Merge branch '13.0' of git@github.com:Dolibarr/dolibarr.git into develop

SECURITY.md

@@ -55,8 +55,7 @@ ONLY vulnerabilities discovered, when the following setup on test platform is us
 * $dolibarr_nocsrfcheck must be kept to the value 0 into conf.php (this is the default value)
 * $dolibarr_main_force_https must be set to something else than 0.
 * The constant MAIN_SECURITY_CSRF_WITH_TOKEN must be set to 1 into backoffice menu Home - Setup - Other (this protection should be set to 1 soon by default)
-* The module DebugBar must NOT be enabled (by default, this module is not enabled. This is a developer tool)
+* The module DebugBar and ModuleBuilder must NOT be enabled (by default, this module is not enabled. This is a developer tool)
-* The module ModuleBuilder must NOT be enabled (by default, this module is not enabled. This is a developer tool)
 * ONLY security reports on modules provided by default and with the "stable" status are valid (troubles into "experimental", "developement" or external modules are not valid vulnerabilities).
 * The root of web server must link to htdocs and the documents directory must be outside of the web server root (this is the default when using the default installer but may differs with external installer).
 * The web server setup must be done so only the documents directory is in write mode. The root directory called htdocs must be readonly.

htdocs/admin/agenda_reminder.php

@@ -187,14 +187,14 @@ print '<td class="center">&nbsp;</td>'."\n";
 print '<td class="right">'."\n";
 
 if (empty($conf->global->AGENDA_REMINDER_BROWSER)) {
-	if (! getIsHTTPS()) {
+	if (!isHTTPS()) {
 		$langs->load("errors");
 		print img_warning($langs->trans("WarningAvailableOnlyForHTTPSServers"), '', 'valignmiddle size15x').' ';
 	}
 	print '<a class="valignmiddle" href="'.$_SERVER['PHP_SELF'].'?action=set_AGENDA_REMINDER_BROWSER&amp;token='.newToken().'">'.img_picto($langs->trans('Disabled'), 'switch_off').'</a>';
 	print '</td></tr>'."\n";
 } else {
-	if (! getIsHTTPS()) {
+	if (!isHTTPS()) {
 		$langs->load("errors");
 		print img_warning($langs->trans("WarningAvailableOnlyForHTTPSServers"), '', 'valignmiddle size15x').' ';
 	}

htdocs/admin/modules.php

@@ -475,24 +475,22 @@ print load_fiche_titre($langs->trans("ModulesSetup"), '', 'title_setup');
 if ($mode == 'common' || $mode == 'commonkanban') {
 	$desc = $langs->trans("ModulesDesc", '{picto}');
 	$desc = str_replace('{picto}', img_picto('', 'switch_off'), $desc);
-	print '<span class="opacitymedium hideonsmartphone">'.$desc."<br></span>\n";
+	print '<span class="opacitymedium hideonsmartphone">'.$desc."<br><br></span>\n";
 }
 if ($mode == 'marketplace') {
-	print '<span class="opacitymedium hideonsmartphone">'.$langs->trans("ModulesMarketPlaceDesc")."<br></span>\n";
+	print '<span class="opacitymedium hideonsmartphone">'.$langs->trans("ModulesMarketPlaceDesc")."<br><br></span>\n";
 }
 if ($mode == 'deploy') {
-	print '<span class="opacitymedium hideonsmartphone">'.$langs->trans("ModulesDeployDesc", $langs->transnoentitiesnoconv("AvailableModules"))."<br></span>\n";
+	print '<span class="opacitymedium hideonsmartphone">'.$langs->trans("ModulesDeployDesc", $langs->transnoentitiesnoconv("AvailableModules"))."<br><br></span>\n";
 }
 if ($mode == 'develop') {
-	print '<span class="opacitymedium hideonsmartphone">'.$langs->trans("ModulesDevelopDesc")."<br></span>\n";
+	print '<span class="opacitymedium hideonsmartphone">'.$langs->trans("ModulesDevelopDesc")."<br><br></span>\n";
 }
 
+
 $head = modules_prepare_head();
 
 
-print "<br>\n";
-
-
 if ($mode == 'common' || $mode == 'commonkanban') {
 	dol_set_focus('#search_keyword');
 

htdocs/categories/class/categorie.class.php

@@ -1146,6 +1146,8 @@ class Categorie extends CommonObject
 		// First build full array $motherof
 		//$this->load_motherof();	// Disabled because already done by caller of build_path_from_id_categ
 
+		// $this->cats[$id_categ] is supposed to be already an array. We just want to complete it with property fullpath and fulllabel
+
 		// Define fullpath and fulllabel
 		$this->cats[$id_categ]['fullpath'] = '_'.$id_categ;
 		$this->cats[$id_categ]['fulllabel'] = $this->cats[$id_categ]['label'];

htdocs/comm/mailing/cibles.php

@@ -131,8 +131,8 @@ if (GETPOST('exportcsv', 'int'))
 	header('Content-Disposition: attachment;filename='.$completefilename);
 
 	// List of selected targets
-	$sql  = "SELECT mc.rowid, mc.lastname, mc.firstname, mc.email, mc.other, mc.statut, mc.date_envoi, mc.tms,";
+	$sql  = "SELECT mc.rowid, mc.lastname, mc.firstname, mc.email, mc.other, mc.statut as status, mc.date_envoi, mc.tms,";
-	$sql .= " mc.source_url, mc.source_id, mc.source_type, mc.error_text";
+	$sql .= " mc.source_id, mc.source_type, mc.error_text";
 	$sql .= " FROM ".MAIN_DB_PREFIX."mailing_cibles as mc";
 	$sql .= " WHERE mc.fk_mailing=".$object->id;
 	$sql .= $db->order($sortfield, $sortorder);
@@ -146,16 +146,16 @@ if (GETPOST('exportcsv', 'int'))
 		while ($obj = $db->fetch_object($resql))
 		{
 			print $obj->rowid.$sep;
-			print $obj->lastname.$sep;
+			print '"'.$obj->lastname.'"'.$sep;
-			print $obj->firstname.$sep;
+			print '"'.$obj->firstname.'"'.$sep;
 			print $obj->email.$sep;
 			print $obj->other.$sep;
-			print $obj->date_envoi.$sep;
 			print $obj->tms.$sep;
-			print $obj->source_url.$sep;
-			print $obj->source_id.$sep;
 			print $obj->source_type.$sep;
-			print $obj->error_text.$sep;
+			print $obj->source_id.$sep;
+			print $obj->date_envoi.$sep;
+			print $obj->status.$sep;
+			print '"'.$obj->error_text.'"'.$sep;
 			print "\n";
 		}
 
@@ -499,7 +499,7 @@ if ($object->fetch($id) >= 0)
 
 	    // Fix/update nbemail on emailing record if it differs (may happen if user edit lines from database directly)
 	    if (empty($asearchcriteriahasbeenset)) {
-	    	if ($nbtotalofrecords != $object->email) {
+	    	if ($nbtotalofrecords != $object->nbemail) {
 	    		dol_syslog("We found a difference in nb of record in target table and the property ->nbemail, we fix ->nbemail");
 	    		//print "nbemail=".$object->nbemail." nbtotalofrecords=".$nbtotalofrecords;
 	    		$resultrefresh = $object->refreshNbOfTargets();

htdocs/comm/mailing/class/mailing.class.php

@@ -619,12 +619,15 @@ class Mailing extends CommonObject
 				if (! $resqlupdate) {
 					$this->error = $this->db->lasterror();
 					return -1;
+				} else {
+					$this->nbemail = (int) $nbforupdate;
 				}
 			}
 		} else {
 			$this->error = $this->db->lasterror();
 			return -1;
 		}
+
 		return 1;
 	}
 

htdocs/core/class/notify.class.php

@@ -129,7 +129,7 @@ class Notify
 
 		if (is_array($listofnotiftodo)) {
 			$i = 0;
-			foreach ($listofnotiftodo as $key => $val) {
+			foreach ($listofnotiftodo as $val) {
 				if ($i) {
 					$texte .= ', ';
 				} else {

htdocs/core/lib/functions.lib.php

@@ -2909,7 +2909,7 @@ function getUserRemoteIP()
  *
  * @return	boolean		True if user is using HTTPS
  */
-function getIsHTTPS()
+function isHTTPS()
 {
 	$isSecure = false;
 	if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') {
@@ -3032,7 +3032,7 @@ function dol_print_address($address, $htmlid, $element, $id, $noprint = 0, $char
 /**
  *	Return true if email syntax is ok.
  *
- *	@param	    string		$address    			email (Ex: "toto@examle.com", "John Do <johndo@example.com>")
+ *	@param	    string		$address    			email (Ex: "toto@examle.com". Long form "John Do <johndo@example.com>" will be false)
  *  @param		int			$acceptsupervisorkey	If 1, the special string '__SUPERVISOREMAIL__' is also accepted as valid
  *	@return     boolean     						true if email syntax is OK, false if KO or empty string
  *  @see isValidMXRecord()
@@ -7123,9 +7123,9 @@ function dol_sort_array(&$array, $index, $order = 'asc', $natsort = 0, $case_sen
 			foreach (array_keys($array) as $key)
 			{
 				if (is_object($array[$key])) {
-					$temp[$key] = $array[$key]->$index;
+					$temp[$key] = empty($array[$key]->$index) ? 0 : $array[$key]->$index;
 				} else {
-					$temp[$key] = $array[$key][$index];
+					$temp[$key] = empty($array[$key][$index]) ? 0 : $array[$key][$index];
 				}
 			}
 

htdocs/core/lib/functions2.lib.php

@@ -1252,7 +1252,7 @@ function check_value($mask, $value)
 	//print "masktri=".$masktri." maskcounter=".$maskcounter." maskwithonlyymcode=".$maskwithonlyymcode." maskwithnocode=".$maskwithnocode." maskraz=".$maskraz." maskoffset=".$maskoffset."<br>\n";
 
 	if (function_exists('mb_strrpos')) {
-		$posnumstart = mb_strrpos($maskwithnocode, $maskcounter, 'UTF-8');
+		$posnumstart = mb_strrpos($maskwithnocode, $maskcounter, 0, 'UTF-8');
 	}
 	else {
 		$posnumstart = strrpos($maskwithnocode, $maskcounter);

htdocs/core/modules/mailings/xinputfile.modules.php

@@ -162,7 +162,6 @@ class mailing_xinputfile extends MailingTargets
 						if (!empty($buffer))
 						{
 							//print 'xx'.dol_strlen($buffer).empty($buffer)."<br>\n";
-							$id = $cpt;
 							if (isValidEMail($email))
 							{
 		   						if ($old <> $email)

htdocs/core/modules/societe/mod_codeclient_elephant.php

@@ -212,8 +212,8 @@ class mod_codeclient_elephant extends ModeleThirdPartyCode
 
 		// Get Mask value
 		$mask = '';
-		if ($type == 0) $mask = $conf->global->COMPANY_ELEPHANT_MASK_CUSTOMER;
+		if ($type == 0) $mask = empty($conf->global->COMPANY_ELEPHANT_MASK_CUSTOMER) ? '' : $conf->global->COMPANY_ELEPHANT_MASK_CUSTOMER;
-		if ($type == 1) $mask = $conf->global->COMPANY_ELEPHANT_MASK_SUPPLIER;
+		if ($type == 1) $mask = empty($conf->global->COMPANY_ELEPHANT_MASK_SUPPLIER) ? '' : $conf->global->COMPANY_ELEPHANT_MASK_SUPPLIER;
 		if (!$mask)
 		{
 			$this->error = 'NotConfigured';

htdocs/core/modules/societe/mod_codecompta_digitaria.php

@@ -157,6 +157,8 @@ class mod_codecompta_digitaria extends ModeleAccountancyCode
 		$i = 0;
 		$this->code = '';
 
+		$disponibility = 0;
+
 		if (is_object($societe))
 		{
 			dol_syslog("mod_codecompta_digitaria::get_code search code for type=".$type." & company=".(!empty($societe->name) ? $societe->name : ''));
@@ -216,8 +218,7 @@ class mod_codecompta_digitaria extends ModeleAccountancyCode
 			}
 		}
 
-		if ($disponibility == 0)
+		if ($disponibility == 0) {
-		{
 			return 0; // return ok
 		} else {
 			return -1; // return ko

htdocs/ecm/class/ecmdirectory.class.php

@@ -345,7 +345,7 @@ class EcmDirectory extends CommonObject
 		$sql .= " t.date_c as date_c,";
 		$sql .= " t.tms as date_m";
 		$sql .= " FROM ".MAIN_DB_PREFIX."ecm_directories as t";
-		$sql .= " WHERE t.rowid = ".$id;
+		$sql .= " WHERE t.rowid = ".((int) $id);
 
 		dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
 		$resql = $this->db->query($sql);

htdocs/ecm/dir_card.php

@@ -66,15 +66,15 @@ $ecmdir = new EcmDirectory($db);
 
 if ($module == 'ecm')
 {
+	// $section should be an int except if it is dir not yet created into EcmDirectory
 	$result = $ecmdir->fetch($section);
-	if (!$result > 0)
+	if ($result > 0) {
-	{
-		dol_print_error($db, $ecmdir->error);
-		exit;
-	}
-
 		$relativepath = $ecmdir->getRelativePath();
 		$upload_dir = $conf->ecm->dir_output.'/'.$relativepath;
+	} else {
+		$relativepath = $section;
+		$upload_dir = $conf->ecm->dir_output.'/'.$relativepath;
+	}
 } else // For example $module == 'medias'
 {
 	$relativepath = $section;
@@ -143,28 +143,23 @@ if ($action == 'confirm_deletefile' && $confirm == 'yes')
 }
 
 // Remove dir
-if ($action == 'confirm_deletedir' && $confirm == 'yes')
+if ($action == 'confirm_deletedir' && $confirm == 'yes') {
-{
 	$backtourl = DOL_URL_ROOT."/ecm/index.php";
-	if ($module == 'medias')
+	if ($module == 'medias') {
-	{
 		$backtourl = DOL_URL_ROOT."/website/index.php?file_manager=1";
 	}
 
 	$deletedirrecursive = (GETPOST('deletedirrecursive', 'alpha') == 'on' ? 1 : 0);
 
-	if ($module == 'ecm')
+	if ($module == 'ecm' && $ecmdir->id > 0) {	// If manual ECM and directory is indexed into database
-	{
 		// Fetch was already done
 		$result = $ecmdir->delete($user, 'all', $deletedirrecursive);
-		if ($result <= 0)
+		if ($result <= 0) {
-		{
 			$langs->load('errors');
 			setEventMessages($langs->trans($ecmdir->error, $ecmdir->label), null, 'errors');
 		}
 	} else {
-		if ($deletedirrecursive)
+		if ($deletedirrecursive) {
-		{
 			$resbool = dol_delete_dir_recursive($upload_dir, 0, 1);
 		} else {
 			$resbool = dol_delete_dir($upload_dir, 1);
@@ -176,8 +171,7 @@ if ($action == 'confirm_deletedir' && $confirm == 'yes')
 			$result = 0;
 		}
 	}
-	if ($result > 0)
+	if ($result > 0) {
-	{
 		header("Location: ".$backtourl);
 		exit;
 	}
@@ -269,10 +263,9 @@ if ($action == 'update' && !GETPOST('cancel', 'alpha'))
 }
 
 
-
+/*
-/*******************************************************************
  * View
-********************************************************************/
+ */
 
 $form = new Form($db);
 
@@ -281,9 +274,7 @@ $extrafields = new ExtraFields($db);
 // fetch optionals attributes and labels
 $extrafields->fetch_name_optionals_label($object->table_element);
 
-
+if ($module == 'ecm' && $ecmdir->id > 0) {
-if ($module == 'ecm')
-{
 	$object->fetch($ecmdir->id);
 }
 
@@ -323,6 +314,7 @@ if ($module == 'ecm')
 	$result = 1;
 	$i = 0;
 	$tmpecmdir = new EcmDirectory($db); // Need to create a new one
+	if ($ecmdir->id > 0) {
 		$tmpecmdir->fetch($ecmdir->id);
 		while ($tmpecmdir && $result > 0)
 		{
@@ -340,7 +332,9 @@ if ($module == 'ecm')
 			}
 			$i++;
 		}
-
+	} else {
+		$s .= join(' -> ', explode('/', $section));
+	}
 	$morehtmlref = '<a href="'.DOL_URL_ROOT.'/ecm/index.php">'.$langs->trans("ECMRoot").'</a> -> '.$s;
 }
 if ($module == 'medias')
@@ -393,9 +387,11 @@ if ($module == 'ecm')
 	print '</td></tr>';
 
 	print '<tr><td class="titlefield">'.$langs->trans("ECMCreationUser").'</td><td>';
+	if ($ecmdir->fk_user_c > 0) {
 		$userecm = new User($db);
 		$userecm->fetch($ecmdir->fk_user_c);
 		print $userecm->getNomUrl(1);
+	}
 	print '</td></tr>';
 }
 print '<tr><td class="titlefield">'.$langs->trans("ECMCreationDate").'</td><td>';

htdocs/includes/nusoap/lib/nusoap.php

@@ -6125,7 +6125,7 @@ class wsdl extends nusoap_base {
 				$rows = sizeof($value);
 				$contents = '';
 				foreach($value as $k => $v) {
-					$this->debug("serializing array element: $k, $v of type: $typeDef[arrayType]");
+					$this->debug("serializing array element: $k of type: ".$typeDef['arrayType']);
 					//if (strpos($typeDef['arrayType'], ':') ) {
 					if (!in_array($typeDef['arrayType'],$this->typemap['http://www.w3.org/2001/XMLSchema'])) {
 					    $contents .= $this->serializeType('item', $typeDef['arrayType'], $v, $use);

htdocs/product/class/product.class.php

@@ -2395,7 +2395,7 @@ class Product extends CommonObject
 	public function load_stats_mo($socid = 0)
 	{
 		// phpcs:enable
-		global $user, $hookmanager;
+		global $user, $hookmanager, $action;
 
 		$error = 0;
 
@@ -2408,7 +2408,7 @@ class Product extends CommonObject
 			$sql .= " SUM(mp.qty) as qty";
 			$sql .= " FROM ".MAIN_DB_PREFIX."mrp_mo as c";
 			$sql .= " INNER JOIN ".MAIN_DB_PREFIX."mrp_production as mp ON mp.fk_mo=c.rowid";
-			if (!$user->rights->societe->client->voir && !$socid) {
+			if (empty($user->rights->societe->client->voir) && !$socid) {
 				$sql .= "INNER JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc=c.fk_soc AND sc.fk_user = ".$user->id;
 			}
 			$sql .= " WHERE ";
@@ -2527,14 +2527,14 @@ class Product extends CommonObject
 		$sql .= " FROM ".MAIN_DB_PREFIX."propaldet as pd";
 		$sql .= ", ".MAIN_DB_PREFIX."propal as p";
 		$sql .= ", ".MAIN_DB_PREFIX."societe as s";
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE p.rowid = pd.fk_propal";
 		$sql .= " AND p.fk_soc = s.rowid";
 		$sql .= " AND p.entity IN (".getEntity('propal').")";
 		$sql .= " AND pd.fk_product = ".$this->id;
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND p.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		//$sql.= " AND pr.fk_statut != 0";
@@ -2593,23 +2593,26 @@ class Product extends CommonObject
 	public function load_stats_proposal_supplier($socid = 0)
 	{
 		// phpcs:enable
-		global $conf, $user, $hookmanager;
+		global $conf, $user, $hookmanager, $action;
 
 		$sql = "SELECT COUNT(DISTINCT p.fk_soc) as nb_suppliers, COUNT(DISTINCT p.rowid) as nb,";
 		$sql .= " COUNT(pd.rowid) as nb_rows, SUM(pd.qty) as qty";
 		$sql .= " FROM ".MAIN_DB_PREFIX."supplier_proposaldet as pd";
 		$sql .= ", ".MAIN_DB_PREFIX."supplier_proposal as p";
 		$sql .= ", ".MAIN_DB_PREFIX."societe as s";
-		if (!$user->rights->societe->client->voir && !$socid) { $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
+		if (empty($user->rights->societe->client->voir) && !$socid) {
+			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE p.rowid = pd.fk_supplier_proposal";
 		$sql .= " AND p.fk_soc = s.rowid";
 		$sql .= " AND p.entity IN (".getEntity('supplier_proposal').")";
 		$sql .= " AND pd.fk_product = ".$this->id;
-		if (!$user->rights->societe->client->voir && !$socid) { $sql .= " AND p.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
+		if (empty($user->rights->societe->client->voir) && !$socid) {
+			$sql .= " AND p.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		//$sql.= " AND pr.fk_statut != 0";
-		if ($socid > 0) {    $sql .= " AND p.fk_soc = ".$socid;
+		if ($socid > 0) {
+			$sql .= " AND p.fk_soc = ".$socid;
 		}
 
 		$result = $this->db->query($sql);
@@ -2665,7 +2668,7 @@ class Product extends CommonObject
 			$sql .= " AND c.fk_soc = ".$socid;
 		}
 		if ($filtrestatut <> '') {
-			$sql .= " AND c.fk_statut in (".$filtrestatut.")";
+			$sql .= " AND c.fk_statut in (".$this->db->sanitize($filtrestatut).")";
 		}
 
 		$result = $this->db->query($sql);
@@ -2744,28 +2747,28 @@ class Product extends CommonObject
 	public function load_stats_commande_fournisseur($socid = 0, $filtrestatut = '', $forVirtualStock = 0)
 	{
 		// phpcs:enable
-		global $conf, $user, $hookmanager;
+		global $conf, $user, $hookmanager, $action;
 
 		$sql = "SELECT COUNT(DISTINCT c.fk_soc) as nb_suppliers, COUNT(DISTINCT c.rowid) as nb,";
 		$sql .= " COUNT(cd.rowid) as nb_rows, SUM(cd.qty) as qty";
 		$sql .= " FROM ".MAIN_DB_PREFIX."commande_fournisseurdet as cd";
 		$sql .= ", ".MAIN_DB_PREFIX."commande_fournisseur as c";
 		$sql .= ", ".MAIN_DB_PREFIX."societe as s";
-		if (!$user->rights->societe->client->voir && !$socid && !$forVirtualStock) {
+		if (empty($user->rights->societe->client->voir) && !$socid && !$forVirtualStock) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE c.rowid = cd.fk_commande";
 		$sql .= " AND c.fk_soc = s.rowid";
 		$sql .= " AND c.entity IN (".getEntity($forVirtualStock && !empty($conf->global->STOCK_CALCULATE_VIRTUAL_STOCK_TRANSVERSE_MODE) ? 'stock' : 'supplier_order').")";
 		$sql .= " AND cd.fk_product = ".$this->id;
-		if (!$user->rights->societe->client->voir && !$socid && !$forVirtualStock) {
+		if (empty($user->rights->societe->client->voir) && !$socid && !$forVirtualStock) {
 			$sql .= " AND c.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		if ($socid > 0) {
 			$sql .= " AND c.fk_soc = ".$socid;
 		}
 		if ($filtrestatut != '') {
-			$sql .= " AND c.fk_statut in (".$filtrestatut.")"; // Peut valoir 0
+			$sql .= " AND c.fk_statut in (".$this->db->sanitize($filtrestatut).")"; // Peut valoir 0
 		}
 
 		$result = $this->db->query($sql);
@@ -2809,7 +2812,7 @@ class Product extends CommonObject
 		$sql .= ", ".MAIN_DB_PREFIX."commande as c";
 		$sql .= ", ".MAIN_DB_PREFIX."expedition as e";
 		$sql .= ", ".MAIN_DB_PREFIX."societe as s";
-		if (!$user->rights->societe->client->voir && !$socid && !$forVirtualStock) {
+		if (empty($user->rights->societe->client->voir) && !$socid && !$forVirtualStock) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE e.rowid = ed.fk_expedition";
@@ -2818,16 +2821,16 @@ class Product extends CommonObject
 		$sql .= " AND e.entity IN (".getEntity($forVirtualStock && !empty($conf->global->STOCK_CALCULATE_VIRTUAL_STOCK_TRANSVERSE_MODE) ? 'stock' : 'expedition').")";
 		$sql .= " AND ed.fk_origin_line = cd.rowid";
 		$sql .= " AND cd.fk_product = ".$this->id;
-		if (!$user->rights->societe->client->voir && !$socid && !$forVirtualStock) {
+		if (empty($user->rights->societe->client->voir) && !$socid && !$forVirtualStock) {
 			$sql .= " AND e.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		if ($socid > 0) {
 			$sql .= " AND e.fk_soc = ".$socid;
 		}
 		if ($filtrestatut <> '') {
-			$sql .= " AND c.fk_statut in (".$filtrestatut.")";
+			$sql .= " AND c.fk_statut IN (".$this->db->sanitize($filtrestatut).")";
 		}
-		if (!empty($filterShipmentStatus)) $sql .= " AND e.fk_statut IN (".$filterShipmentStatus.")";
+		if (!empty($filterShipmentStatus)) $sql .= " AND e.fk_statut IN (".$this->db->sanitize($filterShipmentStatus).")";
 
 		$result = $this->db->query($sql);
 		if ($result) {
@@ -2881,24 +2884,28 @@ class Product extends CommonObject
 	public function load_stats_reception($socid = 0, $filtrestatut = '', $forVirtualStock = 0)
 	{
 		// phpcs:enable
-		global $conf, $user, $hookmanager;
+		global $conf, $user, $hookmanager, $action;
 
 		$sql = "SELECT COUNT(DISTINCT cf.fk_soc) as nb_suppliers, COUNT(DISTINCT cf.rowid) as nb,";
 		$sql .= " COUNT(fd.rowid) as nb_rows, SUM(fd.qty) as qty";
 		$sql .= " FROM ".MAIN_DB_PREFIX."commande_fournisseur_dispatch as fd";
 		$sql .= ", ".MAIN_DB_PREFIX."commande_fournisseur as cf";
 		$sql .= ", ".MAIN_DB_PREFIX."societe as s";
-		if (!$user->rights->societe->client->voir && !$socid && !$forVirtualStock) { $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
+		if (empty($user->rights->societe->client->voir) && !$socid && !$forVirtualStock) {
+			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE cf.rowid = fd.fk_commande";
 		$sql .= " AND cf.fk_soc = s.rowid";
 		$sql .= " AND cf.entity IN (".getEntity($forVirtualStock && !empty($conf->global->STOCK_CALCULATE_VIRTUAL_STOCK_TRANSVERSE_MODE) ? 'stock' : 'supplier_order').")";
 		$sql .= " AND fd.fk_product = ".$this->id;
-		if (!$user->rights->societe->client->voir && !$socid && !$forVirtualStock) { $sql .= " AND cf.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
+		if (empty($user->rights->societe->client->voir) && !$socid && !$forVirtualStock) {
+			$sql .= " AND cf.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
-		if ($socid > 0) {    $sql .= " AND cf.fk_soc = ".$socid;
+		if ($socid > 0) {
+			$sql .= " AND cf.fk_soc = ".$socid;
 		}
-		if ($filtrestatut <> '') { $sql .= " AND cf.fk_statut in (".$filtrestatut.")";
+		if ($filtrestatut <> '') {
+			$sql .= " AND cf.fk_statut IN (".$this->db->sanitize($filtrestatut).")";
 		}
 
 		$result = $this->db->query($sql);
@@ -2939,20 +2946,20 @@ class Product extends CommonObject
 		$sql .= " FROM ".MAIN_DB_PREFIX."mrp_production as mp";
 		$sql .= ", ".MAIN_DB_PREFIX."mrp_mo as m";
 		$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe as s ON s.rowid = m.fk_soc";
-		if (!$user->rights->societe->client->voir && !$socid && !$forVirtualStock) {
+		if (empty($user->rights->societe->client->voir) && !$socid && !$forVirtualStock) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE m.rowid = mp.fk_mo";
 		$sql .= " AND m.entity IN (".getEntity($forVirtualStock && !empty($conf->global->STOCK_CALCULATE_VIRTUAL_STOCK_TRANSVERSE_MODE) ? 'stock' : 'mrp').")";
 		$sql .= " AND mp.fk_product = ".$this->id;
-		if (!$user->rights->societe->client->voir && !$socid && !$forVirtualStock) {
+		if (empty($user->rights->societe->client->voir) && !$socid && !$forVirtualStock) {
 			$sql .= " AND m.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		if ($socid > 0) {
 			$sql .= " AND m.fk_soc = ".$socid;
 		}
 		if ($filtrestatut <> '') {
-			$sql .= " AND m.status in (".$filtrestatut.")";
+			$sql .= " AND m.status IN (".$this->db->sanitize($filtrestatut).")";
 		}
 		$sql .= " GROUP BY role";
 
@@ -3026,14 +3033,14 @@ class Product extends CommonObject
 		$sql .= " FROM ".MAIN_DB_PREFIX."contratdet as cd";
 		$sql .= ", ".MAIN_DB_PREFIX."contrat as c";
 		$sql .= ", ".MAIN_DB_PREFIX."societe as s";
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE c.rowid = cd.fk_contrat";
 		$sql .= " AND c.fk_soc = s.rowid";
 		$sql .= " AND c.entity IN (".getEntity('contract').")";
 		$sql .= " AND cd.fk_product = ".$this->id;
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND c.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		//$sql.= " AND c.statut != 0";
@@ -3098,14 +3105,14 @@ class Product extends CommonObject
 		$sql .= " FROM ".MAIN_DB_PREFIX."facturedet as fd";
 		$sql .= ", ".MAIN_DB_PREFIX."facture as f";
 		$sql .= ", ".MAIN_DB_PREFIX."societe as s";
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE f.rowid = fd.fk_facture";
 		$sql .= " AND f.fk_soc = s.rowid";
 		$sql .= " AND f.entity IN (".getEntity('invoice').")";
 		$sql .= " AND fd.fk_product = ".$this->id;
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND f.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		//$sql.= " AND f.fk_statut != 0";
@@ -3163,21 +3170,21 @@ class Product extends CommonObject
 	public function load_stats_facture_fournisseur($socid = 0)
 	{
 		// phpcs:enable
-		global $conf, $user, $hookmanager;
+		global $conf, $user, $hookmanager, $action;
 
 		$sql = "SELECT COUNT(DISTINCT f.fk_soc) as nb_suppliers, COUNT(DISTINCT f.rowid) as nb,";
 		$sql .= " COUNT(fd.rowid) as nb_rows, SUM(fd.qty) as qty";
 		$sql .= " FROM ".MAIN_DB_PREFIX."facture_fourn_det as fd";
 		$sql .= ", ".MAIN_DB_PREFIX."facture_fourn as f";
 		$sql .= ", ".MAIN_DB_PREFIX."societe as s";
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE f.rowid = fd.fk_facture_fourn";
 		$sql .= " AND f.fk_soc = s.rowid";
 		$sql .= " AND f.entity IN (".getEntity('facture_fourn').")";
 		$sql .= " AND fd.fk_product = ".$this->id;
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND f.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		//$sql.= " AND f.fk_statut != 0";
@@ -3302,7 +3309,7 @@ class Product extends CommonObject
 		if ($filteronproducttype >= 0) {
 			$sql .= ", ".MAIN_DB_PREFIX."product as p";
 		}
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE f.rowid = d.fk_facture";
@@ -3312,11 +3319,11 @@ class Product extends CommonObject
 			$sql .= " AND d.fk_product > 0";
 		}
 		if ($filteronproducttype >= 0) {
-			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type =".$filteronproducttype;
+			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type = ".((int) $filteronproducttype);
 		}
 		$sql .= " AND f.fk_soc = s.rowid";
 		$sql .= " AND f.entity IN (".getEntity('invoice').")";
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND f.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		if ($socid > 0) {
@@ -3355,7 +3362,7 @@ class Product extends CommonObject
 		if ($filteronproducttype >= 0) {
 			$sql .= ", ".MAIN_DB_PREFIX."product as p";
 		}
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE f.rowid = d.fk_facture_fourn";
@@ -3365,11 +3372,11 @@ class Product extends CommonObject
 			$sql .= " AND d.fk_product > 0";
 		}
 		if ($filteronproducttype >= 0) {
-			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type =".$filteronproducttype;
+			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type = ".((int) $filteronproducttype);
 		}
 		$sql .= " AND f.fk_soc = s.rowid";
 		$sql .= " AND f.entity IN (".getEntity('facture_fourn').")";
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND f.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		if ($socid > 0) {
@@ -3406,7 +3413,7 @@ class Product extends CommonObject
 		if ($filteronproducttype >= 0) {
 			$sql .= ", ".MAIN_DB_PREFIX."product as prod";
 		}
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE p.rowid = d.fk_propal";
@@ -3416,11 +3423,11 @@ class Product extends CommonObject
 			$sql .= " AND d.fk_product > 0";
 		}
 		if ($filteronproducttype >= 0) {
-			$sql .= " AND prod.rowid = d.fk_product AND prod.fk_product_type =".$filteronproducttype;
+			$sql .= " AND prod.rowid = d.fk_product AND prod.fk_product_type = ".((int) $filteronproducttype);
 		}
 		$sql .= " AND p.fk_soc = s.rowid";
 		$sql .= " AND p.entity IN (".getEntity('propal').")";
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND p.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		if ($socid > 0) {
@@ -3458,7 +3465,7 @@ class Product extends CommonObject
 		if ($filteronproducttype >= 0) {
 			$sql .= ", ".MAIN_DB_PREFIX."product as prod";
 		}
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE p.rowid = d.fk_supplier_proposal";
@@ -3468,11 +3475,11 @@ class Product extends CommonObject
 			$sql .= " AND d.fk_product > 0";
 		}
 		if ($filteronproducttype >= 0) {
-			$sql .= " AND prod.rowid = d.fk_product AND prod.fk_product_type =".$filteronproducttype;
+			$sql .= " AND prod.rowid = d.fk_product AND prod.fk_product_type = ".((int) $filteronproducttype);
 		}
 		$sql .= " AND p.fk_soc = s.rowid";
 		$sql .= " AND p.entity IN (".getEntity('supplier_proposal').")";
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND p.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		if ($socid > 0) {
@@ -3509,7 +3516,7 @@ class Product extends CommonObject
 		if ($filteronproducttype >= 0) {
 			$sql .= ", ".MAIN_DB_PREFIX."product as p";
 		}
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE c.rowid = d.fk_commande";
@@ -3519,11 +3526,11 @@ class Product extends CommonObject
 			$sql .= " AND d.fk_product > 0";
 		}
 		if ($filteronproducttype >= 0) {
-			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type =".$filteronproducttype;
+			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type = ".((int) $filteronproducttype);
 		}
 		$sql .= " AND c.fk_soc = s.rowid";
 		$sql .= " AND c.entity IN (".getEntity('commande').")";
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND c.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		if ($socid > 0) {
@@ -3560,7 +3567,7 @@ class Product extends CommonObject
 		if ($filteronproducttype >= 0) {
 			$sql .= ", ".MAIN_DB_PREFIX."product as p";
 		}
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 		$sql .= " WHERE c.rowid = d.fk_commande";
@@ -3570,11 +3577,11 @@ class Product extends CommonObject
 			$sql .= " AND d.fk_product > 0";
 		}
 		if ($filteronproducttype >= 0) {
-			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type =".$filteronproducttype;
+			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type = ".((int) $filteronproducttype);
 		}
 		$sql .= " AND c.fk_soc = s.rowid";
 		$sql .= " AND c.entity IN (".getEntity('supplier_order').")";
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND c.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		if ($socid > 0) {
@@ -3611,7 +3618,7 @@ class Product extends CommonObject
 		if ($filteronproducttype >= 0) {
 			$sql .= ", ".MAIN_DB_PREFIX."product as p";
 		}
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 
@@ -3624,11 +3631,11 @@ class Product extends CommonObject
 			$sql .= " AND d.fk_product > 0";
 		}
 		if ($filteronproducttype >= 0) {
-			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type =".$filteronproducttype;
+			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type = ".((int) $filteronproducttype);
 		}
 		$sql .= " AND c.fk_soc = s.rowid";
 
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND c.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		if ($socid > 0) {
@@ -3665,7 +3672,7 @@ class Product extends CommonObject
 		if ($filteronproducttype >= 0) {
 			$sql .= ", ".MAIN_DB_PREFIX."product as p";
 		}
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 		}
 
@@ -3678,10 +3685,10 @@ class Product extends CommonObject
 			$sql .= " AND d.fk_product > 0";
 		}
 		if ($filteronproducttype >= 0) {
-			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type =".$filteronproducttype;
+			$sql .= " AND p.rowid = d.fk_product AND p.fk_product_type = ".((int) $filteronproducttype);
 		}
 
-		if (!$user->rights->societe->client->voir && !$socid) {
+		if (empty($user->rights->societe->client->voir) && !$socid) {
 			$sql .= " AND d.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
 		}
 		if ($socid > 0) {

htdocs/product/list.php

@@ -533,9 +533,6 @@ if ($resql)
 		//'builddoc'=>$langs->trans("PDFMerge"),
 		//'presend'=>$langs->trans("SendByMail"),
 	);
-
-	$rightskey = 'produit';
-	if ($type == Product::TYPE_SERVICE) $rightskey = 'service';
 	if ($user->rights->{$rightskey}->supprimer) $arrayofmassactions['predelete'] = "<span class='fa fa-trash paddingrightonly'></span>".$langs->trans("Delete");
 	if (in_array($massaction, array('presend', 'predelete'))) $arrayofmassactions = array();
 	$massactionbutton = $form->selectMassAction('', $arrayofmassactions);

htdocs/societe/card.php

@@ -109,7 +109,7 @@ if ($object->id > 0) {
 
 $permissiontoread = $user->rights->societe->lire;
 $permissiontoadd = $user->rights->societe->creer; // Used by the include of actions_addupdatedelete.inc.php and actions_lineupdown.inc.php
-$permissiontodelete = $user->rights->societe->delete || ($permissiontoadd && isset($object->status) && $object->status == 0);
+$permissiontodelete = $user->rights->societe->supprimer || ($permissiontoadd && isset($object->status) && $object->status == 0);
 $permissionnote = $user->rights->societe->creer; // Used by the include of actions_setnotes.inc.php
 $permissiondellink = $user->rights->societe->creer; // Used by the include of actions_dellink.inc.php
 $upload_dir = $conf->societe->multidir_output[isset($object->entity) ? $object->entity : 1];
@@ -1355,7 +1355,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action))
 		print '<td'.($conf->browser->layout == 'phone' ? ' colspan="3"' : '').'>'.img_picto('', 'object_phoning_fax').' <input type="text" name="fax" id="fax" class="maxwidth200 widthcentpercentminusx" value="'.(GETPOSTISSET('fax') ?GETPOST('fax', 'alpha') : $object->fax).'"></td></tr>';
 
 		// Email / Web
-		print '<tr><td>'.$form->editfieldkey('EMail', 'email', '', $object, 0, 'string', '', $conf->global->SOCIETE_EMAIL_MANDATORY).'</td>';
+		print '<tr><td>'.$form->editfieldkey('EMail', 'email', '', $object, 0, 'string', '', empty($conf->global->SOCIETE_EMAIL_MANDATORY) ? '' : $conf->global->SOCIETE_EMAIL_MANDATORY).'</td>';
 		print '<td colspan="3">'.img_picto('', 'object_email').' <input type="text" class="maxwidth500 widthcentpercentminusx" name="email" id="email" value="'.$object->email.'"></td></tr>';
 		print '<tr><td>'.$form->editfieldkey('Web', 'url', '', $object, 0).'</td>';
 		print '<td colspan="3">'.img_picto('', 'globe').' <input type="text" class="maxwidth500 widthcentpercentminusx" name="url" id="url" value="'.$object->url.'"></td></tr>';
@@ -1366,7 +1366,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action))
 					print '<tr>';
 					print '<td><label for="'.$value['label'].'">'.$form->editfieldkey($value['label'], $key, '', $object, 0).'</label></td>';
 					print '<td colspan="3">';
-					print '<input type="text" name="'.$key.'" id="'.$key.'" class="minwidth100" maxlength="80" value="'.dol_escape_htmltag(GETPOSTISSET($key) ?GETPOST($key, 'alphanohtml') : $object->socialnetworks[$key]).'">';
+					print '<input type="text" name="'.$key.'" id="'.$key.'" class="minwidth100" maxlength="80" value="'.dol_escape_htmltag(GETPOSTISSET($key) ? GETPOST($key, 'alphanohtml') : (empty($object->socialnetworks[$key]) ? '' : $object->socialnetworks[$key])).'">';
 					print '</td>';
 					print '</tr>';
 				} elseif (!empty($object->socialnetworks[$key])) {

htdocs/theme/eldy/global.inc.php

@@ -35,7 +35,7 @@
 	--oddevencolor: #202020;
 	--colorboxstatsborder: #e0e0e0;
 	--dolgraphbg: rgba(255,255,255,0);
-	--fieldrequiredcolor: #804000;
+	--fieldrequiredcolor: #700040;
 	--colortextbacktab: #<?php print $colortextbacktab; ?>;
 	--colorboxiconbg: #eee;
 	--refidnocolor:#444;

htdocs/user/class/user.class.php

@@ -2418,6 +2418,7 @@ class User extends CommonObject
 		}
 
 		$result = ''; $label = '';
+		$companylink = '';
 
 		if (!empty($this->photo)) {
 			$label .= '<div class="photointooltip">';

htdocs/webservices/server_invoice.php

@@ -288,7 +288,7 @@ $server->register(
  */
 function getInvoice($authentication, $id = '', $ref = '', $ref_ext = '')
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: getInvoice login=".$authentication['login']." id=".$id." ref=".$ref." ref_ext=".$ref_ext);
 
@@ -363,7 +363,7 @@ function getInvoice($authentication, $id = '', $ref = '', $ref_ext = '')
 						'note_private' => $invoice->note_private ? $invoice->note_private : '',
 						'note_public' => $invoice->note_public ? $invoice->note_public : '',
 						'status' => $invoice->statut,
-					'project_id' => $invoic->fk_project,
+						'project_id' => $invoice->fk_project,
 						'close_code' => $invoice->close_code ? $invoice->close_code : '',
 						'close_note' => $invoice->close_note ? $invoice->close_note : '',
 						'payment_mode_id' => $invoice->mode_reglement_id ? $invoice->mode_reglement_id : '',
@@ -399,7 +399,7 @@ function getInvoice($authentication, $id = '', $ref = '', $ref_ext = '')
  */
 function getInvoicesForThirdParty($authentication, $idthirdparty)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: getInvoicesForThirdParty login=".$authentication['login']." idthirdparty=".$idthirdparty);
 
@@ -492,7 +492,7 @@ function getInvoicesForThirdParty($authentication, $idthirdparty)
 						'note_private' => $invoice->note_private ? $invoice->note_private : '',
 						'note_public' => $invoice->note_public ? $invoice->note_public : '',
 						'status'=> $invoice->statut,
-										'project_id' => $invoic->fk_project,
+						'project_id' => $invoice->fk_project,
 						'close_code' => $invoice->close_code ? $invoice->close_code : '',
 						'close_note' => $invoice->close_note ? $invoice->close_note : '',
 						'payment_mode_id' => $invoice->mode_reglement_id ? $invoice->mode_reglement_id : '',
@@ -528,17 +528,16 @@ function getInvoicesForThirdParty($authentication, $idthirdparty)
  * Create an invoice
  *
  * @param	array		$authentication		Array of authentication information
- * @param	Facture		$invoice			Invoice
+ * @param	array		$invoice			Invoice
  * @return	array							Array result
  */
 function createInvoice($authentication, $invoice)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	$now = dol_now();
 
-	dol_syslog("Function: createInvoice login=".$authentication['login']." id=".$invoice->id.
+	dol_syslog("Function: createInvoice login=".$authentication['login']." id=".$invoice['id'].", ref=".$invoice['ref'].", ref_ext=".$invoice['ref_ext']);
-			", ref=".$invoice->ref.", ref_ext=".$invoice->ref_ext);
 
 	if ($authentication['entity']) $conf->entity = $authentication['entity'];
 
@@ -580,22 +579,22 @@ function createInvoice($authentication, $invoice)
 		if (isset($invoice['lines']['line'][0])) $arrayoflines = $invoice['lines']['line'];
 		else $arrayoflines = $invoice['lines'];
 
-		foreach ($arrayoflines as $key => $line)
+		foreach ($arrayoflines as $line)
 		{
 			// $key can be 'line' or '0','1',...
 			$newline = new FactureLigne($db);
 			$newline->product_type = $line['type'];
 			$newline->desc = $line['desc'];
-			$newline->fk_product = $line['fk_product'];
+			$newline->fk_product = $line['product_id'];
-			$newline->tva_tx = $line['vat_rate'];
+			$newline->tva_tx = isset($line['vat_rate']) ? $line['vat_rate'] : 0;
 			$newline->qty = $line['qty'];
-			$newline->subprice = $line['unitprice'];
+			$newline->subprice = isset($line['unitprice']) ? $line['unitprice'] : null;
 			$newline->total_ht = $line['total_net'];
 			$newline->total_tva = $line['total_vat'];
 			$newline->total_ttc = $line['total'];
 			$newline->date_start = dol_stringtotime($line['date_start']);
 			$newline->date_end = dol_stringtotime($line['date_end']);
-			$newline->fk_product = $line['product_id'];
+
 			$new_invoice->lines[] = $newline;
 		}
 		//var_dump($newobject->date_lim_reglement); exit;
@@ -654,10 +653,7 @@ function createInvoiceFromOrder($authentication, $id_order = '', $ref_order = ''
 {
 	global $db, $conf;
 
-	$now = dol_now();
+	dol_syslog("Function: createInvoiceFromOrder login=".$authentication['login']." id=".$id_order.", ref=".$ref_order.", ref_ext=".$ref_ext_order);
-
-	dol_syslog("Function: createInvoiceFromOrder login=".$authentication['login']." id=".$id_order.
-			", ref=".$ref_order.", ref_ext=".$ref_ext_order);
 
 	if ($authentication['entity']) $conf->entity = $authentication['entity'];
 
@@ -781,12 +777,11 @@ function updateInvoice($authentication, $invoice)
 						$object->generateDocument($object->model_pdf, $outputlangs);
 					}
 				}
-				if ($invoice['status'] == Facture::STATUS_CLOSED)
+				if ($invoice['status'] == Facture::STATUS_CLOSED) {
-				{
+					$result = $object->set_paid($fuser, $invoice['close_code'], $invoice['close_note']);
-					$result = $object->set_paid($fuser, $invoice->close_code, $invoice->close_note);
 				}
 				if ($invoice['status'] == Facture::STATUS_ABANDONED)
-					$result = $object->set_canceled($fuser, $invoice->close_code, $invoice->close_note);
+					$result = $object->set_canceled($fuser, $invoice['close_code'], $invoice['close_note']);
 			}
 		}
 

htdocs/webservices/server_order.php

@@ -354,7 +354,7 @@ $server->register(
  */
 function getOrder($authentication, $id = '', $ref = '', $ref_ext = '')
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: getOrder login=".$authentication['login']." id=".$id." ref=".$ref." ref_ext=".$ref_ext);
 
@@ -504,7 +504,7 @@ function getOrder($authentication, $id = '', $ref = '', $ref_ext = '')
  */
 function getOrdersForThirdParty($authentication, $idthirdparty)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: getOrdersForThirdParty login=".$authentication['login']." idthirdparty=".$idthirdparty);
 
@@ -813,7 +813,7 @@ function validOrder($authentication, $id = '', $id_warehouse = 0)
 {
 	global $db, $conf, $langs;
 
-	dol_syslog("Function: validOrder login=".$authentication['login']." id=".$id." ref=".$ref." ref_ext=".$ref_ext);
+	dol_syslog("Function: validOrder login=".$authentication['login']." id=".$id." id_warehouse=".$id_warehouse);
 
 	// Init and check authentication
 	$objectresp = array();
@@ -830,7 +830,7 @@ function validOrder($authentication, $id = '', $id_warehouse = 0)
 		if ($fuser->rights->commande->lire)
 		{
 			$order = new Commande($db);
-			$result = $order->fetch($id, $ref, $ref_ext);
+			$result = $order->fetch($id);
 
 			$order->fetch_thirdparty();
 			$db->begin();
@@ -889,8 +889,6 @@ function updateOrder($authentication, $order)
 {
 	global $db, $conf, $langs;
 
-	$now = dol_now();
-
 	dol_syslog("Function: updateOrder login=".$authentication['login']);
 
 	if ($authentication['entity']) $conf->entity = $authentication['entity'];

htdocs/webservices/server_other.php

@@ -145,7 +145,7 @@ $server->register(
  */
 function getVersions($authentication)
 {
-	global $db, $conf, $langs;
+	global $conf;
 
 	dol_syslog("Function: getVersions login=".$authentication['login']);
 
@@ -188,7 +188,7 @@ function getVersions($authentication)
  */
 function getDocument($authentication, $modulepart, $file, $refname = '')
 {
-	global $db, $conf, $langs, $mysoc;
+	global $db, $conf;
 
 	dol_syslog("Function: getDocument login=".$authentication['login'].' - modulepart='.$modulepart.' - file='.$file);
 
@@ -283,10 +283,7 @@ function getDocument($authentication, $modulepart, $file, $refname = '')
 		{
 			if (file_exists($original_file))
 			{
-				dol_syslog("Function: getDocument $original_file $filename content-type=$type");
+				dol_syslog("Function: getDocument $original_file  content-type=$type");
-
-				$file = $fileparams['fullname'];
-				$filename = basename($file);
 
 				$f = fopen($original_file, 'r');
 				$content_file = fread($f, filesize($original_file));

htdocs/webservices/server_payment.php

@@ -45,6 +45,7 @@ $langs->load("main");
 if (empty($conf->global->MAIN_MODULE_WEBSERVICES))
 {
 	   $langs->load("admin");
+
 	   dol_syslog("Call Dolibarr webservices interfaces with module webservices disabled");
 	   print $langs->trans("WarningModuleNotActive", 'WebServices').'.<br><br>';
 	   print $langs->trans("ToActivateModule");
@@ -139,7 +140,7 @@ $server->register(
  */
 function createPayment($authentication, $payment)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	$now = dol_now();
 
@@ -165,7 +166,7 @@ function createPayment($authentication, $payment)
 	if (!$error)
 	{
 		$soc = new Societe($db);
-		$res = $soc->fetch($payment['thirdparty_id']);
+		$soc->fetch($payment['thirdparty_id']);
 
 		$new_payment              = new Paiement($db);
 		$new_payment->amount      = doubleval($payment['amount']);

htdocs/webservices/server_productorservice.php

@@ -479,7 +479,7 @@ function getProductOrService($authentication, $id = '', $ref = '', $ref_ext = ''
  */
 function createProductOrService($authentication, $product)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	$now = dol_now();
 
@@ -536,7 +536,7 @@ function createProductOrService($authentication, $product)
 
 		$newobject->stock_reel = isset($product['stock_real']) ? $product['stock_real'] : null;
 		$newobject->pmp = isset($product['pmp']) ? $product['pmp'] : null;
-		$newobject->seuil_stock_alert = isset($product['stock_alert']) ? $product['stock_alert'] : null;
+		$newobject->seuil_stock_alerte = isset($product['stock_alert']) ? $product['stock_alert'] : null;
 
 		$newobject->country_id = isset($product['country_id']) ? $product['country_id'] : 0;
 		if (!empty($product['country_code'])) $newobject->country_id = getCountry($product['country_code'], 3);
@@ -650,7 +650,7 @@ function createProductOrService($authentication, $product)
  */
 function updateProductOrService($authentication, $product)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	$now = dol_now();
 
@@ -705,15 +705,15 @@ function updateProductOrService($authentication, $product)
 				$newobject->barcode_type = $product['barcode_type'];
 		}
 
-		$newobject->stock_reel = $product['stock_real'];
+		$newobject->stock_reel = isset($product['stock_real']) ? $product['stock_real'] : null;
-		$newobject->pmp = $product['pmp'];
+		$newobject->pmp = isset($product['pmp']) ? $product['pmp'] : null;
-		$newobject->seuil_stock_alert = $product['stock_alert'];
+		$newobject->seuil_stock_alerte = isset($product['stock_alert']) ? $product['stock_alert'] : null;
 
-		$newobject->country_id = $product['country_id'];
+		$newobject->country_id = isset($product['country_id']) ? $product['country_id'] : 0;
-		if ($product['country_code']) $newobject->country_id = getCountry($product['country_code'], 3);
+		if (!empty($product['country_code'])) $newobject->country_id = getCountry($product['country_code'], 3);
-		$newobject->customcode = $product['customcode'];
+		$newobject->customcode = isset($product['customcode']) ? $product['customcode'] : '';
 
-		$newobject->canvas = $product['canvas'];
+		$newobject->canvas = isset($product['canvas']) ? $product['canvas'] : '';
 
 		$elementtype = 'product';
 
@@ -824,7 +824,7 @@ function updateProductOrService($authentication, $product)
  */
 function deleteProductOrService($authentication, $listofidstring)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: deleteProductOrService login=".$authentication['login']);
 
@@ -855,7 +855,7 @@ function deleteProductOrService($authentication, $listofidstring)
 
 		$db->begin();
 
-		foreach ($listofid as $key => $id)
+		foreach ($listofid as $id)
 		{
 			$newobject = new Product($db);
 			$result = $newobject->fetch($id);
@@ -917,7 +917,7 @@ function deleteProductOrService($authentication, $listofidstring)
  */
 function getListOfProductsOrServices($authentication, $filterproduct)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: getListOfProductsOrServices login=".$authentication['login']);
 

htdocs/webservices/server_project.php

@@ -131,7 +131,7 @@ $server->wsdl->addComplexType(
 );
 
 $project_elements = array();
-foreach ($listofreferent as $key => $_)
+foreach ($listofreferent as $key => $label)
 {
 	$project_elements[$key] = array('name'=>$key, 'type'=>'tns:elementsArray');
 }
@@ -338,7 +338,7 @@ function createProject($authentication, $project)
  */
 function getProject($authentication, $id = '', $ref = '')
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: getProject login=".$authentication['login']." id=".$id." ref=".$ref);
 

htdocs/webservices/server_supplier_invoice.php

@@ -225,7 +225,7 @@ $server->register(
  */
 function getSupplierInvoice($authentication, $id = '', $ref = '', $ref_ext = '')
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: getSupplierInvoice login=".$authentication['login']." id=".$id." ref=".$ref." ref_ext=".$ref_ext);
 
@@ -333,7 +333,7 @@ function getSupplierInvoice($authentication, $id = '', $ref = '', $ref_ext = '')
  */
 function getSupplierInvoicesForThirdParty($authentication, $idthirdparty)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: getSupplierInvoicesForThirdParty login=".$authentication['login']." idthirdparty=".$idthirdparty);
 
@@ -344,6 +344,7 @@ function getSupplierInvoicesForThirdParty($authentication, $idthirdparty)
 	$errorcode = ''; $errorlabel = '';
 	$error = 0;
 	$fuser = check_authentication($authentication, $error, $errorcode, $errorlabel);
+
 	// Check parameters
 	if (!$error && empty($idthirdparty))
 	{

htdocs/webservices/server_thirdparty.php

@@ -290,7 +290,7 @@ $server->register(
  */
 function getThirdParty($authentication, $id = '', $ref = '', $ref_ext = '')
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: getThirdParty login=".$authentication['login']." id=".$id." ref=".$ref." ref_ext=".$ref_ext);
 
@@ -408,7 +408,7 @@ function getThirdParty($authentication, $id = '', $ref = '', $ref_ext = '')
  */
 function createThirdParty($authentication, $thirdparty)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	$now = dol_now();
 
@@ -538,7 +538,7 @@ function createThirdParty($authentication, $thirdparty)
  */
 function updateThirdParty($authentication, $thirdparty)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	$now = dol_now();
 
@@ -672,9 +672,7 @@ function updateThirdParty($authentication, $thirdparty)
  */
 function getListOfThirdParties($authentication, $filterthirdparty)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
-
-	$now = dol_now();
 
 	dol_syslog("Function: getListOfThirdParties login=".$authentication['login']);
 
@@ -782,7 +780,7 @@ function getListOfThirdParties($authentication, $filterthirdparty)
  */
 function deleteThirdParty($authentication, $id = '', $ref = '', $ref_ext = '')
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: deleteThirdParty login=".$authentication['login']." id=".$id." ref=".$ref." ref_ext=".$ref_ext);
 

htdocs/webservices/server_user.php

@@ -308,7 +308,7 @@ $server->register(
  */
 function getUser($authentication, $id, $ref = '', $ref_ext = '')
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
 
 	dol_syslog("Function: getUser login=".$authentication['login']." id=".$id." ref=".$ref." ref_ext=".$ref_ext);
 
@@ -399,9 +399,7 @@ function getUser($authentication, $id, $ref = '', $ref_ext = '')
  */
 function getListOfGroups($authentication)
 {
-	global $db, $conf, $langs;
+	global $db, $conf;
-
-	$now = dol_now();
 
 	dol_syslog("Function: getListOfGroups login=".$authentication['login']);
 
@@ -477,7 +475,7 @@ function createUserFromThirdparty($authentication, $thirdpartywithuser)
 {
 	global $db, $conf, $langs;
 
-	dol_syslog("Function: createUserFromThirdparty login=".$authentication['login']." id=".$id." ref=".$ref." ref_ext=".$ref_ext);
+	dol_syslog("Function: createUserFromThirdparty login=".$authentication['login']);
 
 	if ($authentication['entity']) $conf->entity = $authentication['entity'];
 
@@ -644,7 +642,7 @@ function createUserFromThirdparty($authentication, $thirdpartywithuser)
 						}
 					} else {
 						$error++;
-						$errors = ($thirdparty->error ? array($thirdparty->error) : $thirdparty->errors);
+						$errorcode = join(', ', ($thirdparty->error ? array($thirdparty->error) : $thirdparty->errors));
 					}
 				}
 			} else {
@@ -680,9 +678,9 @@ function createUserFromThirdparty($authentication, $thirdpartywithuser)
 function setUserPassword($authentication, $shortuser)
 {
 
-	global $db, $conf, $langs;
+	global $db, $conf;
 
-	dol_syslog("Function: setUserPassword login=".$authentication['login']." id=".$id." ref=".$ref." ref_ext=".$ref_ext);
+	dol_syslog("Function: setUserPassword login=".$authentication['login']);
 
 	if ($authentication['entity']) $conf->entity = $authentication['entity'];
 
@@ -715,7 +713,6 @@ function setUserPassword($authentication, $shortuser)
 				{
 					$objectresp = array(
 						'result'=>array('result_code' => 'OK', 'result_label' => ''),
-						'groups'=>$arraygroups
 					);
 				}
 				else {

test/phpunit/FunctionsLibTest.php

@@ -131,6 +131,35 @@ class FunctionsLibTest extends PHPUnit\Framework\TestCase
         print __METHOD__."\n";
     }
 
+    /**
+     * testIsValidEmail
+     *
+     * @return void
+     */
+    public function testIsValidEmail()
+    {
+    	// Nb of line is same than entry text
+
+    	$input="bidon@bademail";
+    	$result=isValidEmail($input);
+    	print __METHOD__." result=".$result."\n";
+    	$this->assertFalse($result, 'Check isValidEmail '.$input);
+
+    	$input="test@yahoo.com";
+    	$result=isValidEmail($input);
+    	print __METHOD__." result=".$result."\n";
+    	$this->assertTrue($result, 'Check isValidEmail '.$input);
+
+    	$input="The name of sender <test@yahoo.com>";
+    	$result=isValidEmail($input);
+    	print __METHOD__." result=".$result."\n";
+    	$this->assertFalse($result, 'Check isValidEmail '.$input);
+
+    	$input="1234.abcdefg@domainame.com.br";
+    	$result=isValidEmail($input);
+    	print __METHOD__." result=".$result."\n";
+    	$this->assertTrue($result, 'Check isValidEmail '.$input);
+    }
 
     /**
      * testIsValidMXRecord

test/phpunit/WebservicesInvoicesTest.php

@@ -61,6 +61,9 @@ class WebservicesInvoicesTest extends PHPUnit\Framework\TestCase
 
 	protected $ns = 'http://www.dolibarr.org/ns/';
 
+	protected $pass = 'admin';
+
+
 	/**
 	 * Constructor
 	 * We save global variables into local variables
@@ -102,6 +105,8 @@ class WebservicesInvoicesTest extends PHPUnit\Framework\TestCase
     {
         global $conf,$user,$langs,$db;
 
+        $now = dol_now();
+
 		// create a third_party, needed to create an invoice
 		//
 		// The third party is created in setUpBeforeClass() and not in the
@@ -246,7 +251,7 @@ class WebservicesInvoicesTest extends PHPUnit\Framework\TestCase
     	'dolibarrkey'=>$conf->global->WEBSERVICES_KEY,
     	'sourceapplication'=>'DEMO',
     	'login'=>'admin',
-    	'password'=>'admin',
+    	'password'=>$this->pass,
     	'entity'=>'');
 
     	// Test URL
@@ -270,7 +275,7 @@ class WebservicesInvoicesTest extends PHPUnit\Framework\TestCase
     		print "\n";
     	}
 
-    	print __METHOD__." result=".$result['result']['result_code']."\n";
+    	print __METHOD__." result=".$result['result']['result_code']." ".$result['result']['result_label']."\n";
     	$this->assertEquals('OK', $result['result']['result_code']);
     	$this->assertEquals('ref-phpunit-2', $result['ref_ext']);
 
@@ -302,7 +307,7 @@ class WebservicesInvoicesTest extends PHPUnit\Framework\TestCase
     	'dolibarrkey'=>$conf->global->WEBSERVICES_KEY,
     	'sourceapplication'=>'DEMO',
     	'login'=>'admin',
-    	'password'=>'admin',
+    	'password'=>$this->pass,
     	'entity'=>'');
 
     	// Test URL
@@ -401,7 +406,7 @@ class WebservicesInvoicesTest extends PHPUnit\Framework\TestCase
     	'dolibarrkey'=>$conf->global->WEBSERVICES_KEY,
     	'sourceapplication'=>'DEMO',
     	'login'=>'admin',
-    	'password'=>'admin',
+    	'password'=>$this->pass,
     	'entity'=>'');
 
     	// Test URL