htdocs/core/modules/dons/html_cerfafr.modules.php | 6 +++---
 htdocs/langs/en_US/admin.lang                     | 2 --
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/htdocs/core/modules/dons/html_cerfafr.modules.php b/htdocs/core/modules/dons/html_cerfafr.modules.php
index 657c24e615d..a4ff4e43a2d 100644
--- a/htdocs/core/modules/dons/html_cerfafr.modules.php
+++ b/htdocs/core/modules/dons/html_cerfafr.modules.php
@@ -205,7 +205,7 @@ class html_cerfafr extends ModeleDon
 				$form = str_replace('__FrenchEligibility__', $frencheligibility, $form);
 
 				$art200 = '';
-				if (preg_match('/fr/i', $outputlangs->defaultlang)) {
+				if ($mysoc->country_code == 'FR') {
 					if ($conf->global->DONATION_ART200 >= 1)
 					{
 						$art200 = '<input type="checkbox" disabled="true" checked="checked" >200 du CGI';
@@ -216,7 +216,7 @@ class html_cerfafr extends ModeleDon
 				$form = str_replace('__ARTICLE200__', $art200, $form);
 
 				$art238 = '';
-				if (preg_match('/fr/i', $outputlangs->defaultlang)) {
+				if ($mysoc->country_code == 'FR') {
 					if ($conf->global->DONATION_ART238 >= 1)
 					{
 						$art238 = '<input type="checkbox" disabled="true" checked="checked" >238 bis du CGI';
@@ -227,7 +227,7 @@ class html_cerfafr extends ModeleDon
 				$form = str_replace('__ARTICLE238__', $art238, $form);
 
 				$art978 = '';
-				if (preg_match('/fr/i', $outputlangs->defaultlang)) {
+				if ($mysoc->country_code == 'FR') {
 					if ($conf->global->DONATION_ART978 >= 1)
 					{
 						$art978 = '<input type="checkbox" disabled="true" checked="checked" >978 du CGI';
diff --git a/htdocs/langs/en_US/admin.lang b/htdocs/langs/en_US/admin.lang
index 241848a594a..9550e7a54fe 100644
--- a/htdocs/langs/en_US/admin.lang
+++ b/htdocs/langs/en_US/admin.lang
@@ -555,8 +555,6 @@ Module57Name=Payments by Direct Debit
 Module57Desc=Management of Direct Debit orders. It includes generation of SEPA file for European countries.
 Module58Name=ClickToDial
 Module58Desc=Integration of a ClickToDial system (Asterisk, ...)
-Module59Name=Bookmark4u
-Module59Desc=Add function to generate Bookmark4u account from a Dolibarr account
 Module60Name=Stickers
 Module60Desc=Management of stickers
 Module70Name=Interventions

From 75ff2eb642f5b715001571139e6e30884e95eaa8 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 09:39:18 +0200
Subject: [PATCH 077/101] Typo

---
 htdocs/langs/en_US/admin.lang | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/langs/en_US/admin.lang b/htdocs/langs/en_US/admin.lang
index 9550e7a54fe..1e64a5bfd04 100644
--- a/htdocs/langs/en_US/admin.lang
+++ b/htdocs/langs/en_US/admin.lang
@@ -71,7 +71,7 @@ DisableJavascriptNote=Note: For test or debug purpose. For optimization for blin
 UseSearchToSelectCompanyTooltip=Also if you have a large number of third parties (> 100 000), you can increase speed by setting constant COMPANY_DONOTSEARCH_ANYWHERE to 1 in Setup->Other. Search will then be limited to start of string.
 UseSearchToSelectContactTooltip=Also if you have a large number of third parties (> 100 000), you can increase speed by setting constant CONTACT_DONOTSEARCH_ANYWHERE to 1 in Setup->Other. Search will then be limited to start of string.
 DelaiedFullListToSelectCompany=Wait until a key is pressed before loading content of Third Parties combo list.<br>This may increase performance if you have a large number of third parties, but it is less convenient.
-DelaiedFullListToSelectContact=Wait until a key is pressed before loading content of Contact combo list.<br>This may increase performance if you have a large number of contacts, but it is less convenient)
+DelaiedFullListToSelectContact=Wait until a key is pressed before loading content of Contact combo list.<br>This may increase performance if you have a large number of contacts, but it is less convenient.
 NumberOfKeyToSearch=Number of characters to trigger search: %s
 NumberOfBytes=Number of Bytes
 SearchString=Search string

From c16cd91d8e886b782408df6424e603b8db9fb250 Mon Sep 17 00:00:00 2001
From: John Botella <john.botella@atm-consulting.fr>
Date: Thu, 1 Oct 2020 09:40:11 +0200
Subject: [PATCH 078/101] FIX default accountancy values and posted values

---
 htdocs/product/card.php | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/htdocs/product/card.php b/htdocs/product/card.php
index d0dc01bac33..ea1b2ef0e9f 100644
--- a/htdocs/product/card.php
+++ b/htdocs/product/card.php
@@ -78,6 +78,14 @@ $confirm = GETPOST('confirm', 'alpha');
 $socid = GETPOST('socid', 'int');
 $duration_value = GETPOST('duration_value', 'int');
 $duration_unit = GETPOST('duration_unit', 'alpha');
+
+$accountancy_code_sell = GETPOST('accountancy_code_sell', 'alpha');
+$accountancy_code_sell_intra = GETPOST('accountancy_code_sell_intra', 'alpha');
+$accountancy_code_sell_export = GETPOST('accountancy_code_sell_export', 'alpha');
+$accountancy_code_buy = GETPOST('accountancy_code_buy', 'alpha');
+$accountancy_code_buy_intra = GETPOST('accountancy_code_buy_intra', 'alpha');
+$accountancy_code_buy_export = GETPOST('accountancy_code_buy_export', 'alpha');
+
 if (!empty($user->socid)) $socid = $user->socid;
 
 $object = new Product($db);
@@ -1323,6 +1331,14 @@ else
 		}
 		else // For external software
 		{
+
+			if (!empty($accountancy_code_sell)) { $object->accountancy_code_sell = $accountancy_code_sell; }
+			if (!empty($accountancy_code_sell_intra)) { $object->accountancy_code_sell_intra = $accountancy_code_sell_intra; }
+			if (!empty($accountancy_code_sell_export)) { $object->accountancy_code_sell_export = $accountancy_code_sell_export; }
+			if (!empty($accountancy_code_buy)) { $object->accountancy_code_buy = $accountancy_code_buy; }
+			if (!empty($accountancy_code_buy_intra)) { $object->accountancy_code_buy_intra = $accountancy_code_buy_intra; }
+			if (!empty($accountancy_code_buy_export)) { $object->accountancy_code_buy_export = $accountancy_code_buy_export; }
+
 			// Accountancy_code_sell
 			print '<tr><td class="titlefieldcreate">'.$langs->trans("ProductAccountancySellCode").'</td>';
 			print '<td class="maxwidthonsmartphone"><input class="minwidth100" name="accountancy_code_sell" value="'.$object->accountancy_code_sell.'">';

From e558dc3f275b95507298eb52d4778a50ef8ea639 Mon Sep 17 00:00:00 2001
From: stickler-ci <support@stickler-ci.com>
Date: Thu, 1 Oct 2020 07:48:24 +0000
Subject: [PATCH 079/101] Fixing style errors.

---
 htdocs/product/card.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/htdocs/product/card.php b/htdocs/product/card.php
index ea1b2ef0e9f..8b4654ba921 100644
--- a/htdocs/product/card.php
+++ b/htdocs/product/card.php
@@ -1331,7 +1331,6 @@ else
 		}
 		else // For external software
 		{
-
 			if (!empty($accountancy_code_sell)) { $object->accountancy_code_sell = $accountancy_code_sell; }
 			if (!empty($accountancy_code_sell_intra)) { $object->accountancy_code_sell_intra = $accountancy_code_sell_intra; }
 			if (!empty($accountancy_code_sell_export)) { $object->accountancy_code_sell_export = $accountancy_code_sell_export; }

From 9447eb28737d8c8ae6af71993b5459ae2f688d91 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 09:50:09 +0200
Subject: [PATCH 080/101] Typo

---
 htdocs/langs/en_US/agenda.lang | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/langs/en_US/agenda.lang b/htdocs/langs/en_US/agenda.lang
index aff922c4c23..4ab87aa8420 100644
--- a/htdocs/langs/en_US/agenda.lang
+++ b/htdocs/langs/en_US/agenda.lang
@@ -14,7 +14,7 @@ EventsNb=Number of events
 ListOfActions=List of events
 EventReports=Event reports
 Location=Location
-ToUserOfGroup=Event assigned to any user in group
+ToUserOfGroup=Event assigned to any user in the group
 EventOnFullDay=Event on all day(s)
 MenuToDoActions=All incomplete events
 MenuDoneActions=All terminated events

From 7b3a7c9921c0d675a37d62eb71f7a85c43c88534 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 10:50:54 +0200
Subject: [PATCH 081/101] Add token on all url with action=delete

---
 htdocs/accountancy/admin/account.php           |  4 ++--
 htdocs/accountancy/admin/accountmodel.php      |  4 ++--
 htdocs/accountancy/admin/card.php              |  4 ++--
 htdocs/accountancy/admin/categories.php        |  2 +-
 htdocs/accountancy/admin/fiscalyear_card.php   |  4 ++--
 htdocs/adherents/card.php                      |  2 +-
 htdocs/adherents/subscription/card.php         |  4 ++--
 htdocs/adherents/type.php                      |  2 +-
 htdocs/adherents/type_translation.php          |  4 ++--
 htdocs/admin/boxes.php                         |  2 +-
 htdocs/admin/const.php                         |  2 +-
 htdocs/admin/defaultvalues.php                 |  4 ++--
 htdocs/admin/dict.php                          |  4 ++--
 htdocs/admin/emailcollector_card.php           |  4 ++--
 htdocs/admin/expensereport_ik.php              |  4 ++--
 htdocs/admin/expensereport_rules.php           |  4 ++--
 htdocs/admin/mails_senderprofile_list.php      |  2 +-
 htdocs/admin/mails_templates.php               |  4 ++--
 htdocs/admin/menus/index.php                   | 18 +++++++++---------
 htdocs/admin/oauthlogintokens.php              |  4 ++--
 htdocs/admin/paymentbybanktransfer.php         |  2 +-
 htdocs/admin/prelevement.php                   |  2 +-
 htdocs/admin/receiptprinter.php                |  4 ++--
 htdocs/admin/translation.php                   |  4 ++--
 htdocs/admin/website.php                       |  4 ++--
 htdocs/asset/card.php                          |  2 +-
 htdocs/asset/type.php                          |  2 +-
 htdocs/bom/bom_card.php                        |  2 +-
 htdocs/bom/tpl/objectline_view.tpl.php         |  2 +-
 htdocs/bookmarks/card.php                      |  4 ++--
 htdocs/bookmarks/list.php                      |  4 ++--
 htdocs/categories/photos.php                   |  2 +-
 htdocs/categories/traduction.php               |  2 +-
 htdocs/categories/viewcat.php                  |  2 +-
 htdocs/comm/action/card.php                    |  2 +-
 htdocs/comm/mailing/card.php                   |  2 +-
 htdocs/comm/mailing/cibles.php                 |  2 +-
 htdocs/comm/propal/card.php                    |  4 ++--
 htdocs/commande/card.php                       |  2 +-
 htdocs/compta/bank/bankentries_list.php        |  2 +-
 htdocs/compta/bank/card.php                    |  4 ++--
 htdocs/compta/bank/categ.php                   |  4 ++--
 htdocs/compta/bank/various_payment/card.php    |  2 +-
 htdocs/compta/deplacement/card.php             |  2 +-
 htdocs/compta/facture/card.php                 |  6 +++---
 htdocs/compta/facture/prelevement.php          |  2 +-
 htdocs/compta/localtax/card.php                |  2 +-
 htdocs/compta/paiement/cheque/card.php         |  4 ++--
 htdocs/compta/payment_sc/card.php              |  2 +-
 htdocs/compta/sociales/card.php                | 10 +++++-----
 htdocs/compta/tva/card.php                     |  2 +-
 .../default/tpl/contactcard_view.tpl.php       |  2 +-
 htdocs/contact/card.php                        |  2 +-
 htdocs/contrat/card.php                        |  4 ++--
 htdocs/core/class/commonobject.class.php       |  4 ++--
 htdocs/core/class/html.formfile.class.php      |  6 +++---
 .../core/modules/printing/printgcp.modules.php |  4 ++--
 htdocs/core/tpl/admin_extrafields_view.tpl.php |  4 ++--
 htdocs/core/tpl/bloc_comment.tpl.php           |  4 ++--
 htdocs/core/tpl/contacts.tpl.php               |  6 +++---
 htdocs/core/tpl/resource_view.tpl.php          |  4 ++--
 htdocs/cron/card.php                           |  2 +-
 htdocs/cron/list.php                           |  4 ++--
 htdocs/don/card.php                            |  2 +-
 htdocs/don/payment/card.php                    |  2 +-
 htdocs/ecm/dir_add_card.php                    |  2 +-
 htdocs/ecm/dir_card.php                        |  2 +-
 htdocs/ecm/file_card.php                       |  2 +-
 htdocs/expedition/card.php                     |  4 ++--
 htdocs/expensereport/card.php                  |  4 ++--
 htdocs/expensereport/payment/card.php          |  2 +-
 htdocs/exports/class/export.class.php          |  2 +-
 htdocs/fichinter/card-rec.php                  |  4 ++--
 htdocs/fichinter/card.php                      |  2 +-
 htdocs/fourn/commande/card.php                 |  2 +-
 htdocs/fourn/facture/card.php                  |  6 +++---
 htdocs/fourn/paiement/card.php                 |  2 +-
 htdocs/ftp/index.php                           |  8 ++++----
 htdocs/holiday/card.php                        |  2 +-
 htdocs/hrm/establishment/card.php              |  2 +-
 htdocs/imports/import.php                      |  2 +-
 htdocs/langs/en_US/ticket.lang                 |  4 +---
 htdocs/livraison/card.php                      |  4 ++--
 htdocs/loan/card.php                           |  4 ++--
 htdocs/loan/payment/card.php                   |  2 +-
 htdocs/main.inc.php                            |  2 +-
 htdocs/modulebuilder/index.php                 |  2 +-
 .../modulebuilder/template/myobject_card.php   |  2 +-
 htdocs/mrp/mo_card.php                         |  2 +-
 htdocs/opensurvey/card.php                     |  2 +-
 htdocs/product/admin/dynamic_prices.php        |  8 ++++----
 htdocs/product/card.php                        |  2 +-
 htdocs/product/dynamic_price/editor.php        |  2 +-
 htdocs/product/inventory/card.php              |  2 +-
 htdocs/product/inventory/inventory.php         |  2 +-
 htdocs/product/price.php                       |  8 ++++----
 htdocs/product/stock/card.php                  | 18 ++++++++++++------
 htdocs/product/stock/product.php               |  2 +-
 htdocs/product/stock/productlot_card.php       |  2 +-
 htdocs/product/traduction.php                  |  4 ++--
 htdocs/projet/card.php                         |  2 +-
 htdocs/projet/tasks/contact.php                |  2 +-
 htdocs/projet/tasks/task.php                   |  2 +-
 htdocs/projet/tasks/time.php                   |  2 +-
 htdocs/reception/card.php                      |  6 +++---
 .../recruitmentcandidature_card.php            |  2 +-
 .../recruitmentjobposition_candidature.php     |  2 +-
 .../recruitmentjobposition_card.php            |  2 +-
 htdocs/resource/card.php                       |  2 +-
 htdocs/resource/list.php                       |  4 ++--
 htdocs/salaries/card.php                       |  2 +-
 .../canvas/company/tpl/card_view.tpl.php       |  2 +-
 .../canvas/individual/tpl/card_view.tpl.php    |  2 +-
 htdocs/societe/card.php                        |  2 +-
 htdocs/societe/notify/card.php                 |  2 +-
 htdocs/societe/paymentmodes.php                |  8 ++++----
 htdocs/societe/price.php                       |  2 +-
 htdocs/supplier_proposal/card.php              |  2 +-
 htdocs/takepos/index.php                       |  4 ++--
 htdocs/takepos/phone.php                       |  6 +++---
 htdocs/ticket/card.php                         |  2 +-
 htdocs/user/card.php                           |  2 +-
 htdocs/user/group/card.php                     |  4 ++--
 htdocs/user/notify/card.php                    |  2 +-
 htdocs/variants/card.php                       |  6 +++---
 htdocs/variants/combinations.php               |  2 +-
 htdocs/variants/list.php                       |  2 +-
 htdocs/website/websiteaccount_card.php         |  2 +-
 htdocs/zapier/hook_card.php                    |  2 +-
 129 files changed, 216 insertions(+), 212 deletions(-)

diff --git a/htdocs/accountancy/admin/account.php b/htdocs/accountancy/admin/account.php
index de8fd9a8cd6..0ac79bcc3aa 100644
--- a/htdocs/accountancy/admin/account.php
+++ b/htdocs/accountancy/admin/account.php
@@ -481,11 +481,11 @@ if ($resql)
 		// Action
 		print '<td class="center">';
 		if ($user->rights->accounting->chartofaccount) {
-			print '<a class="editfielda" href="./card.php?action=update&id='.$obj->rowid.'&backtopage='.urlencode($_SERVER["PHP_SELF"].'?chartofaccounts='.$object->id).'">';
+			print '<a class="editfielda" href="./card.php?action=update&token='.newToken().'&id='.$obj->rowid.'&backtopage='.urlencode($_SERVER["PHP_SELF"].'?chartofaccounts='.$object->id).'">';
 			print img_edit();
 			print '</a>';
 			print '&nbsp;';
-			print '<a class="marginleftonly" href="./card.php?action=delete&id='.$obj->rowid.'&backtopage='.urlencode($_SERVER["PHP_SELF"].'?chartofaccounts='.$object->id).'">';
+			print '<a class="marginleftonly" href="./card.php?action=delete&token='.newToken().'&id='.$obj->rowid.'&backtopage='.urlencode($_SERVER["PHP_SELF"].'?chartofaccounts='.$object->id).'">';
 			print img_delete();
 			print '</a>';
 		}
diff --git a/htdocs/accountancy/admin/accountmodel.php b/htdocs/accountancy/admin/accountmodel.php
index be3b49e41c1..d3bd17d95a5 100644
--- a/htdocs/accountancy/admin/accountmodel.php
+++ b/htdocs/accountancy/admin/accountmodel.php
@@ -669,11 +669,11 @@ if ($id)
 					print "</td>";
 
 					// Modify link
-					if ($canbemodified) print '<td class="center"><a class="reposition editfielda" href="'.$url.'action=edit">'.img_edit().'</a></td>';
+					if ($canbemodified) print '<td class="center"><a class="reposition editfielda" href="'.$url.'action=edit&token='.newToken().'">'.img_edit().'</a></td>';
 					else print '<td>&nbsp;</td>';
 
 					// Delete link
-					if ($iserasable) print '<td class="center"><a href="'.$url.'action=delete">'.img_delete().'</a></td>';
+					if ($iserasable) print '<td class="center"><a href="'.$url.'action=delete&token='.newToken().'">'.img_delete().'</a></td>';
 					else print '<td>&nbsp;</td>';
 
 					print "</tr>\n";
diff --git a/htdocs/accountancy/admin/card.php b/htdocs/accountancy/admin/card.php
index 4ad131f5170..29ed90bb7be 100644
--- a/htdocs/accountancy/admin/card.php
+++ b/htdocs/accountancy/admin/card.php
@@ -372,13 +372,13 @@ if ($action == 'create') {
 			print '<div class="tabsAction">';
 
 			if (!empty($user->rights->accounting->chartofaccount)) {
-				print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=update&id='.$id.'">'.$langs->trans('Modify').'</a>';
+				print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=update&token='.newToken().'&id='.$id.'">'.$langs->trans('Modify').'</a>';
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotAllowed")).'">'.$langs->trans('Modify').'</a>';
 			}
 
 			if (!empty($user->rights->accounting->chartofaccount)) {
-				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&id='.$id.'">'.$langs->trans('Delete').'</a>';
+				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&token='.newToken().'&id='.$id.'">'.$langs->trans('Delete').'</a>';
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotAllowed")).'">'.$langs->trans('Delete').'</a>';
 			}
diff --git a/htdocs/accountancy/admin/categories.php b/htdocs/accountancy/admin/categories.php
index 909d633c487..d605105f8e9 100644
--- a/htdocs/accountancy/admin/categories.php
+++ b/htdocs/accountancy/admin/categories.php
@@ -170,7 +170,7 @@ if ($action == 'display' || $action == 'delete') {
 				print '<td>'.length_accountg($cpt->account_number).'</td>';
 				print '<td>'.$cpt->label.'</td>';
 				print '<td class="right">';
-				print "<a href= '".$_SERVER['PHP_SELF']."?action=delete&account_category=".$cat_id."&cptid=".$cpt->rowid."'>";
+				print '<a href="'.$_SERVER['PHP_SELF'].'?action=delete&token='.newToken().'&account_category='.$cat_id.'&cptid='.$cpt->rowid.'">';
 				print $langs->trans("DeleteFromCat");
 				print img_picto($langs->trans("DeleteFromCat"), 'unlink');
 				print "</a>";
diff --git a/htdocs/accountancy/admin/fiscalyear_card.php b/htdocs/accountancy/admin/fiscalyear_card.php
index 27ef1ea7bd1..a122d3acab5 100644
--- a/htdocs/accountancy/admin/fiscalyear_card.php
+++ b/htdocs/accountancy/admin/fiscalyear_card.php
@@ -305,9 +305,9 @@ if ($action == 'create')
     			 */
     			print '<div class="tabsAction">';
 
-    			print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=edit&id='.$id.'">'.$langs->trans('Modify').'</a>';
+    			print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=edit&token='.newToken().'&id='.$id.'">'.$langs->trans('Modify').'</a>';
 
-    			// print '<a class="butActionDelete" href="' . $_SERVER["PHP_SELF"] . '?action=delete&id=' . $id . '">' . $langs->trans('Delete') . '</a>';
+    			// print '<a class="butActionDelete" href="' . $_SERVER["PHP_SELF"] . '?action=delete&token='.newToken().'&id=' . $id . '">' . $langs->trans('Delete') . '</a>';
 
     			print '</div>';
 			}
diff --git a/htdocs/adherents/card.php b/htdocs/adherents/card.php
index 0a32398f307..d0a67153209 100644
--- a/htdocs/adherents/card.php
+++ b/htdocs/adherents/card.php
@@ -1694,7 +1694,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action)) {
 
 				// Delete
 				if ($user->rights->adherent->supprimer) {
-					print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?rowid='.$object->id.'&action=delete">'.$langs->trans("Delete")."</a></div>\n";
+					print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?rowid='.$object->id.'&action=delete&token='.newToken().'">'.$langs->trans("Delete")."</a></div>\n";
 				} else {
 					print '<div class="inline-block divButAction"><font class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotEnoughPermissions")).'">'.$langs->trans("Delete")."</font></div>";
 				}
diff --git a/htdocs/adherents/subscription/card.php b/htdocs/adherents/subscription/card.php
index 3fad8c9db14..a79355de768 100644
--- a/htdocs/adherents/subscription/card.php
+++ b/htdocs/adherents/subscription/card.php
@@ -345,7 +345,7 @@ if ($rowid && $action != 'edit') {
 
     if ($user->rights->adherent->cotisation->creer) {
 		if (!$bankline->rappro) {
-			print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"]."?rowid=".$object->id."&action=edit\">".$langs->trans("Modify")."</a></div>";
+			print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"]."?rowid=".$object->id.'&action=edit&token='.newToken().'">'.$langs->trans("Modify")."</a></div>";
 		} else {
 			print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.$langs->trans("BankLineConciliated")."\" href=\"#\">".$langs->trans("Modify")."</a></div>";
 		}
@@ -353,7 +353,7 @@ if ($rowid && $action != 'edit') {
 
     // Delete
     if ($user->rights->adherent->cotisation->creer) {
-        print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"]."?rowid=".$object->id."&action=delete\">".$langs->trans("Delete")."</a></div>\n";
+        print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"]."?rowid=".$object->id.'&action=delete&token='.newToken().'">'.$langs->trans("Delete")."</a></div>\n";
     }
 
     print '</div>';
diff --git a/htdocs/adherents/type.php b/htdocs/adherents/type.php
index 853e22bfbc9..ecd709bdd17 100644
--- a/htdocs/adherents/type.php
+++ b/htdocs/adherents/type.php
@@ -455,7 +455,7 @@ if ($rowid > 0) {
 
 		// Delete
 		if ($user->rights->adherent->configurer) {
-			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&rowid='.$object->id.'">'.$langs->trans("DeleteType").'</a></div>';
+			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&token='.newToken().'&rowid='.$object->id.'">'.$langs->trans("DeleteType").'</a></div>';
 		}
 
 		print "</div>";
diff --git a/htdocs/adherents/type_translation.php b/htdocs/adherents/type_translation.php
index dcd4a7aa981..10c43dadbe3 100644
--- a/htdocs/adherents/type_translation.php
+++ b/htdocs/adherents/type_translation.php
@@ -201,7 +201,7 @@ if ($action == 'edit') {
 	if (!empty($object->multilangs)) {
 		foreach ($object->multilangs as $key => $value) {
 			$s = picto_from_langcode($key);
-			print "<br>".($s ? $s.' ' : '')." <b>".$langs->trans('Language_'.$key).":</b> ".'<a href="'.$_SERVER["PHP_SELF"].'?rowid='.$object->id.'&action=delete&langtodelete='.$key.'">'.img_delete('', 'class="valigntextbottom"')."</a><br>";
+			print '<br>'.($s ? $s.' ' : '').' <b>'.$langs->trans('Language_'.$key).':</b> <a href="'.$_SERVER["PHP_SELF"].'?rowid='.$object->id.'&action=delete&token='.newToken().'&langtodelete='.$key.'">'.img_delete('', 'class="valigntextbottom"')."</a><br>";
 
 			print '<div class="underbanner clearboth"></div>';
 			print '<table class="border centpercent">';
@@ -228,7 +228,7 @@ if ($action == 'edit') {
 	if (!empty($object->multilangs)) {
 		foreach ($object->multilangs as $key => $value) {
 			$s = picto_from_langcode($key);
-			print ($s ? $s.' ' : '')." <b>".$langs->trans('Language_'.$key).":</b> ".'<a href="'.$_SERVER["PHP_SELF"].'?rowid='.$object->id.'&action=delete&langtodelete='.$key.'">'.img_delete('', 'class="valigntextbottom"').'</a>';
+			print ($s ? $s.' ' : '')." <b>".$langs->trans('Language_'.$key).":</b> ".'<a href="'.$_SERVER["PHP_SELF"].'?rowid='.$object->id.'&action=delete&token='.newToken().'&langtodelete='.$key.'">'.img_delete('', 'class="valigntextbottom"').'</a>';
 
 			print '<div class="fichecenter">';
 			print '<div class="underbanner clearboth"></div>';
diff --git a/htdocs/admin/boxes.php b/htdocs/admin/boxes.php
index 2dbcfe00015..31723888e44 100644
--- a/htdocs/admin/boxes.php
+++ b/htdocs/admin/boxes.php
@@ -429,7 +429,7 @@ foreach ($boxactivated as $key => $box)
 	print ($hasprevious ? '<a href="boxes.php?action=switch&amp;switchfrom='.$box->rowid.'&amp;switchto='.$boxactivated[$key - 1]->rowid.'">'.img_up().'</a>' : '');
 	print '</td>';
 	print '<td class="center">';
-	print '<a href="boxes.php?rowid='.$box->rowid.'&amp;action=delete">'.img_delete().'</a>';
+	print '<a href="boxes.php?rowid='.$box->rowid.'&action=delete&token='.newToken().'">'.img_delete().'</a>';
 	print '</td>';
 
 	print '</tr>'."\n";
diff --git a/htdocs/admin/const.php b/htdocs/admin/const.php
index 5a525cbe9ad..4aacdb3cfc2 100644
--- a/htdocs/admin/const.php
+++ b/htdocs/admin/const.php
@@ -299,7 +299,7 @@ if ($result)
 		{
 			print '<input type="checkbox" class="flat checkboxfordelete" id="check_'.$i.'" name="const['.$i.'][check]" value="1">';
 		} else {
-			print '<a href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$obj->entity.'&action=delete'.((empty($user->entity) && $debug) ? '&debug=1' : '').'">'.img_delete().'</a>';
+			print '<a href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$obj->entity.'&action=delete&token='.newToken().((empty($user->entity) && $debug) ? '&debug=1' : '').'">'.img_delete().'</a>';
 		}
 
 		print "</td></tr>\n";
diff --git a/htdocs/admin/defaultvalues.php b/htdocs/admin/defaultvalues.php
index 453f10bf837..17fa15af382 100644
--- a/htdocs/admin/defaultvalues.php
+++ b/htdocs/admin/defaultvalues.php
@@ -378,9 +378,9 @@ if ($result)
 		print '<td class="center">';
 		if ($action != 'edit' || GETPOST('rowid') != $obj->rowid)
 		{
-    		print '<a href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$obj->entity.'&mode='.$mode.'&action=edit'.((empty($user->entity) && $debug) ? '&debug=1' : '').'">'.img_edit().'</a>';
+    		print '<a href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$obj->entity.'&mode='.$mode.'&action=edit&token='.newToken().((empty($user->entity) && $debug) ? '&debug=1' : '').'">'.img_edit().'</a>';
     		print ' &nbsp; ';
-    		print '<a href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$obj->entity.'&mode='.$mode.'&action=delete'.((empty($user->entity) && $debug) ? '&debug=1' : '').'">'.img_delete().'</a>';
+    		print '<a href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$obj->entity.'&mode='.$mode.'&action=delete&token='.newToken().((empty($user->entity) && $debug) ? '&debug=1' : '').'">'.img_delete().'</a>';
 		} else {
 		    print '<input type="hidden" name="page" value="'.$page.'">';
 		    print '<input type="hidden" name="rowid" value="'.$id.'">';
diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php
index b6d5df3644a..1ac1e0f4ad4 100644
--- a/htdocs/admin/dict.php
+++ b/htdocs/admin/dict.php
@@ -1671,14 +1671,14 @@ if ($id)
                     print "</td>";
 
                     // Modify link
-                    if ($canbemodified) print '<td align="center"><a class="reposition editfielda" href="'.$url.'action=edit">'.img_edit().'</a></td>';
+                    if ($canbemodified) print '<td align="center"><a class="reposition editfielda" href="'.$url.'action=edit&token='.newToken().'">'.img_edit().'</a></td>';
                     else print '<td>&nbsp;</td>';
 
                     // Delete link
                     if ($iserasable)
                     {
                         print '<td class="center">';
-                        if ($user->admin) print '<a href="'.$url.'action=delete">'.img_delete().'</a>';
+                        if ($user->admin) print '<a href="'.$url.'action=delete&token='.newToken().'">'.img_delete().'</a>';
                         //else print '<a href="#">'.img_delete().'</a>';    // Some dictionary can be edited by other profile than admin
                         print '</td>';
                     } else print '<td>&nbsp;</td>';
diff --git a/htdocs/admin/emailcollector_card.php b/htdocs/admin/emailcollector_card.php
index 1420cc0263e..eb9ffb52831 100644
--- a/htdocs/admin/emailcollector_card.php
+++ b/htdocs/admin/emailcollector_card.php
@@ -540,7 +540,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 		print '</td>';
 		print '<td>'.$rulefilter['rulevalue'].'</td>';
 		print '<td class="right">';
-		print ' <a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deletefilter&filterid='.$rulefilter['id'].'&token='.urlencode(newToken()).'">'.img_delete().'</a>';
+		print ' <a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deletefilter&token='.urlencode(newToken()).'&filterid='.$rulefilter['id'].'">'.img_delete().'</a>';
 		print '</td>';
 		print '</tr>';
 	}
@@ -632,7 +632,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 		// Delete
 		print '<td class="right nowraponall">';
 		print '<a class="editfielda marginrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=editoperation&operationid='.$ruleaction['id'].'">'.img_edit().'</a>';
-		print ' <a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deleteoperation&operationid='.$ruleaction['id'].'&token='.urlencode(newToken()).'">'.img_delete().'</a>';
+		print ' <a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deleteoperation&token='.newToken().'&operationid='.$ruleaction['id'].'">'.img_delete().'</a>';
 		print '</td>';
 		print '</tr>';
 		$i++;
diff --git a/htdocs/admin/expensereport_ik.php b/htdocs/admin/expensereport_ik.php
index 3ff8ad0c4ce..f55e78d4105 100644
--- a/htdocs/admin/expensereport_ik.php
+++ b/htdocs/admin/expensereport_ik.php
@@ -166,8 +166,8 @@ foreach ($rangesbycateg as $fk_c_exp_tax_cat => $Tab)
 				echo '<input id="" class="button" name="save" value="'.$langs->trans('Save').'" type="submit" />';
 				echo '<input class="button" value="'.$langs->trans('Cancel').'" onclick="javascript:history.go(-1)" type="button" />';
 			} else {
-				echo '<a class="editfielda marginrightonly paddingleft paddingright" href="'.$_SERVER['PHP_SELF'].'?action=edit&id='.$range->ik->id.'&fk_c_exp_tax_cat='.$range->fk_c_exp_tax_cat.'&fk_range='.$range->rowid.'">'.img_edit().'</a>';
-				if (!empty($range->ik->id)) echo '<a class="paddingleft paddingright" href="'.$_SERVER['PHP_SELF'].'?action=delete&id='.$range->ik->id.'">'.img_delete().'</a>';
+				echo '<a class="editfielda marginrightonly paddingleft paddingright" href="'.$_SERVER['PHP_SELF'].'?action=edit&token='.newToken().'&id='.$range->ik->id.'&fk_c_exp_tax_cat='.$range->fk_c_exp_tax_cat.'&fk_range='.$range->rowid.'">'.img_edit().'</a>';
+				if (!empty($range->ik->id)) echo '<a class="paddingleft paddingright" href="'.$_SERVER['PHP_SELF'].'?action=delete&token='.newToken().'&id='.$range->ik->id.'">'.img_delete().'</a>';
 				// TODO add delete link
 			}
 		}
diff --git a/htdocs/admin/expensereport_rules.php b/htdocs/admin/expensereport_rules.php
index 6d08355b815..e0012139154 100644
--- a/htdocs/admin/expensereport_rules.php
+++ b/htdocs/admin/expensereport_rules.php
@@ -305,8 +305,8 @@ foreach ($rules as $rule)
 	echo '<td class="center">';
 	if ($object->id != $rule->id)
 	{
-		echo '<a class="editfielda paddingright paddingleft" href="'.$_SERVER['PHP_SELF'].'?action=edit&id='.$rule->id.'">'.img_edit().'</a>&nbsp;';
-		echo '<a class="paddingright paddingleft" href="'.$_SERVER['PHP_SELF'].'?action=delete&id='.$rule->id.'">'.img_delete().'</a>';
+		echo '<a class="editfielda paddingright paddingleft" href="'.$_SERVER['PHP_SELF'].'?action=edit&token='.newToken().'&id='.$rule->id.'">'.img_edit().'</a>&nbsp;';
+		echo '<a class="paddingright paddingleft" href="'.$_SERVER['PHP_SELF'].'?action=delete&token='.newToken().'&id='.$rule->id.'">'.img_delete().'</a>';
 	} else {
 		echo '<input type="submit" class="button" value="'.$langs->trans('Update').'" />&nbsp;';
 		echo '<a href="'.$_SERVER['PHP_SELF'].'" class="button">'.$langs->trans('Cancel').'</a>';
diff --git a/htdocs/admin/mails_senderprofile_list.php b/htdocs/admin/mails_senderprofile_list.php
index 9a1a696e034..16ae12ffcc5 100644
--- a/htdocs/admin/mails_senderprofile_list.php
+++ b/htdocs/admin/mails_senderprofile_list.php
@@ -587,7 +587,7 @@ while ($i < ($limit ? min($num, $limit) : $num))
 	if ($sortorder) $url .= '&page='.urlencode($sortorder);
 	print '<a class="editfielda reposition marginrightonly marginleftonly" href="'.$url.'&action=edit&rowid='.$obj->rowid.'">'.img_edit().'</a>';
 	//print ' &nbsp; ';
-	print '<a class=" marginrightonly marginleftonly" href="'.$url.'&action=delete">'.img_delete().'</a>  &nbsp; ';
+	print '<a class=" marginrightonly marginleftonly" href="'.$url.'&action=delete&token='.newToken().'">'.img_delete().'</a>  &nbsp; ';
 	if ($massactionbutton || $massaction)   // If we are in select mode (massactionbutton defined) or if we have already selected and sent an action ($massaction) defined
 	{
 		$selected = 0;
diff --git a/htdocs/admin/mails_templates.php b/htdocs/admin/mails_templates.php
index 610dd9c1ef2..7c79505158a 100644
--- a/htdocs/admin/mails_templates.php
+++ b/htdocs/admin/mails_templates.php
@@ -889,10 +889,10 @@ if ($resql)
 
 				// Modify link / Delete link
 				print '<td class="center nowraponall" width="64">';
-				if ($canbemodified) print '<a class="reposition editfielda" href="'.$url.'action=edit">'.img_edit().'</a>';
+				if ($canbemodified) print '<a class="reposition editfielda" href="'.$url.'action=edit&token='.newToken().'">'.img_edit().'</a>';
 				if ($iserasable)
 				{
-					print '<a class="marginleftonly" href="'.$url.'action=delete">'.img_delete().'</a>';
+					print '<a class="marginleftonly" href="'.$url.'action=delete&token='.newToken().'">'.img_delete().'</a>';
 					//else print '<a href="#">'.img_delete().'</a>';    // Some dictionary can be edited by other profile than admin
 				}
 				print '</td>';
diff --git a/htdocs/admin/menus/index.php b/htdocs/admin/menus/index.php
index 101e57970c0..b7b0060c778 100644
--- a/htdocs/admin/menus/index.php
+++ b/htdocs/admin/menus/index.php
@@ -320,20 +320,20 @@ if ($conf->use_javascript_ajax)
 			$titre = $langs->trans($menu['titre']);
 
 			$entry = '<table class="nobordernopadding centpercent"><tr><td>';
-			$entry .= '<strong> &nbsp; <a href="edit.php?menu_handler='.$menu_handler_to_search.'&action=edit&menuId='.$menu['rowid'].'">'.$titre.'</a></strong>';
+			$entry .= '<strong> &nbsp; <a href="edit.php?menu_handler='.$menu_handler_to_search.'&action=edit&token='.newToken().'&menuId='.$menu['rowid'].'">'.$titre.'</a></strong>';
 			$entry .= '</td><td class="right">';
-			$entry .= '<a class="editfielda marginleftonly marginrightonly" href="edit.php?menu_handler='.$menu_handler_to_search.'&action=edit&menuId='.$menu['rowid'].'">'.img_edit('default', 0, 'class="menuEdit" id="edit'.$menu['rowid'].'"').'</a> ';
-			$entry .= '<a class="marginleftonly marginrightonly" href="edit.php?menu_handler='.$menu_handler_to_search.'&action=create&menuId='.$menu['rowid'].'">'.img_edit_add('default').'</a> ';
-			$entry .= '<a class="marginleftonly marginrightonly" href="index.php?menu_handler='.$menu_handler_to_search.'&action=delete&menuId='.$menu['rowid'].'">'.img_delete('default').'</a> ';
+			$entry .= '<a class="editfielda marginleftonly marginrightonly" href="edit.php?menu_handler='.$menu_handler_to_search.'&action=edit&token='.newToken().'&menuId='.$menu['rowid'].'">'.img_edit('default', 0, 'class="menuEdit" id="edit'.$menu['rowid'].'"').'</a> ';
+			$entry .= '<a class="marginleftonly marginrightonly" href="edit.php?menu_handler='.$menu_handler_to_search.'&action=create&token='.newToken().'&menuId='.$menu['rowid'].'">'.img_edit_add('default').'</a> ';
+			$entry .= '<a class="marginleftonly marginrightonly" href="index.php?menu_handler='.$menu_handler_to_search.'&action=delete&token='.newToken().'&menuId='.$menu['rowid'].'">'.img_delete('default').'</a> ';
 			$entry .= '&nbsp; &nbsp; &nbsp;';
-			$entry .= '<a class="marginleftonly marginrightonly" href="index.php?menu_handler='.$menu_handler_to_search.'&action=up&menuId='.$menu['rowid'].'">'.img_picto("Up", "1uparrow").'</a><a href="index.php?menu_handler='.$menu_handler_to_search.'&action=down&menuId='.$menu['rowid'].'">'.img_picto("Down", "1downarrow").'</a>';
+			$entry .= '<a class="marginleftonly marginrightonly" href="index.php?menu_handler='.$menu_handler_to_search.'&action=up&token='.newToken().'&menuId='.$menu['rowid'].'">'.img_picto("Up", "1uparrow").'</a><a href="index.php?menu_handler='.$menu_handler_to_search.'&action=down&menuId='.$menu['rowid'].'">'.img_picto("Down", "1downarrow").'</a>';
 			$entry .= '</td></tr></table>';
 
-			$buttons = '<a class="editfielda marginleftonly marginrightonly" href="edit.php?menu_handler='.$menu_handler_to_search.'&action=edit&menuId='.$menu['rowid'].'">'.img_edit('default', 0, 'class="menuEdit" id="edit'.$menu['rowid'].'"').'</a> ';
-			$buttons .=	'<a class="marginleftonly marginrightonly" href="edit.php?menu_handler='.$menu_handler_to_search.'&action=create&menuId='.$menu['rowid'].'">'.img_edit_add('default').'</a> ';
-			$buttons .=	'<a class="marginleftonly marginrightonly" href="index.php?menu_handler='.$menu_handler_to_search.'&action=delete&menuId='.$menu['rowid'].'">'.img_delete('default').'</a> ';
+			$buttons = '<a class="editfielda marginleftonly marginrightonly" href="edit.php?menu_handler='.$menu_handler_to_search.'&action=edit&token='.newToken().'&menuId='.$menu['rowid'].'">'.img_edit('default', 0, 'class="menuEdit" id="edit'.$menu['rowid'].'"').'</a> ';
+			$buttons .=	'<a class="marginleftonly marginrightonly" href="edit.php?menu_handler='.$menu_handler_to_search.'&action=create&token='.newToken().'&menuId='.$menu['rowid'].'">'.img_edit_add('default').'</a> ';
+			$buttons .=	'<a class="marginleftonly marginrightonly" href="index.php?menu_handler='.$menu_handler_to_search.'&action=delete&token='.newToken().'&menuId='.$menu['rowid'].'">'.img_delete('default').'</a> ';
 			$buttons .=	'&nbsp; &nbsp; &nbsp;';
-			$buttons .=	'<a class="marginleftonly marginrightonly" href="index.php?menu_handler='.$menu_handler_to_search.'&action=up&menuId='.$menu['rowid'].'">'.img_picto("Up", "1uparrow").'</a><a href="index.php?menu_handler='.$menu_handler_to_search.'&action=down&menuId='.$menu['rowid'].'">'.img_picto("Down", "1downarrow").'</a>';
+			$buttons .=	'<a class="marginleftonly marginrightonly" href="index.php?menu_handler='.$menu_handler_to_search.'&action=up&token='.newToken().'&menuId='.$menu['rowid'].'">'.img_picto("Up", "1uparrow").'</a><a href="index.php?menu_handler='.$menu_handler_to_search.'&action=down&menuId='.$menu['rowid'].'">'.img_picto("Down", "1downarrow").'</a>';
 
 			$data[] = array(
 				'rowid'=>$menu['rowid'],
diff --git a/htdocs/admin/oauthlogintokens.php b/htdocs/admin/oauthlogintokens.php
index 0f12da3a02a..2d843a52577 100644
--- a/htdocs/admin/oauthlogintokens.php
+++ b/htdocs/admin/oauthlogintokens.php
@@ -148,7 +148,7 @@ if ($mode == 'setup' && $user->admin)
             // We pass this param list in to 'state' because we need it before and after the redirect.
             $shortscope = 'user,public_repo';
             $urltorenew = $urlwithroot.'/core/modules/oauth/github_oauthcallback.php?shortscope='.$shortscope.'&state='.$shortscope.'&backtourl='.urlencode(DOL_URL_ROOT.'/admin/oauthlogintokens.php');
-            $urltodelete = $urlwithroot.'/core/modules/oauth/github_oauthcallback.php?action=delete&backtourl='.urlencode(DOL_URL_ROOT.'/admin/oauthlogintokens.php');
+            $urltodelete = $urlwithroot.'/core/modules/oauth/github_oauthcallback.php?action=delete&token='.newToken().'&backtourl='.urlencode(DOL_URL_ROOT.'/admin/oauthlogintokens.php');
             $urltocheckperms = 'https://github.com/settings/applications/';
         } elseif ($key[0] == 'OAUTH_GOOGLE_NAME')
         {
@@ -161,7 +161,7 @@ if ($mode == 'setup' && $user->admin)
 			}
             //$scope.=',gmail_full';
             $urltorenew = $urlwithroot.'/core/modules/oauth/google_oauthcallback.php?shortscope='.$shortscope.'&state='.$shortscope.'&backtourl='.urlencode(DOL_URL_ROOT.'/admin/oauthlogintokens.php');
-            $urltodelete = $urlwithroot.'/core/modules/oauth/google_oauthcallback.php?action=delete&backtourl='.urlencode(DOL_URL_ROOT.'/admin/oauthlogintokens.php');
+            $urltodelete = $urlwithroot.'/core/modules/oauth/google_oauthcallback.php?action=delete&token='.newToken().'&backtourl='.urlencode(DOL_URL_ROOT.'/admin/oauthlogintokens.php');
             $urltocheckperms = 'https://security.google.com/settings/security/permissions';
         } elseif ($key[0] == 'OAUTH_STRIPE_TEST_NAME')
         {
diff --git a/htdocs/admin/paymentbybanktransfer.php b/htdocs/admin/paymentbybanktransfer.php
index d85f79257d0..718e64e6446 100644
--- a/htdocs/admin/paymentbybanktransfer.php
+++ b/htdocs/admin/paymentbybanktransfer.php
@@ -465,7 +465,7 @@ if (! empty($conf->global->MAIN_MODULE_NOTIFICATION))
 	        print '<td>'.dolGetFirstLastname($obj->firstname,$obj->lastname).'</td>';
 	        $label=($langs->trans("Notify_".$obj->code)!="Notify_".$obj->code?$langs->trans("Notify_".$obj->code):$obj->label);
 	        print '<td>'.$label.'</td>';
-	        print '<td class="right"><a href="'.$_SERVER["PHP_SELF"].'?action=deletenotif&amp;notif='.$obj->rowid.'">'.img_delete().'</a></td>';
+	        print '<td class="right"><a href="'.$_SERVER["PHP_SELF"].'?action=deletenotif&token='.newToken().'&notif='.$obj->rowid.'">'.img_delete().'</a></td>';
 	        print '</tr>';
 	        $i++;
 	    }
diff --git a/htdocs/admin/prelevement.php b/htdocs/admin/prelevement.php
index 1e1bee11ad4..50d01924364 100644
--- a/htdocs/admin/prelevement.php
+++ b/htdocs/admin/prelevement.php
@@ -472,7 +472,7 @@ if (! empty($conf->global->MAIN_MODULE_NOTIFICATION))
 	        print '<td>'.dolGetFirstLastname($obj->firstname,$obj->lastname).'</td>';
 	        $label=($langs->trans("Notify_".$obj->code)!="Notify_".$obj->code?$langs->trans("Notify_".$obj->code):$obj->label);
 	        print '<td>'.$label.'</td>';
-	        print '<td class="right"><a href="'.$_SERVER["PHP_SELF"].'?action=deletenotif&amp;notif='.$obj->rowid.'">'.img_delete().'</a></td>';
+	        print '<td class="right"><a href="'.$_SERVER["PHP_SELF"].'?action=deletenotif&token='.newToken().'&notif='.$obj->rowid.'">'.img_delete().'</a></td>';
 	        print '</tr>';
 	        $i++;
 	    }
diff --git a/htdocs/admin/receiptprinter.php b/htdocs/admin/receiptprinter.php
index 9b3563edd63..92b9ffbd8b4 100644
--- a/htdocs/admin/receiptprinter.php
+++ b/htdocs/admin/receiptprinter.php
@@ -340,11 +340,11 @@ if ($mode == 'config' && $user->admin) {
                 print img_picto($langs->trans("Edit"), 'edit');
                 print '</a>';
                 // delete icon
-                print '<a class="marginrightonly" href="'.$_SERVER['PHP_SELF'].'?mode=config&amp;action=deleteprinter&amp;printerid='.$printer->listprinters[$line]['rowid'].'&amp;printername='.$printer->listprinters[$line]['name'].'">';
+                print '<a class="marginrightonly" href="'.$_SERVER['PHP_SELF'].'?mode=config&amp;action=deleteprinter&amp;token='.newToken().'&amp;printerid='.$printer->listprinters[$line]['rowid'].'&amp;printername='.$printer->listprinters[$line]['name'].'">';
                 print img_picto($langs->trans("Delete"), 'delete');
                 print '</a>';
                 // test icon
-                print '<a class="marginrightonly" href="'.$_SERVER['PHP_SELF'].'?mode=config&amp;action=testprinter&amp;printerid='.$printer->listprinters[$line]['rowid'].'&amp;printername='.$printer->listprinters[$line]['name'].'">';
+                print '<a class="marginrightonly" href="'.$_SERVER['PHP_SELF'].'?mode=config&amp;action=testprinter&amp;token='.newToken().'&amp;printerid='.$printer->listprinters[$line]['rowid'].'&amp;printername='.$printer->listprinters[$line]['name'].'">';
                 print img_picto($langs->trans("TestPrinter"), 'printer');
                 print '</a></td>';
                 print '</tr>';
diff --git a/htdocs/admin/translation.php b/htdocs/admin/translation.php
index 17c4592f382..560530c9161 100644
--- a/htdocs/admin/translation.php
+++ b/htdocs/admin/translation.php
@@ -350,7 +350,7 @@ if ($mode == 'overwrite')
     		} else {
     			print '<a class="reposition editfielda paddingrightonly" href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$obj->entity.'&action=edit'.((empty($user->entity) && $debug) ? '&debug=1' : '').'">'.img_edit().'</a>';
 				print ' &nbsp; ';
-    			print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$obj->entity.'&action=delete'.((empty($user->entity) && $debug) ? '&debug=1' : '').'">'.img_delete().'</a>';
+    			print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$obj->entity.'&action=delete&token='.newToken().((empty($user->entity) && $debug) ? '&debug=1' : '').'">'.img_delete().'</a>';
     		}
     		print '</td>';
 
@@ -514,7 +514,7 @@ if ($mode == 'searchkey')
                 }
                 print '<a class="editfielda reposition paddingrightonly" href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$conf->entity.'&action=edit">'.img_edit().'</a>';
                 print ' ';
-                print '<a href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$conf->entity.'&action=delete">'.img_delete().'</a>';
+                print '<a href="'.$_SERVER['PHP_SELF'].'?rowid='.$obj->rowid.'&entity='.$conf->entity.'&action=delete&token='.newToken().'">'.img_delete().'</a>';
                 print '&nbsp;&nbsp;';
                 $htmltext = $langs->trans("OriginalValueWas", '<i>'.$newlangfileonly->tab_translate[$key].'</i>');
                 print $form->textwithpicto('', $htmltext, 1, 'info');
diff --git a/htdocs/admin/website.php b/htdocs/admin/website.php
index 83aeed6bd13..b8520ecc227 100644
--- a/htdocs/admin/website.php
+++ b/htdocs/admin/website.php
@@ -601,10 +601,10 @@ if ($id)
                     print "</td>";
 
                     // Modify link
-                    print '<td align="center"><a class="reposition" href="'.$url.'action=edit">'.img_edit().'</a></td>';
+                    print '<td align="center"><a class="reposition" href="'.$url.'action=edit&token='.newToken().'">'.img_edit().'</a></td>';
 
                     // Delete link
-                    if ($iserasable) print '<td align="center"><a class="reposition" href="'.$url.'action=delete">'.img_delete().'</a></td>';
+                    if ($iserasable) print '<td align="center"><a class="reposition" href="'.$url.'action=delete&token='.newToken().'">'.img_delete().'</a></td>';
                     else print '<td class="center">'.img_delete($langs->trans("DisableSiteFirst"), 'class="opacitymedium"').'</td>';
 
                     print "</tr>\n";
diff --git a/htdocs/asset/card.php b/htdocs/asset/card.php
index 3434b03da99..7ef3d9c011e 100644
--- a/htdocs/asset/card.php
+++ b/htdocs/asset/card.php
@@ -323,7 +323,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 
 			if ($user->rights->asset->delete)
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>'."\n";
+				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&token='.newToken().'">'.$langs->trans('Delete').'</a>'."\n";
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotEnoughPermissions")).'">'.$langs->trans('Delete').'</a>'."\n";
 			}
diff --git a/htdocs/asset/type.php b/htdocs/asset/type.php
index 01418fde201..1045e9135ee 100644
--- a/htdocs/asset/type.php
+++ b/htdocs/asset/type.php
@@ -507,7 +507,7 @@ if ($rowid > 0)
 		// Delete
 		if ($user->rights->asset->write)
 		{
-			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&rowid='.$object->id.'">'.$langs->trans("DeleteType").'</a></div>';
+			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&token='.newToken().'&rowid='.$object->id.'">'.$langs->trans("DeleteType").'</a></div>';
 		}
 
 		print "</div>";
diff --git a/htdocs/bom/bom_card.php b/htdocs/bom/bom_card.php
index cf452d6b8da..7daf29416c2 100644
--- a/htdocs/bom/bom_card.php
+++ b/htdocs/bom/bom_card.php
@@ -683,7 +683,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 
 			if ($permissiontodelete)
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>'."\n";
+				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>'."\n";
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotEnoughPermissions")).'">'.$langs->trans('Delete').'</a>'."\n";
 			}
diff --git a/htdocs/bom/tpl/objectline_view.tpl.php b/htdocs/bom/tpl/objectline_view.tpl.php
index e1e94dc2076..c5ee3870272 100644
--- a/htdocs/bom/tpl/objectline_view.tpl.php
+++ b/htdocs/bom/tpl/objectline_view.tpl.php
@@ -121,7 +121,7 @@ if ($this->status == 0 && ($object_rights->write) && $action != 'selectlines') {
     $coldisplay++;
     if (($line->fk_prev_id == null) && empty($disableremove)) {
         //La suppression n'est autorisée que si il n'y a pas de ligne dans une précédente situation
-        print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$this->id.'&amp;action=deleteline&amp;lineid='.$line->id.'">';
+        print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$this->id.'&amp;action=deleteline&amp;token='.newToken().'&amp;lineid='.$line->id.'">';
         print img_delete();
         print '</a>';
     }
diff --git a/htdocs/bookmarks/card.php b/htdocs/bookmarks/card.php
index b6552dbd89c..93926e4ba92 100644
--- a/htdocs/bookmarks/card.php
+++ b/htdocs/bookmarks/card.php
@@ -311,13 +311,13 @@ if ($id > 0 && !preg_match('/^add/i', $action))
 	// Edit
 	if ($user->rights->bookmark->creer && $action != 'edit')
 	{
-		print "  <a class=\"butAction\" href=\"".$_SERVER["PHP_SELF"]."?id=".$object->id."&amp;action=edit\">".$langs->trans("Edit")."</a>\n";
+		print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=edit&amp;token='.newToken().'">'.$langs->trans("Edit").'</a>'."\n";
 	}
 
 	// Remove
 	if ($user->rights->bookmark->supprimer && $action != 'edit')
 	{
-		print "  <a class=\"butActionDelete\" href=\"list.php?bid=".$object->id."&amp;action=delete\">".$langs->trans("Delete")."</a>\n";
+		print '<a class="butActionDelete" href="list.php?bid='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans("Delete").'</a>'."\n";
 	}
 
 	print '</div>';
diff --git a/htdocs/bookmarks/list.php b/htdocs/bookmarks/list.php
index 3b01efdeea8..7f70d74f5d9 100644
--- a/htdocs/bookmarks/list.php
+++ b/htdocs/bookmarks/list.php
@@ -241,11 +241,11 @@ while ($i < min($num, $limit))
 	print '<td class="nowrap right">';
 	if ($user->rights->bookmark->creer)
 	{
-		print '<a class="editfielda" href="'.DOL_URL_ROOT."/bookmarks/card.php?action=edit&id=".$obj->rowid."&backtopage=".urlencode($_SERVER["PHP_SELF"]).'">'.img_edit()."</a>";
+		print '<a class="editfielda" href="'.DOL_URL_ROOT."/bookmarks/card.php?action=edit&token='.newToken().'&id=".$obj->rowid."&backtopage=".urlencode($_SERVER["PHP_SELF"]).'">'.img_edit()."</a>";
 	}
 	if ($user->rights->bookmark->supprimer)
 	{
-		print '<a class="marginleftonly" href="'.$_SERVER["PHP_SELF"].'?action=delete&id='.$obj->rowid.'">'.img_delete().'</a>';
+		print '<a class="marginleftonly" href="'.$_SERVER["PHP_SELF"].'?action=delete&token='.newToken().'&id='.$obj->rowid.'">'.img_delete().'</a>';
 	} else {
 		print "&nbsp;";
 	}
diff --git a/htdocs/categories/photos.php b/htdocs/categories/photos.php
index e8b3da0a525..dc0a980a6f8 100644
--- a/htdocs/categories/photos.php
+++ b/htdocs/categories/photos.php
@@ -254,7 +254,7 @@ if ($object->id)
     			}
     			if ($user->rights->categorie->creer)
     			{
-    				print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;type='.$type.'&amp;file='.urlencode($pdir.$viewfilename).'">';
+    				print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'&amp;type='.$type.'&amp;file='.urlencode($pdir.$viewfilename).'">';
     				print img_delete().'</a>';
     			}
     			if ($nbbyrow) print '</td>';
diff --git a/htdocs/categories/traduction.php b/htdocs/categories/traduction.php
index cf3db3444c7..f5755a697ca 100644
--- a/htdocs/categories/traduction.php
+++ b/htdocs/categories/traduction.php
@@ -301,7 +301,7 @@ if ($action == 'edit')
 		{
 		    $s = picto_from_langcode($key);
 			print '<table class="border centpercent">';
-			print '<tr class="liste_titre"><td colspan="2">'.($s ? $s.' ' : '')." <b>".$langs->trans('Language_'.$key).":</b> ".'<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=delete&langtodelete='.$key.'&type='.$type.'">'.img_delete('', '').'</a></td></tr>';
+			print '<tr class="liste_titre"><td colspan="2">'.($s ? $s.' ' : '')." <b>".$langs->trans('Language_'.$key).":</b> ".'<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=delete&token='.newToken().'&langtodelete='.$key.'&type='.$type.'">'.img_delete('', '').'</a></td></tr>';
 			print '<tr><td class="titlefield">'.$langs->trans('Label').'</td><td>'.$object->multilangs[$key]["label"].'</td></tr>';
 			print '<tr><td>'.$langs->trans('Description').'</td><td>'.$object->multilangs[$key]["description"].'</td></tr>';
 			if (!empty($conf->global->CATEGORY_USE_OTHER_FIELD_IN_TRANSLATION))
diff --git a/htdocs/categories/viewcat.php b/htdocs/categories/viewcat.php
index 616c97f3bb9..30b706a4b3a 100644
--- a/htdocs/categories/viewcat.php
+++ b/htdocs/categories/viewcat.php
@@ -266,7 +266,7 @@ if ($user->rights->categorie->creer)
 
 if ($user->rights->categorie->supprimer)
 {
-	print "<a class='butActionDelete' href='".DOL_URL_ROOT."/categories/viewcat.php?action=delete&amp;id=".$object->id."&amp;type=".$type."'>".$langs->trans("Delete")."</a>";
+	print "<a class='butActionDelete' href='".DOL_URL_ROOT."/categories/viewcat.php?action=delete&amp;token='.newToken().'&amp;id=".$object->id."&amp;type=".$type."'>".$langs->trans("Delete")."</a>";
 }
 
 print "</div>";
diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index 3818f459893..cb63813139d 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -2139,7 +2139,7 @@ if ($id > 0)
 			if ($user->rights->agenda->allactions->delete ||
 			   (($object->authorid == $user->id || $object->userownerid == $user->id) && $user->rights->agenda->myactions->delete))
 			{
-				print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?action=delete&id='.$object->id.'">'.$langs->trans("Delete").'</a></div>';
+				print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?action=delete&token='.newToken().'&id='.$object->id.'">'.$langs->trans("Delete").'</a></div>';
 			} else {
 				print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#" title="'.$langs->trans("NotAllowed").'">'.$langs->trans("Delete").'</a></div>';
 			}
diff --git a/htdocs/comm/mailing/card.php b/htdocs/comm/mailing/card.php
index 13037b58769..78b9dea4bc6 100644
--- a/htdocs/comm/mailing/card.php
+++ b/htdocs/comm/mailing/card.php
@@ -1014,7 +1014,7 @@ if ($action == 'create')
 					{
 						print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->transnoentitiesnoconv("NotEnoughPermissions")).'">'.$langs->trans("DeleteMailing").'</a>';
 					} else {
-						print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&amp;id='.$object->id.(!empty($urlfrom) ? '&urlfrom='.$urlfrom : '').'">'.$langs->trans("DeleteMailing").'</a>';
+						print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&amp;token='.newToken().'&amp;id='.$object->id.(!empty($urlfrom) ? '&urlfrom='.$urlfrom : '').'">'.$langs->trans("DeleteMailing").'</a>';
 					}
 				}
 
diff --git a/htdocs/comm/mailing/cibles.php b/htdocs/comm/mailing/cibles.php
index 813a195007b..ef2f3cc772e 100644
--- a/htdocs/comm/mailing/cibles.php
+++ b/htdocs/comm/mailing/cibles.php
@@ -665,7 +665,7 @@ if ($object->fetch($id) >= 0)
 				if ($obj->statut == 0)	// Not sent yet
 				{
 					if ($user->rights->mailing->creer && $allowaddtarget) {
-						print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=delete&rowid='.$obj->rowid.$param.'">'.img_delete($langs->trans("RemoveRecipient")).'</a>';
+						print '<a class="reposition" href="'.$_SERVER['PHP_SELF'].'?action=delete&token='.newToken().'&rowid='.$obj->rowid.$param.'">'.img_delete($langs->trans("RemoveRecipient")).'</a>';
 					}
 				}
 				/*if ($obj->statut == -1)	// Sent with error
diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php
index 2c6b7a9dca6..8febd8868e9 100644
--- a/htdocs/comm/propal/card.php
+++ b/htdocs/comm/propal/card.php
@@ -2491,12 +2491,12 @@ if ($action == 'create')
 
 				// Clone
 				if ($usercancreate) {
-					print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;socid='.$object->socid.'&amp;action=clone&amp;object='.$object->element.'">'.$langs->trans("ToClone").'</a>';
+					print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;socid='.$object->socid.'&amp;action=clone&amp;token='.newToken().'&amp;object='.$object->element.'">'.$langs->trans("ToClone").'</a>';
 				}
 
 				// Delete
 				if ($usercandelete) {
-					print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete"';
+					print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'"';
 					print '>'.$langs->trans('Delete').'</a>';
 				}
 			}
diff --git a/htdocs/commande/card.php b/htdocs/commande/card.php
index b3cb465d70d..5de377930d7 100644
--- a/htdocs/commande/card.php
+++ b/htdocs/commande/card.php
@@ -2602,7 +2602,7 @@ if ($action == 'create' && $usercancreate)
 				// Delete order
 				if ($usercandelete) {
 					if ($numshipping == 0) {
-						print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a></div>';
+						print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a></div>';
 					} else {
 						print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#" title="'.$langs->trans("ShippingExist").'">'.$langs->trans("Delete").'</a></div>';
 					}
diff --git a/htdocs/compta/bank/bankentries_list.php b/htdocs/compta/bank/bankentries_list.php
index 950d0c7d3c6..974ba750dd1 100644
--- a/htdocs/compta/bank/bankentries_list.php
+++ b/htdocs/compta/bank/bankentries_list.php
@@ -1490,7 +1490,7 @@ if ($resql)
     	    }
     	    if ($user->rights->banque->modifier)
     	    {
-    	        print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete&amp;rowid='.$objp->rowid.'&amp;id='.$objp->bankid.'&amp;page='.$page.'">';
+    	        print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete&amp;token='.newToken().'&amp;rowid='.$objp->rowid.'&amp;id='.$objp->bankid.'&amp;page='.$page.'">';
     	        print img_delete('', 'class="marginleftonly"');
     	        print '</a>';
     	    }
diff --git a/htdocs/compta/bank/card.php b/htdocs/compta/bank/card.php
index 7d9e825ce08..bac2f974def 100644
--- a/htdocs/compta/bank/card.php
+++ b/htdocs/compta/bank/card.php
@@ -761,13 +761,13 @@ if ($action == 'create')
 
 		if ($user->rights->banque->configurer)
 		{
-			print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=edit&id='.$object->id.'">'.$langs->trans("Modify").'</a>';
+			print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=edit&token='.newToken().'&id='.$object->id.'">'.$langs->trans("Modify").'</a>';
 		}
 
 		$canbedeleted = $object->can_be_deleted(); // Renvoi vrai si compte sans mouvements
 		if ($user->rights->banque->configurer && $canbedeleted)
 		{
-			print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&id='.$object->id.'">'.$langs->trans("Delete").'</a>';
+			print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&token='.newToken().'&id='.$object->id.'">'.$langs->trans("Delete").'</a>';
 		}
 
 		print '</div>';
diff --git a/htdocs/compta/bank/categ.php b/htdocs/compta/bank/categ.php
index 0f71134d08a..18b75bdea9b 100644
--- a/htdocs/compta/bank/categ.php
+++ b/htdocs/compta/bank/categ.php
@@ -135,8 +135,8 @@ if ($result)
 		} else {
 			print "<td >".$objp->label."</td>";
 			print '<td class="center">';
-			print '<a class="editfielda reposition marginleftonly marginrightonly" href="'.$_SERVER["PHP_SELF"].'?categid='.$objp->rowid.'&amp;action=edit">'.img_edit().'</a>';
-			print '<a class="marginleftonly" href="'.$_SERVER["PHP_SELF"].'?categid='.$objp->rowid.'&amp;action=delete">'.img_delete().'</a>';
+			print '<a class="editfielda reposition marginleftonly marginrightonly" href="'.$_SERVER["PHP_SELF"].'?categid='.$objp->rowid.'&amp;action=edit&amp;token='.newToken().'">'.img_edit().'</a>';
+			print '<a class="marginleftonly" href="'.$_SERVER["PHP_SELF"].'?categid='.$objp->rowid.'&amp;action=delete&amp;token='.newToken().'">'.img_delete().'</a>';
 			print '</td>';
 		}
 		print "</tr>";
diff --git a/htdocs/compta/bank/various_payment/card.php b/htdocs/compta/bank/various_payment/card.php
index 20eab8b349e..371dbaa65e2 100644
--- a/htdocs/compta/bank/various_payment/card.php
+++ b/htdocs/compta/bank/various_payment/card.php
@@ -550,7 +550,7 @@ if ($id)
 			if ($alreadyaccounted) {
 				print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#" title="'.$langs->trans("Accounted").'">'.$langs->trans("Delete").'</a></div>';
 			} else {
-				print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?id='.$object->id.'&action=delete">'.$langs->trans("Delete").'</a></div>';
+				print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?id='.$object->id.'&action=delete&token='.newToken().'">'.$langs->trans("Delete").'</a></div>';
 			}
 		} else {
 			print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#" title="'.(dol_escape_htmltag($langs->trans("NotAllowed"))).'">'.$langs->trans("Delete").'</a></div>';
diff --git a/htdocs/compta/deplacement/card.php b/htdocs/compta/deplacement/card.php
index 682981852d8..5b8b98135a1 100644
--- a/htdocs/compta/deplacement/card.php
+++ b/htdocs/compta/deplacement/card.php
@@ -521,7 +521,7 @@ if ($action == 'create')
 
             if ($user->rights->deplacement->supprimer)
             {
-                print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&id='.$id.'">'.$langs->trans('Delete').'</a>';
+                print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&token='.newToken().'&id='.$id.'">'.$langs->trans('Delete').'</a>';
             } else {
                 print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotAllowed")).'">'.$langs->trans('Delete').'</a>';
             }
diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php
index 634a4a0e452..7b0d7fcf869 100644
--- a/htdocs/compta/facture/card.php
+++ b/htdocs/compta/facture/card.php
@@ -3935,7 +3935,7 @@ if ($action == 'create')
 		}
 	}
 
-	if ($action == 'deletepaiement')
+	if ($action == 'deletepayment')
 	{
 		$payment_id = GETPOST('paiement_id');
 		$formconfirm = $form->formconfirm($_SERVER["PHP_SELF"].'?id='.$object->id.'&paiement_id='.$payment_id, $langs->trans('DeletePayment'), $langs->trans('ConfirmDeletePayment'), 'confirm_delete_paiement', '', 'no', 1);
@@ -4743,7 +4743,7 @@ if ($action == 'create')
 				print '<td class="center">';
 				if ($object->statut == Facture::STATUS_VALIDATED && $object->paye == 0 && $user->socid == 0)
 				{
-					print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deletepaiement&paiement_id='.$objp->rowid.'">';
+					print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deletepayment&token='.newToken().'&paiement_id='.$objp->rowid.'">';
 					print img_delete();
 					print '</a>';
 				}
@@ -5286,7 +5286,7 @@ if ($action == 'create')
 				{
 					print '<a class="butActionRefused classfortooltip" href="#" title="'.$langs->trans("DisabledBecauseReplacedInvoice").'">'.$langs->trans('Delete').'</a>';
 				} else {
-					print '<a class="butActionDelete'.($conf->use_javascript_ajax ? ' reposition' : '').'" href="'.$_SERVER["PHP_SELF"].'?facid='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>';
+					print '<a class="butActionDelete'.($conf->use_javascript_ajax ? ' reposition' : '').'" href="'.$_SERVER["PHP_SELF"].'?facid='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>';
 				}
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.$langs->trans("NotAllowed").'">'.$langs->trans('Delete').'</a>';
diff --git a/htdocs/compta/facture/prelevement.php b/htdocs/compta/facture/prelevement.php
index 721c0b857ab..f69517c1037 100644
--- a/htdocs/compta/facture/prelevement.php
+++ b/htdocs/compta/facture/prelevement.php
@@ -752,7 +752,7 @@ if ($object->id > 0)
 			print '<td class="center">'.$langs->trans("OrderWaiting").'</td>';
 
 			print '<td class="right">';
-			print '<a href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=delete&did='.$obj->rowid.'&type='.$type.'">';
+			print '<a href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=delete&token='.newToken().'&did='.$obj->rowid.'&type='.$type.'">';
 			print img_delete();
 			print '</a></td>';
 
diff --git a/htdocs/compta/localtax/card.php b/htdocs/compta/localtax/card.php
index cd7bbfd11c2..6353d394f20 100644
--- a/htdocs/compta/localtax/card.php
+++ b/htdocs/compta/localtax/card.php
@@ -280,7 +280,7 @@ if ($id)
 	print "<div class=\"tabsAction\">\n";
 	if ($object->rappro == 0)
 	{
-		print '<a class="butActionDelete" href="card.php?id='.$object->id.'&action=delete">'.$langs->trans("Delete").'</a>';
+		print '<a class="butActionDelete" href="card.php?id='.$object->id.'&action=delete&token='.newToken().'">'.$langs->trans("Delete").'</a>';
 	} else {
 		print '<a class="butActionRefused classfortooltip" href="#" title="'.$langs->trans("LinkedToAConcialitedTransaction").'">'.$langs->trans("Delete").'</a>';
 	}
diff --git a/htdocs/compta/paiement/cheque/card.php b/htdocs/compta/paiement/cheque/card.php
index 24650ea343f..71cd900f915 100644
--- a/htdocs/compta/paiement/cheque/card.php
+++ b/htdocs/compta/paiement/cheque/card.php
@@ -734,12 +734,12 @@ print '<div class="tabsAction">';
 
 if ($user->socid == 0 && !empty($object->id) && $object->statut == 0 && $user->rights->banque->cheque)
 {
-	print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=valide&amp;sortfield='.$sortfield.'&amp;sortorder='.$sortorder.'">'.$langs->trans('Validate').'</a>';
+	print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=valide&amp;token='.newToken().'&amp;sortfield='.$sortfield.'&amp;sortorder='.$sortorder.'">'.$langs->trans('Validate').'</a>';
 }
 
 if ($user->socid == 0 && !empty($object->id) && $user->rights->banque->cheque)
 {
-	print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;sortfield='.$sortfield.'&amp;sortorder='.$sortorder.'">'.$langs->trans('Delete').'</a>';
+	print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'&amp;sortfield='.$sortfield.'&amp;sortorder='.$sortorder.'">'.$langs->trans('Delete').'</a>';
 }
 print '</div>';
 
diff --git a/htdocs/compta/payment_sc/card.php b/htdocs/compta/payment_sc/card.php
index 2819e492f7b..0e71c83f6cb 100644
--- a/htdocs/compta/payment_sc/card.php
+++ b/htdocs/compta/payment_sc/card.php
@@ -311,7 +311,7 @@ if ($action == '')
 	{
 		if (!$disable_delete)
 		{
-			print '<a class="butActionDelete" href="card.php?id='.$_GET['id'].'&amp;action=delete">'.$langs->trans('Delete').'</a>';
+			print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.GETPOST('id', 'int').'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>';
 		} else {
 			print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("CantRemovePaymentWithOneInvoicePaid")).'">'.$langs->trans('Delete').'</a>';
 		}
diff --git a/htdocs/compta/sociales/card.php b/htdocs/compta/sociales/card.php
index bcdfe1f5238..c744bcc90e8 100644
--- a/htdocs/compta/sociales/card.php
+++ b/htdocs/compta/sociales/card.php
@@ -706,13 +706,13 @@ if ($id > 0)
 			// Reopen
 			if ($object->paye && $user->rights->tax->charges->creer)
 			{
-				print "<div class=\"inline-block divButAction\"><a class=\"butAction\" href=\"".dol_buildpath("/compta/sociales/card.php", 1)."?id=$object->id&amp;action=reopen\">".$langs->trans("ReOpen")."</a></div>";
+				print '<div class="inline-block divButAction"><a class="butAction" href="'.dol_buildpath("/compta/sociales/card.php", 1).'?id='.$object->id.'&amp;action=reopen">'.$langs->trans("ReOpen").'</a></div>';
 			}
 
 			// Edit
 			if ($object->paye == 0 && $user->rights->tax->charges->creer)
 			{
-				print "<div class=\"inline-block divButAction\"><a class=\"butAction\" href=\"".DOL_URL_ROOT."/compta/sociales/card.php?id=$object->id&amp;action=edit\">".$langs->trans("Modify")."</a></div>";
+				print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/compta/sociales/card.php?id='.$object->id.'&amp;action=edit">'.$langs->trans("Modify").'</a></div>';
 			}
 
 			// Emit payment
@@ -724,19 +724,19 @@ if ($id > 0)
 			// Classify 'paid'
 			if ($object->paye == 0 && round($resteapayer) <= 0 && $user->rights->tax->charges->creer)
 			{
-				print "<div class=\"inline-block divButAction\"><a class=\"butAction\" href=\"".DOL_URL_ROOT."/compta/sociales/card.php?id=$object->id&amp;action=paid\">".$langs->trans("ClassifyPaid")."</a></div>";
+				print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/compta/sociales/card.php?id='.$object->id.'&amp;action=paid&amp;token='.newToken().'">'.$langs->trans("ClassifyPaid").'</a></div>';
 			}
 
 			// Clone
 			if ($user->rights->tax->charges->creer)
 			{
-				print "<div class=\"inline-block divButAction\"><a class=\"butAction\" href=\"".dol_buildpath("/compta/sociales/card.php", 1)."?id=$object->id&amp;action=clone\">".$langs->trans("ToClone")."</a></div>";
+				print '<div class="inline-block divButAction"><a class="butAction" href="'.dol_buildpath("/compta/sociales/card.php", 1).'?id='.$object->id.'&amp;action=clone">'.$langs->trans("ToClone")."</a></div>";
 			}
 
 			// Delete
 			if ($user->rights->tax->charges->supprimer)
 			{
-				print "<div class=\"inline-block divButAction\"><a class=\"butActionDelete\" href=\"".DOL_URL_ROOT."/compta/sociales/card.php?id=$object->id&amp;action=delete\">".$langs->trans("Delete")."</a></div>";
+				print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.DOL_URL_ROOT.'/compta/sociales/card.php?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans("Delete").'</a></div>';
 			}
 
 			print "</div>";
diff --git a/htdocs/compta/tva/card.php b/htdocs/compta/tva/card.php
index 717b584fe44..010fd112646 100644
--- a/htdocs/compta/tva/card.php
+++ b/htdocs/compta/tva/card.php
@@ -379,7 +379,7 @@ if ($id)
 	{
 		if (!empty($user->rights->tax->charges->supprimer))
 		{
-			print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?id='.$object->id.'&action=delete">'.$langs->trans("Delete").'</a></div>';
+			print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?id='.$object->id.'&action=delete&token='.newToken().'">'.$langs->trans("Delete").'</a></div>';
 		} else {
 			print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#" title="'.(dol_escape_htmltag($langs->trans("NotAllowed"))).'">'.$langs->trans("Delete").'</a></div>';
 		}
diff --git a/htdocs/contact/canvas/default/tpl/contactcard_view.tpl.php b/htdocs/contact/canvas/default/tpl/contactcard_view.tpl.php
index bd0808aa8b5..43fd48e3ef0 100644
--- a/htdocs/contact/canvas/default/tpl/contactcard_view.tpl.php
+++ b/htdocs/contact/canvas/default/tpl/contactcard_view.tpl.php
@@ -144,7 +144,7 @@ if (empty($user->socid)) {
 	}
 
 	if ($user->rights->societe->contact->supprimer) {
-		print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$this->control->tpl['id'].'&amp;action=delete&amp;canvas='.$canvas.'">'.$langs->trans('Delete').'</a>';
+		print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$this->control->tpl['id'].'&amp;action=delete&amp;token='.newToken().'&amp;canvas='.$canvas.'">'.$langs->trans('Delete').'</a>';
 	}
 
 	print '</div><br>';
diff --git a/htdocs/contact/card.php b/htdocs/contact/card.php
index 9f242b52666..e4e7ecaf5fb 100644
--- a/htdocs/contact/card.php
+++ b/htdocs/contact/card.php
@@ -1526,7 +1526,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action))
 			// Delete
 			if ($user->rights->societe->contact->supprimer)
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=delete'.($backtopage ? '&backtopage='.urlencode($backtopage) : '').'">'.$langs->trans('Delete').'</a>';
+				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=delete&token='.newToken().''.($backtopage ? '&backtopage='.urlencode($backtopage) : '').'">'.$langs->trans('Delete').'</a>';
 			}
 		}
 
diff --git a/htdocs/contrat/card.php b/htdocs/contrat/card.php
index adb117b7b8f..dd06d9fed4b 100644
--- a/htdocs/contrat/card.php
+++ b/htdocs/contrat/card.php
@@ -1567,7 +1567,7 @@ if ($action == 'create')
 					}
 					if ($user->rights->contrat->creer && ($object->statut >= 0))
 					{
-						print '<a class="reposition marginrightonly" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=deleteline&amp;rowid='.$objp->rowid.'">';
+						print '<a class="reposition marginrightonly" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=deleteline&amp;token='.newToken().'&amp;rowid='.$objp->rowid.'">';
 						print img_delete();
 						print '</a>';
 					}
@@ -2108,7 +2108,7 @@ if ($action == 'create')
 				// - Droit de supprimer
 				if (($user->rights->contrat->creer && $object->statut == $object::STATUS_DRAFT) || $user->rights->contrat->supprimer)
 				{
-					print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans("Delete").'</a></div>';
+					print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans("Delete").'</a></div>';
 				} else {
 					print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotAllowed")).'">'.$langs->trans("Delete").'</a></div>';
 				}
diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php
index 46567edf369..3ea4bba4a7f 100644
--- a/htdocs/core/class/commonobject.class.php
+++ b/htdocs/core/class/commonobject.class.php
@@ -7152,7 +7152,7 @@ abstract class CommonObject
 								$return .= '<a href="'.DOL_URL_ROOT.'/core/photos_resize.php?modulepart='.urlencode('produit|service').'&id='.$this->id.'&amp;file='.urlencode($pdir.$viewfilename).'" title="'.dol_escape_htmltag($langs->trans("Resize")).'">'.img_picto($langs->trans("Resize"), 'resize', '').'</a> &nbsp; ';
 
 								// Link to delete
-								$return .= '<a href="'.$_SERVER["PHP_SELF"].'?id='.$this->id.'&amp;action=delete&amp;file='.urlencode($pdir.$viewfilename).'">';
+								$return .= '<a href="'.$_SERVER["PHP_SELF"].'?id='.$this->id.'&amp;action=delete&amp;token='.newToken().'&amp;file='.urlencode($pdir.$viewfilename).'">';
 								$return .= img_delete().'</a>';
 							}
 						}
@@ -7178,7 +7178,7 @@ abstract class CommonObject
 								$return .= '<a href="'.DOL_URL_ROOT.'/core/photos_resize.php?modulepart='.urlencode('produit|service').'&id='.$this->id.'&amp;file='.urlencode($pdir.$viewfilename).'" title="'.dol_escape_htmltag($langs->trans("Resize")).'">'.img_picto($langs->trans("Resize"), 'resize', '').'</a> &nbsp; ';
 
 								// Link to delete
-								$return .= '<a href="'.$_SERVER["PHP_SELF"].'?id='.$this->id.'&amp;action=delete&amp;file='.urlencode($pdir.$viewfilename).'">';
+								$return .= '<a href="'.$_SERVER["PHP_SELF"].'?id='.$this->id.'&amp;action=delete&amp;token='.newToken().'&amp;file='.urlencode($pdir.$viewfilename).'">';
 								$return .= img_delete().'</a>';
 							}
 						}
diff --git a/htdocs/core/class/html.formfile.class.php b/htdocs/core/class/html.formfile.class.php
index 2e06837563e..7264c83b152 100644
--- a/htdocs/core/class/html.formfile.class.php
+++ b/htdocs/core/class/html.formfile.class.php
@@ -1337,7 +1337,7 @@ class FormFile
 							if (!empty($conf->dol_use_jmobile)) $useajax = 0;
 							if (empty($conf->use_javascript_ajax)) $useajax = 0;
 							if (!empty($conf->global->MAIN_ECM_DISABLE_JS)) $useajax = 0;
-							print '<a href="'.((($useinecm && $useinecm != 6) && $useajax) ? '#' : ($url.'?action=delete&urlfile='.urlencode($filepath).$param)).'" class="reposition deletefilelink" rel="'.$filepath.'">'.img_delete().'</a>';
+							print '<a href="'.((($useinecm && $useinecm != 6) && $useajax) ? '#' : ($url.'?action=delete&token='.newToken().'&urlfile='.urlencode($filepath).$param)).'" class="reposition deletefilelink" rel="'.$filepath.'">'.img_delete().'</a>';
 						}
 						print "</td>";
 
@@ -1645,7 +1645,7 @@ class FormFile
 				//if ($forcedownload) print '&attachment=1';
 				//print '&file='.urlencode($relativefile).'">';
 				//print img_view().'</a> &nbsp; ';
-				//if ($permissiontodelete) print '<a href="'.$url.'?id='.$object->id.'&section='.$_REQUEST["section"].'&action=delete&urlfile='.urlencode($file['name']).'">'.img_delete().'</a>';
+				//if ($permissiontodelete) print '<a href="'.$url.'?id='.$object->id.'&section='.$_REQUEST["section"].'&action=delete&token='.newToken().'&urlfile='.urlencode($file['name']).'">'.img_delete().'</a>';
 				//else print '&nbsp;';
 				print "</td></tr>\n";
 			}
@@ -1819,7 +1819,7 @@ class FormFile
 				print '<td class="right">';
 				print '<a href="'.$_SERVER['PHP_SELF'].'?action=update&linkid='.$link->id.$param.'" class="editfilelink editfielda reposition" >'.img_edit().'</a>'; // id= is included into $param
 				if ($permissiontodelete) {
-					print ' &nbsp; <a class="deletefilelink" href="'.$_SERVER['PHP_SELF'].'?action=delete&linkid='.$link->id.$param.'">'.img_delete().'</a>'; // id= is included into $param
+					print ' &nbsp; <a class="deletefilelink" href="'.$_SERVER['PHP_SELF'].'?action=delete&token='.newToken().'&linkid='.$link->id.$param.'">'.img_delete().'</a>'; // id= is included into $param
 				} else {
 					print '&nbsp;';
 				}
diff --git a/htdocs/core/modules/printing/printgcp.modules.php b/htdocs/core/modules/printing/printgcp.modules.php
index 4b707f0772f..0312aa061f8 100644
--- a/htdocs/core/modules/printing/printgcp.modules.php
+++ b/htdocs/core/modules/printing/printgcp.modules.php
@@ -140,7 +140,7 @@ class printing_printgcp extends PrintingDriver
                     'info'=>$access,
                     'type'=>'info',
                     'renew'=>$urlwithroot.'/core/modules/oauth/google_oauthcallback.php?state=userinfo_email,userinfo_profile,cloud_print&backtourl='.urlencode(DOL_URL_ROOT.'/printing/admin/printing.php?mode=setup&driver=printgcp'),
-                    'delete'=>($storage->hasAccessToken($this->OAUTH_SERVICENAME_GOOGLE) ? $urlwithroot.'/core/modules/oauth/google_oauthcallback.php?action=delete&backtourl='.urlencode(DOL_URL_ROOT.'/printing/admin/printing.php?mode=setup&driver=printgcp') : '')
+                    'delete'=>($storage->hasAccessToken($this->OAUTH_SERVICENAME_GOOGLE) ? $urlwithroot.'/core/modules/oauth/google_oauthcallback.php?action=delete&token='.newToken().'&backtourl='.urlencode(DOL_URL_ROOT.'/printing/admin/printing.php?mode=setup&driver=printgcp') : '')
                 );
                 if ($token_ok) {
                     $expiredat = '';
@@ -166,7 +166,7 @@ class printing_printgcp extends PrintingDriver
                 /*
                 if ($storage->hasAccessToken($this->OAUTH_SERVICENAME_GOOGLE)) {
                     $this->conf[] = array('varname'=>'PRINTGCP_AUTHLINK', 'link'=>$urlwithroot.'/core/modules/oauth/google_oauthcallback.php?backtourl='.urlencode(DOL_URL_ROOT.'/printing/admin/printing.php?mode=setup&driver=printgcp'), 'type'=>'authlink');
-                    $this->conf[] = array('varname'=>'DELETE_TOKEN', 'link'=>$urlwithroot.'/core/modules/oauth/google_oauthcallback.php?action=delete&backtourl='.urlencode(DOL_URL_ROOT.'/printing/admin/printing.php?mode=setup&driver=printgcp'), 'type'=>'delete');
+                    $this->conf[] = array('varname'=>'DELETE_TOKEN', 'link'=>$urlwithroot.'/core/modules/oauth/google_oauthcallback.php?action=delete&token='.newToken().'&backtourl='.urlencode(DOL_URL_ROOT.'/printing/admin/printing.php?mode=setup&driver=printgcp'), 'type'=>'delete');
                 } else {
                     $this->conf[] = array('varname'=>'PRINTGCP_AUTHLINK', 'link'=>$urlwithroot.'/core/modules/oauth/google_oauthcallback.php?backtourl='.urlencode(DOL_URL_ROOT.'/printing/admin/printing.php?mode=setup&driver=printgcp'), 'type'=>'authlink');
                 }*/
diff --git a/htdocs/core/tpl/admin_extrafields_view.tpl.php b/htdocs/core/tpl/admin_extrafields_view.tpl.php
index 8b92f4e183c..fb542f9037e 100644
--- a/htdocs/core/tpl/admin_extrafields_view.tpl.php
+++ b/htdocs/core/tpl/admin_extrafields_view.tpl.php
@@ -112,8 +112,8 @@ if (is_array($extrafields->attributes[$elementtype]['type']) && count($extrafiel
 			}
 			print '</td>';
 		}
-		print '<td class="right nowraponall"><a class="editfielda" href="'.$_SERVER["PHP_SELF"].'?action=edit&attrname='.$key.'#formeditextrafield">'.img_edit().'</a>';
-		print '&nbsp; <a class="paddingleft" href="'.$_SERVER["PHP_SELF"].'?action=delete&attrname='.$key.'">'.img_delete().'</a></td>'."\n";
+		print '<td class="right nowraponall"><a class="editfielda" href="'.$_SERVER["PHP_SELF"].'?action=edit&token='.newToken().'&attrname='.$key.'#formeditextrafield">'.img_edit().'</a>';
+		print '&nbsp; <a class="paddingleft" href="'.$_SERVER["PHP_SELF"].'?action=delete&token='.newToken().'&attrname='.$key.'">'.img_delete().'</a></td>'."\n";
 		print "</tr>";
 	}
 } else {
diff --git a/htdocs/core/tpl/bloc_comment.tpl.php b/htdocs/core/tpl/bloc_comment.tpl.php
index 02a32110779..edb675e45d6 100644
--- a/htdocs/core/tpl/bloc_comment.tpl.php
+++ b/htdocs/core/tpl/bloc_comment.tpl.php
@@ -125,12 +125,12 @@ if (!empty($object->comments))
         } else {
             if ($fk_user == $user->id || $user->admin == 1)
             {
-                print '<a class="comment-edit comment-cell" href="'.$varpage.'?action=editcomment&id='.$id.'&withproject=1&idcomment='.$comment->id.'#comment" title="'.$langs->trans('Edit').'">';
+                print '<a class="comment-edit comment-cell" href="'.$varpage.'?action=editcomment&token='.newToken().'&id='.$id.'&withproject=1&idcomment='.$comment->id.'#comment" title="'.$langs->trans('Edit').'">';
                 print img_picto('', 'edit.png');
                 print '</a>';
             }
             if (($first && $fk_user == $user->id) || $user->admin == 1) {
-                print '<a class="comment-delete comment-cell" href="'.$varpage.'?action=deletecomment&id='.$id.'&withproject=1&idcomment='.$comment->id.'" title="'.$langs->trans('Delete').'">';
+                print '<a class="comment-delete comment-cell" href="'.$varpage.'?action=deletecomment&token='.newToken().'&id='.$id.'&withproject=1&idcomment='.$comment->id.'" title="'.$langs->trans('Delete').'">';
                 print img_picto('', 'delete.png');
                 print '</a>';
             }
diff --git a/htdocs/core/tpl/contacts.tpl.php b/htdocs/core/tpl/contacts.tpl.php
index 7665c4e2211..1cb8b813001 100644
--- a/htdocs/core/tpl/contacts.tpl.php
+++ b/htdocs/core/tpl/contacts.tpl.php
@@ -298,9 +298,9 @@ foreach ($list as $entry)
 	if ($permission)
 	{
 		$href = $_SERVER["PHP_SELF"];
-		$href .= "?id=".$object->id;
-		$href .= "&action=deletecontact";
-		$href .= "&lineid=".$entry->id;
+		$href .= '?id='.$object->id;
+		$href .= '&action=deletecontact&token='.newToken();
+		$href .= '&lineid='.$entry->id;
 
 		print "<td class='center'>";
 		print "<a href='$href'>";
diff --git a/htdocs/core/tpl/resource_view.tpl.php b/htdocs/core/tpl/resource_view.tpl.php
index ed54b4a2d00..9bc8447a796 100644
--- a/htdocs/core/tpl/resource_view.tpl.php
+++ b/htdocs/core/tpl/resource_view.tpl.php
@@ -73,11 +73,11 @@ if ((array) $linked_resources && count($linked_resources) > 0)
 			print '</div>';
 
 			print '<div class="tagtd right">';
-			print '<a class="editfielda marginleftonly marginrightonly" href="'.$_SERVER['PHP_SELF'].'?mode=edit&resource_type='.$linked_resource['resource_type'].'&element='.$element.'&element_id='.$element_id.'&lineid='.$linked_resource['rowid'].'">';
+			print '<a class="editfielda marginleftonly marginrightonly" href="'.$_SERVER['PHP_SELF'].'?mode=edit&token='.newToken().'&resource_type='.$linked_resource['resource_type'].'&element='.$element.'&element_id='.$element_id.'&lineid='.$linked_resource['rowid'].'">';
 			print img_edit();
 			print '</a>';
 			print '&nbsp;';
-			print '<a class="marginleftonly marginrightonly" href="'.$_SERVER['PHP_SELF'].'?action=delete_resource&id='.$linked_resource['resource_id'].'&element='.$element.'&element_id='.$element_id.'&lineid='.$linked_resource['rowid'].'">';
+			print '<a class="marginleftonly marginrightonly" href="'.$_SERVER['PHP_SELF'].'?action=delete_resource&token='.newToken().'&id='.$linked_resource['resource_id'].'&element='.$element.'&element_id='.$element_id.'&lineid='.$linked_resource['rowid'].'">';
 			print img_picto($langs->trans("Unlink"), 'unlink');
 			print '</a>';
 			print '</div>';
diff --git a/htdocs/cron/card.php b/htdocs/cron/card.php
index 80c3602f5d9..df529b598ec 100644
--- a/htdocs/cron/card.php
+++ b/htdocs/cron/card.php
@@ -726,7 +726,7 @@ if (($action == "create") || ($action == "edit"))
 	if (!$user->rights->cron->delete) {
 		print '<a class="butActionDeleteRefused" href="#" title="'.dol_escape_htmltag($langs->transnoentitiesnoconv("NotEnoughPermissions")).'">'.$langs->trans("Delete").'</a>';
 	} else {
-		print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&id='.$object->id.'">'.$langs->trans("Delete").'</a>';
+		print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&token='.newToken().'&id='.$object->id.'">'.$langs->trans("Delete").'</a>';
 	}
 	print '</div>';
 
diff --git a/htdocs/cron/list.php b/htdocs/cron/list.php
index a41608e7e25..927c1d1014f 100644
--- a/htdocs/cron/list.php
+++ b/htdocs/cron/list.php
@@ -536,12 +536,12 @@ if ($num > 0)
 		$backtourl = urlencode($_SERVER["PHP_SELF"].'?'.$param.($sortfield ? '&sortfield='.$sortfield : '').($sortorder ? '&sortorder='.$sortorder : ''));
 		if ($user->rights->cron->create)
 		{
-			print '<a class="editfielda" href="'.DOL_URL_ROOT."/cron/card.php?id=".$obj->rowid."&action=edit".($sortfield ? '&sortfield='.$sortfield : '').($sortorder ? '&sortorder='.$sortorder : '').$param;
+			print '<a class="editfielda" href="'.DOL_URL_ROOT."/cron/card.php?id=".$obj->rowid.'&action=edit&token='.newToken().($sortfield ? '&sortfield='.$sortfield : '').($sortorder ? '&sortorder='.$sortorder : '').$param;
 			print "&backtourl=".$backtourl."\" title=\"".dol_escape_htmltag($langs->trans('Edit'))."\">".img_picto($langs->trans('Edit'), 'edit')."</a> &nbsp;";
 		}
 		if ($user->rights->cron->delete)
 		{
-			print '<a class="reposition" href="'.$_SERVER["PHP_SELF"]."?id=".$obj->rowid."&action=delete".($page ? '&page='.$page : '').($sortfield ? '&sortfield='.$sortfield : '').($sortorder ? '&sortorder='.$sortorder : '').$param;
+			print '<a class="reposition" href="'.$_SERVER["PHP_SELF"]."?id=".$obj->rowid.'&action=delete&token='.newToken().($page ? '&page='.$page : '').($sortfield ? '&sortfield='.$sortfield : '').($sortorder ? '&sortorder='.$sortorder : '').$param;
 			print "\" title=\"".dol_escape_htmltag($langs->trans('CronDelete'))."\">".img_picto($langs->trans('CronDelete'), 'delete', '', false, 0, 0, '', 'marginleftonly')."</a> &nbsp; ";
 		} else {
 			print "<a href=\"#\" title=\"".dol_escape_htmltag($langs->trans('NotEnoughPermissions'))."\">".img_picto($langs->trans('NotEnoughPermissions'), 'delete', '', false, 0, 0, '', 'marginleftonly')."</a> &nbsp; ";
diff --git a/htdocs/don/card.php b/htdocs/don/card.php
index 42e45c2cba0..95bebb3ef8d 100644
--- a/htdocs/don/card.php
+++ b/htdocs/don/card.php
@@ -817,7 +817,7 @@ if (!empty($id) && $action != 'edit')
 	{
 		if ($object->statut == -1 || $object->statut == 0)
 		{
-			print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?rowid='.$object->id.'&action=delete">'.$langs->trans("Delete")."</a></div>";
+			print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?rowid='.$object->id.'&action=delete&token='.newToken().'">'.$langs->trans("Delete")."</a></div>";
 		} else {
 			print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#">'.$langs->trans("Delete")."</a></div>";
 		}
diff --git a/htdocs/don/payment/card.php b/htdocs/don/payment/card.php
index 4e4ce818556..26f540969ee 100644
--- a/htdocs/don/payment/card.php
+++ b/htdocs/don/payment/card.php
@@ -268,7 +268,7 @@ if (empty($action))
 	{
 		if (!$disable_delete)
 		{
-			print '<a class="butActionDelete" href="card.php?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>';
+			print '<a class="butActionDelete" href="card.php?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>';
 		} else {
 			print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("CantRemovePaymentWithOneInvoicePaid")).'">'.$langs->trans('Delete').'</a>';
 		}
diff --git a/htdocs/ecm/dir_add_card.php b/htdocs/ecm/dir_add_card.php
index b4e3c76aef1..a84beb605cb 100644
--- a/htdocs/ecm/dir_add_card.php
+++ b/htdocs/ecm/dir_add_card.php
@@ -292,7 +292,7 @@ if (empty($action) || $action == 'delete_section')
 	print '<div class="tabsAction">';
 	if ($user->rights->ecm->setup)
 	{
-		print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?action=delete_section">'.$langs->trans('Delete').'</a>';
+		print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?action=delete_section&token='.newToken().'">'.$langs->trans('Delete').'</a>';
 	} else {
 		print '<a class="butActionRefused classfortooltip" href="#" title="'.$langs->trans("NotAllowed").'">'.$langs->trans('Delete').'</a>';
 	}
diff --git a/htdocs/ecm/dir_card.php b/htdocs/ecm/dir_card.php
index 27d08e9119f..be481aa09bd 100644
--- a/htdocs/ecm/dir_card.php
+++ b/htdocs/ecm/dir_card.php
@@ -457,7 +457,7 @@ if ($action != 'edit' && $action != 'delete')
 	//{
 	if ($permtoadd)
 	{
-		print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete_dir'.($module ? '&module='.$module : '').'&section='.$section.($backtopage ? '&backtopage='.urlencode($backtopage) : '').'">'.$langs->trans('Delete').'</a>';
+		print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete_dir&token='.newToken().($module ? '&module='.$module : '').'&section='.$section.($backtopage ? '&backtopage='.urlencode($backtopage) : '').'">'.$langs->trans('Delete').'</a>';
 	} else {
 		print '<a class="butActionDeleteRefused" href="#" title="'.$langs->trans("NotAllowed").'">'.$langs->trans('Delete').'</a>';
 	}
diff --git a/htdocs/ecm/file_card.php b/htdocs/ecm/file_card.php
index 48c15f92aa2..40068e2e0a3 100644
--- a/htdocs/ecm/file_card.php
+++ b/htdocs/ecm/file_card.php
@@ -405,7 +405,7 @@ if ($action != 'edit')
     /*
 	if ($user->rights->ecm->setup)
 	{
-		print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?action=delete_file&section='.$section.'&urlfile='.urlencode($urlfile).'">'.$langs->trans('Delete').'</a>';
+		print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?action=delete_file&token='.newToken().'&section='.$section.'&urlfile='.urlencode($urlfile).'">'.$langs->trans('Delete').'</a>';
 	}
 	else
 	{
diff --git a/htdocs/expedition/card.php b/htdocs/expedition/card.php
index 7d4a455d58b..86ec2ee5c38 100644
--- a/htdocs/expedition/card.php
+++ b/htdocs/expedition/card.php
@@ -2360,7 +2360,7 @@ if ($action == 'create')
 					print '<a class="editfielda reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=editline&amp;lineid='.$lines[$i]->id.'">'.img_edit().'</a>';
 					print '</td>';
 					print '<td class="linecoldelete" width="10">';
-					print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=deleteline&amp;lineid='.$lines[$i]->id.'">'.img_delete().'</a>';
+					print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=deleteline&amp;token='.newToken().'&amp;lineid='.$lines[$i]->id.'">'.img_delete().'</a>';
 					print '</td>';
 
 					// Display lines extrafields
@@ -2499,7 +2499,7 @@ if ($action == 'create')
 			// Delete
 			if ($user->rights->expedition->supprimer)
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans("Delete").'</a>';
+				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans("Delete").'</a>';
 			}
 		}
 
diff --git a/htdocs/expensereport/card.php b/htdocs/expensereport/card.php
index addb13da745..34c33f5aaab 100644
--- a/htdocs/expensereport/card.php
+++ b/htdocs/expensereport/card.php
@@ -2199,10 +2199,10 @@ if ($action == 'create')
 							{
 								print '<td class="nowrap right">';
 
-								print '<a class="editfielda reposition paddingrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=editline&amp;rowid='.$line->rowid.'">';
+								print '<a class="editfielda reposition paddingrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=editline&amp;token='.newToken().'&amp;rowid='.$line->rowid.'">';
 								print img_edit();
 								print '</a> &nbsp; ';
-								print '<a class="paddingrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete_line&amp;rowid='.$line->rowid.'">';
+								print '<a class="paddingrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete_line&amp;token='.newToken().'&amp;rowid='.$line->rowid.'">';
 								print img_delete();
 								print '</a>';
 
diff --git a/htdocs/expensereport/payment/card.php b/htdocs/expensereport/payment/card.php
index fd1453b8ae5..9bc50341973 100644
--- a/htdocs/expensereport/payment/card.php
+++ b/htdocs/expensereport/payment/card.php
@@ -293,7 +293,7 @@ if ($action == '')
 	{
 		if (!$disable_delete)
 		{
-			print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$id.'&amp;action=delete">'.$langs->trans('Delete').'</a>';
+			print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>';
 		} else {
 			print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($title_button).'">'.$langs->trans('Delete').'</a>';
 		}
diff --git a/htdocs/exports/class/export.class.php b/htdocs/exports/class/export.class.php
index a33437166ea..89ae2103476 100644
--- a/htdocs/exports/class/export.class.php
+++ b/htdocs/exports/class/export.class.php
@@ -845,7 +845,7 @@ class Export
 				}
 				// suppression de l'export
 				print '<td class="right">';
-				print '<a href="'.$_SERVER["PHP_SELF"].'?action=deleteprof&id='.$obj->rowid.'">';
+				print '<a href="'.$_SERVER["PHP_SELF"].'?action=deleteprof&token='.newToken().'&id='.$obj->rowid.'">';
 				print img_delete();
 				print '</a>';
 				print "</tr>";
diff --git a/htdocs/fichinter/card-rec.php b/htdocs/fichinter/card-rec.php
index d297313675e..b8ff3714596 100644
--- a/htdocs/fichinter/card-rec.php
+++ b/htdocs/fichinter/card-rec.php
@@ -714,14 +714,14 @@ if ($action == 'create') {
 
 			if ($user->rights->ficheinter->creer) {
 				print '<div class="inline-block divButAction">';
-				print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?action=createfrommodel';
+				print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?action=createfrommodel&token='.newToken().'';
 				print '&socid='.$object->thirdparty->id.'&id='.$object->id.'">';
 				print $langs->trans("CreateFichInter").'</a></div>';
 			}
 
 			if ($user->rights->ficheinter->supprimer) {
 				print '<div class="inline-block divButAction">';
-				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&id='.$object->id.'">';
+				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&token='.newToken().'&id='.$object->id.'">';
 				print $langs->trans('Delete').'</a></div>';
 			}
 			print '</div>';
diff --git a/htdocs/fichinter/card.php b/htdocs/fichinter/card.php
index 4034abad733..b6d7ab39336 100644
--- a/htdocs/fichinter/card.php
+++ b/htdocs/fichinter/card.php
@@ -1697,7 +1697,7 @@ if ($action == 'create')
 				// Delete
 				if (($object->statut == Fichinter::STATUS_DRAFT && $user->rights->ficheinter->creer) || $user->rights->ficheinter->supprimer)
 				{
-					print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete"';
+					print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'"';
 					print '>'.$langs->trans('Delete').'</a></div>';
 				}
 			}
diff --git a/htdocs/fourn/commande/card.php b/htdocs/fourn/commande/card.php
index 4a26d3b4cb6..419d5c7a559 100644
--- a/htdocs/fourn/commande/card.php
+++ b/htdocs/fourn/commande/card.php
@@ -2559,7 +2559,7 @@ if ($action == 'create')
 			// Delete
 			if (!empty($usercandelete) || ($object->statut == CommandeFournisseur::STATUS_DRAFT && !empty($usercancreate)))
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans("Delete").'</a>';
+				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans("Delete").'</a>';
 			}
 		}
 
diff --git a/htdocs/fourn/facture/card.php b/htdocs/fourn/facture/card.php
index 9470e408b70..b0f178c6fc4 100644
--- a/htdocs/fourn/facture/card.php
+++ b/htdocs/fourn/facture/card.php
@@ -2345,7 +2345,7 @@ if ($action == 'create')
 		{
 			$formconfirm = $form->formconfirm($_SERVER["PHP_SELF"].'?id='.$object->id, $langs->trans('DeleteBill'), $langs->trans('ConfirmDeleteBill'), 'confirm_delete', '', 0, 1);
 		}
-		if ($action == 'deletepaiement')
+		if ($action == 'deletepayment')
 		{
 			$payment_id = GETPOST('paiement_id');
 			$formconfirm = $form->formconfirm($_SERVER["PHP_SELF"].'?id='.$object->id.'&paiement_id='.$payment_id, $langs->trans('DeletePayment'), $langs->trans('ConfirmDeletePayment'), 'confirm_delete_paiement', '', 0, 1);
@@ -2789,7 +2789,7 @@ if ($action == 'create')
 					print '<td class="center">';
 					if ($object->statut == FactureFournisseur::STATUS_VALIDATED && $object->paye == 0 && $user->socid == 0)
 					{
-						print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deletepaiement&paiement_id='.$objp->rowid.'">';
+						print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deletepayment&token='.newToken().'&paiement_id='.$objp->rowid.'">';
 						print img_delete();
 						print '</a>';
 					}
@@ -3178,7 +3178,7 @@ if ($action == 'create')
 	            	{
 	            		print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#" title="'.$langs->trans("DisabledBecauseNotErasable").'">'.$langs->trans('Delete').'</a></div>';
 	            	} else {
-    	                print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a></div>';
+    	                print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a></div>';
                     }
 	            }
 	            print '</div>';
diff --git a/htdocs/fourn/paiement/card.php b/htdocs/fourn/paiement/card.php
index 9a7af329f50..ffe4c95bf51 100644
--- a/htdocs/fourn/paiement/card.php
+++ b/htdocs/fourn/paiement/card.php
@@ -345,7 +345,7 @@ if ($result > 0)
 		{
 			if ($allow_delete)
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>';
+				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>';
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.$title_button.'">'.$langs->trans('Delete').'</a>';
 			}
diff --git a/htdocs/ftp/index.php b/htdocs/ftp/index.php
index cd76f74b278..7c0eab0f352 100644
--- a/htdocs/ftp/index.php
+++ b/htdocs/ftp/index.php
@@ -598,19 +598,19 @@ if (!function_exists('ftp_connect'))
 				print '<td class="right nowrap" width="64">';
 				if ($is_directory)
 				{
-					if ($file != '..') print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete_section&numero_ftp='.$numero_ftp.'&section='.urlencode($section).'&file='.urlencode($file).'">'.img_delete().'</a>';
+					if ($file != '..') print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete_section&token='.newToken().'&numero_ftp='.$numero_ftp.'&section='.urlencode($section).'&file='.urlencode($file).'">'.img_delete().'</a>';
 					else print '&nbsp;';
 				} elseif ($is_link)
 				{
 					$newfile = $file;
 					$newfile = preg_replace('/ ->.*/', '', $newfile);
-					print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete&numero_ftp='.$numero_ftp.'&section='.urlencode($section).'&file='.urlencode($newfile).'">'.img_delete().'</a>';
+					print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete&token='.newToken().'&numero_ftp='.$numero_ftp.'&section='.urlencode($section).'&file='.urlencode($newfile).'">'.img_delete().'</a>';
 				} else {
-					print '<a href="'.$_SERVER["PHP_SELF"].'?action=download&numero_ftp='.$numero_ftp.'&section='.urlencode($section).'&file='.urlencode($file).'">'.img_picto('', 'file').'</a>';
+					print '<a href="'.$_SERVER["PHP_SELF"].'?action=download&token='.newToken().'&numero_ftp='.$numero_ftp.'&section='.urlencode($section).'&file='.urlencode($file).'">'.img_picto('', 'file').'</a>';
 					print ' &nbsp; ';
 					print '<input type="checkbox" class="flat checkboxfordelete" id="check_'.$i.'" name="const['.$i.'][check]" value="1">';
 					print ' &nbsp; ';
-					print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete&numero_ftp='.$numero_ftp.'&section='.urlencode($section).'&file='.urlencode($file).'">'.img_delete().'</a>';
+					print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete&token='.newToken().'&numero_ftp='.$numero_ftp.'&section='.urlencode($section).'&file='.urlencode($file).'">'.img_delete().'</a>';
 					print '<input type="hidden" name="const['.$i.'][section]" value="'.$section.'">';
 					print '<input type="hidden" name="const['.$i.'][file]" value="'.$file.'">';
 				}
diff --git a/htdocs/holiday/card.php b/htdocs/holiday/card.php
index 3bacf8d6d6a..d9bbe6607bf 100644
--- a/htdocs/holiday/card.php
+++ b/htdocs/holiday/card.php
@@ -1470,7 +1470,7 @@ if ((empty($id) && empty($ref)) || $action == 'create' || $action == 'add')
 					}
 					if ($candelete && ($object->statut == Holiday::STATUS_DRAFT || $object->statut == Holiday::STATUS_CANCELED || $object->statut == Holiday::STATUS_REFUSED))	// If draft or canceled or refused
 					{
-						print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=delete" class="butActionDelete">'.$langs->trans("DeleteCP").'</a>';
+						print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=delete&token='.newToken().'" class="butActionDelete">'.$langs->trans("DeleteCP").'</a>';
 					}
 
 					print '</div>';
diff --git a/htdocs/hrm/establishment/card.php b/htdocs/hrm/establishment/card.php
index 0b000f879c2..1f43878babf 100644
--- a/htdocs/hrm/establishment/card.php
+++ b/htdocs/hrm/establishment/card.php
@@ -426,7 +426,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 
 	print '<div class="tabsAction">';
 	print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=edit&id='.$id.'">'.$langs->trans('Modify').'</a>';
-	print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&id='.$id.'">'.$langs->trans('Delete').'</a>';
+	print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&token='.newToken().'&id='.$id.'">'.$langs->trans('Delete').'</a>';
 	print '</div>';
 }
 
diff --git a/htdocs/imports/import.php b/htdocs/imports/import.php
index 8dee2ed0538..71fad9dee9b 100644
--- a/htdocs/imports/import.php
+++ b/htdocs/imports/import.php
@@ -639,7 +639,7 @@ if ($step == 3 && $datatoimport)
 			// Affiche date fichier
 			print '<td style="text-align:right">'.dol_print_date(dol_filemtime($dir.'/'.$file), 'dayhour').'</td>';
 			// Del button
-			print '<td style="text-align:right"><a href="'.$_SERVER['PHP_SELF'].'?action=delete&step=3'.$param.'&urlfile='.urlencode($relativepath);
+			print '<td style="text-align:right"><a href="'.$_SERVER['PHP_SELF'].'?action=delete&token='.newToken().'&step=3'.$param.'&urlfile='.urlencode($relativepath);
 			print '">'.img_delete().'</a></td>';
 			// Action button
 			print '<td style="text-align:right">';
diff --git a/htdocs/langs/en_US/ticket.lang b/htdocs/langs/en_US/ticket.lang
index e6f9e612a59..cf370fbdca0 100644
--- a/htdocs/langs/en_US/ticket.lang
+++ b/htdocs/langs/en_US/ticket.lang
@@ -31,10 +31,8 @@ TicketDictType=Ticket - Types
 TicketDictCategory=Ticket - Groupes
 TicketDictSeverity=Ticket - Severities
 TicketDictResolution=Ticket - Resolution
-TicketTypeShortBUGSOFT=Dysfonctionnement logiciel
-TicketTypeShortBUGHARD=Dysfonctionnement matériel
-TicketTypeShortCOM=Commercial question
 
+TicketTypeShortCOM=Commercial question
 TicketTypeShortHELP=Request for functionnal help
 TicketTypeShortISSUE=Issue, bug or problem
 TicketTypeShortREQUEST=Change or enhancement request
diff --git a/htdocs/livraison/card.php b/htdocs/livraison/card.php
index 80594338ba1..2a1646a5d80 100644
--- a/htdocs/livraison/card.php
+++ b/htdocs/livraison/card.php
@@ -658,9 +658,9 @@ if ($action == 'create')    // Create. Seems to no be used
 				{
 					if ($conf->expedition_bon->enabled)
 					{
-						print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;expid='.$object->origin_id.'&amp;action=delete&amp;backtopage='.urlencode(DOL_URL_ROOT.'/expedition/card.php?id='.$object->origin_id).'">'.$langs->trans("Delete").'</a>';
+						print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;expid='.$object->origin_id.'&amp;action=delete&amp;token='.newToken().'&amp;backtopage='.urlencode(DOL_URL_ROOT.'/expedition/card.php?id='.$object->origin_id).'">'.$langs->trans("Delete").'</a>';
 					} else {
-						print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=delete">'.$langs->trans("Delete").'</a>';
+						print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans("Delete").'</a>';
 					}
 				}
 
diff --git a/htdocs/loan/card.php b/htdocs/loan/card.php
index 157bdbd53b8..1c4116b34c2 100644
--- a/htdocs/loan/card.php
+++ b/htdocs/loan/card.php
@@ -752,13 +752,13 @@ if ($id > 0)
 				// Classify 'paid'
 				if (($object->paid == 0 || $object->paid == 2) && round($staytopay) <= 0 && $user->rights->loan->write)
 				{
-					print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/loan/card.php?id='.$object->id.'&amp;action=paid">'.$langs->trans("ClassifyPaid").'</a></div>';
+					print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/loan/card.php?id='.$object->id.'&amp;action=paid&amp;token='.newToken().'">'.$langs->trans("ClassifyPaid").'</a></div>';
 				}
 
 				// Delete
 				if (($object->paid == 0 || $object->paid == 2) && $user->rights->loan->delete)
 				{
-					print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.DOL_URL_ROOT.'/loan/card.php?id='.$object->id.'&amp;action=delete">'.$langs->trans("Delete").'</a></div>';
+					print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.DOL_URL_ROOT.'/loan/card.php?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans("Delete").'</a></div>';
 				}
 
 				print "</div>";
diff --git a/htdocs/loan/payment/card.php b/htdocs/loan/payment/card.php
index 9b4da35e5d1..51aa3f85a92 100644
--- a/htdocs/loan/payment/card.php
+++ b/htdocs/loan/payment/card.php
@@ -281,7 +281,7 @@ if (empty($action) && !empty($user->rights->loan->delete))
 {
 	if (!$disable_delete)
 	{
-		print '<a class="butActionDelete" href="card.php?id='.$id.'&amp;action=delete">'.$langs->trans('Delete').'</a>';
+		print '<a class="butActionDelete" href="card.php?id='.$id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>';
 	} else {
 		print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("CantRemovePaymentWithOneInvoicePaid")).'">'.$langs->trans('Delete').'</a>';
 	}
diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index 6cdf59a078a..69f985db0b9 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -373,7 +373,7 @@ if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && !empty($conf->gl
 	|| defined('CSRFCHECK_WITH_TOKEN'))	// Check validity of token, only if option MAIN_SECURITY_CSRF_WITH_TOKEN enabled or if constant CSRFCHECK_WITH_TOKEN is set
 {
 	// Check all cases that need a token (all POST actions, all actions and mass actions on pages with CSRFCHECK_WITH_TOKEN set, all sensitive GET actions)
-	if ($_SERVER['REQUEST_METHOD'] == 'POST' || ((GETPOSTISSET('action') || GETPOSTISSET('massaction')) && defined('CSRFCHECK_WITH_TOKEN')) || in_array(GETPOST('action', 'aZ09'), array('add', 'addtimespent', 'update', 'install', 'delete', 'deleteprof')))
+	if ($_SERVER['REQUEST_METHOD'] == 'POST' || ((GETPOSTISSET('action') || GETPOSTISSET('massaction')) && defined('CSRFCHECK_WITH_TOKEN')) || in_array(GETPOST('action', 'aZ09'), array('add', 'addtimespent', 'update', 'install', 'delete', 'deleteprof', 'deletepayment')))
 	{
 		if (!GETPOSTISSET('token')) {
 			dol_syslog("--- Access to ".$_SERVER["PHP_SELF"]." refused by CSRFCHECK_WITH_TOKEN protection. Token not provided.");
diff --git a/htdocs/modulebuilder/index.php b/htdocs/modulebuilder/index.php
index fd9fe7fa798..49d097ffc8a 100644
--- a/htdocs/modulebuilder/index.php
+++ b/htdocs/modulebuilder/index.php
@@ -2713,7 +2713,7 @@ if ($module == 'initmodule')
 									print '<td class="center">';
 									if ($propname != 'rowid')
 									{
-										print '<a href="'.$_SERVER["PHP_SELF"].'?action=deleteproperty&propertykey='.urlencode($propname).'&tab='.urlencode($tab).'&module='.urlencode($module).'&tabobj='.urlencode($tabobj).'">'.img_delete().'</a>';
+										print '<a href="'.$_SERVER["PHP_SELF"].'?action=deleteproperty&token='.newToken().'&propertykey='.urlencode($propname).'&tab='.urlencode($tab).'&module='.urlencode($module).'&tabobj='.urlencode($tabobj).'">'.img_delete().'</a>';
 									}
 									print '</td>';
 
diff --git a/htdocs/modulebuilder/template/myobject_card.php b/htdocs/modulebuilder/template/myobject_card.php
index d97bc8f7f35..49841fe24b9 100644
--- a/htdocs/modulebuilder/template/myobject_card.php
+++ b/htdocs/modulebuilder/template/myobject_card.php
@@ -521,7 +521,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 			// Delete (need delete permission, or if draft, just need create/modify permission)
 			if ($permissiontodelete || ($object->status == $object::STATUS_DRAFT && $permissiontoadd))
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>'."\n";
+				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>'."\n";
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotEnoughPermissions")).'">'.$langs->trans('Delete').'</a>'."\n";
 			}
diff --git a/htdocs/mrp/mo_card.php b/htdocs/mrp/mo_card.php
index 49b29b7048b..add7de31b56 100644
--- a/htdocs/mrp/mo_card.php
+++ b/htdocs/mrp/mo_card.php
@@ -656,7 +656,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
     		// Delete (need delete permission, or if draft, just need create/modify permission)
     		if ($permissiontodelete || ($object->status == $object::STATUS_DRAFT && $permissiontoadd))
     		{
-    			print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=delete">'.$langs->trans('Delete').'</a>'."\n";
+    			print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=delete&token='.newToken().'">'.$langs->trans('Delete').'</a>'."\n";
     		} else {
     			print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotEnoughPermissions")).'">'.$langs->trans('Delete').'</a>'."\n";
     		}
diff --git a/htdocs/opensurvey/card.php b/htdocs/opensurvey/card.php
index 2d714deeb2c..f5fa5a5ab78 100644
--- a/htdocs/opensurvey/card.php
+++ b/htdocs/opensurvey/card.php
@@ -371,7 +371,7 @@ if ($action != 'edit' && $user->rights->opensurvey->write) {
 	}
 
 	//Delete button
-	print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?suppressionsondage=1&id='.$numsondage.'&amp;action=delete">'.$langs->trans('Delete').'</a>';
+	print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?suppressionsondage=1&id='.$numsondage.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>';
 }
 
 print '</div>';
diff --git a/htdocs/product/admin/dynamic_prices.php b/htdocs/product/admin/dynamic_prices.php
index bc9f1048b4b..aafc36ca256 100644
--- a/htdocs/product/admin/dynamic_prices.php
+++ b/htdocs/product/admin/dynamic_prices.php
@@ -178,8 +178,8 @@ if ($action != 'create_updater' && $action != 'edit_updater')
 	        print '<td>'.$entry->code.'</td>';
 	        print '<td>'.$entry->description.'</td>';
 	        print '<td>'.price($entry->value).'</td>';
-	        print '<td class="right"><a href="'.$_SERVER["PHP_SELF"].'?action=edit_variable&selection='.$entry->id.'">'.img_edit().'</a> &nbsp;';
-	        print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete_variable&selection='.$entry->id.'">'.img_delete().'</a></td>';
+	        print '<td class="right"><a href="'.$_SERVER["PHP_SELF"].'?action=edit_variable&token='.newToken().'&selection='.$entry->id.'">'.img_edit().'</a> &nbsp;';
+	        print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete_variable&token='.newToken().'&selection='.$entry->id.'">'.img_delete().'</a></td>';
 	        print '</tr>';
 	    }
     } else {
@@ -270,7 +270,7 @@ if ($action != 'create_variable' && $action != 'edit_variable')
 	        print '<td>'.$entry->update_interval.'</td>';
 	        print '<td>'.$entry->getLastUpdated().'</td>';
 	        print '<td class="right"><a href="'.$_SERVER["PHP_SELF"].'?action=edit_updater&selection='.$entry->id.'">'.img_edit().'</a> &nbsp;';
-	        print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete_updater&selection='.$entry->id.'">'.img_delete().'</a></td>';
+	        print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete_updater&token='.newToken().'&selection='.$entry->id.'">'.img_delete().'</a></td>';
 	        print '</tr>';
 	    }
     } else {
@@ -284,7 +284,7 @@ if ($action != 'create_variable' && $action != 'edit_variable')
     {
         //Action Buttons
         print '<div class="tabsAction">';
-        print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=create_updater">'.$langs->trans("AddUpdater").'</a>';
+        print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?action=create_updater&token='.newToken().'">'.$langs->trans("AddUpdater").'</a>';
         print '</div>';
     }
 }
diff --git a/htdocs/product/card.php b/htdocs/product/card.php
index f86b94f314e..ce852876a3d 100644
--- a/htdocs/product/card.php
+++ b/htdocs/product/card.php
@@ -2238,7 +2238,7 @@ if ($action != 'create' && $action != 'edit')
 				{
 					print '<span id="action-delete" class="butActionDelete">'.$langs->trans('Delete').'</span>'."\n";
 				} else {
-					print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&amp;id='.$object->id.'">'.$langs->trans("Delete").'</a>';
+					print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?action=delete&amp;token='.newToken().'&amp;id='.$object->id.'">'.$langs->trans("Delete").'</a>';
 				}
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.$langs->trans("ProductIsUsed").'">'.$langs->trans("Delete").'</a>';
diff --git a/htdocs/product/dynamic_price/editor.php b/htdocs/product/dynamic_price/editor.php
index c0bbf8388a2..b59319ad985 100644
--- a/htdocs/product/dynamic_price/editor.php
+++ b/htdocs/product/dynamic_price/editor.php
@@ -206,7 +206,7 @@ if ($eid == 0)
 {
 	print '<div class="inline-block divButAction"><span id="action-delete" class="butActionRefused classfortooltip">'.$langs->trans('Delete').'</span></div>'."\n";
 } else {
-	print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$id.'&amp;tab='.$tab.'&amp;eid='.$eid.'&amp;action=delete">'.$langs->trans("Delete").'</a></div>';
+	print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$id.'&amp;tab='.$tab.'&amp;eid='.$eid.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans("Delete").'</a></div>';
 }
 print '</div>';
 
diff --git a/htdocs/product/inventory/card.php b/htdocs/product/inventory/card.php
index 3053cc45d71..f7dbc1f6410 100644
--- a/htdocs/product/inventory/card.php
+++ b/htdocs/product/inventory/card.php
@@ -425,7 +425,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 			// Delete (need delete permission, or if draft, just need create/modify permission)
 			if ($permissiontodelete || ($object->status == $object::STATUS_DRAFT && $permissiontoadd))
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>'."\n";
+				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>'."\n";
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotEnoughPermissions")).'">'.$langs->trans('Delete').'</a>'."\n";
 			}
diff --git a/htdocs/product/inventory/inventory.php b/htdocs/product/inventory/inventory.php
index 504f8419685..37f1cb9721a 100644
--- a/htdocs/product/inventory/inventory.php
+++ b/htdocs/product/inventory/inventory.php
@@ -512,7 +512,7 @@ if ($object->id > 0)
 			print '<input type="text" class="maxwidth75" name="id_'.$obj->rowid.' value="'.GETPOST("id_".$obj->rowid).'">';
 			print '</td>';
 			print '<td class="right">';
-			print '<a class="reposition" href="'.DOL_URL_ROOT.'/product/inventory/inventory.php?id='.$object->id.'&lineid='.$obj->rowid.'&action=deleteline">'.img_delete().'</a>';
+			print '<a class="reposition" href="'.DOL_URL_ROOT.'/product/inventory/inventory.php?id='.$object->id.'&lineid='.$obj->rowid.'&action=deleteline&token='.newToken().'">'.img_delete().'</a>';
 			print '</td>';
 
 			print '</tr>';
diff --git a/htdocs/product/price.php b/htdocs/product/price.php
index c73e43dc6f0..847292fa367 100644
--- a/htdocs/product/price.php
+++ b/htdocs/product/price.php
@@ -913,7 +913,7 @@ if (!empty($conf->global->PRODUIT_MULTIPRICES) || !empty($conf->global->PRODUIT_
 							if (($user->rights->produit->creer || $user->rights->service->creer)) {
 								print '<a class="editfielda marginleftonly marginrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=edit_price_by_qty&amp;rowid='.$prices["rowid"].'">';
 								print img_edit().'</a>';
-								print '<a class="marginleftonly marginrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete_price_by_qty&amp;rowid='.$prices["rowid"].'">';
+								print '<a class="marginleftonly marginrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete_price_by_qty&amp;token='.newToken().'&amp;rowid='.$prices["rowid"].'">';
 								print img_delete().'</a>';
 							} else {
 								print '&nbsp;';
@@ -1064,7 +1064,7 @@ if (!empty($conf->global->PRODUIT_MULTIPRICES) || !empty($conf->global->PRODUIT_
 					{
 						print '<a class="editfielda marginleftonly marginrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=edit_price_by_qty&amp;rowid='.$prices["rowid"].'">';
 						print img_edit().'</a>';
-						print '<a class="marginleftonly marginrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete_price_by_qty&amp;rowid='.$prices["rowid"].'">';
+						print '<a class="marginleftonly marginrightonly" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete_price_by_qty&amp;token='.newToken().'&amp;rowid='.$prices["rowid"].'">';
 						print img_delete().'</a>';
 					} else {
 						print '&nbsp;';
@@ -1591,7 +1591,7 @@ if ((empty($conf->global->PRODUIT_CUSTOMER_PRICES) || $action == 'showlog_defaul
     				print '<td class="right">';
     				if ($candelete)
     				{
-    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete&amp;id='.$object->id.'&amp;lineid='.$objp->rowid.'">';
+    					print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete&amp;token='.newToken().'&amp;id='.$object->id.'&amp;lineid='.$objp->rowid.'">';
     					print img_delete();
     					print '</a>';
     				} else print '&nbsp;'; // Can not delete last price (it's current price)
@@ -2148,7 +2148,7 @@ if (!empty($conf->global->PRODUIT_CUSTOMER_PRICES))
 					print img_edit('default', 0, 'style="vertical-align: middle;"');
 					print '</a>';
 					print ' ';
-					print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete_customer_price&amp;id='.$object->id.'&amp;lineid='.$line->id.'">';
+					print '<a href="'.$_SERVER["PHP_SELF"].'?action=delete_customer_price&amp;token='.newToken().'&amp;id='.$object->id.'&amp;lineid='.$line->id.'">';
 					print img_delete('default', 'style="vertical-align: middle;"');
 					print '</a>';
 					print '</td>';
diff --git a/htdocs/product/stock/card.php b/htdocs/product/stock/card.php
index 11aa5e860ae..81ae26390c9 100644
--- a/htdocs/product/stock/card.php
+++ b/htdocs/product/stock/card.php
@@ -485,13 +485,19 @@ if ($action == 'create')
 			{
 				if (empty($action))
 				{
-					if ($user->rights->stock->creer)
-						print "<a class=\"butAction\" href=\"card.php?action=edit&id=".$object->id."\">".$langs->trans("Modify")."</a>";
-					else print "<a class=\"butActionRefused classfortooltip\" href=\"#\">".$langs->trans("Modify")."</a>";
+					if ($user->rights->stock->creer) {
+						print '<a class="butAction" href="card.php?action=edit&token='.newToken().'&id='.$object->id.'">'.$langs->trans("Modify").'</a>';
+					}
+					else {
+						print '<a class="butActionRefused classfortooltip" href="#">'.$langs->trans("Modify").'</a>';
+					}
 
-					if ($user->rights->stock->supprimer)
-						print "<a class=\"butActionDelete\" href=\"card.php?action=delete&id=".$object->id."\">".$langs->trans("Delete")."</a>";
-					else print "<a class=\"butActionRefused classfortooltip\" href=\"#\">".$langs->trans("Delete")."</a>";
+					if ($user->rights->stock->supprimer) {
+						print '<a class="butActionDelete" href="card.php?action=delete&token='.newToken().'&id='.$object->id.'">'.$langs->trans("Delete").'</a>';
+					}
+					else {
+						print '<a class="butActionRefused classfortooltip" href="#">'.$langs->trans("Delete").'</a>';
+					}
 				}
 			}
 
diff --git a/htdocs/product/stock/product.php b/htdocs/product/stock/product.php
index 54d57bf5d75..64c23814ec2 100644
--- a/htdocs/product/stock/product.php
+++ b/htdocs/product/stock/product.php
@@ -1006,7 +1006,7 @@ if (!$variants) {
 				print '<td class="right">'.$line['seuil_stock_alerte'].'</td>';
 				print '<td class="right">'.$line['desiredstock'].'</td>';
 				if (!empty($user->rights->produit->creer)) {
-					print '<td class="right"><a href="?id='.$id.'&fk_productstockwarehouse='.$line['id'].'&action=delete_productstockwarehouse">'.img_delete().'</a></td>';
+					print '<td class="right"><a href="'.$_SERVER['PHP_SELF'].'?id='.$id.'&fk_productstockwarehouse='.$line['id'].'&action=delete_productstockwarehouse&token='.newToken().'">'.img_delete().'</a></td>';
 				}
 				print '</tr>';
 			}
diff --git a/htdocs/product/stock/productlot_card.php b/htdocs/product/stock/productlot_card.php
index bdc68f5c3e5..dbedba85d99 100644
--- a/htdocs/product/stock/productlot_card.php
+++ b/htdocs/product/stock/productlot_card.php
@@ -371,7 +371,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 
 		if ($user->rights->stock->supprimer)
 		{
-			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a></div>'."\n";
+			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a></div>'."\n";
 		}
 		*/
 	}
diff --git a/htdocs/product/traduction.php b/htdocs/product/traduction.php
index 502a15cd04e..c6a5d15a0b0 100644
--- a/htdocs/product/traduction.php
+++ b/htdocs/product/traduction.php
@@ -236,7 +236,7 @@ if ($action == 'edit')
 		foreach ($object->multilangs as $key => $value)
 		{
 			$s = picto_from_langcode($key);
-			print "<br>".($s ? $s.' ' : '')." <b>".$langs->trans('Language_'.$key).":</b> ".'<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=delete&langtodelete='.$key.'">'.img_delete('', 'class="valigntextbottom"')."</a><br>";
+			print "<br>".($s ? $s.' ' : '')." <b>".$langs->trans('Language_'.$key).":</b> ".'<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=delete&token='.newToken().'&langtodelete='.$key.'">'.img_delete('', 'class="valigntextbottom"')."</a><br>";
 
 			print '<div class="underbanner clearboth"></div>';
 			print '<table class="border centpercent">';
@@ -272,7 +272,7 @@ if ($action == 'edit')
 		foreach ($object->multilangs as $key => $value)
 		{
 			$s = picto_from_langcode($key);
-			print ($s ? $s.' ' : '')." <b>".$langs->trans('Language_'.$key).":</b> ".'<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=delete&langtodelete='.$key.'">'.img_delete('', 'class="valigntextbottom"').'</a>';
+			print ($s ? $s.' ' : '')." <b>".$langs->trans('Language_'.$key).":</b> ".'<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=delete&token='.newToken().'&langtodelete='.$key.'">'.img_delete('', 'class="valigntextbottom"').'</a>';
 
 			print '<div class="fichecenter">';
 			print '<div class="underbanner clearboth"></div>';
diff --git a/htdocs/projet/card.php b/htdocs/projet/card.php
index c1c59bcd3b7..db38e3c02d7 100644
--- a/htdocs/projet/card.php
+++ b/htdocs/projet/card.php
@@ -1324,7 +1324,7 @@ if ($action == 'create' && $user->rights->projet->creer)
 			{
 				if ($userDelete > 0 || ($object->statut == 0 && $user->rights->projet->creer))
 				{
-					print '<a class="butActionDelete" href="card.php?id='.$object->id.'&amp;action=delete">'.$langs->trans("Delete").'</a>';
+					print '<a class="butActionDelete" href="card.php?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans("Delete").'</a>';
 				} else {
 					print '<a class="butActionRefused classfortooltip" href="#" title="'.$langs->trans("NotOwnerOfProject").'">'.$langs->trans('Delete').'</a>';
 				}
diff --git a/htdocs/projet/tasks/contact.php b/htdocs/projet/tasks/contact.php
index 72e3a1bae32..313fec73721 100644
--- a/htdocs/projet/tasks/contact.php
+++ b/htdocs/projet/tasks/contact.php
@@ -518,7 +518,7 @@ if ($id > 0 || !empty($ref))
 				if ($user->rights->projet->creer)
 				{
 					print '&nbsp;';
-					print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deleteline&lineid='.$tab[$i]['rowid'].($withproject ? '&withproject=1' : '').'">';
+					print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=deleteline&token='.newToken().'&lineid='.$tab[$i]['rowid'].($withproject ? '&withproject=1' : '').'">';
 					print img_picto($langs->trans('Unlink'), 'unlink');
 					print '</a>';
 				}
diff --git a/htdocs/projet/tasks/task.php b/htdocs/projet/tasks/task.php
index 49e1a3e6866..096eb62d0d0 100644
--- a/htdocs/projet/tasks/task.php
+++ b/htdocs/projet/tasks/task.php
@@ -604,7 +604,7 @@ if ($id > 0 || !empty($ref))
 				{
 				    if (!$object->hasChildren() && !$object->hasTimeSpent())
 				    {
-						print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=delete&amp;withproject='.$withproject.'">'.$langs->trans('Delete').'</a>';
+						print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'&amp;withproject='.$withproject.'">'.$langs->trans('Delete').'</a>';
 				    } else {
 				        print '<a class="butActionRefused classfortooltip" href="#" title="'.$langs->trans("TaskHasChild").'">'.$langs->trans('Delete').'</a>';
 				    }
diff --git a/htdocs/projet/tasks/time.php b/htdocs/projet/tasks/time.php
index 4ded7e9d197..dfeb73bb3cc 100644
--- a/htdocs/projet/tasks/time.php
+++ b/htdocs/projet/tasks/time.php
@@ -1462,7 +1462,7 @@ if (($id > 0 || !empty($ref)) || $projectidforalltimes > 0)
 					print '</a>';
 
 					print '&nbsp;';
-					print '<a class="reposition paddingleft" href="'.$_SERVER["PHP_SELF"].'?id='.$task_time->fk_task.'&amp;action=deleteline&amp;lineid='.$task_time->rowid.$param.((empty($id) || $tab == 'timespent') ? '&tab=timespent' : '').'">';
+					print '<a class="reposition paddingleft" href="'.$_SERVER["PHP_SELF"].'?id='.$task_time->fk_task.'&amp;action=deletelin&amp;token='.newToken().'&amp;lineid='.$task_time->rowid.$param.((empty($id) || $tab == 'timespent') ? '&tab=timespent' : '').'">';
 					print img_delete('default', 'class="pictodelete paddingleft"');
 					print '</a>';
 
diff --git a/htdocs/reception/card.php b/htdocs/reception/card.php
index 0758e1456ce..d41ce8e6bf4 100644
--- a/htdocs/reception/card.php
+++ b/htdocs/reception/card.php
@@ -1909,10 +1909,10 @@ if ($action == 'create')
 			{
 				// edit-delete buttons
 				print '<td class="linecoledit center">';
-				print '<a class="editfielda" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=editline&amp;lineid='.$lines[$i]->id.'">'.img_edit().'</a>';
+				print '<a class="editfielda" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=editline&amp;token='.newToken().'&amp;lineid='.$lines[$i]->id.'">'.img_edit().'</a>';
 				print '</td>';
 				print '<td class="linecoldelete" width="10">';
-				print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=deleteline&amp;lineid='.$lines[$i]->id.'">'.img_delete().'</a>';
+				print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=deleteline&amp;token='.newToken().'&amp;lineid='.$lines[$i]->id.'">'.img_delete().'</a>';
 				print '</td>';
 
 				// Display lines extrafields
@@ -2035,7 +2035,7 @@ if ($action == 'create')
 
 			if ($user->rights->reception->supprimer)
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans("Delete").'</a>';
+				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans("Delete").'</a>';
 			}
 		}
 
diff --git a/htdocs/recruitment/recruitmentcandidature_card.php b/htdocs/recruitment/recruitmentcandidature_card.php
index 5e790c0b993..e25de998a36 100644
--- a/htdocs/recruitment/recruitmentcandidature_card.php
+++ b/htdocs/recruitment/recruitmentcandidature_card.php
@@ -543,7 +543,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 			// Delete (need delete permission, or if draft, just need create/modify permission)
 			if ($permissiontodelete || ($object->status == $object::STATUS_DRAFT && $permissiontoadd))
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>'."\n";
+				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>'."\n";
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotEnoughPermissions")).'">'.$langs->trans('Delete').'</a>'."\n";
 			}
diff --git a/htdocs/recruitment/recruitmentjobposition_candidature.php b/htdocs/recruitment/recruitmentjobposition_candidature.php
index 219bb3469f6..a945df25bfc 100644
--- a/htdocs/recruitment/recruitmentjobposition_candidature.php
+++ b/htdocs/recruitment/recruitmentjobposition_candidature.php
@@ -520,7 +520,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 			// Delete (need delete permission, or if draft, just need create/modify permission)
 			if ($permissiontodelete || ($object->status == $object::STATUS_DRAFT && $permissiontoadd))
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>'."\n";
+				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>'."\n";
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotEnoughPermissions")).'">'.$langs->trans('Delete').'</a>'."\n";
 			}
diff --git a/htdocs/recruitment/recruitmentjobposition_card.php b/htdocs/recruitment/recruitmentjobposition_card.php
index ee09413905d..d4a115962f2 100644
--- a/htdocs/recruitment/recruitmentjobposition_card.php
+++ b/htdocs/recruitment/recruitmentjobposition_card.php
@@ -544,7 +544,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 
 			// Delete (need delete permission, or if draft, just need create/modify permission)
 			if ($permissiontodelete || ($object->status == $object::STATUS_DRAFT && $permissiontoadd)) {
-				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>'."\n";
+				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>'."\n";
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotEnoughPermissions")).'">'.$langs->trans('Delete').'</a>'."\n";
 			}
diff --git a/htdocs/resource/card.php b/htdocs/resource/card.php
index b1fec3058c0..e170b038e7a 100644
--- a/htdocs/resource/card.php
+++ b/htdocs/resource/card.php
@@ -369,7 +369,7 @@ if ($action == 'create' || $object->fetch($id, $ref) > 0)
 		    if ($user->rights->resource->delete)
 		    {
 		        print '<div class="inline-block divButAction">';
-		        print '<a href="'.$_SERVER['PHP_SELF'].'?id='.$id.'&amp;action=delete" class="butActionDelete">'.$langs->trans('Delete').'</a>';
+		        print '<a href="'.$_SERVER['PHP_SELF'].'?id='.$id.'&amp;action=delete&amp;token='.newToken().'" class="butActionDelete">'.$langs->trans('Delete').'</a>';
 		        print '</div>';
 		    }
 		}
diff --git a/htdocs/resource/list.php b/htdocs/resource/list.php
index e2d10ffceef..a8a946e7578 100644
--- a/htdocs/resource/list.php
+++ b/htdocs/resource/list.php
@@ -269,11 +269,11 @@ if ($ret)
         include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_print_fields.tpl.php';
 
         print '<td class="center">';
-        print '<a class="editfielda" href="./card.php?action=edit&id='.$resource->id.'">';
+        print '<a class="editfielda" href="./card.php?action=edit&token='.newToken().'&id='.$resource->id.'">';
         print img_edit();
         print '</a>';
         print '&nbsp;';
-        print '<a href="./card.php?action=delete&id='.$resource->id.'">';
+        print '<a href="./card.php?action=delete&token='.newToken().'&id='.$resource->id.'">';
         print img_delete('', 'class="marginleftonly"');
         print '</a>';
         print '</td>';
diff --git a/htdocs/salaries/card.php b/htdocs/salaries/card.php
index 6a696aa4132..ec1184a77e6 100644
--- a/htdocs/salaries/card.php
+++ b/htdocs/salaries/card.php
@@ -484,7 +484,7 @@ if ($id)
 	{
 		if (!empty($user->rights->salaries->delete))
 		{
-			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=delete">'.$langs->trans("Delete").'</a></div>';
+			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=delete&token='.newToken().'">'.$langs->trans("Delete").'</a></div>';
 		} else {
 			print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#" title="'.(dol_escape_htmltag($langs->trans("NotAllowed"))).'">'.$langs->trans("Delete").'</a></div>';
 		}
diff --git a/htdocs/societe/canvas/company/tpl/card_view.tpl.php b/htdocs/societe/canvas/company/tpl/card_view.tpl.php
index d7f06763034..6591e38e1cb 100644
--- a/htdocs/societe/canvas/company/tpl/card_view.tpl.php
+++ b/htdocs/societe/canvas/company/tpl/card_view.tpl.php
@@ -246,7 +246,7 @@ for ($i = 1; $i <= 4; $i++) {
 	<?php if ($conf->use_javascript_ajax) { ?>
 		<span id="action-delete" class="butActionDelete"><?php echo $langs->trans('Delete'); ?></span>
 	<?php } else { ?>
-		<a class="butActionDelete" href="<?php echo $_SERVER["PHP_SELF"].'?socid='.$this->control->tpl['id'].'&amp;action=delete&amp;canvas='.$canvas; ?>"><?php echo $langs->trans('Delete'); ?></a>
+		<a class="butActionDelete" href="<?php echo $_SERVER["PHP_SELF"].'?socid='.$this->control->tpl['id'].'&amp;action=delete&amp;token='.newToken().'&amp;canvas='.$canvas; ?>"><?php echo $langs->trans('Delete'); ?></a>
 	<?php } ?>
 <?php } ?>
 </div>
diff --git a/htdocs/societe/canvas/individual/tpl/card_view.tpl.php b/htdocs/societe/canvas/individual/tpl/card_view.tpl.php
index 14c8822dc9e..a49dbcde698 100644
--- a/htdocs/societe/canvas/individual/tpl/card_view.tpl.php
+++ b/htdocs/societe/canvas/individual/tpl/card_view.tpl.php
@@ -189,7 +189,7 @@ if ($this->control->tpl['action_delete']) echo $this->control->tpl['action_delet
 	<?php if ($conf->use_javascript_ajax) { ?>
 		<span id="action-delete" class="butActionDelete"><?php echo $langs->trans('Delete'); ?></span>
 	<?php } else { ?>
-		<a class="butActionDelete" href="<?php echo $_SERVER["PHP_SELF"].'?socid='.$this->control->tpl['id'].'&amp;action=delete&amp;canvas='.$canvas; ?>"><?php echo $langs->trans('Delete'); ?></a>
+		<a class="butActionDelete" href="<?php echo $_SERVER["PHP_SELF"].'?socid='.$this->control->tpl['id'].'&amp;action=delete&amp;token='.newToken().'&amp;canvas='.$canvas; ?>"><?php echo $langs->trans('Delete'); ?></a>
 	<?php } ?>
 <?php } ?>
 </div>
diff --git a/htdocs/societe/card.php b/htdocs/societe/card.php
index 8104d40d201..9e6ad514da6 100644
--- a/htdocs/societe/card.php
+++ b/htdocs/societe/card.php
@@ -2657,7 +2657,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action))
 		            {
 		                print '<span id="action-delete" class="butActionDelete">'.$langs->trans('Delete').'</span>'."\n";
 		            } else {
-		                print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?socid='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>'."\n";
+		                print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?socid='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>'."\n";
 		            }
 		        }
 			}
diff --git a/htdocs/societe/notify/card.php b/htdocs/societe/notify/card.php
index 18cc536d6b8..ba1ea5d54a5 100644
--- a/htdocs/societe/notify/card.php
+++ b/htdocs/societe/notify/card.php
@@ -339,7 +339,7 @@ if ($result > 0)
             if ($obj->type == 'email') print $langs->trans("Email");
             if ($obj->type == 'sms') print $langs->trans("SMS");
             print '</td>';
-            print '<td class="right"><a href="card.php?socid='.$socid.'&action=delete&actid='.$obj->rowid.'">'.img_delete().'</a></td>';
+            print '<td class="right"><a href="card.php?socid='.$socid.'&action=delete&token='.newToken().'&actid='.$obj->rowid.'">'.img_delete().'</a></td>';
             print '</tr>';
             $i++;
         }
diff --git a/htdocs/societe/paymentmodes.php b/htdocs/societe/paymentmodes.php
index ed835dfd9a4..6adf32dd392 100644
--- a/htdocs/societe/paymentmodes.php
+++ b/htdocs/societe/paymentmodes.php
@@ -1094,11 +1094,11 @@ if ($socid && $action != 'edit' && $action != 'create' && $action != 'editcard'
 									print '<a href="'.$_SERVER['PHP_SELF'].'?action=synccardtostripe&socid='.$object->id.'&id='.$companypaymentmodetemp->id.'" class="paddingrightonly marginrightonly">'.$langs->trans("CreateCardOnStripe").'</a>';
 								}
 
-								print '<a class="editfielda marginleftonly marginrightonly" href="'.DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.$object->id.'&id='.$companypaymentmodetemp->id.'&action=editcard">';
+								print '<a class="editfielda marginleftonly marginrightonly" href="'.DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.$object->id.'&id='.$companypaymentmodetemp->id.'&action=editcard&token='.newToken().'">';
 								print img_picto($langs->trans("Modify"), 'edit');
 								print '</a>';
 								print '&nbsp;';
-								print '<a class="marginleftonly marginrightonly" href="'.DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.$object->id.'&id='.$companypaymentmodetemp->id.'&action=deletecard">'; // source='.$companypaymentmodetemp->stripe_card_ref.'&
+								print '<a class="marginleftonly marginrightonly" href="'.DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.$object->id.'&id='.$companypaymentmodetemp->id.'&action=deletecard&token='.newToken().'">'; // source='.$companypaymentmodetemp->stripe_card_ref.'&
 								print img_picto($langs->trans("Delete"), 'delete');
 								print '</a>';
 							}
@@ -1248,7 +1248,7 @@ if ($socid && $action != 'edit' && $action != 'create' && $action != 'editcard'
 				print '<td class="right nowraponall">';
 				if ($user->rights->societe->creer)
 				{
-					print '<a href="'.DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.$object->id.'&source='.$src->id.'&action=deletecard">';
+					print '<a href="'.DOL_URL_ROOT.'/societe/paymentmodes.php?socid='.$object->id.'&source='.$src->id.'&action=deletecard&token='.newToken().'">';
 					print img_picto($langs->trans("Delete"), 'delete');
 					print '</a>';
 				}
@@ -1492,7 +1492,7 @@ if ($socid && $action != 'edit' && $action != 'create' && $action != 'editcard'
 				print img_picto($langs->trans("Modify"), 'edit');
 				print '</a>';
 
-		   		print '<a class="marginleftonly" href="'.$_SERVER["PHP_SELF"].'?socid='.$object->id.'&id='.$rib->id.'&action=delete">';
+		   		print '<a class="marginleftonly" href="'.$_SERVER["PHP_SELF"].'?socid='.$object->id.'&id='.$rib->id.'&action=delete&token='.newToken().'">';
 		   		print img_picto($langs->trans("Delete"), 'delete');
 		   		print '</a>';
 			}
diff --git a/htdocs/societe/price.php b/htdocs/societe/price.php
index 8fb17a59e3f..4a709fb9009 100644
--- a/htdocs/societe/price.php
+++ b/htdocs/societe/price.php
@@ -593,7 +593,7 @@ if (!empty($conf->global->PRODUIT_CUSTOMER_PRICES)) {
                     print img_edit('default', 0, 'style="vertical-align: middle;"');
                     print '</a>';
                     print ' ';
-                    print '<a class="paddingleftonly paddingrightonly" href="'.$_SERVER["PHP_SELF"].'?action=delete_customer_price&amp;socid='.$object->id.'&amp;lineid='.$line->id.'">';
+                    print '<a class="paddingleftonly paddingrightonly" href="'.$_SERVER["PHP_SELF"].'?action=delete_customer_price&amp;token='.newToken().'&amp;socid='.$object->id.'&amp;lineid='.$line->id.'">';
                     print img_delete('default', 'style="vertical-align: middle;"');
                     print '</a>';
                     print '</td>';
diff --git a/htdocs/supplier_proposal/card.php b/htdocs/supplier_proposal/card.php
index 1e884629791..1190b29aa3c 100644
--- a/htdocs/supplier_proposal/card.php
+++ b/htdocs/supplier_proposal/card.php
@@ -1902,7 +1902,7 @@ if ($action == 'create')
 
 				// Delete
 				if (($object->statut == SupplierProposal::STATUS_DRAFT && $usercancreate) || $usercandelete) {
-					print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete"';
+					print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'"';
 					print '>'.$langs->trans('Delete').'</a></div>';
 				}
 			}
diff --git a/htdocs/takepos/index.php b/htdocs/takepos/index.php
index bcc56ff0166..66212ab3203 100644
--- a/htdocs/takepos/index.php
+++ b/htdocs/takepos/index.php
@@ -432,7 +432,7 @@ function ChangeThirdparty(idcustomer) {
 
 function deleteline() {
 	console.log("Delete line");
-	$("#poslines").load("invoice.php?action=deleteline&place="+place+"&idline="+selectedline, function() {
+	$("#poslines").load("invoice.php?action=deleteline&token=<?php echo newToken(); ?>&place="+place+"&idline="+selectedline, function() {
 		//$('#poslines').scrollTop($('#poslines')[0].scrollHeight);
 	});
 	ClearSearch();
@@ -499,7 +499,7 @@ function New() {
 
 		if (r == true) {
 			// Reload section with invoice lines
-			$("#poslines").load("invoice.php?action=delete&place=" + place, function () {
+			$("#poslines").load("invoice.php?action=delete&token=<?php echo newToken(); ?>&place=" + place, function () {
 				//$('#poslines').scrollTop($('#poslines')[0].scrollHeight);
 			});
 			ClearSearch();
diff --git a/htdocs/takepos/phone.php b/htdocs/takepos/phone.php
index 119752014a1..14ca718740b 100644
--- a/htdocs/takepos/phone.php
+++ b/htdocs/takepos/phone.php
@@ -250,7 +250,7 @@ function SetQty(place, selectedline, qty){
 	if (defined('INCLUDE_PHONEPAGE_FROM_PUBLIC_PAGE')) {
 		?>
 	if (qty==0){
-		$("#phonediv2").load("auto_order.php?mobilepage=invoice&action=deleteline&place="+place+"&idline="+selectedline, function() {
+		$("#phonediv2").load("auto_order.php?mobilepage=invoice&action=deleteline&token=<?php echo newToken(); ?>&place="+place+"&idline="+selectedline, function() {
 		});
 	}
 	else{
@@ -262,7 +262,7 @@ function SetQty(place, selectedline, qty){
 	else {
 		?>
 	if (qty==0){
-		$("#phonediv2").load("invoice.php?mobilepage=invoice&action=deleteline&place="+place+"&idline="+selectedline, function() {
+		$("#phonediv2").load("invoice.php?mobilepage=invoice&action=deleteline&token=<?php echo newToken(); ?>&place="+place+"&idline="+selectedline, function() {
 		});
 	}
 	else{
@@ -271,7 +271,7 @@ function SetQty(place, selectedline, qty){
 	}
 		<?php
 	}
-	?>	
+	?>
 	LoadCats();
 }
 
diff --git a/htdocs/ticket/card.php b/htdocs/ticket/card.php
index 03e9fe52781..1719013bdf5 100644
--- a/htdocs/ticket/card.php
+++ b/htdocs/ticket/card.php
@@ -1265,7 +1265,7 @@ elseif (empty($action) || $action == 'view' || $action == 'addlink' || $action =
 
 				// Delete ticket
 				if ($user->rights->ticket->delete && !$user->socid) {
-					print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?track_id='.$object->track_id.'&action=delete">'.$langs->trans('Delete').'</a></div>';
+					print '<div class="inline-block divButAction"><a class="butActionDelete" href="card.php?track_id='.$object->track_id.'&action=delete&token='.newToken().'">'.$langs->trans('Delete').'</a></div>';
 				}
 			}
 			print '</div>'."\n";
diff --git a/htdocs/user/card.php b/htdocs/user/card.php
index 96b9d55af6a..f989e231f60 100644
--- a/htdocs/user/card.php
+++ b/htdocs/user/card.php
@@ -1898,7 +1898,7 @@ if ($action == 'create' || $action == 'adduserldap')
 				{
 					if ($user->admin || !$object->admin) // If user edited is admin, delete is possible on for an admin
 					{
-						print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&amp;id='.$object->id.'">'.$langs->trans("DeleteUser").'</a></div>';
+						print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&amp;token='.newToken().'&amp;id='.$object->id.'">'.$langs->trans("DeleteUser").'</a></div>';
 					} else {
 						print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("MustBeAdminToDeleteOtherAdmin")).'">'.$langs->trans("DeleteUser").'</a></div>';
 					}
diff --git a/htdocs/user/group/card.php b/htdocs/user/group/card.php
index febdf3373fe..e8ffbd7c1f7 100644
--- a/htdocs/user/group/card.php
+++ b/htdocs/user/group/card.php
@@ -385,12 +385,12 @@ else {
 
 			if ($caneditperms)
 			{
-				print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=edit">'.$langs->trans("Modify").'</a>';
+				print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=edit&amp;token='.newToken().'">'.$langs->trans("Modify").'</a>';
 			}
 
 			if ($candisableperms)
 			{
-				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&amp;id='.$object->id.'">'.$langs->trans("DeleteGroup").'</a>';
+				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&amp;id='.$object->id.'&amp;token='.newToken().'">'.$langs->trans("DeleteGroup").'</a>';
 			}
 
 			print "</div>\n";
diff --git a/htdocs/user/notify/card.php b/htdocs/user/notify/card.php
index bc07dc0270d..ca90e7f60e9 100644
--- a/htdocs/user/notify/card.php
+++ b/htdocs/user/notify/card.php
@@ -313,7 +313,7 @@ if ($result > 0)
             if ($obj->type == 'email') print $langs->trans("Email");
             if ($obj->type == 'sms') print $langs->trans("SMS");
             print '</td>';
-            print '<td class="right"><a href="card.php?id='.$id.'&amp;action=delete&amp;actid='.$obj->rowid.'">'.img_delete().'</a></td>';
+            print '<td class="right"><a href="card.php?id='.$id.'&amp;action=delete&amp;token='.newToken().'&amp;actid='.$obj->rowid.'">'.img_delete().'</a></td>';
             print '</tr>';
             $i++;
         }
diff --git a/htdocs/variants/card.php b/htdocs/variants/card.php
index 13b7408fc93..c1bbc6fe6e2 100644
--- a/htdocs/variants/card.php
+++ b/htdocs/variants/card.php
@@ -219,8 +219,8 @@ if ($action == 'edit') {
 
 	<div class="tabsAction">
 		<div class="inline-block divButAction">
-			<a href="card.php?id=<?php echo $object->id ?>&action=edit" class="butAction"><?php echo $langs->trans('Modify') ?></a>
-			<a href="card.php?id=<?php echo $object->id ?>&action=delete" class="butAction"><?php echo $langs->trans('Delete') ?></a>
+			<a href="card.php?id=<?php echo $object->id ?>&action=edit&token=<?php echo newToken(); ?>" class="butAction"><?php echo $langs->trans('Modify') ?></a>
+			<a href="card.php?id=<?php echo $object->id ?>&action=delete&token=<?php echo newToken(); ?>" class="butAction"><?php echo $langs->trans('Delete') ?></a>
 		</div>
 	</div>
 
@@ -263,7 +263,7 @@ if ($action == 'edit') {
 				<td><?php echo dol_htmlentities($attrval->value) ?></td>
 				<td class="right">
 					<a class="editfielda marginrightonly" href="card.php?id=<?php echo $object->id ?>&action=edit_value&valueid=<?php echo $attrval->id ?>"><?php echo img_edit() ?></a>
-					<a href="card.php?id=<?php echo $object->id ?>&action=delete_value&valueid=<?php echo $attrval->id ?>"><?php echo img_delete() ?></a>
+					<a href="card.php?id=<?php echo $object->id ?>&action=delete_value&token=<?php echo newToken(); ?>&valueid=<?php echo $attrval->id ?>"><?php echo img_delete() ?></a>
 				</td>
 			<?php
 		}
diff --git a/htdocs/variants/combinations.php b/htdocs/variants/combinations.php
index 31dc07b6bad..c9835440103 100644
--- a/htdocs/variants/combinations.php
+++ b/htdocs/variants/combinations.php
@@ -871,7 +871,7 @@ if (!empty($id) || !empty($ref))
 				print '<td class="center">'.$prodstatic->getLibStatut(2, 1).'</td>';
 				print '<td class="right">';
 				print '<a class="paddingleft paddingright editfielda" href="'.$_SERVER["PHP_SELF"].'?id='.$id.'&action=edit&valueid='.$currcomb->id.'">'.img_edit().'</a>';
-				print '<a class="paddingleft paddingright" href="'.$_SERVER["PHP_SELF"].'?id='.$id.'&action=delete&valueid='.$currcomb->id.'">'.img_delete().'</a>';
+				print '<a class="paddingleft paddingright" href="'.$_SERVER["PHP_SELF"].'?id='.$id.'&action=delete&token='.newToken().'&valueid='.$currcomb->id.'">'.img_delete().'</a>';
 				print '</td>';
 				print '<td class="nowrap center">';
 				if ($productCombinations || $massactionbutton || $massaction)   // If we are in select mode (massactionbutton defined) or if we have already selected and sent an action ($massaction) defined
diff --git a/htdocs/variants/list.php b/htdocs/variants/list.php
index 971533bdd25..7973553f6d0 100644
--- a/htdocs/variants/list.php
+++ b/htdocs/variants/list.php
@@ -126,7 +126,7 @@ foreach ($variants as $key => $attribute) {
 	print '<td class="right">'.$attribute->countChildProducts().'</td>';
 	print '<td class="right">';
 	print '<a class="editfielda marginrightonly paddingleftonly" href="card.php?id='.$attribute->id.'&action=edit">'.img_edit().'</a>';
-	print '<a class="marginrightonly paddingleftonlyhref="card.php?id='.$attribute->id.'&action=delete">'.img_delete().'</a>';
+	print '<a class="marginrightonly paddingleftonlyhref="card.php?id='.$attribute->id.'&action=delete&token='.newToken().'">'.img_delete().'</a>';
 	print '</td>';
 	print '<td class="center linecolmove tdlineupdown">';
 	if ($key > 0) {
diff --git a/htdocs/website/websiteaccount_card.php b/htdocs/website/websiteaccount_card.php
index c1057935e31..403128a0f8b 100644
--- a/htdocs/website/websiteaccount_card.php
+++ b/htdocs/website/websiteaccount_card.php
@@ -331,7 +331,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 
     		if ($user->rights->website->delete)
     		{
-    			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a></div>'."\n";
+    			print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a></div>'."\n";
     		}
     	}
     	print '</div>'."\n";
diff --git a/htdocs/zapier/hook_card.php b/htdocs/zapier/hook_card.php
index efb02395e7b..721b40ebfd9 100644
--- a/htdocs/zapier/hook_card.php
+++ b/htdocs/zapier/hook_card.php
@@ -353,7 +353,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
     		*/
 
     		if ($user->rights->mymodule->delete) {
-    			print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>'."\n";
+    			print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete&amp;token='.newToken().'">'.$langs->trans('Delete').'</a>'."\n";
     		} else {
     			print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("NotEnoughPermissions")).'">'.$langs->trans('Delete').'</a>'."\n";
     		}

From c1bb03e56d869887287a8842a67fe31f52c56e89 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 10:58:43 +0200
Subject: [PATCH 082/101] Doc

---
 ChangeLog | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 9e0b301edde..62f28b9bd6e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -13,16 +13,17 @@ WARNING:
 
 Following changes may create regressions for some external modules, but were necessary to make Dolibarr better:
 * Properties ->contactid has been renamed into ->contact_id
-* Property $paiementid in API api_supplier_invoices has been renamed into into $payment_mode_id (english)
+* Property $paiementid in API 'api_supplier_invoices.php' has been renamed into into $payment_mode_id (english)
 * The deprecated subsitution key __SIGNATURE__ has been removed. Replace with __USER_SIGNATURE__ if you used the old syntax in
   your email templates. 
 * The hidden option HOLIDAY_MORE_PUBLIC_HOLIDAYS has been removed. Use instead the dictionary table if you need to define custom
   days of holiday.
-* Property num_paiement has been renamed num_payment everywhere for better code consistency.
-* If you build a class that implement CommonObject to use the incoterm properties or method (->fk_incoterm, ->label_incoterm, ->location_incoterm),
-  you must now also include declaration of the Trait CommonIncoterm in your class. All incoterm functions were moved into this Trait. 
-* The GETPOST(..., 'alpha') has now the same behaviour than GETPOST(..., 'alphanohtml');
-
+* Property 'num_paiement' has been renamed 'num_payment' everywhere for better code consistency.
+* If you build a class that implement CommonObject to use the incoterm properties or methods (->fk_incoterm, ->label_incoterm, ->location_incoterm),
+  you must now also include declaration of the Trait 'CommonIncoterm' in your class. All incoterm functions were moved into this Trait. 
+* The GETPOST(..., 'alpha') has now the same behaviour than GETPOST(..., 'alphanohtml') so no html will be allowed. Use GETPOST(..., 'restricthtml') to accept HTML.
+* If you have links in your code with '&action=delete' as a parameter, you must also add '&token='.newToken() as another parameter to avoid CSRF protection errors.
+ 
 
 ***** ChangeLog for 12.0.3 compared to 12.0.2 *****
 FIX: 10.0 - when the mime file name is different from the filesystem name, the attachment name should be the mime filename

From 298e94e574f7fccf08c47b487037b2bc08c867f4 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 11:16:43 +0200
Subject: [PATCH 083/101] Typo

---
 htdocs/langs/en_US/receiptprinter.lang | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/langs/en_US/receiptprinter.lang b/htdocs/langs/en_US/receiptprinter.lang
index 83a003f388d..284c4fa61fa 100644
--- a/htdocs/langs/en_US/receiptprinter.lang
+++ b/htdocs/langs/en_US/receiptprinter.lang
@@ -54,7 +54,7 @@ DOL_DOUBLE_WIDTH=Double width size
 DOL_DEFAULT_HEIGHT_WIDTH=Default height and width size
 DOL_UNDERLINE=Enable underline
 DOL_UNDERLINE_DISABLED=Disable underline
-DOL_BEEP=Beed sound
+DOL_BEEP=Beep sound
 DOL_PRINT_TEXT=Print text
 DateInvoiceWithTime=Invoice date and time
 YearInvoice=Invoice year

From 676d70d86dc71aa9b878b8b6c437eafafaff2086 Mon Sep 17 00:00:00 2001
From: ptibogxiv <support@ptibogxiv.net>
Date: Thu, 1 Oct 2020 12:14:50 +0200
Subject: [PATCH 084/101] FIX stripe for connect mode

---
 htdocs/public/stripe/ipn.php | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/htdocs/public/stripe/ipn.php b/htdocs/public/stripe/ipn.php
index 4291cb6f834..16160e94200 100644
--- a/htdocs/public/stripe/ipn.php
+++ b/htdocs/public/stripe/ipn.php
@@ -1,6 +1,6 @@
 <?php
-/* Copyright (C) 2018       Thibault FOUCART        <support@ptibogxiv.net>
- * Copyright (C) 2018       Frédéric France         <frederic.france@netlogic.fr>
+/* Copyright (C) 2018-2020      Thibault FOUCART        <support@ptibogxiv.net>
+ * Copyright (C) 2018       	Frédéric France         <frederic.france@netlogic.fr>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -115,7 +115,7 @@ if (!empty($conf->multicompany->enabled) && !empty($conf->stripeconnect->enabled
 {
 	$sql = "SELECT entity";
 	$sql .= " FROM ".MAIN_DB_PREFIX."oauth_token";
-	$sql .= " WHERE service = '".$db->escape($service)."' and tokenstring = '%".$db->escape($event->account)."%'";
+	$sql .= " WHERE service = '".$db->escape($service)."' and tokenstring LIKE '%".$db->escape($event->account)."%'";
 
 	dol_syslog(get_class($db)."::fetch", LOG_DEBUG);
 	$result = $db->query($sql);
@@ -134,8 +134,6 @@ if (!empty($conf->multicompany->enabled) && !empty($conf->stripeconnect->enabled
 		$key = 1;
 	}
 	$ret = $mc->switchEntity($key);
-	if (!$res && file_exists("../../main.inc.php")) $res = @include "../../main.inc.php";
-	if (!$res) die("Include of main fails");
 }
 
 // list of  action

From 3f78d8fe258f43d3e4716663f86d8b291b78e9b4 Mon Sep 17 00:00:00 2001
From: ptibogxiv <support@ptibogxiv.net>
Date: Thu, 1 Oct 2020 12:19:12 +0200
Subject: [PATCH 085/101] Update stripe.class.php

---
 htdocs/stripe/class/stripe.class.php | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/htdocs/stripe/class/stripe.class.php b/htdocs/stripe/class/stripe.class.php
index a72e5291f58..2ac8193a71e 100644
--- a/htdocs/stripe/class/stripe.class.php
+++ b/htdocs/stripe/class/stripe.class.php
@@ -90,15 +90,12 @@ class Stripe extends CommonObject
 		global $conf;
 
 		$sql = "SELECT tokenstring";
-		$sql .= " FROM ".MAIN_DB_PREFIX."oauth_token";
-		$sql .= " WHERE entity = ".$conf->entity;
-		$sql .= " AND service = '".$mode."'";
+		$sql .= " FROM ".MAIN_DB_PREFIX."oauth_token WHERE";
+		if (empty($fk_soc)) $sql .= " entity = ".$conf->entity. " AND";
+		$sql .= " service = '".$mode."'";
 		if ($fk_soc > 0) {
 			$sql .= " AND fk_soc = ".$fk_soc;
 		}
-		else {
-			$sql .= " AND fk_soc IS NULL";
-		}
 		$sql .= " AND fk_user IS NULL AND fk_adherent IS NULL";
 
 		dol_syslog(get_class($this)."::fetch", LOG_DEBUG);

From 4e16db1e5f71dfe1f2ca416f222ed24a2b5dea83 Mon Sep 17 00:00:00 2001
From: ptibogxiv <support@ptibogxiv.net>
Date: Thu, 1 Oct 2020 12:22:53 +0200
Subject: [PATCH 086/101] Update paymentmodes.php

---
 htdocs/societe/paymentmodes.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/societe/paymentmodes.php b/htdocs/societe/paymentmodes.php
index b29a3073c85..5894c3245a9 100644
--- a/htdocs/societe/paymentmodes.php
+++ b/htdocs/societe/paymentmodes.php
@@ -1329,7 +1329,7 @@ if ($socid && $action != 'edit' && $action != 'create' && $action != 'editcard'
 	}
 
   	// List of Stripe payment modes
-	if (!empty($conf->stripe->enabled) && !empty($conf->stripeconnect->enabled) && $object->fournisseur && !empty($stripesupplieracc))
+	if (!empty($conf->stripe->enabled) && !empty($conf->stripeconnect->enabled) && !empty($stripesupplieracc))
 	{
         print load_fiche_titre($langs->trans('StripeBalance').($stripesupplieracc ? ' (Stripe connection with StripeConnect account '.$stripesupplieracc.')' : ' (Stripe connection with keys from Stripe module setup)'), $morehtmlright, 'stripe-s');
         $balance = \Stripe\Balance::retrieve(array("stripe_account" => $stripesupplieracc));

From a890b2d7ad3464187f042cd5bdb8f793c272bc2e Mon Sep 17 00:00:00 2001
From: Christian Foellmann <foellmann@foe-services.de>
Date: Thu, 1 Oct 2020 12:31:00 +0200
Subject: [PATCH 087/101] handle fk_origin for stock movement for users the
 core way

---
 htdocs/product/stock/class/mouvementstock.class.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/htdocs/product/stock/class/mouvementstock.class.php b/htdocs/product/stock/class/mouvementstock.class.php
index 534b9300158..0252e6a17ce 100644
--- a/htdocs/product/stock/class/mouvementstock.class.php
+++ b/htdocs/product/stock/class/mouvementstock.class.php
@@ -1002,6 +1002,10 @@ class MouvementStock extends CommonObject
 				require_once DOL_DOCUMENT_ROOT.'/mrp/class/mo.class.php';
 				$origin = new Mo($this->db);
 				break;
+			case 'user':
+				require_once DOL_DOCUMENT_ROOT.'/user/class/user.class.php';
+				$origin = new User($this->db);
+				break;
 
 			default:
 				if ($origintype)

From c89f8b323b256e4c12fe6063c8f92c9d6394c073 Mon Sep 17 00:00:00 2001
From: Florian <florian@inovea-conseil.com>
Date: Thu, 1 Oct 2020 15:18:19 +0200
Subject: [PATCH 088/101] Rename fk_typeobject to type_object

---
 htdocs/install/mysql/migration/12.0.0-13.0.0.sql |  2 +-
 htdocs/install/mysql/tables/llx_website_page.sql |  2 +-
 htdocs/website/class/websitepage.class.php       | 12 ++++++------
 htdocs/website/index.php                         |  4 ++--
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/htdocs/install/mysql/migration/12.0.0-13.0.0.sql b/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
index e177d53d6cc..cae368aea21 100644
--- a/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
+++ b/htdocs/install/mysql/migration/12.0.0-13.0.0.sql
@@ -331,5 +331,5 @@ ALTER TABLE llx_bank ADD COLUMN import_key varchar(14);
 
 ALTER TABLE llx_menu MODIFY COLUMN enabled text;
 
-ALTER TABLE llx_website_page ADD COLUMN fk_typeobject varchar(255);
+ALTER TABLE llx_website_page ADD COLUMN object_type varchar(255);
 ALTER TABLE llx_website_page ADD COLUMN fk_object varchar(255);
diff --git a/htdocs/install/mysql/tables/llx_website_page.sql b/htdocs/install/mysql/tables/llx_website_page.sql
index ec2d6f4c72b..e2bec4a8a24 100644
--- a/htdocs/install/mysql/tables/llx_website_page.sql
+++ b/htdocs/install/mysql/tables/llx_website_page.sql
@@ -40,6 +40,6 @@ CREATE TABLE llx_website_page
     date_creation datetime,
 	tms           timestamp,
     import_key    varchar(14),      -- import key
-    fk_typeobject varchar(255),
+    object_type varchar(255),
     fk_object     varchar(255)
 ) ENGINE=innodb;
diff --git a/htdocs/website/class/websitepage.class.php b/htdocs/website/class/websitepage.class.php
index aa256960f0f..8e9584a86ac 100644
--- a/htdocs/website/class/websitepage.class.php
+++ b/htdocs/website/class/websitepage.class.php
@@ -108,7 +108,7 @@ class WebsitePage extends CommonObject
    	/**
      * @var string path of external object
      */
-    public $fk_typeobject;
+    public $object_type;
 
     /**
      * @var string id of external object
@@ -171,7 +171,7 @@ class WebsitePage extends CommonObject
 		'fk_user_modif'  =>array('type'=>'integer', 'label'=>'UserModif', 'enabled'=>1, 'visible'=>-1, 'position'=>512),
 		//'fk_user_valid' =>array('type'=>'integer',      'label'=>'UserValidation',        'enabled'=>1, 'visible'=>-1, 'position'=>512),
 		'import_key'     =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>-1, 'index'=>1, 'position'=>1000, 'notnull'=>-1),
-		'fk_typeobject' => array('type' => 'varchar(255)','label' => 'ObjectType', 'enabled'=>1, 'visible'=>1, 'position'=>46, 'searchall'=>0, 'help'=>''),
+		'object_type' => array('type' => 'varchar(255)','label' => 'ObjectType', 'enabled'=>1, 'visible'=>1, 'position'=>46, 'searchall'=>0, 'help'=>''),
 	    'fk_object' => array('type' => 'varchar(255)','label' => 'ObjectId', 'enabled'=>1, 'visible'=>1, 'position'=>47, 'searchall'=>0, 'help'=>'')
 	);
 	// END MODULEBUILDER PROPERTIES
@@ -273,7 +273,7 @@ class WebsitePage extends CommonObject
 		$sql .= " t.author_alias,";
 		$sql .= " t.fk_user_modif,";
 		$sql .= " t.import_key,";
-		$sql .= " t.fk_typeobject,";
+		$sql .= " t.object_type,";
         $sql .= " t.fk_object";
 		$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' as t';
 		//$sql .= ' WHERE entity IN ('.getEntity('website').')';       // entity is on website level
@@ -333,7 +333,7 @@ class WebsitePage extends CommonObject
 				$this->author_alias = $obj->author_alias;
 				$this->fk_user_modif = $obj->fk_user_modif;
 				$this->import_key = $obj->import_key;
-				$this->fk_typeobject = $obj->fk_typeobject;
+				$this->object_type = $obj->object_type;
                 $this->fk_object = $obj->fk_object;
 			}
 			$this->db->free($resql);
@@ -391,7 +391,7 @@ class WebsitePage extends CommonObject
 		$sql .= " t.author_alias,";
 		$sql .= " t.fk_user_modif,";
 		$sql .= " t.import_key,";
-		$sql .= " t.fk_typeobject,";
+		$sql .= " t.object_type,";
         $sql .= " t.fk_object";
 		$sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' as t';
 		$sql .= ' WHERE t.fk_website = '.$websiteid;
@@ -461,7 +461,7 @@ class WebsitePage extends CommonObject
 				$record->author_alias = $obj->author_alias;
 				$record->fk_user_modif = $obj->fk_user_modif;
 				$record->import_key = $obj->import_key;
-				$record->fk_typeobject = $obj->fk_typeobject;
+				$record->object_type = $obj->object_type;
 				$record->fk_object = $obj->fk_object;
 				//var_dump($record->id);
 				$records[$record->id] = $record;
diff --git a/htdocs/website/index.php b/htdocs/website/index.php
index 29dd6c44929..db859573707 100644
--- a/htdocs/website/index.php
+++ b/htdocs/website/index.php
@@ -942,7 +942,7 @@ if ($action == 'addcontainer')
 		$objectpage->keywords = str_replace(array('<', '>'), '', GETPOST('WEBSITE_KEYWORDS', 'alphanohtml'));
 		$objectpage->htmlheader = GETPOST('htmlheader', 'none');
 		$objectpage->author_alias = GETPOST('WEBSITE_AUTHORALIAS', 'alphanohtml');
-		$objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTCLASS');
+		$objectpage->object_type = GETPOST('WEBSITE_OBJECTCLASS');
 		$objectpage->fk_object = GETPOST('WEBSITE_OBJECTID');
 		$substitutionarray = array();
 		$substitutionarray['__WEBSITE_CREATE_BY__'] = $user->getFullName($langs);
@@ -1659,7 +1659,7 @@ if ($action == 'updatemeta')
 		$objectpage->htmlheader = trim(GETPOST('htmlheader', 'none'));
 		$objectpage->fk_page = (GETPOST('pageidfortranslation', 'int') > 0 ? GETPOST('pageidfortranslation', 'int') : 0);
 		$objectpage->author_alias = trim(GETPOST('WEBSITE_AUTHORALIAS', 'alphanohtml'));
-		$objectpage->fk_typeobject = GETPOST('WEBSITE_OBJECTCLASS', 'alpha');
+		$objectpage->object_type = GETPOST('WEBSITE_OBJECTCLASS', 'alpha');
         $objectpage->fk_object = GETPOST('WEBSITE_OBJECTID', 'aZ09');
 
 		$newdatecreation = dol_mktime(GETPOST('datecreationhour', 'int'), GETPOST('datecreationmin', 'int'), GETPOST('datecreationsec', 'int'), GETPOST('datecreationmonth', 'int'), GETPOST('datecreationday', 'int'), GETPOST('datecreationyear', 'int'));

From b258a848e29dc91c2e57aa7a82895bb41a50d56c Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 16:21:07 +0200
Subject: [PATCH 089/101] NEW Can enable/disable users in bulk actions

---
 htdocs/core/actions_massactions.inc.php       |   2 +-
 .../modulebuilder/template/myobject_list.php  |   1 -
 htdocs/user/card.php                          |   1 +
 htdocs/user/list.php                          | 314 ++++++++++++++----
 4 files changed, 249 insertions(+), 69 deletions(-)

diff --git a/htdocs/core/actions_massactions.inc.php b/htdocs/core/actions_massactions.inc.php
index 98e936a2d7a..2bdae583429 100644
--- a/htdocs/core/actions_massactions.inc.php
+++ b/htdocs/core/actions_massactions.inc.php
@@ -3,7 +3,7 @@
  * Copyright (C) 2018	   Nicolas ZABOURI	<info@inovea-conseil.com>
  * Copyright (C) 2018 	   Juanjo Menent  <jmenent@2byte.es>
  * Copyright (C) 2019 	   Ferran Marcet  <fmarcet@2byte.es>
- * Copyright (C) 2019       Frédéric France         <frederic.france@netlogic.fr>
+ * Copyright (C) 2019      Frédéric France         <frederic.france@netlogic.fr>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/htdocs/modulebuilder/template/myobject_list.php b/htdocs/modulebuilder/template/myobject_list.php
index 3fc5032bced..e79128e1657 100644
--- a/htdocs/modulebuilder/template/myobject_list.php
+++ b/htdocs/modulebuilder/template/myobject_list.php
@@ -379,7 +379,6 @@ print '<input type="hidden" name="formfilteraction" id="formfilteraction" value=
 print '<input type="hidden" name="action" value="list">';
 print '<input type="hidden" name="sortfield" value="'.$sortfield.'">';
 print '<input type="hidden" name="sortorder" value="'.$sortorder.'">';
-//print '<input type="hidden" name="page" value="'.$page.'">';
 print '<input type="hidden" name="contextpage" value="'.$contextpage.'">';
 
 $newcardbutton = dolGetButtonTitle($langs->trans('New'), '', 'fa fa-plus-circle', dol_buildpath('/mymodule/myobject_card.php', 1).'?action=create&backtopage='.urlencode($_SERVER['PHP_SELF']), '', $permissiontoadd);
diff --git a/htdocs/user/card.php b/htdocs/user/card.php
index f989e231f60..95a60804cfb 100644
--- a/htdocs/user/card.php
+++ b/htdocs/user/card.php
@@ -117,6 +117,7 @@ $hookmanager->initHooks(array('usercard', 'globalcard'));
 /**
  * Actions
  */
+
 $parameters = array('id' => $id, 'socid' => $socid, 'group' => $group, 'caneditgroup' => $caneditgroup);
 $reshook = $hookmanager->executeHooks('doActions', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks
 if ($reshook < 0) setEventMessages($hookmanager->error, $hookmanager->errors, 'errors');
diff --git a/htdocs/user/list.php b/htdocs/user/list.php
index 406401bdf38..d5d928f7c79 100644
--- a/htdocs/user/list.php
+++ b/htdocs/user/list.php
@@ -38,7 +38,15 @@ if (!$user->rights->user->user->lire && !$user->admin) {
 // Load translation files required by page
 $langs->loadLangs(array('users', 'companies', 'hrm'));
 
+$action     = GETPOST('action', 'aZ09') ?GETPOST('action', 'aZ09') : 'view'; // The action 'add', 'create', 'edit', 'update', 'view', ...
+$massaction = GETPOST('massaction', 'alpha'); // The bulk action (combo box choice into lists)
+$show_files = GETPOST('show_files', 'int'); // Show files area generated by bulk actions ?
+$confirm    = GETPOST('confirm', 'alpha'); // Result of a confirmation
+$cancel     = GETPOST('cancel', 'alpha'); // We click on a Cancel button
+$toselect   = GETPOST('toselect', 'array'); // Array of ids of elements selected into a list
 $contextpage = GETPOST('contextpage', 'aZ') ?GETPOST('contextpage', 'aZ') : 'userlist'; // To manage different context of search
+$backtopage = GETPOST('backtopage', 'alpha'); // Go back to a dedicated page
+$optioncss  = GETPOST('optioncss', 'aZ'); // Option for the css output (always '' except when 'print')
 
 // Security check (for external users)
 $socid = 0;
@@ -54,25 +62,33 @@ $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
 $sortfield = GETPOST('sortfield', 'aZ09comma');
 $sortorder = GETPOST('sortorder', 'aZ09comma');
 $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
-if (empty($page) || $page == -1) { $page = 0; }
+if (empty($page) || $page < 0 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha')) { $page = 0; }     // If $page is not defined, or '' or -1 or if we click on clear filters
 $offset = $limit * $page;
 $pageprev = $page - 1;
 $pagenext = $page + 1;
-if (!$sortfield) $sortfield = "u.login";
-if (!$sortorder) $sortorder = "ASC";
-
-// Define value to know what current user can do on users
-$canadduser = (!empty($user->admin) || $user->rights->user->user->creer);
 
 // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
 $object = new User($db);
-$hookmanager->initHooks(array('userlist'));
 $extrafields = new ExtraFields($db);
+$diroutputmassaction = $conf->mymodule->dir_output.'/temp/massgeneration/'.$user->id;
+$hookmanager->initHooks(array('userlist'));
 
-// fetch optionals attributes and labels
+// Fetch optionals attributes and labels
 $extrafields->fetch_name_optionals_label($object->table_element);
+
 $search_array_options = $extrafields->getOptionalsFromPost($object->table_element, '', 'search_');
 
+if (!$sortfield) $sortfield = "u.login";
+if (!$sortorder) $sortorder = "ASC";
+
+// Initialize array of search criterias
+$search_all = GETPOST('search_all', 'alphanohtml') ? GETPOST('search_all', 'alphanohtml') : GETPOST('sall', 'alphanohtml');
+$search = array();
+foreach ($object->fields as $key => $val)
+{
+	if (GETPOST('search_'.$key, 'alpha') !== '') $search[$key] = GETPOST('search_'.$key, 'alpha');
+}
+
 $userstatic = new User($db);
 $companystatic = new Societe($db);
 $form = new Form($db);
@@ -115,8 +131,16 @@ if (is_array($extrafields->attributes[$object->table_element]['label']) && count
 {
 	foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val)
 	{
-		if (!empty($extrafields->attributes[$object->table_element]['list'][$key]))
-			$arrayfields["ef.".$key] = array('label'=>$extrafields->attributes[$object->table_element]['label'][$key], 'checked'=>(($extrafields->attributes[$object->table_element]['list'][$key] < 0) ? 0 : 1), 'position'=>$extrafields->attributes[$object->table_element]['pos'][$key], 'enabled'=>(abs($extrafields->attributes[$object->table_element]['list'][$key]) != 3 && $extrafields->attributes[$object->table_element]['perms'][$key]));
+		if (!empty($extrafields->attributes[$object->table_element]['list'][$key])) {
+			$arrayfields["ef.".$key] = array(
+				'label'=>$extrafields->attributes[$object->table_element]['label'][$key],
+				'checked'=>(($extrafields->attributes[$object->table_element]['list'][$key] < 0) ? 0 : 1),
+				'position'=>$extrafields->attributes[$object->table_element]['pos'][$key],
+				'enabled'=>(abs($extrafields->attributes[$object->table_element]['list'][$key]) != 3 && $extrafields->attributes[$object->table_element]['perms'][$key]),
+				'langfile'=>$extrafields->attributes[$object->table_element]['langfile'][$key],
+				'help'=>$extrafields->attributes[$object->table_element]['help'][$key]
+			);
+		}
 	}
 }
 $object->fields = dol_sort_array($object->fields, 'position');
@@ -144,6 +168,20 @@ $catid = GETPOST('catid', 'int');
 if ($search_statut == '') $search_statut = '1';
 if ($mode == 'employee' && !GETPOSTISSET('search_employee')) $search_employee = 1;
 
+// Define value to know what current user can do on users
+$permissiontoadd = (!empty($user->admin) || $user->rights->user->user->creer);
+$canreaduser = (!empty($user->admin) || $user->rights->user->user->lire);
+$canedituser = (!empty($user->admin) || $user->rights->user->user->creer);
+$candisableuser = (!empty($user->admin) || $user->rights->user->user->supprimer);
+$canreadgroup = $canreaduser;
+$caneditgroup = $canedituser;
+if (!empty($conf->global->MAIN_USE_ADVANCED_PERMS))
+{
+	$canreadgroup = (!empty($user->admin) || $user->rights->user->group_advance->read);
+	$caneditgroup = (!empty($user->admin) || $user->rights->user->group_advance->write);
+}
+
+$error = 0;
 
 
 /*
@@ -154,7 +192,7 @@ if (GETPOST('cancel', 'alpha')) { $action = 'list'; $massaction = ''; }
 if (!GETPOST('confirmmassaction', 'alpha') && $massaction != 'presend' && $massaction != 'confirm_presend' && $massaction != 'confirm_createbills') { $massaction = ''; }
 
 $parameters = array();
-$reshook = $hookmanager->executeHooks('doActions', $parameters); // Note that $action and $object may have been modified by some hooks
+$reshook = $hookmanager->executeHooks('doActions', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks
 if ($reshook < 0) setEventMessages($hookmanager->error, $hookmanager->errors, 'errors');
 
 if (empty($reshook))
@@ -184,6 +222,72 @@ if (empty($reshook))
 		$search_array_options = array();
         $search_categ = 0;
 	}
+
+	// Mass actions
+	$objectclass = 'User';
+	$objectlabel = 'User';
+	$uploaddir = $conf->user->dir_output;
+	include DOL_DOCUMENT_ROOT.'/core/actions_massactions.inc.php';
+
+	// Disable or Enable records
+	if (!$error && ($massaction == 'disable' || $massaction == 'reactivate') && $permissiontoadd)
+	{
+		$objecttmp = new User($db);
+
+		if (!$error)
+		{
+			$db->begin();
+
+			$nbok = 0;
+			foreach ($toselect as $toselectid)
+			{
+				if ($toselectid == $user->id) {
+					setEventMessages($langs->trans($massaction == 0 ? 'CantDisableYourself' : 'CanEnableYourself'), null, 'errors');
+					$error++;
+					break;
+				}
+
+				$result = $objecttmp->fetch($toselectid);
+				if ($result > 0) {
+					if ($objecttmp->admin) {
+						setEventMessages($langs->trans($massaction == 0 ? 'CantDisableAnAdminUserWithMassActions' : 'CantEnableAnAdminUserWithMassActions', $objecttmp->login), null, 'errors');
+						$error++;
+						break;
+					}
+
+					$result = $objecttmp->setstatus($massaction == 'disable' ? 0 : 1);
+					if ($result == 0) {
+						// Nothing is done
+					} elseif ($result < 0) {
+						setEventMessages($objecttmp->error, $objecttmp->errors, 'errors');
+						$error++;
+						break;
+					} else $nbok++;
+				} else {
+					setEventMessages($objecttmp->error, $objecttmp->errors, 'errors');
+					$error++;
+					break;
+				}
+			}
+
+			if (!$error && !empty($conf->file->main_limit_users)) {
+				$nb = $object->getNbOfUsers("active");
+				if ($nb >= $conf->file->main_limit_users) {
+					$error++;
+					setEventMessages($langs->trans("YourQuotaOfUsersIsReached"), null, 'errors');
+				}
+			}
+
+			if (!$error)
+			{
+				if ($nbok > 1) setEventMessages($langs->trans("RecordsModified", $nbok), null, 'mesgs');
+				else setEventMessages($langs->trans("RecordsModified", $nbok), null, 'mesgs');
+				$db->commit();
+			} else {
+				$db->rollback();
+			}
+		}
+	}
 }
 
 
@@ -191,7 +295,11 @@ if (empty($reshook))
  * View
  */
 
-$htmlother = new FormOther($db);
+$formother = new FormOther($db);
+
+//$help_url="EN:Module_MyObject|FR:Module_MyObject_FR|ES:Módulo_MyObject";
+$help_url = '';
+$text = $langs->trans("ListOfUsers");
 
 $user2 = new User($db);
 
@@ -203,11 +311,13 @@ $sql .= " u2.rowid as id2, u2.login as login2, u2.firstname as firstname2, u2.la
 $sql .= " s.nom as name, s.canvas";
 // Add fields from extrafields
 if (!empty($extrafields->attributes[$object->table_element]['label'])) {
-	foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : '');
+	foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key.', ' : '');
 }
 // Add fields from hooks
 $parameters = array();
 $reshook = $hookmanager->executeHooks('printFieldListSelect', $parameters); // Note that $action and $object may have been modified by hook
+$sql .= preg_replace('/^,/', '', $hookmanager->resPrint);
+$sql = preg_replace('/,\s*$/', '', $sql);
 $sql .= $hookmanager->resPrint;
 $sql .= " FROM ".MAIN_DB_PREFIX."user as u";
 if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label'])) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX.$object->table_element."_extrafields as ef on (u.rowid = ef.fk_object)";
@@ -246,29 +356,41 @@ if ($search_categ == -2) $sql .= " AND cu.fk_categorie IS NULL";
 include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_sql.tpl.php';
 // Add where from hooks
 $parameters = array();
-$reshook = $hookmanager->executeHooks('printFieldListWhere', $parameters); // Note that $action and $object may have been modified by hook
+$reshook = $hookmanager->executeHooks('printFieldListWhere', $parameters, $object); // Note that $action and $object may have been modified by hook
 $sql .= $hookmanager->resPrint;
 $sql .= $db->order($sortfield, $sortorder);
 
-$nbtotalofrecords = 0;
-$result = $db->query($sql);
-if ($result)
+// Count total nb of records
+$nbtotalofrecords = '';
+if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST))
 {
-	$nbtotalofrecords = $db->num_rows($result);
+	$resql = $db->query($sql);
+	$nbtotalofrecords = $db->num_rows($resql);
+	if (($page * $limit) > $nbtotalofrecords)	// if total of record found is smaller than page * limit, goto and load page 0
+	{
+		$page = 0;
+		$offset = 0;
+	}
+}
+// if total of record found is smaller than limit, no need to do paging and to restart another select with limits set.
+if (is_numeric($nbtotalofrecords) && ($limit > $nbtotalofrecords || empty($limit)))
+{
+	$num = $nbtotalofrecords;
+} else {
+	if ($limit) $sql .= $db->plimit($limit + 1, $offset);
+
+	$resql = $db->query($sql);
+	if (!$resql)
+	{
+		dol_print_error($db);
+		exit;
+	}
+
+	$num = $db->num_rows($resql);
 }
 
-$sql .= $db->plimit($limit + 1, $offset);
-
-$result = $db->query($sql);
-if (!$result)
-{
-	dol_print_error($db);
-	exit;
-}
-
-$num = $db->num_rows($result);
-
-if ($num == 1 && !empty($conf->global->MAIN_SEARCH_DIRECT_OPEN_IF_ONLY_ONE) && $sall)
+// Direct jump if only one record found
+if ($num == 1 && !empty($conf->global->MAIN_SEARCH_DIRECT_OPEN_IF_ONLY_ONE) && $search_all && !$page)
 {
 	$obj = $db->fetch_object($resql);
 	$id = $obj->rowid;
@@ -276,7 +398,10 @@ if ($num == 1 && !empty($conf->global->MAIN_SEARCH_DIRECT_OPEN_IF_ONLY_ONE) && $
 	exit;
 }
 
-llxHeader('', $langs->trans("ListOfUsers"));
+// Output page
+// --------------------------------------------------------------------
+
+llxHeader('', $langs->trans("ListOfUsers"), $help_url);
 
 $param = '';
 if (!empty($contextpage) && $contextpage != $_SERVER["PHP_SELF"]) $param .= '&amp;contextpage='.urlencode($contextpage);
@@ -299,11 +424,14 @@ if ($search_categ > 0) $param .= "&amp;search_categ=".urlencode($search_categ);
 // Add $param from extra fields
 include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_param.tpl.php';
 
-$text = $langs->trans("ListOfUsers");
+// List of mass actions available
+$arrayofmassactions = array();
+if ($permissiontoadd) $arrayofmassactions['disable'] = $langs->trans("DisableUser");
+if ($permissiontoadd) $arrayofmassactions['reactivate'] = $langs->trans("Reactivate");
+//if ($permissiontodelete) $arrayofmassactions['predelete'] = '<span class="fa fa-trash paddingrightonly"></span>'.$langs->trans("Delete");
 
-$url = DOL_URL_ROOT.'/user/card.php?action=create'.($mode == 'employee' ? '&employee=1' : '').'&leftmenu=';
-if (!empty($socid)) $url .= '&socid='.$socid;
-$newcardbutton = dolGetButtonTitle($langs->trans('NewUser'), '', 'fa fa-plus-circle', $url, '', $canadduser);
+if (GETPOST('nomassaction', 'int') || in_array($massaction, array('presend', 'predelete'))) $arrayofmassactions = array();
+$massactionbutton = $form->selectMassAction('', $arrayofmassactions);
 
 print '<form method="POST" id="searchFormList" action="'.$_SERVER["PHP_SELF"].'">'."\n";
 if ($optioncss != '') print '<input type="hidden" name="optioncss" value="'.$optioncss.'">';
@@ -314,12 +442,24 @@ print '<input type="hidden" name="sortorder" value="'.$sortorder.'">';
 print '<input type="hidden" name="mode" value="'.$mode.'">';
 print '<input type="hidden" name="contextpage" value="'.$contextpage.'">';
 
+$url = DOL_URL_ROOT.'/user/card.php?action=create'.($mode == 'employee' ? '&employee=1' : '').'&leftmenu=';
+if (!empty($socid)) $url .= '&socid='.$socid;
+
+$newcardbutton = dolGetButtonTitle($langs->trans('NewUser'), '', 'fa fa-plus-circle', $url, '', $permissiontoadd);
+
 $param = array('morecss'=>'btnTitleSelected');
 $morehtmlright .= dolGetButtonTitle($langs->trans("List"), '', 'fa fa-list paddingleft imgforviewmode', DOL_URL_ROOT.'/user/list.php'.(($search_statut != '' && $search_statut >= 0) ? '?search_statut='.$search_statut : ''), '', 1, $param);
 $param = array('morecss'=>'marginleftonly');
 $morehtmlright .= dolGetButtonTitle($langs->trans("HierarchicView"), '', 'fa fa-stream paddingleft imgforviewmode', DOL_URL_ROOT.'/user/hierarchy.php'.(($search_statut != '' && $search_statut >= 0) ? '?search_statut='.$search_statut : ''), '', 1, $param);
 
-print_barre_liste($text, $page, $_SERVER["PHP_SELF"], $param, $sortfield, $sortorder, "", $num, $nbtotalofrecords, 'user', 0, $morehtmlright.' '.$newcardbutton, '', $limit, 0, 0, 1);
+print_barre_liste($text, $page, $_SERVER["PHP_SELF"], $param, $sortfield, $sortorder, $massactionbutton, $num, $nbtotalofrecords, 'user', 0, $morehtmlright.' '.$newcardbutton, '', $limit, 0, 0, 1);
+
+// Add code for pre mass action (confirmation or email presend form)
+$topicmail = "SendUserRef";
+$modelmail = "user";
+$objecttmp = new User($db);
+$trackid = 'use'.$object->id;
+include DOL_DOCUMENT_ROOT.'/core/tpl/massactions_pre.tpl.php';
 
 if (!empty($catid))
 {
@@ -330,29 +470,32 @@ if (!empty($catid))
     print "</div><br>";
 }
 
-if ($sall)
+if ($search_all)
 {
 	foreach ($fieldstosearchall as $key => $val) $fieldstosearchall[$key] = $langs->trans($val);
-	print '<div class="divsearchfieldfilter">'.$langs->trans("FilterOnInto", $sall).join(', ', $fieldstosearchall).'</div>';
+	print '<div class="divsearchfieldfilter">'.$langs->trans("FilterOnInto", $search_all).join(', ', $fieldstosearchall).'</div>';
 }
 
 $moreforfilter = '';
+/*$moreforfilter.='<div class="divsearchfield">';
+ $moreforfilter.= $langs->trans('MyFilter') . ': <input type="text" name="search_myfield" value="'.dol_escape_htmltag($search_myfield).'">';
+ $moreforfilter.= '</div>';*/
 
 // Filter on categories
 if (!empty($conf->categorie->enabled))
 {
     $moreforfilter .= '<div class="divsearchfield">';
     $moreforfilter .= $langs->trans('Categories').': ';
-    $moreforfilter .= $htmlother->select_categories(Categorie::TYPE_USER, $search_categ, 'search_categ', 1);
+    $moreforfilter .= $formother->select_categories(Categorie::TYPE_USER, $search_categ, 'search_categ', 1);
     $moreforfilter .= '</div>';
 }
 
 $parameters = array();
-$reshook = $hookmanager->executeHooks('printFieldPreListTitle', $parameters); // Note that $action and $object may have been modified by hook
+$reshook = $hookmanager->executeHooks('printFieldPreListTitle', $parameters, $object); // Note that $action and $object may have been modified by hook
 if (empty($reshook)) $moreforfilter .= $hookmanager->resPrint;
 else $moreforfilter = $hookmanager->resPrint;
 
-if ($moreforfilter)
+if (!empty($moreforfilter))
 {
     print '<div class="liste_titre liste_titre_bydiv centpercent">';
     print $moreforfilter;
@@ -360,14 +503,14 @@ if ($moreforfilter)
 }
 
 $varpage = empty($contextpage) ? $_SERVER["PHP_SELF"] : $contextpage;
-
 $selectedfields = $form->multiSelectArrayWithCheckbox('selectedfields', $arrayfields, $varpage); // This also change content of $arrayfields
+$selectedfields .= (count($arrayofmassactions) ? $form->showCheckAddButtons('checkforselect', 1) : '');
 
+print '<div class="div-table-responsive">'; // You can use div-table-responsive-no-min if you dont need reserved height for your table
+print '<table class="tagtable nobottomiftotal liste'.($moreforfilter ? " listwithfilterbefore" : "").'">'."\n";
 
-print '<div class="div-table-responsive">';
-print '<table class="tagtable liste'.($moreforfilter ? " listwithfilterbefore" : "").'">'."\n";
-
-// Search bar
+// Fields title search
+// --------------------------------------------------------------------
 print '<tr class="liste_titre_filter">';
 if (!empty($arrayfields['u.login']['checked']))
 {
@@ -433,7 +576,7 @@ if (!empty($arrayfields['u.datepreviouslogin']['checked']))
 include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_input.tpl.php';
 // Fields from hook
 $parameters = array('arrayfields'=>$arrayfields);
-$reshook = $hookmanager->executeHooks('printFieldListOption', $parameters); // Note that $action and $object may have been modified by hook
+$reshook = $hookmanager->executeHooks('printFieldListOption', $parameters, $object); // Note that $action and $object may have been modified by hook
 print $hookmanager->resPrint;
 if (!empty($arrayfields['u.datec']['checked']))
 {
@@ -456,11 +599,10 @@ if (!empty($arrayfields['u.statut']['checked']))
 }
 // Action column
 print '<td class="liste_titre maxwidthsearch">';
-$searchpicto = $form->showFilterAndCheckAddButtons(0);
+$searchpicto = $form->showFilterButtons();
 print $searchpicto;
 print '</td>';
-
-print "</tr>\n";
+print '</tr>'."\n";
 
 
 print '<tr class="liste_titre">';
@@ -481,21 +623,38 @@ if (!empty($arrayfields['u.datepreviouslogin']['checked'])) print_liste_field_ti
 include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_title.tpl.php';
 // Hook fields
 $parameters = array('arrayfields'=>$arrayfields, 'param'=>$param, 'sortfield'=>$sortfield, 'sortorder'=>$sortorder);
-$reshook = $hookmanager->executeHooks('printFieldListTitle', $parameters); // Note that $action and $object may have been modified by hook
+$reshook = $hookmanager->executeHooks('printFieldListTitle', $parameters, $object); // Note that $action and $object may have been modified by hook
 print $hookmanager->resPrint;
 if (!empty($arrayfields['u.datec']['checked']))  print_liste_field_titre("DateCreationShort", $_SERVER["PHP_SELF"], "u.datec", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
 if (!empty($arrayfields['u.tms']['checked']))    print_liste_field_titre("DateModificationShort", $_SERVER["PHP_SELF"], "u.tms", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
 if (!empty($arrayfields['u.statut']['checked'])) print_liste_field_titre("Status", $_SERVER["PHP_SELF"], "u.statut", "", $param, '', $sortfield, $sortorder, 'center ');
-print_liste_field_titre($selectedfields, $_SERVER["PHP_SELF"], "", '', '', '', $sortfield, $sortorder, 'center maxwidthsearch ');
-print "</tr>\n";
+// Action column
+print getTitleFieldOfList($selectedfields, 0, $_SERVER["PHP_SELF"], '', '', '', '', $sortfield, $sortorder, 'center maxwidthsearch ')."\n";
+print '</tr>'."\n";
 
 
+// Detect if we need a fetch on each output line
+$needToFetchEachLine = 0;
+if (is_array($extrafields->attributes[$object->table_element]['computed']) && count($extrafields->attributes[$object->table_element]['computed']) > 0)
+{
+	foreach ($extrafields->attributes[$object->table_element]['computed'] as $key => $val)
+	{
+		if (preg_match('/\$object/', $val)) $needToFetchEachLine++; // There is at least one compute field that use $object
+	}
+}
 
+
+// Loop on record
+// --------------------------------------------------------------------
 $i = 0;
 $totalarray = array();
-while ($i < min($num, $limit))
+while ($i < ($limit ? min($num, $limit) : $num))
 {
-	$obj = $db->fetch_object($result);
+	$obj = $db->fetch_object($resql);
+	if (empty($obj)) break; // Should not happen
+
+	// Store properties in $object
+	$object->setVarsFromFetchObj($obj);
 
 	$userstatic->id = $obj->rowid;
 	$userstatic->admin = $obj->admin;
@@ -512,7 +671,7 @@ while ($i < min($num, $limit))
 
 	$li = $userstatic->getNomUrl(-1, '', 0, 0, 24, 1, 'login', '', 1);
 
-	print "<tr>";
+	print '<tr class="oddeven">';
 	if (!empty($arrayfields['u.login']['checked']))
 	{
 		print '<td class="nowraponall">';
@@ -529,12 +688,12 @@ while ($i < min($num, $limit))
 	}
 	if (!empty($arrayfields['u.lastname']['checked']))
 	{
-		  print '<td>'.$obj->lastname.'</td>';
+		  print '<td class="tdoverflowmax150">'.$obj->lastname.'</td>';
 		if (!$i) $totalarray['nbfield']++;
 	}
 	if (!empty($arrayfields['u.firstname']['checked']))
 	{
-	    print '<td>'.$obj->firstname.'</td>';
+	    print '<td class="tdoverflowmax150">'.$obj->firstname.'</td>';
 		if (!$i) $totalarray['nbfield']++;
 	}
 	if (!empty($arrayfields['u.gender']['checked']))
@@ -645,8 +804,8 @@ while ($i < min($num, $limit))
 	// Extra fields
 	include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_print_fields.tpl.php';
 	// Fields from hook
-	$parameters = array('arrayfields'=>$arrayfields, 'obj'=>$obj, 'i'=>$i, 'totalarray'=>&$totalarray);
-	$reshook = $hookmanager->executeHooks('printFieldListValue', $parameters); // Note that $action and $object may have been modified by hook
+	$parameters = array('arrayfields'=>$arrayfields, 'object'=>$object, 'obj'=>$obj, 'i'=>$i, 'totalarray'=>&$totalarray);
+	$reshook = $hookmanager->executeHooks('printFieldListValue', $parameters, $object); // Note that $action and $object may have been modified by hook
 	print $hookmanager->resPrint;
 	// Date creation
 	if (!empty($arrayfields['u.datec']['checked']))
@@ -672,23 +831,44 @@ while ($i < min($num, $limit))
 	    if (!$i) $totalarray['nbfield']++;
 	}
 	// Action column
-	print '<td></td>';
+	print '<td class="nowrap center">';
+	if ($massactionbutton || $massaction)   // If we are in select mode (massactionbutton defined) or if we have already selected and sent an action ($massaction) defined
+	{
+		$selected = 0;
+		if (in_array($object->id, $arrayofselected)) $selected = 1;
+		print '<input id="cb'.$object->id.'" class="flat checkforselect" type="checkbox" name="toselect[]" value="'.$object->id.'"'.($selected ? ' checked="checked"' : '').'>';
+	}
+	print '</td>';
 	if (!$i) $totalarray['nbfield']++;
 
-	print "</tr>\n";
+	print '</tr>'."\n";
 
 	$i++;
 }
 
+// Show total line
+include DOL_DOCUMENT_ROOT.'/core/tpl/list_print_total.tpl.php';
+
+// If no record found
+if ($num == 0)
+{
+	$colspan = 1;
+	foreach ($arrayfields as $key => $val) { if (!empty($val['checked'])) $colspan++; }
+	print '<tr><td colspan="'.$colspan.'" class="opacitymedium">'.$langs->trans("NoRecordFound").'</td></tr>';
+}
+
+
+$db->free($resql);
+
 $parameters = array('arrayfields'=>$arrayfields, 'sql'=>$sql);
-$reshook = $hookmanager->executeHooks('printFieldListFooter', $parameters); // Note that $action and $object may have been modified by hook
+$reshook = $hookmanager->executeHooks('printFieldListFooter', $parameters, $object); // Note that $action and $object may have been modified by hook
 print $hookmanager->resPrint;
 
-print "</table>";
-print '</div>';
-print "</form>\n";
+print '</table>'."\n";
+print '</div>'."\n";
+
+print '</form>'."\n";
 
-$db->free($result);
 
 // End of page
 llxFooter();

From 8bfc2bed3eb214668dcdbcc04ad8299fdbcbf6d4 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 16:27:17 +0200
Subject: [PATCH 090/101] Fix navigation into user list

---
 htdocs/user/list.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/htdocs/user/list.php b/htdocs/user/list.php
index d5d928f7c79..0bed08c3c31 100644
--- a/htdocs/user/list.php
+++ b/htdocs/user/list.php
@@ -447,10 +447,10 @@ if (!empty($socid)) $url .= '&socid='.$socid;
 
 $newcardbutton = dolGetButtonTitle($langs->trans('NewUser'), '', 'fa fa-plus-circle', $url, '', $permissiontoadd);
 
-$param = array('morecss'=>'btnTitleSelected');
-$morehtmlright .= dolGetButtonTitle($langs->trans("List"), '', 'fa fa-list paddingleft imgforviewmode', DOL_URL_ROOT.'/user/list.php'.(($search_statut != '' && $search_statut >= 0) ? '?search_statut='.$search_statut : ''), '', 1, $param);
-$param = array('morecss'=>'marginleftonly');
-$morehtmlright .= dolGetButtonTitle($langs->trans("HierarchicView"), '', 'fa fa-stream paddingleft imgforviewmode', DOL_URL_ROOT.'/user/hierarchy.php'.(($search_statut != '' && $search_statut >= 0) ? '?search_statut='.$search_statut : ''), '', 1, $param);
+$moreparam = array('morecss'=>'btnTitleSelected');
+$morehtmlright .= dolGetButtonTitle($langs->trans("List"), '', 'fa fa-list paddingleft imgforviewmode', DOL_URL_ROOT.'/user/list.php'.(($search_statut != '' && $search_statut >= 0) ? '?search_statut='.$search_statut : ''), '', 1, $moreparam);
+$moreparam = array('morecss'=>'marginleftonly');
+$morehtmlright .= dolGetButtonTitle($langs->trans("HierarchicView"), '', 'fa fa-stream paddingleft imgforviewmode', DOL_URL_ROOT.'/user/hierarchy.php'.(($search_statut != '' && $search_statut >= 0) ? '?search_statut='.$search_statut : ''), '', 1, $moreparam);
 
 print_barre_liste($text, $page, $_SERVER["PHP_SELF"], $param, $sortfield, $sortorder, $massactionbutton, $num, $nbtotalofrecords, 'user', 0, $morehtmlright.' '.$newcardbutton, '', $limit, 0, 0, 1);
 

From 2f89d526eb49b16d03138414ca4ef5789259d273 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 16:43:56 +0200
Subject: [PATCH 091/101] Avoid to get a random result.

---
 htdocs/stripe/class/stripe.class.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/htdocs/stripe/class/stripe.class.php b/htdocs/stripe/class/stripe.class.php
index 2ac8193a71e..e50f48aad69 100644
--- a/htdocs/stripe/class/stripe.class.php
+++ b/htdocs/stripe/class/stripe.class.php
@@ -90,11 +90,13 @@ class Stripe extends CommonObject
 		global $conf;
 
 		$sql = "SELECT tokenstring";
-		$sql .= " FROM ".MAIN_DB_PREFIX."oauth_token WHERE";
+		$sql .= " FROM ".MAIN_DB_PREFIX."oauth_token";
+		$sql .= " WHERE service = '".$this->db->escape($mode)."'";
 		if (empty($fk_soc)) $sql .= " entity = ".$conf->entity. " AND";
-		$sql .= " service = '".$mode."'";
 		if ($fk_soc > 0) {
 			$sql .= " AND fk_soc = ".$fk_soc;
+		} else {
+			$sql .= " AND fk_soc IS NULL";
 		}
 		$sql .= " AND fk_user IS NULL AND fk_adherent IS NULL";
 

From a2efdee8656066355a436a575c8f2ad6ec3341ad Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 16:49:27 +0200
Subject: [PATCH 092/101] Fix after regression of #14886

---
 htdocs/stripe/class/stripe.class.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/htdocs/stripe/class/stripe.class.php b/htdocs/stripe/class/stripe.class.php
index e50f48aad69..392607ad89e 100644
--- a/htdocs/stripe/class/stripe.class.php
+++ b/htdocs/stripe/class/stripe.class.php
@@ -83,16 +83,17 @@ class Stripe extends CommonObject
 	 *
 	 * @param 	string	$mode		'StripeTest' or 'StripeLive'
 	 * @param	int		$fk_soc		Id of thirdparty
+	 * @param	int		$entity		Id of entity
 	 * @return 	string				Stripe account 'acc_....' or '' if no OAuth token found
 	 */
-	public function getStripeAccount($mode = 'StripeTest', $fk_soc = 0)
+	public function getStripeAccount($mode = 'StripeTest', $fk_soc = 0, $entity = 1)
 	{
 		global $conf;
 
 		$sql = "SELECT tokenstring";
 		$sql .= " FROM ".MAIN_DB_PREFIX."oauth_token";
 		$sql .= " WHERE service = '".$this->db->escape($mode)."'";
-		if (empty($fk_soc)) $sql .= " entity = ".$conf->entity. " AND";
+		$sql .= " AND entity = ".((int) $entity);
 		if ($fk_soc > 0) {
 			$sql .= " AND fk_soc = ".$fk_soc;
 		} else {

From f5f2ea57e35eac728b309c648798d00cfdd9568f Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 16:57:49 +0200
Subject: [PATCH 093/101] Fix compatibility

---
 htdocs/stripe/class/stripe.class.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/htdocs/stripe/class/stripe.class.php b/htdocs/stripe/class/stripe.class.php
index 392607ad89e..83b3905de43 100644
--- a/htdocs/stripe/class/stripe.class.php
+++ b/htdocs/stripe/class/stripe.class.php
@@ -83,13 +83,15 @@ class Stripe extends CommonObject
 	 *
 	 * @param 	string	$mode		'StripeTest' or 'StripeLive'
 	 * @param	int		$fk_soc		Id of thirdparty
-	 * @param	int		$entity		Id of entity
+	 * @param	int		$entity		Id of entity (-1 = current environment)
 	 * @return 	string				Stripe account 'acc_....' or '' if no OAuth token found
 	 */
-	public function getStripeAccount($mode = 'StripeTest', $fk_soc = 0, $entity = 1)
+	public function getStripeAccount($mode = 'StripeTest', $fk_soc = 0, $entity = -1)
 	{
 		global $conf;
 
+		if ($entity < 0) $entity = $conf->entity;
+
 		$sql = "SELECT tokenstring";
 		$sql .= " FROM ".MAIN_DB_PREFIX."oauth_token";
 		$sql .= " WHERE service = '".$this->db->escape($mode)."'";

From 58de8c9149d91dc21de35aca2d6386c14cc3b73d Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 17:04:24 +0200
Subject: [PATCH 094/101] Close #14885 Merge manualy the PR to solve a
 conflict.

---
 htdocs/fourn/class/fournisseur.facture.class.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/htdocs/fourn/class/fournisseur.facture.class.php b/htdocs/fourn/class/fournisseur.facture.class.php
index 156f2a9a1df..23f0cc1f3ea 100644
--- a/htdocs/fourn/class/fournisseur.facture.class.php
+++ b/htdocs/fourn/class/fournisseur.facture.class.php
@@ -34,7 +34,7 @@
  *  \brief      File of class to manage suppliers invoices
  */
 
-include_once DOL_DOCUMENT_ROOT.'/core/class/commoninvoice.class.php';
+require_once DOL_DOCUMENT_ROOT.'/core/class/commoninvoice.class.php';
 require_once DOL_DOCUMENT_ROOT.'/multicurrency/class/multicurrency.class.php';
 require_once DOL_DOCUMENT_ROOT.'/product/class/product.class.php';
 
@@ -765,7 +765,7 @@ class FactureFournisseur extends CommonInvoice
 		$sql .= ', f.localtax1_tx, f.localtax2_tx, f.localtax1_type, f.localtax2_type, f.total_localtax1, f.total_localtax2, f.fk_facture_fourn ';
 		$sql .= ', f.total_ht, f.tva as total_tva, f.total_ttc, f.fk_product, f.product_type, f.info_bits, f.rang, f.special_code, f.fk_parent_line, f.fk_unit';
 		$sql .= ', p.rowid as product_id, p.ref as product_ref, p.label as label, p.description as product_desc';
-		$sql .= ', f.fk_multicurrency, f.multicurrency_code, f.multicurrency_subprice, f.multicurrency_total_ht, f.multicurrency_total_tva, f.multicurrency_total_ttc';
+		$sql .= ', fk_code_ventilation, f.fk_multicurrency, f.multicurrency_code, f.multicurrency_subprice, f.multicurrency_total_ht, f.multicurrency_total_tva, f.multicurrency_total_ttc';
 		$sql .= ' FROM '.MAIN_DB_PREFIX.'facture_fourn_det as f';
 		$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product as p ON f.fk_product = p.rowid';
 		$sql .= ' WHERE fk_facture_fourn='.$this->id;
@@ -825,6 +825,10 @@ class FactureFournisseur extends CommonInvoice
 					$line->rang = $obj->rang;
 					$line->fk_unit          = $obj->fk_unit;
 
+					// Accountancy
+					$line->code_ventilation = $obj->fk_code_ventilation;
+					$line->fk_accounting_account	= $obj->fk_code_ventilation;
+
 					// Multicurrency
 					$line->fk_multicurrency = $obj->fk_multicurrency;
 					$line->multicurrency_code = $obj->multicurrency_code;

From 2f5a2d0e281e1d192609418bcb77ca3d4bd31448 Mon Sep 17 00:00:00 2001
From: Florian HENRY <florian.henry@open-concept.pro>
Date: Thu, 1 Oct 2020 17:42:04 +0200
Subject: [PATCH 095/101] fix CSRF not provided

---
 htdocs/core/filemanagerdol/browser/default/frmupload.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/htdocs/core/filemanagerdol/browser/default/frmupload.php b/htdocs/core/filemanagerdol/browser/default/frmupload.php
index 08c76f374e4..e0f0f03e430 100644
--- a/htdocs/core/filemanagerdol/browser/default/frmupload.php
+++ b/htdocs/core/filemanagerdol/browser/default/frmupload.php
@@ -122,6 +122,7 @@ window.onload = function()
 	</head>
 	<body>
 		<form id="frmUpload" action="" target="frmUploadWorker" method="post" enctype="multipart/form-data" onsubmit="return OnSubmit();">
+			<input type="hidden" name="token" value="<?php echo newToken(); ?>" />
 			<table class="fullHeight" cellspacing="0" cellpadding="0" width="100%" border="0">
 				<tr>
 					<td class="nowrap">

From ece8037f426c420f43bd23616d859b6322ee7d61 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 18:08:46 +0200
Subject: [PATCH 096/101] The button "Invoice orders" switch to page with lines
 autoselected.

---
 htdocs/comm/card.php                  |  2 +-
 htdocs/commande/customer.php          |  2 +-
 htdocs/commande/list.php              | 12 +++++++++++-
 htdocs/core/class/html.form.class.php | 18 ++++++++----------
 4 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/htdocs/comm/card.php b/htdocs/comm/card.php
index 8df97d1031f..6f1a40b2fb0 100644
--- a/htdocs/comm/card.php
+++ b/htdocs/comm/card.php
@@ -1283,7 +1283,7 @@ if ($object->id > 0)
     				{
     				    if ($object->client != 0 && $object->client != 2)
     				    {
-    					    if (!empty($orders2invoice) && $orders2invoice > 0) print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/commande/orderstoinvoice.php?socid='.$object->id.'">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
+    					    if (!empty($orders2invoice) && $orders2invoice > 0) print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/commande/list.php?socid='.$object->id.'&autoselectall=1">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
     					    else print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("NoOrdersToInvoice")).'" href="#">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
     				    } else print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("ThirdPartyMustBeEditAsCustomer")).'" href="#">'.$langs->trans("AddBill").'</a></div>';
     				}
diff --git a/htdocs/commande/customer.php b/htdocs/commande/customer.php
index f78d6ce2e84..f2f806cc7af 100644
--- a/htdocs/commande/customer.php
+++ b/htdocs/commande/customer.php
@@ -164,7 +164,7 @@ if ($resql)
 
 		$result = '';
 		$link = $linkend = '';
-		$link = '<a href="'.dol_buildpath('/commande/orderstoinvoice.php', 1).'?socid='.$obj->rowid.'">';
+		$link = '<a href="'.DOL_URL_ROOT.'/commande/list.php?socid='.$obj->rowid.'">';
 		$linkend = '</a>';
 		$name = $obj->name;
 		$result .= ($link.img_object($langs->trans("ShowCompany").': '.$name, 'company').$linkend);
diff --git a/htdocs/commande/list.php b/htdocs/commande/list.php
index 1acd515a49a..82fde75966b 100644
--- a/htdocs/commande/list.php
+++ b/htdocs/commande/list.php
@@ -624,6 +624,16 @@ if ($resql)
 	$selectedfields = $form->multiSelectArrayWithCheckbox('selectedfields', $arrayfields, $varpage); // This also change content of $arrayfields
 	$selectedfields .= $form->showCheckAddButtons('checkforselect', 1);
 
+	if (GETPOST('autoselectall', 'int')) {
+		$selectedfields .= '<script>';
+		$selectedfields .= '   $(document).ready(function() {';
+		$selectedfields .= '        console.log("Autoclick on checkforselects");';
+		$selectedfields .= '   		$("#checkforselects").click();';
+		$selectedfields .= '        $("#massaction").val("createbills").change();';
+		$selectedfields .= '   });';
+		$selectedfields .= '</script>';
+	}
+
 	print '<div class="div-table-responsive">';
 	print '<table class="tagtable liste'.($moreforfilter ? " listwithfilterbefore" : "").'">'."\n";
 
@@ -1092,7 +1102,7 @@ if ($resql)
 				{
 					if (($obj->fk_statut > 0 && $obj->fk_statut < 3) || ($obj->fk_statut == 3 && $obj->billed == 0))
 					{
-						print '&nbsp;<a href="'.DOL_URL_ROOT.'/commande/orderstoinvoice.php?socid='.$companystatic->id.'">';
+						print '&nbsp;<a href="'.DOL_URL_ROOT.'/commande/list.php?socid='.$companystatic->id.'&autoselectall=1">';
 						print img_picto($langs->trans("CreateInvoiceForThisCustomer").' : '.$companystatic->name, 'object_bill', 'hideonsmartphone').'</a>';
 					}
 				}
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index e00d544ed22..7bf559240d9 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -647,7 +647,7 @@ class Form
 
 		$disabled = 0;
 		$ret = '<div class="centpercent center">';
-				$ret .= '<select class="flat'.(empty($conf->use_javascript_ajax) ? '' : ' hideobject').' '.$name.' '.$name.'select valignmiddle alignstart" name="'.$name.'"'.($disabled ? ' disabled="disabled"' : '').'>';
+		$ret .= '<select class="flat'.(empty($conf->use_javascript_ajax) ? '' : ' hideobject').' '.$name.' '.$name.'select valignmiddle alignstart" id="'.$name.'" name="'.$name.'"'.($disabled ? ' disabled="disabled"' : '').'>';
 
 		// Complete list with data from external modules. THe module can use $_SERVER['PHP_SELF'] to know on which page we are, or use the $parameters['currentcontext'] completed by executeHooks.
 		$parameters = array();
@@ -7552,8 +7552,8 @@ class Form
 		global $conf, $langs;
 
 		$out = '';
-		$id = uniqid();
-				if (!empty($conf->use_javascript_ajax)) $out .= '<div class="inline-block checkallactions"><input type="checkbox" id="'.$cssclass.'s" name="'.$cssclass.'s" class="checkallactions"></div>';
+
+		if (!empty($conf->use_javascript_ajax)) $out .= '<div class="inline-block checkallactions"><input type="checkbox" id="'.$cssclass.'s" name="'.$cssclass.'s" class="checkallactions"></div>';
 		$out .= '<script>
             $(document).ready(function() {
                 $("#' . $cssclass.'s").click(function() {
@@ -7568,13 +7568,11 @@ class Form
                     }'."\n";
 				if ($calljsfunction) $out .= 'if (typeof initCheckForSelect == \'function\') { initCheckForSelect(0, "'.$massactionname.'", "'.$cssclass.'"); } else { console.log("No function initCheckForSelect found. Call won\'t be done."); }';
 		$out .= '         });
-
-                $(".' . $cssclass.'").change(function() {
-				$(this).closest("tr").toggleClass("highlight", this.checked);
-			});
-
- 	});
-    </script>';
+        	        $(".' . $cssclass.'").change(function() {
+					$(this).closest("tr").toggleClass("highlight", this.checked);
+				});
+		 	});
+    	</script>';
 
 		return $out;
 	}

From d912908aef1744e68a06e289e01ac01f3d8e4a22 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Thu, 1 Oct 2020 19:05:20 +0200
Subject: [PATCH 097/101] NEW Can build vendor invoice from vendor orders

---
 htdocs/comm/card.php                          |   4 +-
 htdocs/commande/list.php                      |   4 +-
 htdocs/core/actions_massactions.inc.php       |   4 +-
 htdocs/fourn/card.php                         |   2 +-
 .../fourn/class/fournisseur.facture.class.php |   5 +-
 htdocs/fourn/commande/list.php                | 214 +++++++++++-------
 6 files changed, 145 insertions(+), 88 deletions(-)

diff --git a/htdocs/comm/card.php b/htdocs/comm/card.php
index 6f1a40b2fb0..79278fef056 100644
--- a/htdocs/comm/card.php
+++ b/htdocs/comm/card.php
@@ -777,8 +777,6 @@ if ($object->id > 0)
 				print '<tr class="liste_titre">';
 				print '<td colspan="4"><table width="100%" class="nobordernopadding"><tr><td>'.$langs->trans("LastCustomerOrders", ($num <= $MAXLIST ? "" : $MAXLIST)).'</td><td class="right"><a class="notasortlink" href="'.DOL_URL_ROOT.'/commande/list.php?socid='.$object->id.'">'.$langs->trans("AllOrders").'<span class="badge marginleftonlyshort">'.$num.'</span></a></td>';
 				print '<td width="20px" class="right"><a href="'.DOL_URL_ROOT.'/commande/stats/index.php?socid='.$object->id.'">'.img_picto($langs->trans("Statistics"), 'stats').'</a></td>';
-				//if($num2 > 0) print '<td width="20px" class="right"><a href="'.DOL_URL_ROOT.'/commande/orderstoinvoice.php?socid='.$object->id.'">'.img_picto($langs->trans("CreateInvoiceForThisCustomer"),'object_bill').'</a></td>';
-				//else print '<td width="20px" class="right"><a href="#">'.img_picto($langs->trans("NoOrdersToInvoice"),'object_bill').'</a></td>';
 				print '</tr></table></td>';
 				print '</tr>';
 			}
@@ -1283,7 +1281,7 @@ if ($object->id > 0)
     				{
     				    if ($object->client != 0 && $object->client != 2)
     				    {
-    					    if (!empty($orders2invoice) && $orders2invoice > 0) print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/commande/list.php?socid='.$object->id.'&autoselectall=1">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
+    					    if (!empty($orders2invoice) && $orders2invoice > 0) print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/commande/list.php?socid='.$object->id.'&search_billed=0&autoselectall=1">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
     					    else print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("NoOrdersToInvoice")).'" href="#">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
     				    } else print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("ThirdPartyMustBeEditAsCustomer")).'" href="#">'.$langs->trans("AddBill").'</a></div>';
     				}
diff --git a/htdocs/commande/list.php b/htdocs/commande/list.php
index 82fde75966b..ad422a8b930 100644
--- a/htdocs/commande/list.php
+++ b/htdocs/commande/list.php
@@ -1102,7 +1102,7 @@ if ($resql)
 				{
 					if (($obj->fk_statut > 0 && $obj->fk_statut < 3) || ($obj->fk_statut == 3 && $obj->billed == 0))
 					{
-						print '&nbsp;<a href="'.DOL_URL_ROOT.'/commande/list.php?socid='.$companystatic->id.'&autoselectall=1">';
+						print '&nbsp;<a href="'.DOL_URL_ROOT.'/commande/list.php?socid='.$companystatic->id.'&search_billed=0&autoselectall=1">';
 						print img_picto($langs->trans("CreateInvoiceForThisCustomer").' : '.$companystatic->name, 'object_bill', 'hideonsmartphone').'</a>';
 					}
 				}
@@ -1299,7 +1299,7 @@ if ($resql)
 		}
 
 		// Action column
-		print '<td class="nowrap" align="center">';
+		print '<td class="nowrap center">';
 		if ($massactionbutton || $massaction)   // If we are in select mode (massactionbutton defined) or if we have already selected and sent an action ($massaction) defined
 		{
 			$selected = 0;
diff --git a/htdocs/core/actions_massactions.inc.php b/htdocs/core/actions_massactions.inc.php
index 2bdae583429..c2f0a314445 100644
--- a/htdocs/core/actions_massactions.inc.php
+++ b/htdocs/core/actions_massactions.inc.php
@@ -615,7 +615,7 @@ if ($massaction == 'confirm_createbills')   // Create bills from orders
 			$cmd->fetch_optionals();
 
 			$objecttmp->socid = $cmd->socid;
-			$objecttmp->type = Facture::TYPE_STANDARD;
+			$objecttmp->type = $objecttmp::TYPE_STANDARD;
 			$objecttmp->cond_reglement_id	= $cmd->cond_reglement_id;
 			$objecttmp->mode_reglement_id	= $cmd->mode_reglement_id;
 			$objecttmp->fk_project = $cmd->fk_project;
@@ -742,7 +742,7 @@ if ($massaction == 'confirm_createbills')   // Create bills from orders
 							'HT',
 							0,
 							$product_type,
-							$ii,
+							$lines[$i]->rang,
 							$lines[$i]->special_code,
 							$objecttmp->origin,
 							$lines[$i]->rowid,
diff --git a/htdocs/fourn/card.php b/htdocs/fourn/card.php
index 8488abeee30..1de6d30b681 100644
--- a/htdocs/fourn/card.php
+++ b/htdocs/fourn/card.php
@@ -798,7 +798,7 @@ if ($object->id > 0)
 				if ($object->status == 1)
 				{
 					// Company is open
-					print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/fourn/commande/orderstoinvoice.php?socid='.$object->id.'">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
+					print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/fourn/commande/list.php?socid='.$object->id.'&search_billed=0&autoselectall=1">'.$langs->trans("CreateInvoiceForThisSupplier").'</a></div>';
 				} else {
 					print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
 				}
diff --git a/htdocs/fourn/class/fournisseur.facture.class.php b/htdocs/fourn/class/fournisseur.facture.class.php
index 23f0cc1f3ea..0c0e32a2055 100644
--- a/htdocs/fourn/class/fournisseur.facture.class.php
+++ b/htdocs/fourn/class/fournisseur.facture.class.php
@@ -1601,9 +1601,10 @@ class FactureFournisseur extends CommonInvoice
 	 *  @param		double	$pu_ht_devise		Amount in currency
 	 *  @param		string	$ref_supplier		Supplier ref
 	 *  @param      string  $special_code       Special code
+	 *  @param		int		$fk_parent_line		Parent line id
 	 *	@return    	int             			>0 if OK, <0 if KO
 	 */
-	public function addline($desc, $pu, $txtva, $txlocaltax1, $txlocaltax2, $qty, $fk_product = 0, $remise_percent = 0, $date_start = '', $date_end = '', $ventil = 0, $info_bits = '', $price_base_type = 'HT', $type = 0, $rang = -1, $notrigger = false, $array_options = 0, $fk_unit = null, $origin_id = 0, $pu_ht_devise = 0, $ref_supplier = '', $special_code = '')
+	public function addline($desc, $pu, $txtva, $txlocaltax1, $txlocaltax2, $qty, $fk_product = 0, $remise_percent = 0, $date_start = '', $date_end = '', $ventil = 0, $info_bits = '', $price_base_type = 'HT', $type = 0, $rang = -1, $notrigger = false, $array_options = 0, $fk_unit = null, $origin_id = 0, $pu_ht_devise = 0, $ref_supplier = '', $special_code = '', $fk_parent_line = 0)
 	{
 		global $langs, $mysoc, $conf;
 
@@ -1777,7 +1778,7 @@ class FactureFournisseur extends CommonInvoice
 			$this->line->info_bits = $info_bits;
 
 			$this->line->special_code = ((string) $special_code != '' ? $special_code : $this->special_code);
-			$this->line->fk_parent_line = $this->fk_parent_line;
+			$this->line->fk_parent_line = $fk_parent_line;
 			$this->line->origin = $this->origin;
 			$this->line->origin_id = $origin_id;
 			$this->line->fk_unit = $fk_unit;
diff --git a/htdocs/fourn/commande/list.php b/htdocs/fourn/commande/list.php
index 6be60c04249..48613e67d43 100644
--- a/htdocs/fourn/commande/list.php
+++ b/htdocs/fourn/commande/list.php
@@ -35,6 +35,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.class.php';
 require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.commande.class.php';
+require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.facture.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formorder.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php';
@@ -130,6 +131,9 @@ $fieldstosearchall = array(
 	'cf.ref_supplier'=>'RefSupplierOrder',
 	'pd.description'=>'Description',
 	's.nom'=>"ThirdParty",
+	's.name_alias'=>"AliasNameShort",
+	's.zip'=>"Zip",
+	's.town'=>"Town",
 	'cf.note_public'=>'NotePublic',
 );
 if (empty($user->socid)) $fieldstosearchall["cf.note_private"] = "NotePrivate";
@@ -180,7 +184,7 @@ $arrayfields = dol_sort_array($arrayfields, 'position');
  */
 
 if (GETPOST('cancel', 'alpha')) { $action = 'list'; $massaction = ''; }
-if (!GETPOST('confirmmassaction', 'alpha') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction = ''; }
+if (!GETPOST('confirmmassaction', 'alpha') && $massaction != 'presend' && $massaction != 'confirm_presend' && $massaction != 'confirm_createsupplierbills') { $massaction = ''; }
 
 $parameters = array('socid'=>$socid);
 $reshook = $hookmanager->executeHooks('doActions', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks
@@ -244,7 +248,7 @@ if (empty($reshook))
 	include DOL_DOCUMENT_ROOT.'/core/actions_massactions.inc.php';
 
 	// TODO Move this into mass action include
-	if ($massaction == 'confirm_createbills')
+	if ($massaction == 'confirm_createsupplierbills')
 	{
 		$orders = GETPOST('toselect', 'array');
 		$createbills_onebythird = GETPOST('createbills_onebythird', 'int');
@@ -258,34 +262,36 @@ if (empty($reshook))
 		$db->begin();
 
 		foreach ($orders as $id_order) {
-			$cmd = new Commande($db);
+			$cmd = new CommandeFournisseur($db);
 			if ($cmd->fetch($id_order) <= 0) continue;
 
-			$object = new Facture($db);
-			if (!empty($createbills_onebythird) && !empty($TFactThird[$cmd->socid])) $object = $TFactThird[$cmd->socid]; // If option "one bill per third" is set, we use already created order.
+			$objecttmp = new FactureFournisseur($db);
+			if (!empty($createbills_onebythird) && !empty($TFactThird[$cmd->socid])) $objecttmp = $TFactThird[$cmd->socid]; // If option "one bill per third" is set, we use already created order.
 			else {
-				$object->socid = $cmd->socid;
-				$object->type = Facture::TYPE_STANDARD;
-				$object->cond_reglement_id	= $cmd->cond_reglement_id;
-				$object->mode_reglement_id	= $cmd->mode_reglement_id;
-				$object->fk_project = $cmd->fk_project;
+				$objecttmp->socid = $cmd->socid;
+				$objecttmp->type = $objecttmp::TYPE_STANDARD;
+				$objecttmp->cond_reglement_id	= $cmd->cond_reglement_id;
+				$objecttmp->mode_reglement_id	= $cmd->mode_reglement_id;
+				$objecttmp->fk_project = $cmd->fk_project;
+				$objecttmp->multicurrency_code = $cmd->multicurrency_code;
+				if (empty($createbills_onebythird)) $objecttmp->ref_client = $cmd->ref_client;
 
-				$datefacture = dol_mktime(12, 0, 0, $_POST['remonth'], $_POST['reday'], $_POST['reyear']);
+				$datefacture = dol_mktime(12, 0, 0, GETPOST('remonth', 'int'), GETPOST('reday', 'int'), GETPOST('reyear', 'int'));
 				if (empty($datefacture))
 				{
-					$datefacture = dol_mktime(date("h"), date("M"), 0, date("m"), date("d"), date("Y"));
+					$datefacture = dol_now();
 				}
 
-				$object->date = $datefacture;
-				$object->origin    = 'commande';
-				$object->origin_id = $id_order;
+				$objecttmp->date = $datefacture;
+				$objecttmp->origin    = 'order_supplier';
+				$objecttmp->origin_id = $id_order;
 
-				$res = $object->create($user);
+				$res = $objecttmp->create($user);
 
 				if ($res > 0) $nb_bills_created++;
 			}
 
-			if ($object->id > 0)
+			if ($objecttmp->id > 0)
 			{
 				$sql = "INSERT INTO ".MAIN_DB_PREFIX."element_element (";
 				$sql .= "fk_source";
@@ -294,9 +300,9 @@ if (empty($reshook))
 				$sql .= ", targettype";
 				$sql .= ") VALUES (";
 				$sql .= $id_order;
-				$sql .= ", '".$db->escape($object->origin)."'";
-				$sql .= ", ".$object->id;
-				$sql .= ", '".$db->escape($object->element)."'";
+				$sql .= ", '".$db->escape($objecttmp->origin)."'";
+				$sql .= ", ".$objecttmp->id;
+				$sql .= ", '".$db->escape($objecttmp->element)."'";
 				$sql .= ")";
 
 				if (!$db->query($sql))
@@ -323,7 +329,7 @@ if (empty($reshook))
 						{
 							// Negative line, we create a discount line
 							$discount = new DiscountAbsolute($db);
-							$discount->fk_soc = $object->socid;
+							$discount->fk_soc = $objecttmp->socid;
 							$discount->amount_ht = abs($lines[$i]->total_ht);
 							$discount->amount_tva = abs($lines[$i]->total_tva);
 							$discount->amount_ttc = abs($lines[$i]->total_ttc);
@@ -333,7 +339,7 @@ if (empty($reshook))
 							$discountid = $discount->create($user);
 							if ($discountid > 0)
 							{
-								$result = $object->insert_discount($discountid);
+								$result = $objecttmp->insert_discount($discountid);
 								//$result=$discount->link_to_invoice($lineid,$id);
 							} else {
 								setEventMessages($discount->error, $discount->errors, 'errors');
@@ -358,32 +364,31 @@ if (empty($reshook))
 							{
 								$fk_parent_line = 0;
 							}
-                            $result = $object->addline(
+                            $result = $objecttmp->addline(
 								$desc,
 								$lines[$i]->subprice,
-								$lines[$i]->qty,
 								$lines[$i]->tva_tx,
 								$lines[$i]->localtax1_tx,
 								$lines[$i]->localtax2_tx,
-								$lines[$i]->fk_product,
+                            	$lines[$i]->qty,
+                            	$lines[$i]->fk_product,
 								$lines[$i]->remise_percent,
 								$date_start,
 								$date_end,
 								0,
 								$lines[$i]->info_bits,
-								$lines[$i]->fk_remise_except,
-								'HT',
-								0,
-								$product_type,
-								$ii,
-								$lines[$i]->special_code,
-								$object->origin,
-								$lines[$i]->rowid,
-								$fk_parent_line,
-								$lines[$i]->fk_fournprice,
-								$lines[$i]->pa_ht,
-								$lines[$i]->label
-								);
+                            	'HT',
+                            	$product_type,
+                            	$lines[$i]->rang,
+                            	false,
+                            	$lines[$i]->array_options,
+                            	$lines[$i]->fk_unit,
+                            	$objecttmp->origin_id,
+                            	$lines[$i]->pa_ht,
+                            	$lines[$i]->ref_supplier,
+                            	$lines[$i]->special_code,
+                            	$fk_parent_line
+							);
 							if ($result > 0)
 							{
 								$lineid = $result;
@@ -404,8 +409,8 @@ if (empty($reshook))
 
 			$cmd->classifyBilled($user); // TODO Move this in workflow like done for customer orders
 
-			if (!empty($createbills_onebythird) && empty($TFactThird[$cmd->socid])) $TFactThird[$cmd->socid] = $object;
-			else $TFact[$object->id] = $object;
+			if (!empty($createbills_onebythird) && empty($TFactThird[$cmd->socid])) $TFactThird[$cmd->socid] = $objecttmp;
+			else $TFact[$objecttmp->id] = $objecttmp;
 		}
 
 		// Build doc with all invoices
@@ -415,38 +420,67 @@ if (empty($reshook))
 		if (!$error && $validate_invoices) {
 			$massaction = $action = 'builddoc';
 
-			foreach ($TAllFact as &$object)
+			foreach ($TAllFact as &$objecttmp)
 			{
-				$object->validate($user);
+				$objecttmp->validate($user);
 				if ($result <= 0)
 				{
 					$error++;
-					setEventMessages($object->error, $object->errors, 'errors');
+					setEventMessages($objecttmp->error, $objecttmp->errors, 'errors');
 					break;
 				}
 
-				$id = $object->id; // For builddoc action
+				$id = $objecttmp->id; // For builddoc action
 
 				// Fac builddoc
 				$donotredirect = 1;
-				$upload_dir = $conf->facture->dir_output;
-				$permissiontoadd = $user->rights->facture->creer;
-				include DOL_DOCUMENT_ROOT.'/core/actions_builddoc.inc.php';
+				$upload_dir = $conf->fournisseur->facture->dir_output;
+				$permissiontoadd = $user->rights->fournisseur->facture->creer;
+				//include DOL_DOCUMENT_ROOT.'/core/actions_builddoc.inc.php';
 			}
 
-			$massaction = $action = 'confirm_createbills';
+			$massaction = $action = 'confirm_createsupplierbills';
 		}
 
 		if (!$error)
 		{
 			$db->commit();
 			setEventMessages($langs->trans('BillCreated', $nb_bills_created), null, 'mesgs');
+
+			// Make a redirect to avoid to bill twice if we make a refresh or back
+			$param = '';
+			if (!empty($contextpage) && $contextpage != $_SERVER["PHP_SELF"]) $param .= '&contextpage='.urlencode($contextpage);
+			if ($limit > 0 && $limit != $conf->liste_limit) $param .= '&limit='.urlencode($limit);
+			if ($sall)					$param .= '&sall='.urlencode($sall);
+			if ($socid > 0)             $param .= '&socid='.urlencode($socid);
+			if ($search_status != '')      $param .= '&search_status='.urlencode($search_status);
+			if ($search_orderday)      		$param .= '&search_orderday='.urlencode($search_orderday);
+			if ($search_ordermonth)      		$param .= '&search_ordermonth='.urlencode($search_ordermonth);
+			if ($search_orderyear)       		$param .= '&search_orderyear='.urlencode($search_orderyear);
+			if ($search_deliveryday)   		$param .= '&search_deliveryday='.urlencode($search_deliveryday);
+			if ($search_deliverymonth)   		$param .= '&search_deliverymonth='.urlencode($search_deliverymonth);
+			if ($search_deliveryyear)    		$param .= '&search_deliveryyear='.urlencode($search_deliveryyear);
+			if ($search_ref)      		$param .= '&search_ref='.urlencode($search_ref);
+			if ($search_company)  		$param .= '&search_company='.urlencode($search_company);
+			if ($search_ref_customer)	$param .= '&search_ref_customer='.urlencode($search_ref_customer);
+			if ($search_user > 0) 		$param .= '&search_user='.urlencode($search_user);
+			if ($search_sale > 0) 		$param .= '&search_sale='.urlencode($search_sale);
+			if ($search_total_ht != '') $param .= '&search_total_ht='.urlencode($search_total_ht);
+			if ($search_total_vat != '') $param .= '&search_total_vat='.urlencode($search_total_vat);
+			if ($search_total_ttc != '') $param .= '&search_total_ttc='.urlencode($search_total_ttc);
+			if ($search_project_ref >= 0)  	$param .= "&search_project_ref=".urlencode($search_project_ref);
+			if ($show_files)            $param .= '&show_files='.urlencode($show_files);
+			if ($optioncss != '')       $param .= '&optioncss='.urlencode($optioncss);
+			if ($billed != '')			$param .= '&billed='.urlencode($billed);
+
+			header("Location: ".$_SERVER['PHP_SELF'].'?'.$param);
+			exit;
 		} else {
 			$db->rollback();
 			$action = 'create';
 			$_GET["origin"] = $_POST["origin"];
 			$_GET["originid"] = $_POST["originid"];
-			setEventMessages($object->error, $object->errors, 'errors');
+			setEventMessages("Error", null, 'errors');
 			$error++;
 		}
 	}
@@ -566,6 +600,7 @@ $sql .= $hookmanager->resPrint;
 
 $sql .= $db->order($sortfield, $sortorder);
 
+// Count total nb of records
 $nbtotalofrecords = '';
 if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST))
 {
@@ -579,6 +614,7 @@ if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST))
 }
 
 $sql .= $db->plimit($limit + 1, $offset);
+//print $sql;
 
 $resql = $db->query($sql);
 if ($resql)
@@ -607,23 +643,24 @@ if ($resql)
 	llxHeader('', $title, $help_url);
 
 	$param = '';
-	if ($socid > 0)             $param .= '&socid='.$socid;
-	if (!empty($contextpage) && $contextpage != $_SERVER["PHP_SELF"]) $param .= '&contextpage='.$contextpage;
-	if ($limit > 0 && $limit != $conf->liste_limit) $param .= '&limit='.$limit;
-	if ($sall)					$param .= "&search_all=".$sall;
-	if ($search_orderday)      	$param .= '&search_orderday='.$search_orderday;
-	if ($search_ordermonth)     $param .= '&search_ordermonth='.$search_ordermonth;
-	if ($search_orderyear)      $param .= '&search_orderyear='.$search_orderyear;
-	if ($search_deliveryday)   	$param .= '&search_deliveryday='.$search_deliveryday;
-	if ($search_deliverymonth)  $param .= '&search_deliverymonth='.$search_deliverymonth;
-	if ($search_deliveryyear)   $param .= '&search_deliveryyear='.$search_deliveryyear;
-	if ($search_ref)      		$param .= '&search_ref='.$search_ref;
-	if ($search_company)  		$param .= '&search_company='.$search_company;
-	if ($search_user > 0) 		$param .= '&search_user='.$search_user;
-	if ($search_request_author) $param .= '&search_request_author='.$search_request_author;
-	if ($search_sale > 0) 		$param .= '&search_sale='.$search_sale;
-	if ($search_total_ht != '') $param .= '&search_total_ht='.$search_total_ht;
-	if ($search_total_ttc != '') $param .= "&search_total_ttc=".$search_total_ttc;
+	if (!empty($contextpage) && $contextpage != $_SERVER["PHP_SELF"]) $param .= '&contextpage='.urlencode($contextpage);
+	if ($limit > 0 && $limit != $conf->liste_limit) $param .= '&limit='.urlencode($limit);
+	if ($sall)					$param .= '&sall='.urlencode($sall);
+	if ($socid > 0)             $param .= '&socid='.urlencode($socid);
+	if ($sall)					$param .= "&search_all=".urlencode($sall);
+	if ($search_orderday)      	$param .= '&search_orderday='.urlencode($search_orderday);
+	if ($search_ordermonth)     $param .= '&search_ordermonth='.urlencode($search_ordermonth);
+	if ($search_orderyear)      $param .= '&search_orderyear='.urlencode($search_orderyear);
+	if ($search_deliveryday)   	$param .= '&search_deliveryday='.urlencode($search_deliveryday);
+	if ($search_deliverymonth)  $param .= '&search_deliverymonth='.urlencode($search_deliverymonth);
+	if ($search_deliveryyear)   $param .= '&search_deliveryyear='.urlencode($search_deliveryyear);
+	if ($search_ref)      		$param .= '&search_ref='.urlencode($search_ref);
+	if ($search_company)  		$param .= '&search_company='.urlencode($search_company);
+	if ($search_user > 0) 		$param .= '&search_user='.urlencode($search_user);
+	if ($search_request_author) $param .= '&search_request_author='.urlencode($search_request_author);
+	if ($search_sale > 0) 		$param .= '&search_sale='.urlencode($search_sale);
+	if ($search_total_ht != '') $param .= '&search_total_ht='.urlencode($search_total_ht);
+	if ($search_total_ttc != '') $param .= "&search_total_ttc=".urlencode($search_total_ttc);
 	if ($search_multicurrency_code != '')  $param .= '&search_multicurrency_code='.urlencode($search_multicurrency_code);
 	if ($search_multicurrency_tx != '')  $param .= '&search_multicurrency_tx='.urlencode($search_multicurrency_tx);
 	if ($search_multicurrency_montant_ht != '')  $param .= '&search_multicurrency_montant_ht='.urlencode($search_multicurrency_montant_ht);
@@ -644,7 +681,7 @@ if ($resql)
 		'builddoc'=>$langs->trans("PDFMerge"),
 	    'presend'=>$langs->trans("SendByMail"),
 	);
-	//if($user->rights->fournisseur->facture->creer) $arrayofmassactions['createbills']=$langs->trans("CreateInvoiceForThisCustomer");
+	if ($user->rights->fournisseur->facture->creer) $arrayofmassactions['createbills'] = $langs->trans("CreateInvoiceForThisSupplier");
 	if ($user->rights->fournisseur->commande->supprimer) $arrayofmassactions['predelete'] = '<span class="fa fa-trash paddingrightonly"></span>'.$langs->trans("Delete");
 	if (in_array($massaction, array('presend', 'predelete', 'createbills'))) $arrayofmassactions = array();
 	$massactionbutton = $form->selectMassAction('', $arrayofmassactions);
@@ -653,15 +690,16 @@ if ($resql)
 	if (!empty($socid)) $url .= '&socid='.$socid;
 	$newcardbutton = dolGetButtonTitle($langs->trans('NewOrder'), '', 'fa fa-plus-circle', $url, '', $user->rights->fournisseur->commande->creer);
 
-	// Fields title search
-	print '<form method="POST" action="'.$_SERVER["PHP_SELF"].'">';
+	// Lines of title fields
+	print '<form method="POST" id="searchFormList" action="'.$_SERVER["PHP_SELF"].'">';
 	if ($optioncss != '') print '<input type="hidden" name="optioncss" value="'.$optioncss.'">';
 	print '<input type="hidden" name="token" value="'.newToken().'">';
 	print '<input type="hidden" name="formfilteraction" id="formfilteraction" value="list">';
 	print '<input type="hidden" name="action" value="list">';
-	print '<input type="hidden" name="contextpage" value="'.$contextpage.'">';
 	print '<input type="hidden" name="sortfield" value="'.$sortfield.'">';
 	print '<input type="hidden" name="sortorder" value="'.$sortorder.'">';
+	print '<input type="hidden" name="contextpage" value="'.$contextpage.'">';
+	print '<input type="hidden" name="socid" value="'.$socid.'">';
 
 	print_barre_liste($title, $page, $_SERVER["PHP_SELF"], $param, $sortfield, $sortorder, $massactionbutton, $num, $nbtotalofrecords, 'supplier_order', 0, $newcardbutton, '', $limit, 0, 0, 1);
 
@@ -674,11 +712,11 @@ if ($resql)
 	if ($massaction == 'createbills')
 	{
 		//var_dump($_REQUEST);
-		print '<input type="hidden" name="massaction" value="confirm_createbills">';
+		print '<input type="hidden" name="massaction" value="confirm_createsupplierbills">';
 
-		print '<table class="border" width="100%" >';
+		print '<table class="noborder" width="100%" >';
 		print '<tr>';
-		print '<td class="titlefieldmiddle">';
+		print '<td class="titlefield">';
 		print $langs->trans('DateInvoice');
 		print '</td>';
 		print '<td>';
@@ -760,7 +798,17 @@ if ($resql)
 
 	$varpage = empty($contextpage) ? $_SERVER["PHP_SELF"] : $contextpage;
 	$selectedfields = $form->multiSelectArrayWithCheckbox('selectedfields', $arrayfields, $varpage); // This also change content of $arrayfields
-	if ($massactionbutton) $selectedfields .= $form->showCheckAddButtons('checkforselect', 1);
+	$selectedfields .= $form->showCheckAddButtons('checkforselect', 1);
+
+	if (GETPOST('autoselectall', 'int')) {
+		$selectedfields .= '<script>';
+		$selectedfields .= '   $(document).ready(function() {';
+		$selectedfields .= '        console.log("Autoclick on checkforselects");';
+		$selectedfields .= '   		$("#checkforselects").click();';
+		$selectedfields .= '        $("#massaction").val("createbills").change();';
+		$selectedfields .= '   });';
+		$selectedfields .= '</script>';
+	}
 
 	print '<div class="div-table-responsive">';
 	print '<table class="tagtable liste'.($moreforfilter ? " listwithfilterbefore" : "").'">'."\n";
@@ -933,6 +981,7 @@ if ($resql)
 
 	print "</tr>\n";
 
+	// Fields title
 	print '<tr class="liste_titre">';
 	if (!empty($arrayfields['cf.ref']['checked']))            print_liste_field_titre($arrayfields['cf.ref']['label'], $_SERVER["PHP_SELF"], "cf.ref", "", $param, '', $sortfield, $sortorder);
 	if (!empty($arrayfields['cf.ref_supplier']['checked']))   print_liste_field_titre($arrayfields['cf.ref_supplier']['label'], $_SERVER["PHP_SELF"], "cf.ref_supplier", "", $param, '', $sortfield, $sortorder, 'tdoverflowmax100imp ');
@@ -983,6 +1032,12 @@ if ($resql)
 	{
 		$obj = $db->fetch_object($resql);
 
+		$notshippable = 0;
+		$warning = 0;
+		$text_info = '';
+		$text_warning = '';
+		$nbprod = 0;
+
 		$objectstatic->id = $obj->rowid;
 		$objectstatic->ref = $obj->ref;
 		$objectstatic->ref_supplier = $obj->ref_supplier;
@@ -1220,22 +1275,25 @@ if ($resql)
 		if (!$i) $totalarray['nbfield']++;
 
 		print "</tr>\n";
+
+		$total += $obj->total_ht;
+		$subtotal += $obj->total_ht;
 		$i++;
 	}
 
 	// Show total line
 	include DOL_DOCUMENT_ROOT.'/core/tpl/list_print_total.tpl.php';
 
+	$db->free($resql);
 
     $parameters = array('arrayfields'=>$arrayfields, 'sql'=>$sql);
     $reshook = $hookmanager->executeHooks('printFieldListFooter', $parameters); // Note that $action and $object may have been modified by hook
     print $hookmanager->resPrint;
 
-	print "</table>\n";
-	print '</div>';
-	print "</form>\n";
+    print '</table>'."\n";
+    print '</div>';
 
-	$db->free($resql);
+    print '</form>'."\n";
 
 	$hidegeneratedfilelistifempty = 1;
 	if ($massaction == 'builddoc' || $action == 'remove_file' || $show_files) $hidegeneratedfilelistifempty = 0;

From 813deee4a512b5e3ac7a3542ef58fc1591ba4bbf Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Fri, 2 Oct 2020 01:14:43 +0200
Subject: [PATCH 098/101] Fix phpcs

---
 htdocs/accountancy/admin/journals_list.php | 2 +-
 htdocs/comm/action/card.php                | 9 +++------
 htdocs/core/lib/payments.lib.php           | 5 ++---
 3 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/htdocs/accountancy/admin/journals_list.php b/htdocs/accountancy/admin/journals_list.php
index 687ca02c91d..ebfa44e959f 100644
--- a/htdocs/accountancy/admin/journals_list.php
+++ b/htdocs/accountancy/admin/journals_list.php
@@ -22,7 +22,7 @@
  * \brief		Setup page to configure journals
  */
 
-if (! defined('CSRFCHECK_WITH_TOKEN'))     define('CSRFCHECK_WITH_TOKEN','1');		// Force use of CSRF protection with tokens even for GET
+if (!defined('CSRFCHECK_WITH_TOKEN')) define('CSRFCHECK_WITH_TOKEN','1');		// Force use of CSRF protection with tokens even for GET
 
 require '../../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formadmin.class.php';
diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index cb63813139d..3c8ed94c2bf 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -1709,8 +1709,8 @@ if ($id > 0)
 		// Reminders
 		if ($conf->global->AGENDA_REMINDER_EMAIL || $conf->global->AGENDA_REMINDER_BROWSER)
 		{
-			$filtreuserid = $user->id;
-			if ($user->rights->agenda->allactions->read) $filtreuserid = 0;
+			$filteruserid = $user->id;
+			if ($user->rights->agenda->allactions->read) $filteruserid = 0;
 			$object->loadReminders('', $filteruserid, false);
 
 			print '<hr>';
@@ -1721,10 +1721,7 @@ if ($id > 0)
 				$firstreminderId = array_shift($keys);
 
 				$actionCommReminder = $object->reminders[$firstreminderId];
-
-			}
-			else
-			{
+			} else {
 				$checked = '';
 				$actionCommReminder = new ActionCommReminder($db);
 				$actionCommReminder->offsetvalue = 10;
diff --git a/htdocs/core/lib/payments.lib.php b/htdocs/core/lib/payments.lib.php
index 02b5727e174..4fb593e354d 100644
--- a/htdocs/core/lib/payments.lib.php
+++ b/htdocs/core/lib/payments.lib.php
@@ -59,12 +59,11 @@ function payment_prepare_head(Paiement $object)
  * Returns an array with the tabs for the "Bannkline" section
  * It loads tabs from modules looking for the entity payment
  *
- * @param Bankline $object Current payment object
- * @return array Tabs for the Bankline section
+ * @param 	int		$id		ID of bank line
+ * @return 	array 			Tabs for the Bankline section
  */
 function bankline_prepare_head($id)
 {
-
     global $langs, $conf;
 
     $h = 0;

From e1d156973b320c62df361ec2a014bffc2bc11886 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Fri, 2 Oct 2020 02:08:04 +0200
Subject: [PATCH 099/101] phpcs

---
 htdocs/accountancy/admin/journals_list.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/accountancy/admin/journals_list.php b/htdocs/accountancy/admin/journals_list.php
index ebfa44e959f..e48ee43ef8d 100644
--- a/htdocs/accountancy/admin/journals_list.php
+++ b/htdocs/accountancy/admin/journals_list.php
@@ -22,7 +22,7 @@
  * \brief		Setup page to configure journals
  */
 
-if (!defined('CSRFCHECK_WITH_TOKEN')) define('CSRFCHECK_WITH_TOKEN','1');		// Force use of CSRF protection with tokens even for GET
+if (!defined('CSRFCHECK_WITH_TOKEN')) define('CSRFCHECK_WITH_TOKEN', '1');		// Force use of CSRF protection with tokens even for GET
 
 require '../../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formadmin.class.php';

From 4e494611437de12d8d4747265a5f6a7a008550e9 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Fri, 2 Oct 2020 02:11:04 +0200
Subject: [PATCH 100/101] code comment

---
 htdocs/main.inc.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index 69f985db0b9..1344287044e 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -373,7 +373,9 @@ if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && !empty($conf->gl
 	|| defined('CSRFCHECK_WITH_TOKEN'))	// Check validity of token, only if option MAIN_SECURITY_CSRF_WITH_TOKEN enabled or if constant CSRFCHECK_WITH_TOKEN is set
 {
 	// Check all cases that need a token (all POST actions, all actions and mass actions on pages with CSRFCHECK_WITH_TOKEN set, all sensitive GET actions)
-	if ($_SERVER['REQUEST_METHOD'] == 'POST' || ((GETPOSTISSET('action') || GETPOSTISSET('massaction')) && defined('CSRFCHECK_WITH_TOKEN')) || in_array(GETPOST('action', 'aZ09'), array('add', 'addtimespent', 'update', 'install', 'delete', 'deleteprof', 'deletepayment')))
+	if ($_SERVER['REQUEST_METHOD'] == 'POST' ||
+		((GETPOSTISSET('action') || GETPOSTISSET('massaction')) && defined('CSRFCHECK_WITH_TOKEN')) ||
+		in_array(GETPOST('action', 'aZ09'), array('add', 'addtimespent', 'update', 'install', 'delete', 'deleteprof', 'deletepayment')))
 	{
 		if (!GETPOSTISSET('token')) {
 			dol_syslog("--- Access to ".$_SERVER["PHP_SELF"]." refused by CSRFCHECK_WITH_TOKEN protection. Token not provided.");

From ce0fa53cb0320fc961bfd5df29948cb3b08d016c Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Fri, 2 Oct 2020 03:07:31 +0200
Subject: [PATCH 101/101] Fix delete of file from file manager

---
 htdocs/core/class/html.form.class.php | 3 +--
 htdocs/website/index.php              | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index 7bf559240d9..0a186c02d92 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -4047,7 +4047,7 @@ class Form
 	{
 		global $langs, $conf;
 
-		$more = '<!-- formconfirm -->';
+		$more = '<!-- formconfirm for page='.dol_escape_htmltag($page).' -->';
 		$formconfirm = '';
 		$inputok = array();
 		$inputko = array();
@@ -4232,7 +4232,6 @@ class Form
                          		});
                          	}
                          	var urljump = pageyes + (pageyes.indexOf("?") < 0 ? "?" : "") + options;
-                         	//alert(urljump);
             				if (pageyes.length > 0) { location.href = urljump; }
                             $(this).dialog("close");
                         },
diff --git a/htdocs/website/index.php b/htdocs/website/index.php
index 89ef1785186..fed5be51e87 100644
--- a/htdocs/website/index.php
+++ b/htdocs/website/index.php
@@ -2433,7 +2433,7 @@ if (!GETPOST('hide_websitemenu'))
 			print '</span>';
 		}
 	} else {
-		print '<input type="hidden" name="website" id="website" value='.$websitekey.'">';
+		print '<input type="hidden" name="website" id="website" value="'.$websitekey.'">';
 	}