diff --git a/htdocs/accountancy/class/accountancyimport.class.php b/htdocs/accountancy/class/accountancyimport.class.php index ece843515e2..ea88534b6ed 100644 --- a/htdocs/accountancy/class/accountancyimport.class.php +++ b/htdocs/accountancy/class/accountancyimport.class.php @@ -55,8 +55,8 @@ class AccountancyImport $fieldname = $fieldArr[1]; } - $debit = trim($arrayrecord[11]['val']); - $credit = trim($arrayrecord[12]['val']); + $debit = floatval(trim($arrayrecord[11]['val'])); + $credit = floatval(trim($arrayrecord[12]['val'])); if (!empty($debit)) { $amount = $debit; } else { @@ -86,7 +86,7 @@ class AccountancyImport $fieldname = $fieldArr[1]; } - $debit = trim($arrayrecord[11]['val']); + $debit = floatval(trim($arrayrecord[11]['val'])); if (!empty($debit)) { $sens = 'D'; } else { diff --git a/htdocs/accountancy/class/bookkeeping.class.php b/htdocs/accountancy/class/bookkeeping.class.php index 43dcce8c646..5635df3c8e7 100644 --- a/htdocs/accountancy/class/bookkeeping.class.php +++ b/htdocs/accountancy/class/bookkeeping.class.php @@ -331,7 +331,7 @@ class BookKeeping extends CommonObject if (empty($this->piece_num)) { $sqlnum = "SELECT MAX(piece_num)+1 as maxpiecenum"; $sqlnum .= " FROM ".MAIN_DB_PREFIX.$this->table_element; - $sqlnum .= " WHERE entity = ".$conf->entity; // Do not use getEntity for accounting features + $sqlnum .= " WHERE entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features $resqlnum = $this->db->query($sqlnum); if ($resqlnum) { @@ -736,7 +736,7 @@ class BookKeeping extends CommonObject $sql .= " t.date_validated as date_validation"; $sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.$mode.' as t'; $sql .= ' WHERE 1 = 1'; - $sql .= " AND entity IN (".getEntity('accountancy').")"; + $sql .= " AND entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features if (null !== $ref) { $sql .= " AND t.ref = '".$this->db->escape($ref)."'"; } else { @@ -881,7 +881,7 @@ class BookKeeping extends CommonObject } $sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' as t'; $sql .= ' WHERE 1 = 1'; - $sql .= " AND entity IN (".getEntity('accountancy').")"; + $sql .= " AND entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features if (count($sqlwhere) > 0) { $sql .= ' AND '.implode(' '.$filtermode.' ', $sqlwhere); } @@ -1037,7 +1037,7 @@ class BookKeeping extends CommonObject } } } - $sql .= ' WHERE t.entity IN ('.getEntity('accountancy').')'; + $sql .= ' WHERE t.entity = ' . ((int) $conf->entity); // Do not use getEntity for accounting features if ($showAlreadyExportMovements == 0) { $sql .= " AND t.date_export IS NULL"; } @@ -1157,7 +1157,7 @@ class BookKeeping extends CommonObject } } } - $sql .= ' WHERE entity IN ('.getEntity('accountancy').')'; + $sql .= ' WHERE entity = ' . ((int) $conf->entity); // Do not use getEntity for accounting features if (count($sqlwhere) > 0) { $sql .= ' AND '.implode(' '.$filtermode.' ', $sqlwhere); } @@ -1454,7 +1454,7 @@ class BookKeeping extends CommonObject */ public function deleteByYearAndJournal($delyear = 0, $journal = '', $mode = '', $delmonth = 0) { - global $langs; + global $conf, $langs; if (empty($delyear) && empty($journal)) { $this->error = 'ErrorOneFieldRequired'; @@ -1475,7 +1475,7 @@ class BookKeeping extends CommonObject if (!empty($journal)) { $sql .= " AND code_journal = '".$this->db->escape($journal)."'"; } - $sql .= " AND entity IN (".getEntity('accountancy').")"; + $sql .= " AND entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features // Exclusion of validated entries at the time of deletion $sql .= " AND date_validated IS NULL"; @@ -1514,7 +1514,7 @@ class BookKeeping extends CommonObject $sql .= " FROM ".MAIN_DB_PREFIX.$this->table_element; $sql .= " WHERE piece_num = ".(int) $piecenum; $sql .= " AND date_validated IS NULL"; // For security, exclusion of validated entries at the time of deletion - $sql .= " AND entity IN (".getEntity('accountancy').")"; + $sql .= " AND entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features $resql = $this->db->query($sql); @@ -1636,7 +1636,7 @@ class BookKeeping extends CommonObject } $sql .= " FROM ".MAIN_DB_PREFIX.$this->table_element.$mode; $sql .= " WHERE piece_num = ".$piecenum; - $sql .= " AND entity IN (".getEntity('accountancy').")"; + $sql .= " AND entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features dol_syslog(__METHOD__, LOG_DEBUG); $result = $this->db->query($sql); @@ -1674,9 +1674,9 @@ class BookKeeping extends CommonObject global $conf; $sql = "SELECT MAX(piece_num)+1 as max FROM ".MAIN_DB_PREFIX.$this->table_element.$mode; - $sql .= " WHERE entity IN (".getEntity('accountancy').")"; + $sql .= " WHERE entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features - dol_syslog(get_class($this)."getNextNumMvt sql=".$sql, LOG_DEBUG); + dol_syslog(get_class($this)."::getNextNumMvt sql=".$sql, LOG_DEBUG); $result = $this->db->query($sql); if ($result) { @@ -1717,7 +1717,7 @@ class BookKeeping extends CommonObject } $sql .= " FROM ".MAIN_DB_PREFIX.$this->table_element.$mode; $sql .= " WHERE piece_num = ".$piecenum; - $sql .= " AND entity IN (".getEntity('accountancy').")"; + $sql .= " AND entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features dol_syslog(__METHOD__, LOG_DEBUG); $result = $this->db->query($sql); @@ -1780,7 +1780,7 @@ class BookKeeping extends CommonObject $sql .= " montant as amount, sens, fk_user_author, import_key, code_journal, piece_num,"; $sql .= " date_validated as date_validation"; $sql .= " FROM ".MAIN_DB_PREFIX.$this->table_element; - $sql .= " WHERE entity IN (".getEntity('accountancy').")"; + $sql .= " WHERE entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features dol_syslog(get_class($this)."::export_bookkeeping", LOG_DEBUG); @@ -1836,6 +1836,8 @@ class BookKeeping extends CommonObject */ public function transformTransaction($direction = 0, $piece_num = '') { + global $conf; + $error = 0; $this->db->begin(); @@ -1855,14 +1857,14 @@ class BookKeeping extends CommonObject $sql .= ' doc_ref, fk_doc, fk_docdet, entity, thirdparty_code, subledger_account, subledger_label,'; $sql .= ' numero_compte, label_compte, label_operation, debit, credit,'; $sql .= ' montant, sens, fk_user_author, import_key, code_journal, journal_label, '.$next_piecenum.", '".$this->db->idate($now)."'"; - $sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.'_tmp WHERE piece_num = '.((int) $piece_num); + $sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.'_tmp WHERE piece_num = '.((int) $piece_num).' AND entity = ' .((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; $this->errors[] = 'Error '.$this->db->lasterror(); dol_syslog(__METHOD__.' '.join(',', $this->errors), LOG_ERR); } - $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$this->table_element.'_tmp WHERE piece_num = '.((int) $piece_num); + $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$this->table_element.'_tmp WHERE piece_num = '.((int) $piece_num).' AND entity = ' .((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; @@ -1870,7 +1872,7 @@ class BookKeeping extends CommonObject dol_syslog(__METHOD__.' '.join(',', $this->errors), LOG_ERR); } } elseif ($direction == 1) { - $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$this->table_element.'_tmp WHERE piece_num = '.((int) $piece_num); + $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$this->table_element.'_tmp WHERE piece_num = '.((int) $piece_num).' AND entity = ' .((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; @@ -1885,14 +1887,14 @@ class BookKeeping extends CommonObject $sql .= ' doc_ref, fk_doc, fk_docdet, thirdparty_code, subledger_account, subledger_label,'; $sql .= ' numero_compte, label_compte, label_operation, debit, credit,'; $sql .= ' montant, sens, fk_user_author, import_key, code_journal, journal_label, piece_num'; - $sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' WHERE piece_num = '.((int) $piece_num); + $sql .= ' FROM '.MAIN_DB_PREFIX.$this->table_element.' WHERE piece_num = '.((int) $piece_num).' AND entity = ' .((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; $this->errors[] = 'Error '.$this->db->lasterror(); dol_syslog(__METHOD__.' '.join(',', $this->errors), LOG_ERR); } - $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$this->table_element.'_tmp WHERE piece_num = '.((int) $piece_num); + $sql = 'DELETE FROM '.MAIN_DB_PREFIX.$this->table_element.'_tmp WHERE piece_num = '.((int) $piece_num).' AND entity = ' .((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; @@ -1947,7 +1949,7 @@ class BookKeeping extends CommonObject $sql .= " AND aa.active = 1"; $sql .= " INNER JOIN ".MAIN_DB_PREFIX."accounting_system as asy ON aa.fk_pcg_version = asy.pcg_version"; $sql .= " AND asy.rowid = ".((int) $pcgver); - $sql .= " AND ab.entity IN (".getEntity('accountancy').")"; + $sql .= " AND ab.entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features $sql .= " ORDER BY account_number ASC"; dol_syslog(get_class($this)."::select_account", LOG_DEBUG); @@ -2011,7 +2013,7 @@ class BookKeeping extends CommonObject $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as parent ON aa.account_parent = parent.rowid AND parent.active = 1"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as root ON parent.account_parent = root.rowid AND root.active = 1"; $sql .= " WHERE aa.account_number = '".$this->db->escape($account)."'"; - $sql .= " AND aa.entity IN (".getEntity('accountancy').")"; + $sql .= " AND aa.entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features dol_syslog(get_class($this)."::select_account sql=".$sql, LOG_DEBUG); $resql = $this->db->query($sql); @@ -2051,7 +2053,7 @@ class BookKeeping extends CommonObject $sql .= " AND asy.rowid = ".((int) $pcgver); $sql .= " AND aa.active = 1"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_accounting_category as cat ON aa.fk_accounting_category = cat.rowid"; - $sql .= " WHERE aa.entity IN (".getEntity('accountancy').")"; + $sql .= " WHERE aa.entity = " . ((int) $conf->entity); // Do not use getEntity for accounting features dol_syslog(get_class($this)."::select_account sql=".$sql, LOG_DEBUG); $resql = $this->db->query($sql); diff --git a/htdocs/accountancy/customer/index.php b/htdocs/accountancy/customer/index.php index a88524ec5d4..c233134f562 100644 --- a/htdocs/accountancy/customer/index.php +++ b/htdocs/accountancy/customer/index.php @@ -403,6 +403,7 @@ if (!empty($conf->global->FACTURE_DEPOSITS_ARE_JUST_PAYMENTS)) { } $sql .= " AND aa.account_number IS NOT NULL"; $sql .= " GROUP BY fd.fk_code_ventilation,aa.account_number,aa.label"; +$sql .= ' ORDER BY aa.account_number'; dol_syslog('htdocs/accountancy/customer/index.php'); $resql = $db->query($sql); diff --git a/htdocs/accountancy/expensereport/index.php b/htdocs/accountancy/expensereport/index.php index 0e3bda39521..2d9c8ac4f1c 100644 --- a/htdocs/accountancy/expensereport/index.php +++ b/htdocs/accountancy/expensereport/index.php @@ -188,6 +188,7 @@ $sql .= " AND er.fk_statut IN (".ExpenseReport::STATUS_APPROVED.", ".ExpenseRepo $sql .= " AND er.entity IN (".getEntity('expensereport', 0).")"; // We don't share object for accountancy $sql .= " AND aa.account_number IS NULL"; $sql .= " GROUP BY erd.fk_code_ventilation,aa.account_number,aa.label"; +$sql .= ' ORDER BY aa.account_number'; dol_syslog('/accountancy/expensereport/index.php:: sql='.$sql); $resql = $db->query($sql); diff --git a/htdocs/accountancy/supplier/index.php b/htdocs/accountancy/supplier/index.php index 585121f7c36..9ea8fd0a307 100644 --- a/htdocs/accountancy/supplier/index.php +++ b/htdocs/accountancy/supplier/index.php @@ -300,6 +300,7 @@ $sql .= " AND ffd.product_type <= 2"; $sql .= " AND ff.entity IN (".getEntity('facture_fourn', 0).")"; // We don't share object for accountancy $sql .= " AND aa.account_number IS NULL"; $sql .= " GROUP BY ffd.fk_code_ventilation,aa.account_number,aa.label"; +$sql .= ' ORDER BY aa.account_number'; dol_syslog('htdocs/accountancy/supplier/index.php'); $resql = $db->query($sql); diff --git a/htdocs/admin/dolistore/class/dolistore.class.php b/htdocs/admin/dolistore/class/dolistore.class.php index 546ef1d57a6..f672cf05a52 100644 --- a/htdocs/admin/dolistore/class/dolistore.class.php +++ b/htdocs/admin/dolistore/class/dolistore.class.php @@ -267,9 +267,9 @@ class Dolistore // add image or default ? if ($product->id_default_image != '') { - $image_url = DOL_URL_ROOT.'/admin/dolistore/ajax/image.php?id_product='.((int) $product->id).'&id_image='.((int) $product->id_default_image); - $images = ''; - $images .= ''; + $image_url = DOL_URL_ROOT.'/admin/dolistore/ajax/image.php?id_product='.urlencode(((int) $product->id)).'&id_image='.urlencode(((int) $product->id_default_image)); + $images = ''; + $images .= ''; } else { $images = ''; } @@ -277,11 +277,11 @@ class Dolistore // free or pay ? if ($product->price > 0) { $price = '

'.price(price2num($product->price, 'MT'), 0, $langs, 1, -1, -1, 'EUR').' '.$langs->trans("HT").'

'; - $download_link = ''; + $download_link = ''; } else { $price = '

'.$langs->trans('Free').'

'; - $download_link = ''; - $download_link .= '

'; + $download_link = ''; + $download_link .= '

'; } // Set and check version diff --git a/htdocs/admin/tools/dolibarr_export.php b/htdocs/admin/tools/dolibarr_export.php index 4f6977ffb41..092f3a57170 100644 --- a/htdocs/admin/tools/dolibarr_export.php +++ b/htdocs/admin/tools/dolibarr_export.php @@ -546,6 +546,7 @@ print ''; print ''; +$title = $langs->trans("BackupZipWizard"); print "
\n"; print "\n"; @@ -564,7 +565,7 @@ print ''; print '
'; -print load_fiche_titre($title ? $title : $langs->trans("BackupZipWizard")); +print load_fiche_titre($title); print '
'; $prefix = 'documents'; diff --git a/htdocs/api/class/api_setup.class.php b/htdocs/api/class/api_setup.class.php index 9856acfacdc..2572899e467 100644 --- a/htdocs/api/class/api_setup.class.php +++ b/htdocs/api/class/api_setup.class.php @@ -1041,7 +1041,7 @@ class Setup extends DolibarrApi * @param int $page Page number (starting from zero) * @param string $zipcode To filter on zipcode * @param string $town To filter on city name - * @param int $active Payment term is active or not {@min 0} {@max 1} + * @param int $active Town is active or not {@min 0} {@max 1} * @param string $sqlfilters Other criteria to filter answers separated by a comma. Syntax example "(t.code:like:'A%') and (t.active:>=:0)" * @return array List of towns * @@ -1055,7 +1055,7 @@ class Setup extends DolibarrApi $sql = "SELECT rowid AS id, zip, town, fk_county, fk_pays AS fk_country"; $sql .= " FROM ".MAIN_DB_PREFIX."c_ziptown as t"; - $sql .= " AND t.active = ".((int) $active); + $sql .= " WHERE t.active = ".((int) $active); if ($zipcode) { $sql .= " AND t.zip LIKE '%".$this->db->escape($zipcode)."%'"; } diff --git a/htdocs/api/index.php b/htdocs/api/index.php index d19754f9c35..869dacc5cc0 100644 --- a/htdocs/api/index.php +++ b/htdocs/api/index.php @@ -55,12 +55,27 @@ if (!empty($_SERVER['HTTP_DOLAPIENTITY'])) { define("DOLENTITY", (int) $_SERVER['HTTP_DOLAPIENTITY']); } +// Response for preflight requests (used by browser when into a CORS context) +if (!empty($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] == 'OPTIONS' && !empty($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'])) { + header('Access-Control-Allow-Origin: *'); + header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE'); + header('Access-Control-Allow-Headers: Content-Type, Authorization, api_key, DOLAPIKEY'); + http_response_code(204); + exit; +} + // When we request url to get the json file, we accept Cross site so we can include the descriptor into an external tool. if (preg_match('/\/explorer\/swagger\.json/', $_SERVER["PHP_SELF"])) { header('Access-Control-Allow-Origin: *'); header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE'); header('Access-Control-Allow-Headers: Content-Type, Authorization, api_key, DOLAPIKEY'); } +// When we request url to get an API, we accept Cross site so we can make js API call inside another website +if (preg_match('/\/api\/index\.php/', $_SERVER["PHP_SELF"])) { + header('Access-Control-Allow-Origin: *'); + header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE'); + header('Access-Control-Allow-Headers: Content-Type, Authorization, api_key, DOLAPIKEY'); +} $res = 0; if (!$res && file_exists("../main.inc.php")) { @@ -304,7 +319,7 @@ if (!empty($reg[1]) && ($reg[1] != 'explorer' || ($reg[2] != '/swagger.json' && foreach ($listofendpoints as $endpointrule) { $tmparray = explode(':', $endpointrule); - if ($classfile == $tmparray[0] && $tmparray[1] == 1) { + if (($classfile == $tmparray[0] || $classfile.'api' == $tmparray[0]) && $tmparray[1] == 1) { $endpointisallowed = true; break; } diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php index c96f24760c0..63f2977acdb 100644 --- a/htdocs/comm/propal/card.php +++ b/htdocs/comm/propal/card.php @@ -1944,7 +1944,7 @@ if ($action == 'create') { // We verify whether the object is provisionally numbering $ref = substr($object->ref, 1, 4); - if ($ref == 'PROV') { + if ($ref == 'PROV' || $ref == '') { $numref = $object->getNextNumRef($soc); if (empty($numref)) { $error++; diff --git a/htdocs/commande/card.php b/htdocs/commande/card.php index ba96725ddbd..3ed5ede556c 100644 --- a/htdocs/commande/card.php +++ b/htdocs/commande/card.php @@ -1877,8 +1877,12 @@ if ($action == 'create' && $usercancreate) { if ($action == 'validate') { // We check that object has a temporary ref $ref = substr($object->ref, 1, 4); - if ($ref == 'PROV') { + if ($ref == 'PROV' || $ref == '') { $numref = $object->getNextNumRef($soc); + if (empty($numref)) { + $error++; + setEventMessages($object->error, $object->errors, 'errors'); + } } else { $numref = $object->ref; } @@ -1915,7 +1919,9 @@ if ($action == 'create' && $usercancreate) { ); } - $formconfirm = $form->formconfirm($_SERVER["PHP_SELF"].'?id='.$object->id, $langs->trans('ValidateOrder'), $text, 'confirm_validate', $formquestion, 0, 1, 220); + if (!$error) { + $formconfirm = $form->formconfirm($_SERVER["PHP_SELF"].'?id='.$object->id, $langs->trans('ValidateOrder'), $text, 'confirm_validate', $formquestion, 0, 1, 220); + } } // Confirm back to draft status diff --git a/htdocs/compta/bank/card.php b/htdocs/compta/bank/card.php index 989ab236a1c..62b97f6d100 100644 --- a/htdocs/compta/bank/card.php +++ b/htdocs/compta/bank/card.php @@ -326,7 +326,7 @@ if ($action == 'create') { if ($conf->use_javascript_ajax) { print "\n".'