diff --git a/htdocs/adherents/canvas/default/tpl/adherentcard_create.tpl.php b/htdocs/adherents/canvas/default/tpl/adherentcard_create.tpl.php
index 9778db176d6..dcab3116f53 100644
--- a/htdocs/adherents/canvas/default/tpl/adherentcard_create.tpl.php
+++ b/htdocs/adherents/canvas/default/tpl/adherentcard_create.tpl.php
@@ -41,7 +41,7 @@ echo $this->control->tpl['ajax_selectcountry']; ?>
 <br>
 
 <form method="post" name="formmember" action="<?php echo $_SERVER["PHP_SELF"]; ?>">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="canvas" value="<?php echo $canvas ?>">
 <input type="hidden" name="action" value="add">
 <?php if ($this->control->tpl['company_id']) { ?>
diff --git a/htdocs/adherents/canvas/default/tpl/adherentcard_edit.tpl.php b/htdocs/adherents/canvas/default/tpl/adherentcard_edit.tpl.php
index 1e75fd57dd6..d49d43825bb 100644
--- a/htdocs/adherents/canvas/default/tpl/adherentcard_edit.tpl.php
+++ b/htdocs/adherents/canvas/default/tpl/adherentcard_edit.tpl.php
@@ -41,7 +41,7 @@ echo $this->control->tpl['ajax_selectcountry'];
 <br>
 
 <form method="post" name="formmember" action="<?php echo $_SERVER["PHP_SELF"].'?id='.GETPOST('id', 'int'); ?>">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="canvas" value="<?php echo $canvas ?>">
 <input type="hidden" name="id" value="<?php echo GETPOST('id', 'int'); ?>">
 <input type="hidden" name="action" value="update">
diff --git a/htdocs/cashdesk/index.php b/htdocs/cashdesk/index.php
index df424e078fd..7122e1b6f59 100644
--- a/htdocs/cashdesk/index.php
+++ b/htdocs/cashdesk/index.php
@@ -90,7 +90,7 @@ else
 <?php if ($err) print dol_escape_htmltag($err)."<br><br>\n"; ?>
 <fieldset class="cadre_facturation"><legend class="titre1"><?php echo $langs->trans("Identification"); ?></legend>
 <form id="frmLogin" method="POST" action="index_verif.php">
-	<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
+	<input type="hidden" name="token" value="<?php echo newToken(); ?>" />
 
 <table>
 
diff --git a/htdocs/cashdesk/tpl/facturation1.tpl.php b/htdocs/cashdesk/tpl/facturation1.tpl.php
index 77de0e4ed8e..f3b76cbaed6 100644
--- a/htdocs/cashdesk/tpl/facturation1.tpl.php
+++ b/htdocs/cashdesk/tpl/facturation1.tpl.php
@@ -41,7 +41,7 @@ $langs->loadLangs(array("main","bills","cashdesk"));
 <!-- ========================= Cadre "Article" ============================= -->
 <fieldset class="cadre_facturation"><legend class="titre1"><?php echo $langs->trans("Article"); ?></legend>
 	<form id="frmFacturation" class="formulaire1" method="post" action="facturation_verif.php" autocomplete="off">
-		<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
+		<input type="hidden" name="token" value="<?php echo newToken(); ?>" />
 
 		<input type="hidden" name="hdnSource" value="NULL" />
 
@@ -90,7 +90,7 @@ for ($i = 0; $i < $nbtoshow; $i++)
 	</form>
 
 	<form id="frmQte" class="formulaire1" method="post" action="facturation_verif.php?action=ajout_article" onsubmit ="javascript: return verifSaisie();">
-		<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
+		<input type="hidden" name="token" value="<?php echo newToken(); ?>" />
 		<table class="center">
 			<tr>
 			<th><?php echo $langs->trans("Qty"); ?></th>
@@ -143,7 +143,7 @@ for ($i = 0; $i < $nbtoshow; $i++)
 <!-- ========================= Cadre "Amount" ============================= -->
 <form id="frmDifference"  class="formulaire1" method="post" onsubmit="javascript: return verifReglement()" action="validation_verif.php?action=valide_achat">
 	<input type="hidden" name="hdnChoix" value="" />
-	<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
+	<input type="hidden" name="token" value="<?php echo newToken(); ?>" />
 <fieldset class="cadre_facturation"><legend class="titre1"><?php echo $langs->trans("Amount"); ?></legend>
 		<table class="centpercent">
 			<tr><th class="label1"><?php echo $langs->trans("TotalTicket"); ?></th><th class="label1"><?php echo $langs->trans("Received"); ?></th><th class="label1"><?php echo $langs->trans("Change"); ?></th></tr>
diff --git a/htdocs/cashdesk/tpl/validation1.tpl.php b/htdocs/cashdesk/tpl/validation1.tpl.php
index 4bc66eff4ad..f2b49d90b51 100644
--- a/htdocs/cashdesk/tpl/validation1.tpl.php
+++ b/htdocs/cashdesk/tpl/validation1.tpl.php
@@ -100,7 +100,7 @@ if ( $obj_facturation->montantRendu() ) {
 	</table>
 
 	<form id="frmValidation" class="formulaire2" method="post" action="validation_verif.php?action=valide_facture">
-		<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
+		<input type="hidden" name="token" value="<?php echo newToken(); ?>" />
 		<p class="note_label">
 			<?php
 				echo $langs->trans("BankToPay")."<br>";
diff --git a/htdocs/compta/accounting-files.php b/htdocs/compta/accounting-files.php
index 1d238a7b852..a7de150edee 100644
--- a/htdocs/compta/accounting-files.php
+++ b/htdocs/compta/accounting-files.php
@@ -107,36 +107,42 @@ if (($action == "searchfiles" || $action == "dl")) {
 	{
 		$wheretail = " '".$db->idate($date_start)."' AND '".$db->idate($date_stop)."'";
 
+		// Customer invoices
 		$sql = "SELECT t.rowid as id, t.ref, t.paye as paid, total as total_ht, total_ttc, tva as total_vat, fk_soc, t.datef as date, 'Invoice' as item, s.nom as thirdparty_name, s.code_client as thirdparty_code, c.code as country_code, s.tva_intra as vatnum";
 	    $sql .= " FROM ".MAIN_DB_PREFIX."facture as t LEFT JOIN ".MAIN_DB_PREFIX."societe as s ON s.rowid = t.fk_soc LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = s.fk_pays";
 	    $sql .= " WHERE datef between ".$wheretail;
 	    $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
 	    $sql .= " AND t.fk_statut <> ".Facture::STATUS_DRAFT;
 	    $sql .= " UNION ALL";
+	    // Vendor invoices
 	    $sql .= " SELECT t.rowid as id, t.ref, paye as paid, total_ht, total_ttc, total_tva as total_vat, fk_soc, datef as date, 'SupplierInvoice' as item, s.nom as thirdparty_name, s.code_fournisseur as thirdparty_code, c.code as country_code, s.tva_intra as vatnum";
 	    $sql .= " FROM ".MAIN_DB_PREFIX."facture_fourn as t LEFT JOIN ".MAIN_DB_PREFIX."societe as s ON s.rowid = t.fk_soc LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = s.fk_pays";
 	    $sql .= " WHERE datef between ".$wheretail;
 	    $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
 	    $sql .= " AND t.fk_statut <> ".FactureFournisseur::STATUS_DRAFT;
 	    $sql .= " UNION ALL";
+	    // Expense reports
 	    $sql .= " SELECT t.rowid as id, t.ref, paid, total_ht, total_ttc, total_tva as total_vat, fk_user_author as fk_soc, date_fin as date, 'ExpenseReport' as item, CONCAT(CONCAT(u.lastname, ' '), u.firstname) as thirdparty_name, '' as thirdparty_code, c.code as country_code, '' as vatnum";
 	    $sql .= " FROM ".MAIN_DB_PREFIX."expensereport as t LEFT JOIN ".MAIN_DB_PREFIX."user as u ON u.rowid = t.fk_user_author LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = u.fk_country";
 	    $sql .= " WHERE date_fin between  ".$wheretail;
 	    $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
 	    $sql .= " AND t.fk_statut <> ".ExpenseReport::STATUS_DRAFT;
 	    $sql .= " UNION ALL";
+	    // Donations
 	    $sql .= " SELECT t.rowid as id, t.ref, paid, amount as total_ht, amount as total_ttc, 0 as total_vat, 0 as fk_soc, datedon as date, 'Donation' as item, t.societe as thirdparty_name, '' as thirdparty_code, c.code as country_code, '' as vatnum";
 	    $sql .= " FROM ".MAIN_DB_PREFIX."don as t LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = t.fk_country";
 	    $sql .= " WHERE datedon between ".$wheretail;
 	    $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
 	    $sql .= " AND t.fk_statut <> ".Don::STATUS_DRAFT;
 	    $sql .= " UNION ALL";
+	    // Paiements of salaries
 	    $sql .= " SELECT t.rowid as id, t.label as ref, 1 as paid, amount as total_ht, amount as total_ttc, 0 as total_vat, t.fk_user as fk_soc, datep as date, 'SalaryPayment' as item, CONCAT(CONCAT(u.lastname, ' '), u.firstname)  as thirdparty_name, '' as thirdparty_code, c.code as country_code, '' as vatnum";
 	    $sql .= " FROM ".MAIN_DB_PREFIX."payment_salary as t LEFT JOIN ".MAIN_DB_PREFIX."user as u ON u.rowid = t.fk_user LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = u.fk_country";
 	    $sql .= " WHERE datep between ".$wheretail;
 	    $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
 	    //$sql.=" AND fk_statut <> ".PaymentSalary::STATUS_DRAFT;
 	    $sql .= " UNION ALL";
+	    // Social contributions
 	    $sql .= " SELECT t.rowid as id, t.libelle as ref, paye as paid, amount as total_ht, amount as total_ttc, 0 as total_tva, 0 as fk_soc, date_creation as date, 'SocialContributions' as item, '' as thirdparty_name, '' as thirdparty_code, '' as country_code, '' as vatnum";
 	    $sql .= " FROM ".MAIN_DB_PREFIX."chargesociales as t";
 	    $sql .= " WHERE date_creation between ".$wheretail;
@@ -213,10 +219,14 @@ if (($action == "searchfiles" || $action == "dl")) {
 	            if (!empty($upload_dir))
 	            {
 	                $result = true;
+
 	                $files = dol_dir_list($upload_dir, "files", 0, '', '(\.meta|_preview\.png)$', '', SORT_ASC, 1);
 	                //var_dump($upload_dir);
+	                //var_dump($files);
+
 	                if (count($files) < 1)
 	                {
+	                	$nofile = array();
 	                	$nofile['id'] = $objd->id;
 	                	$nofile['date'] = $db->idate($objd->date);
 	                    $nofile['paid'] = $objd->paid;
@@ -231,7 +241,7 @@ if (($action == "searchfiles" || $action == "dl")) {
 	                    $nofile['country_code'] = $objd->country_code;
 	                    $nofile['vatnum'] = $objd->vatnum;
 
-	                    $filesarray[] = $nofile;
+	                    $filesarray[$nofile['item'].'_'.$nofile['id']] = $nofile;
 	                }
 	                else
 	                {
@@ -252,13 +262,22 @@ if (($action == "searchfiles" || $action == "dl")) {
 	                        $file['country_code'] = $objd->country_code;
 	                        $file['vatnum'] = $objd->vatnum;
 
-	                        $file['link'] = $link.$file['name'];
-	                        $file['relpathnamelang'] = $langs->trans($file['item']).'/'.$file['name'];
+	                        // Save record into array (only the first time it is found)
+	                        if (empty($filesarray[$file['item'].'_'.$file['id']])) {
+	                        	$filesarray[$file['item'].'_'.$file['id']] = $file;
+	                        }
 
-	                        $filesarray[] = $file;
+	                        // Add or concat file
+	                        if (empty($filesarray[$file['item'].'_'.$file['id']]['files'])) {
+	                        	$filesarray[$file['item'].'_'.$file['id']]['files'] = array();
+	                        }
+	                        $filesarray[$file['item'].'_'.$file['id']]['files'][] = array('link' => $link.$file['name'], 'name'=>$file['name'], 'ref'=>$file['ref'], 'fullname' => $file['fullname'], 'relpathnamelang' => $langs->trans($file['item']).'/'.$file['name']);
+	                        //var_dump($file['item'].'_'.$file['id']);
+	                        //var_dump($filesarray[$file['item'].'_'.$file['id']]['files']);
 	                    }
 	                }
 	            }
+
 	            $i++;
 	        }
 	    }
@@ -316,7 +335,12 @@ if ($result && $action == "dl" && !$error)
     {
         foreach ($filesarray as $key => $file)
         {
-            if (file_exists($file["fullname"])) $zip->addFile($file["fullname"], $file["relpathnamelang"]);
+        	foreach($file['files'] as $filecursor) {
+        		if (file_exists($filecursor["fullname"])) {
+        			$zip->addFile($filecursor["fullname"], $filecursor["relpathnamelang"]);
+        		}
+        	}
+
             $log .= $file['item'];
             $log .= ','.dol_print_date($file['date'], 'dayrfc');
             $log .= ','.$file['ref'];
@@ -370,8 +394,9 @@ $head[$h][2] = 'AccountancyFiles';
 dol_fiche_head($head, 'AccountancyFiles');
 
 
-print '<form name="searchfiles" action="?action=searchfiles'.$tail.'" method="POST" >'."\n";
-print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+print '<form name="searchfiles" action="?action=searchfiles" method="POST">'."\n";
+print '<input type="hidden" name="token" value="'.newToken().'">';
+
 print $langs->trans("ReportPeriod").': '.$form->selectDate($date_start, 'date_start', 0, 0, 0, "", 1, 1, 0);
 print ' - '.$form->selectDate($date_stop, 'date_stop', 0, 0, 0, "", 1, 1, 0)."\n</a>";
 
@@ -402,7 +427,7 @@ if (!empty($date_start) && !empty($date_stop))
     $param .= '&date_stopyear='.GETPOST('date_stopyear', 'int');
 
     print '<form name="dl" action="?action=dl" method="POST" >'."\n";
-    print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
+    print '<input type="hidden" name="token" value="'.newToken().'">';
 
     echo dol_print_date($date_start, 'day')." - ".dol_print_date($date_stop, 'day');
 
@@ -477,9 +502,11 @@ if (!empty($date_start) && !empty($date_stop))
 
                 // File link
                 print '<td>';
-                if ($data['link'])
+                if (! empty($data['files']))
                 {
-                	print '<a href='.DOL_URL_ROOT.'/'.$data['link'].' target="_blank">'.($data['name'] ? $data['name'] : $data['ref']).'</a>';
+                	foreach($data['files'] as $filecursor) {
+                		print '<a href='.DOL_URL_ROOT.'/'.$filecursor['link'].' target="_blank">'.($filecursor['name'] ? $filecursor['name'] : $filecursor['ref']).'</a><br>';
+                	}
                 }
                 print "</td>\n";
 
diff --git a/htdocs/expensereport/class/expensereport.class.php b/htdocs/expensereport/class/expensereport.class.php
index baa362085c1..6d21093f971 100644
--- a/htdocs/expensereport/class/expensereport.class.php
+++ b/htdocs/expensereport/class/expensereport.class.php
@@ -2682,7 +2682,7 @@ class ExpenseReportLine
         if (!$error)
         {
             $this->db->commit();
-            return $this->rowid;
+            return $this->id;
         }
         else
         {
@@ -2773,7 +2773,7 @@ class ExpenseReportLine
         else $sql .= ",fk_c_type_fees=null";
         if ($this->fk_project > 0) $sql .= ",fk_projet=".$this->db->escape($this->fk_project);
         else $sql .= ",fk_projet=null";
-        $sql .= " WHERE rowid = ".$this->db->escape($this->rowid);
+        $sql .= " WHERE rowid = ".$this->db->escape($this->rowid ? $this->rowid : $this->id);
 
         dol_syslog("ExpenseReportLine::update sql=".$sql);
 
diff --git a/htdocs/societe/canvas/company/tpl/card_create.tpl.php b/htdocs/societe/canvas/company/tpl/card_create.tpl.php
index 80e0a23bdd6..80c2f042138 100644
--- a/htdocs/societe/canvas/company/tpl/card_create.tpl.php
+++ b/htdocs/societe/canvas/company/tpl/card_create.tpl.php
@@ -49,7 +49,7 @@ if (empty($conf) || ! is_object($conf))
 
 <input type="hidden" name="canvas" value="<?php echo $canvas ?>">
 <input type="hidden" name="action" value="add">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="private" value="<?php echo $this->control->tpl['particulier']; ?>">
 <?php if ($this->control->tpl['auto_customercode'] || $this->control->tpl['auto_suppliercode']) { ?>
 <input type="hidden" name="code_auto" value="1">
diff --git a/htdocs/societe/canvas/company/tpl/card_edit.tpl.php b/htdocs/societe/canvas/company/tpl/card_edit.tpl.php
index 3f1740d395c..4ee8bacd7e3 100644
--- a/htdocs/societe/canvas/company/tpl/card_edit.tpl.php
+++ b/htdocs/societe/canvas/company/tpl/card_edit.tpl.php
@@ -39,7 +39,7 @@ $contact = $GLOBALS['objcanvas']->control->object;
 <form action="<?php echo $_SERVER["PHP_SELF"].'?socid='.$this->control->tpl['id']; ?>" method="POST" name="formsoc">
 <input type="hidden" name="canvas" value="<?php echo $canvas ?>">
 <input type="hidden" name="action" value="update">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="socid" value="<?php echo $this->control->tpl['id']; ?>">
 <?php if ($this->control->tpl['auto_customercode'] || $this->control->tpl['auto_suppliercode']) { ?>
 <input type="hidden" name="code_auto" value="1">
diff --git a/htdocs/societe/canvas/individual/tpl/card_create.tpl.php b/htdocs/societe/canvas/individual/tpl/card_create.tpl.php
index 8493027bef7..f77233816e0 100644
--- a/htdocs/societe/canvas/individual/tpl/card_create.tpl.php
+++ b/htdocs/societe/canvas/individual/tpl/card_create.tpl.php
@@ -47,7 +47,7 @@ if (empty($conf) || ! is_object($conf))
 
 <input type="hidden" name="action" value="add">
 <input type="hidden" name="canvas" value="<?php echo $canvas ?>">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="private" value="<?php echo $this->control->tpl['particulier']; ?>">
 <?php if ($this->control->tpl['auto_customercode'] || $this->control->tpl['auto_suppliercode']) { ?>
 <input type="hidden" name="code_auto" value="1">
diff --git a/htdocs/societe/canvas/individual/tpl/card_edit.tpl.php b/htdocs/societe/canvas/individual/tpl/card_edit.tpl.php
index 976b00962d8..60a6e18c07b 100644
--- a/htdocs/societe/canvas/individual/tpl/card_edit.tpl.php
+++ b/htdocs/societe/canvas/individual/tpl/card_edit.tpl.php
@@ -36,7 +36,7 @@ if (empty($conf) || ! is_object($conf))
 <form action="<?php echo $_SERVER["PHP_SELF"].'?socid='.$this->control->tpl['id']; ?>" method="POST" name="formsoc">
 <input type="hidden" name="canvas" value="<?php echo $canvas ?>">
 <input type="hidden" name="action" value="update">
-<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>">
+<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 <input type="hidden" name="socid" value="<?php echo $this->control->tpl['id']; ?>">
 <input type="hidden" name="typent_id" value="<?php echo $this->control->tpl['typent_id']; ?>">
 <?php if ($this->control->tpl['auto_customercode'] || $this->control->tpl['auto_suppliercode']) { ?>