diff --git a/COPYRIGHT b/COPYRIGHT index b133b05b2cf..9704c857ed3 100644 --- a/COPYRIGHT +++ b/COPYRIGHT @@ -54,7 +54,7 @@ jQuery TableDnD 0.6 GPL and MIT License Yes jQuery Timepicker 1.1.0 GPL and MIT License Yes JS library Timepicker addon for Datepicker jsGanttImproved 2.7.3 BSD License Yes JS library (to build Gantt reports) JsTimezoneDetect 1.0.6 MIT License Yes JS library to detect user timezone -SwaggerUI 2.0.24 GPL-2+ Yes JS library to offer the REST API explorer +SwaggerUI 2.2.10 GPL-2+ Yes JS library to offer the REST API explorer Image libraries: Octicons 8.1 MIT Yes diff --git a/build/rpm/dolibarr_fedora.spec b/build/rpm/dolibarr_fedora.spec index d50c91d1f05..662c80adf6c 100755 --- a/build/rpm/dolibarr_fedora.spec +++ b/build/rpm/dolibarr_fedora.spec @@ -185,6 +185,7 @@ done >>%{name}.lang %_datadir/dolibarr/htdocs/don %_datadir/dolibarr/htdocs/ecm %_datadir/dolibarr/htdocs/emailcollector +%_datadir/dolibarr/htdocs/eventorganization %_datadir/dolibarr/htdocs/expedition %_datadir/dolibarr/htdocs/expensereport %_datadir/dolibarr/htdocs/exports @@ -206,6 +207,7 @@ done >>%{name}.lang %_datadir/dolibarr/htdocs/mrp %_datadir/dolibarr/htdocs/multicurrency %_datadir/dolibarr/htdocs/opensurvey +%_datadir/dolibarr/htdocs/partnership %_datadir/dolibarr/htdocs/paybox %_datadir/dolibarr/htdocs/paypal %_datadir/dolibarr/htdocs/printing diff --git a/build/rpm/dolibarr_generic.spec b/build/rpm/dolibarr_generic.spec index 4541868a04f..72cb7599b45 100755 --- a/build/rpm/dolibarr_generic.spec +++ b/build/rpm/dolibarr_generic.spec @@ -67,7 +67,8 @@ Requires: httpd, php >= 5.3.0, php-cli, php-gd, php-ldap, php-imap, php-mbstring Requires: mysql-server, mysql Requires: php-mysqli >= 4.1.0 %endif -%endif +%endif%_datadir/dolibarr/htdocs/eventorganization + %endif # Set yes to build test package, no for release (this disable need of /usr/bin/php not found by OpenSuse) @@ -265,6 +266,7 @@ done >>%{name}.lang %_datadir/dolibarr/htdocs/don %_datadir/dolibarr/htdocs/ecm %_datadir/dolibarr/htdocs/emailcollector +%_datadir/dolibarr/htdocs/eventorganization %_datadir/dolibarr/htdocs/expedition %_datadir/dolibarr/htdocs/expensereport %_datadir/dolibarr/htdocs/exports @@ -286,6 +288,7 @@ done >>%{name}.lang %_datadir/dolibarr/htdocs/mrp %_datadir/dolibarr/htdocs/multicurrency %_datadir/dolibarr/htdocs/opensurvey +%_datadir/dolibarr/htdocs/partnership %_datadir/dolibarr/htdocs/paybox %_datadir/dolibarr/htdocs/paypal %_datadir/dolibarr/htdocs/printing diff --git a/build/rpm/dolibarr_mandriva.spec b/build/rpm/dolibarr_mandriva.spec index d618b5729d5..a71a53e690f 100755 --- a/build/rpm/dolibarr_mandriva.spec +++ b/build/rpm/dolibarr_mandriva.spec @@ -182,6 +182,7 @@ done >>%{name}.lang %_datadir/dolibarr/htdocs/don %_datadir/dolibarr/htdocs/ecm %_datadir/dolibarr/htdocs/emailcollector +%_datadir/dolibarr/htdocs/eventorganization %_datadir/dolibarr/htdocs/expedition %_datadir/dolibarr/htdocs/expensereport %_datadir/dolibarr/htdocs/exports @@ -203,6 +204,7 @@ done >>%{name}.lang %_datadir/dolibarr/htdocs/mrp %_datadir/dolibarr/htdocs/multicurrency %_datadir/dolibarr/htdocs/opensurvey +%_datadir/dolibarr/htdocs/partnership %_datadir/dolibarr/htdocs/paybox %_datadir/dolibarr/htdocs/paypal %_datadir/dolibarr/htdocs/printing diff --git a/build/rpm/dolibarr_opensuse.spec b/build/rpm/dolibarr_opensuse.spec index 230a8946e99..0d86e4297cc 100755 --- a/build/rpm/dolibarr_opensuse.spec +++ b/build/rpm/dolibarr_opensuse.spec @@ -193,6 +193,7 @@ done >>%{name}.lang %_datadir/dolibarr/htdocs/don %_datadir/dolibarr/htdocs/ecm %_datadir/dolibarr/htdocs/emailcollector +%_datadir/dolibarr/htdocs/eventorganization %_datadir/dolibarr/htdocs/expedition %_datadir/dolibarr/htdocs/expensereport %_datadir/dolibarr/htdocs/exports @@ -214,6 +215,7 @@ done >>%{name}.lang %_datadir/dolibarr/htdocs/mrp %_datadir/dolibarr/htdocs/multicurrency %_datadir/dolibarr/htdocs/opensurvey +%_datadir/dolibarr/htdocs/partnership %_datadir/dolibarr/htdocs/paybox %_datadir/dolibarr/htdocs/paypal %_datadir/dolibarr/htdocs/printing diff --git a/dev/dolibarr_changes.txt b/dev/dolibarr_changes.txt index e207afa5658..9ea62de9048 100644 --- a/dev/dolibarr_changes.txt +++ b/dev/dolibarr_changes.txt @@ -225,9 +225,6 @@ JQUERYFILETREE: RESTLER: -------- -Change content of file htdocs/includes/restler/framework/Luracast/Restler/explorer/index.html - -+With swagger 2: * Add line into Util.php to complete function @@ -249,6 +246,13 @@ Change content of file htdocs/includes/restler/framework/Luracast/Restler/explor if (!is_string($haystack)) return false; ++With swagger 2 provided into /explorer: +---------------------------------------- + +Change content of file htdocs/includes/restler/framework/Luracast/Restler/explorer/index.html + + + PARSEDOWN --------- diff --git a/htdocs/accountancy/admin/accountmodel.php b/htdocs/accountancy/admin/accountmodel.php index 7c05a9a0da4..f0fd9702009 100644 --- a/htdocs/accountancy/admin/accountmodel.php +++ b/htdocs/accountancy/admin/accountmodel.php @@ -442,7 +442,7 @@ if ($id) { } else { $sql .= " WHERE "; } - $sql .= " c.rowid = ".$search_country_id; + $sql .= " c.rowid = ".((int) $search_country_id); } // If sort order is "country", we use country_code instead diff --git a/htdocs/accountancy/bookkeeping/card.php b/htdocs/accountancy/bookkeeping/card.php index e3cac139c08..f91b1821df4 100644 --- a/htdocs/accountancy/bookkeeping/card.php +++ b/htdocs/accountancy/bookkeeping/card.php @@ -563,7 +563,7 @@ if ($action == 'create') { { $sqlmid = 'SELECT rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."facture as fac"; - $sqlmid .= " WHERE fac.rowid=" . $object->fk_doc; + $sqlmid .= " WHERE fac.rowid=" . ((int) $object->fk_doc); dol_syslog("accountancy/bookkeeping/card.php::sqlmid=" . $sqlmid, LOG_DEBUG); $resultmid = $db->query($sqlmid); if ($resultmid) { diff --git a/htdocs/accountancy/class/accountancycategory.class.php b/htdocs/accountancy/class/accountancycategory.class.php index 9550933f2d8..d8e1598d1ac 100644 --- a/htdocs/accountancy/class/accountancycategory.class.php +++ b/htdocs/accountancy/class/accountancycategory.class.php @@ -473,7 +473,7 @@ class AccountancyCategory // extends CommonObject $sql .= " SELECT DISTINCT aa.account_number"; $sql .= " FROM ".MAIN_DB_PREFIX."accounting_account as aa"; $sql .= " INNER JOIN ".MAIN_DB_PREFIX."accounting_system as asy ON aa.fk_pcg_version = asy.pcg_version"; - $sql .= " AND asy.rowid = ".$conf->global->CHARTOFACCOUNTS; + $sql .= " AND asy.rowid = ".((int) $conf->global->CHARTOFACCOUNTS); $sql .= " AND aa.active = 1"; $sql .= " AND aa.entity = ".$conf->entity.")"; $sql .= " GROUP BY t.numero_compte, t.label_operation, t.doc_ref"; @@ -562,7 +562,7 @@ class AccountancyCategory // extends CommonObject $sql = "SELECT aa.rowid, aa.account_number"; $sql .= " FROM ".MAIN_DB_PREFIX."accounting_account as aa"; $sql .= " INNER JOIN ".MAIN_DB_PREFIX."accounting_system as asy ON aa.fk_pcg_version = asy.pcg_version"; - $sql .= " AND asy.rowid = ".$conf->global->CHARTOFACCOUNTS; + $sql .= " AND asy.rowid = ".((int) $conf->global->CHARTOFACCOUNTS); $sql .= " AND aa.active = 1"; $sql .= " AND aa.entity = ".$conf->entity; $sql .= " ORDER BY LENGTH(aa.account_number) DESC;"; // LENGTH is ok with mysql and postgresql @@ -589,8 +589,8 @@ class AccountancyCategory // extends CommonObject $accountincptsadded[$account_number_formated] = 1; // We found an account number that is in list $cpts of account to add $sql = "UPDATE ".MAIN_DB_PREFIX."accounting_account"; - $sql .= " SET fk_accounting_category=".$id_cat; - $sql .= " WHERE rowid=".$obj->rowid; + $sql .= " SET fk_accounting_category=".((int) $id_cat); + $sql .= " WHERE rowid=".((int) $obj->rowid); dol_syslog(__METHOD__, LOG_DEBUG); $resqlupdate = $this->db->query($sql); if (!$resqlupdate) { @@ -629,7 +629,7 @@ class AccountancyCategory // extends CommonObject $sql = "UPDATE ".MAIN_DB_PREFIX."accounting_account as aa"; $sql .= " SET fk_accounting_category= 0"; - $sql .= " WHERE aa.rowid= ".$cpt_id; + $sql .= " WHERE aa.rowid = ".((int) $cpt_id); $this->db->begin(); dol_syslog(__METHOD__." sql=".$sql, LOG_DEBUG); diff --git a/htdocs/accountancy/class/accountancyexport.class.php b/htdocs/accountancy/class/accountancyexport.class.php index ad3e863cc8c..f1815386624 100644 --- a/htdocs/accountancy/class/accountancyexport.class.php +++ b/htdocs/accountancy/class/accountancyexport.class.php @@ -557,7 +557,7 @@ class AccountancyExport $Tab['signe_montant'] = '+'; // The amount must be in centimes without decimal points. - $Tab['montant'] = str_pad(abs(($data->debit - $abs->credit) * 100), 12, '0', STR_PAD_LEFT); + $Tab['montant'] = str_pad(abs(($data->debit - $data->credit) * 100), 12, '0', STR_PAD_LEFT); $Tab['contrepartie'] = str_repeat(' ', 8); // Force date format : %d%m%y diff --git a/htdocs/accountancy/class/accountingaccount.class.php b/htdocs/accountancy/class/accountingaccount.class.php index a7d89c45294..28601380ac1 100644 --- a/htdocs/accountancy/class/accountingaccount.class.php +++ b/htdocs/accountancy/class/accountingaccount.class.php @@ -347,10 +347,10 @@ class AccountingAccount extends CommonObject $sql .= " , label = ".($this->label ? "'".$this->db->escape($this->label)."'" : "''"); $sql .= " , labelshort = ".($this->labelshort ? "'".$this->db->escape($this->labelshort)."'" : "''"); $sql .= " , fk_accounting_category = ".(empty($this->account_category) ? 0 : (int) $this->account_category); - $sql .= " , fk_user_modif = ".$user->id; + $sql .= " , fk_user_modif = ".((int) $user->id); $sql .= " , active = ".(int) $this->active; $sql .= " , reconcilable = ".(int) $this->reconcilable; - $sql .= " WHERE rowid = ".$this->id; + $sql .= " WHERE rowid = ".((int) $this->id); dol_syslog(get_class($this)."::update sql=".$sql, LOG_DEBUG); $result = $this->db->query($sql); diff --git a/htdocs/accountancy/class/bookkeeping.class.php b/htdocs/accountancy/class/bookkeeping.class.php index 6220904dbe8..a93b36cf2b4 100644 --- a/htdocs/accountancy/class/bookkeeping.class.php +++ b/htdocs/accountancy/class/bookkeeping.class.php @@ -371,8 +371,8 @@ class BookKeeping extends CommonObject $sql .= ", ".(!isset($this->date_lim_reglement) || dol_strlen($this->date_lim_reglement) == 0 ? 'NULL' : "'".$this->db->idate($this->date_lim_reglement)."'"); $sql .= ", '".$this->db->escape($this->doc_type)."'"; $sql .= ", '".$this->db->escape($this->doc_ref)."'"; - $sql .= ", ".$this->fk_doc; - $sql .= ", ".$this->fk_docdet; + $sql .= ", ".((int) $this->fk_doc); + $sql .= ", ".((int) $this->fk_docdet); $sql .= ", ".(!empty($this->thirdparty_code) ? ("'".$this->db->escape($this->thirdparty_code)."'") : "NULL"); $sql .= ", ".(!empty($this->subledger_account) ? ("'".$this->db->escape($this->subledger_account)."'") : "NULL"); $sql .= ", ".(!empty($this->subledger_label) ? ("'".$this->db->escape($this->subledger_label)."'") : "NULL"); @@ -632,8 +632,8 @@ class BookKeeping extends CommonObject $sql .= ' '.(!isset($this->date_lim_reglement) || dol_strlen($this->date_lim_reglement) == 0 ? 'NULL' : "'".$this->db->idate($this->date_lim_reglement)."'").','; $sql .= ' '.(!isset($this->doc_type) ? 'NULL' : "'".$this->db->escape($this->doc_type)."'").','; $sql .= ' '.(!isset($this->doc_ref) ? 'NULL' : "'".$this->db->escape($this->doc_ref)."'").','; - $sql .= ' '.(empty($this->fk_doc) ? '0' : $this->fk_doc).','; - $sql .= ' '.(empty($this->fk_docdet) ? '0' : $this->fk_docdet).','; + $sql .= ' '.(empty($this->fk_doc) ? '0' : (int) $this->fk_doc).','; + $sql .= ' '.(empty($this->fk_docdet) ? '0' : (int) $this->fk_docdet).','; $sql .= ' '.(!isset($this->thirdparty_code) ? 'NULL' : "'".$this->db->escape($this->thirdparty_code)."'").','; $sql .= ' '.(!isset($this->subledger_account) ? 'NULL' : "'".$this->db->escape($this->subledger_account)."'").','; $sql .= ' '.(!isset($this->subledger_label) ? 'NULL' : "'".$this->db->escape($this->subledger_label)."'").','; @@ -1860,7 +1860,7 @@ class BookKeeping extends CommonObject $sql .= " LEFT JOIN " . MAIN_DB_PREFIX . "accounting_account as aa ON aa.account_number = ab.numero_compte"; $sql .= " AND aa.active = 1"; $sql .= " INNER JOIN " . MAIN_DB_PREFIX . "accounting_system as asy ON aa.fk_pcg_version = asy.pcg_version"; - $sql .= " AND asy.rowid = " . $pcgver; + $sql .= " AND asy.rowid = " . ((int) $pcgver); $sql .= " AND ab.entity IN (" . getEntity('accountancy') . ")"; $sql .= " ORDER BY account_number ASC"; */ @@ -1893,7 +1893,7 @@ class BookKeeping extends CommonObject $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa ON aa.account_number = ab.numero_compte"; $sql .= " AND aa.active = 1"; $sql .= " INNER JOIN ".MAIN_DB_PREFIX."accounting_system as asy ON aa.fk_pcg_version = asy.pcg_version"; - $sql .= " AND asy.rowid = ".$pcgver; + $sql .= " AND asy.rowid = ".((int) $pcgver); $sql .= " AND ab.entity IN (".getEntity('accountancy').")"; $sql .= " ORDER BY account_number ASC"; diff --git a/htdocs/accountancy/customer/index.php b/htdocs/accountancy/customer/index.php index 0b32e2802c4..43daa2efa88 100644 --- a/htdocs/accountancy/customer/index.php +++ b/htdocs/accountancy/customer/index.php @@ -110,13 +110,13 @@ if ($action == 'validatehistory') { $sql1 = "UPDATE " . MAIN_DB_PREFIX . "facturedet"; $sql1 .= " SET fk_code_ventilation = accnt.rowid"; $sql1 .= " FROM " . MAIN_DB_PREFIX . "product as p, " . MAIN_DB_PREFIX . "accounting_account as accnt , " . MAIN_DB_PREFIX . "accounting_system as syst"; - $sql1 .= " WHERE " . MAIN_DB_PREFIX . "facturedet.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . $conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE " . MAIN_DB_PREFIX . "facturedet.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND p.accountancy_code_sell=accnt.account_number"; $sql1 .= " AND " . MAIN_DB_PREFIX . "facturedet.fk_code_ventilation = 0"; } else { $sql1 = "UPDATE " . MAIN_DB_PREFIX . "facturedet as fd, " . MAIN_DB_PREFIX . "product as p, " . MAIN_DB_PREFIX . "accounting_account as accnt , " . MAIN_DB_PREFIX . "accounting_system as syst"; $sql1 .= " SET fk_code_ventilation = accnt.rowid"; - $sql1 .= " WHERE fd.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . $conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE fd.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND p.accountancy_code_sell=accnt.account_number"; $sql1 .= " AND fd.fk_code_ventilation = 0"; }*/ diff --git a/htdocs/accountancy/expensereport/index.php b/htdocs/accountancy/expensereport/index.php index 38f7f596932..b4e85fd517a 100644 --- a/htdocs/accountancy/expensereport/index.php +++ b/htdocs/accountancy/expensereport/index.php @@ -103,13 +103,13 @@ if ($action == 'validatehistory') { $sql1 = "UPDATE ".MAIN_DB_PREFIX."expensereport_det"; $sql1 .= " SET fk_code_ventilation = accnt.rowid"; $sql1 .= " FROM ".MAIN_DB_PREFIX."c_type_fees as t, ".MAIN_DB_PREFIX."accounting_account as accnt , ".MAIN_DB_PREFIX."accounting_system as syst"; - $sql1 .= " WHERE ".MAIN_DB_PREFIX."expensereport_det.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=".$conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE ".MAIN_DB_PREFIX."expensereport_det.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid = ".((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND t.accountancy_code = accnt.account_number"; $sql1 .= " AND ".MAIN_DB_PREFIX."expensereport_det.fk_code_ventilation = 0"; } else { $sql1 = "UPDATE ".MAIN_DB_PREFIX."expensereport_det as erd, ".MAIN_DB_PREFIX."c_type_fees as t, ".MAIN_DB_PREFIX."accounting_account as accnt , ".MAIN_DB_PREFIX."accounting_system as syst"; $sql1 .= " SET erd.fk_code_ventilation = accnt.rowid"; - $sql1 .= " WHERE erd.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=".$conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE erd.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid = ".((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND t.accountancy_code=accnt.account_number"; $sql1 .= " AND erd.fk_code_ventilation = 0"; } diff --git a/htdocs/accountancy/journal/bankjournal.php b/htdocs/accountancy/journal/bankjournal.php index 27b37c74932..e3e2a308cf9 100644 --- a/htdocs/accountancy/journal/bankjournal.php +++ b/htdocs/accountancy/journal/bankjournal.php @@ -130,7 +130,7 @@ $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank_url as bu3 ON bu3.fk_bank = b.rowid A $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank_url as bu4 ON bu4.fk_bank = b.rowid AND bu4.type='payment_supplier'"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe as soc on bu1.url_id=soc.rowid"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."user as u on bu2.url_id=u.rowid"; -$sql .= " WHERE ba.fk_accountancy_journal=".$id_journal; +$sql .= " WHERE ba.fk_accountancy_journal=".((int) $id_journal); $sql .= ' AND b.amount != 0 AND ba.entity IN ('.getEntity('bank_account', 0).')'; // We don't share object for accountancy if ($date_start && $date_end) { $sql .= " AND b.dateo >= '".$db->idate($date_start)."' AND b.dateo <= '".$db->idate($date_end)."'"; @@ -1323,42 +1323,42 @@ function getSourceDocRef($val, $typerecord) } elseif ($typerecord == 'payment_supplier') { $sqlmid = 'SELECT payfac.fk_facturefourn as id, f.ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."paiementfourn_facturefourn as payfac, ".MAIN_DB_PREFIX."facture_fourn as f"; - $sqlmid .= " WHERE payfac.fk_facturefourn = f.rowid AND payfac.fk_paiementfourn=".$val["paymentsupplierid"]; + $sqlmid .= " WHERE payfac.fk_facturefourn = f.rowid AND payfac.fk_paiementfourn=".((int) $val["paymentsupplierid"]); $ref = $langs->transnoentitiesnoconv("SupplierInvoice"); } elseif ($typerecord == 'payment_expensereport') { $sqlmid = 'SELECT e.rowid as id, e.ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."payment_expensereport as pe, ".MAIN_DB_PREFIX."expensereport as e"; - $sqlmid .= " WHERE pe.rowid=".$val["paymentexpensereport"]." AND pe.fk_expensereport = e.rowid"; + $sqlmid .= " WHERE pe.rowid=".((int) $val["paymentexpensereport"])." AND pe.fk_expensereport = e.rowid"; $ref = $langs->transnoentitiesnoconv("ExpenseReport"); } elseif ($typerecord == 'payment_salary') { $sqlmid = 'SELECT s.rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."payment_salary as s"; - $sqlmid .= " WHERE s.rowid=".$val["paymentsalid"]; + $sqlmid .= " WHERE s.rowid=".((int) $val["paymentsalid"]); $ref = $langs->transnoentitiesnoconv("SalaryPayment"); } elseif ($typerecord == 'sc') { $sqlmid = 'SELECT sc.rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."paiementcharge as sc"; - $sqlmid .= " WHERE sc.rowid=".$val["paymentscid"]; + $sqlmid .= " WHERE sc.rowid=".((int) $val["paymentscid"]); $ref = $langs->transnoentitiesnoconv("SocialContribution"); } elseif ($typerecord == 'payment_vat') { $sqlmid = 'SELECT v.rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."tva as v"; - $sqlmid .= " WHERE v.rowid=".$val["paymentvatid"]; + $sqlmid .= " WHERE v.rowid=".((int) $val["paymentvatid"]); $ref = $langs->transnoentitiesnoconv("PaymentVat"); } elseif ($typerecord == 'payment_donation') { $sqlmid = 'SELECT payd.fk_donation as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."payment_donation as payd"; - $sqlmid .= " WHERE payd.fk_donation=".$val["paymentdonationid"]; + $sqlmid .= " WHERE payd.fk_donation=".((int) $val["paymentdonationid"]); $ref = $langs->transnoentitiesnoconv("Donation"); } elseif ($typerecord == 'payment_loan') { $sqlmid = 'SELECT l.rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."payment_loan as l"; - $sqlmid .= " WHERE l.rowid=".$val["paymentloanid"]; + $sqlmid .= " WHERE l.rowid=".((int) $val["paymentloanid"]); $ref = $langs->transnoentitiesnoconv("LoanPayment"); } elseif ($typerecord == 'payment_various') { $sqlmid = 'SELECT v.rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."payment_various as v"; - $sqlmid .= " WHERE v.rowid=".$val["paymentvariousid"]; + $sqlmid .= " WHERE v.rowid=".((int) $val["paymentvariousid"]); $ref = $langs->transnoentitiesnoconv("VariousPayment"); } // Add warning diff --git a/htdocs/accountancy/supplier/index.php b/htdocs/accountancy/supplier/index.php index 392551708de..91dd921f1fa 100644 --- a/htdocs/accountancy/supplier/index.php +++ b/htdocs/accountancy/supplier/index.php @@ -118,13 +118,13 @@ if ($action == 'validatehistory') { $sql1 = "UPDATE " . MAIN_DB_PREFIX . "facture_fourn_det"; $sql1 .= " SET fk_code_ventilation = accnt.rowid"; $sql1 .= " FROM " . MAIN_DB_PREFIX . "product as p, " . MAIN_DB_PREFIX . "accounting_account as accnt , " . MAIN_DB_PREFIX . "accounting_system as syst"; - $sql1 .= " WHERE " . MAIN_DB_PREFIX . "facture_fourn_det.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . $conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE " . MAIN_DB_PREFIX . "facture_fourn_det.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND p.accountancy_code_buy=accnt.account_number"; $sql1 .= " AND " . MAIN_DB_PREFIX . "facture_fourn_det.fk_code_ventilation = 0"; } else { $sql1 = "UPDATE " . MAIN_DB_PREFIX . "facture_fourn_det as fd, " . MAIN_DB_PREFIX . "product as p, " . MAIN_DB_PREFIX . "accounting_account as accnt , " . MAIN_DB_PREFIX . "accounting_system as syst"; $sql1 .= " SET fk_code_ventilation = accnt.rowid"; - $sql1 .= " WHERE fd.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . $conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE fd.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND p.accountancy_code_buy=accnt.account_number"; $sql1 .= " AND fd.fk_code_ventilation = 0"; }*/ diff --git a/htdocs/adherents/class/adherent.class.php b/htdocs/adherents/class/adherent.class.php index 0299b32663c..829c6ab8faa 100644 --- a/htdocs/adherents/class/adherent.class.php +++ b/htdocs/adherents/class/adherent.class.php @@ -1570,9 +1570,11 @@ class Adherent extends CommonObject * @param string $emetteur_nom Name of cheque writer * @param string $emetteur_banque Name of bank of cheque * @param string $autocreatethirdparty Auto create new thirdparty if member not yet linked to a thirdparty and we request an option that generate invoice. + * @param string $ext_payment_id External id of payment (for example Stripe charge id) + * @param string $ext_payment_site Name of external paymentmode (for example 'stripe') * @return int <0 if KO, >0 if OK */ - public function subscriptionComplementaryActions($subscriptionid, $option, $accountid, $datesubscription, $paymentdate, $operation, $label, $amount, $num_chq, $emetteur_nom = '', $emetteur_banque = '', $autocreatethirdparty = 0) + public function subscriptionComplementaryActions($subscriptionid, $option, $accountid, $datesubscription, $paymentdate, $operation, $label, $amount, $num_chq, $emetteur_nom = '', $emetteur_banque = '', $autocreatethirdparty = 0, $ext_payment_id = '', $ext_payment_site = '') { global $conf, $langs, $user, $mysoc; @@ -1597,8 +1599,8 @@ class Adherent extends CommonObject $inserturlid = $acct->add_url_line($insertid, $this->id, DOL_URL_ROOT.'/adherents/card.php?rowid=', $this->getFullname($langs), 'member'); if ($inserturlid > 0) { // Update table subscription - $sql = "UPDATE ".MAIN_DB_PREFIX."subscription SET fk_bank=".$insertid; - $sql .= " WHERE rowid=".$subscriptionid; + $sql = "UPDATE ".MAIN_DB_PREFIX."subscription SET fk_bank=".((int) $insertid); + $sql .= " WHERE rowid=".((int) $subscriptionid); dol_syslog("subscription::subscription", LOG_DEBUG); $resql = $this->db->query($sql); @@ -1752,6 +1754,8 @@ class Adherent extends CommonObject $paiement->paiementid = dol_getIdFromCode($this->db, $operation, 'c_paiement', 'code', 'id', 1); $paiement->num_payment = $num_chq; $paiement->note_public = $label; + $paiement->ext_payment_id = $ext_payment_id; + $paiement->ext_payment_site = $ext_payment_site; if (!$error) { // Create payment line for invoice diff --git a/htdocs/adherents/class/adherent_type.class.php b/htdocs/adherents/class/adherent_type.class.php index b2f181e59be..d051c40810b 100644 --- a/htdocs/adherents/class/adherent_type.class.php +++ b/htdocs/adherents/class/adherent_type.class.php @@ -365,7 +365,7 @@ class AdherentType extends CommonObject $sql .= "note = '".$this->db->escape($this->note)."',"; $sql .= "vote = ".(integer) $this->db->escape($this->vote).","; $sql .= "mail_valid = '".$this->db->escape($this->mail_valid)."'"; - $sql .= " WHERE rowid =".$this->id; + $sql .= " WHERE rowid =".((int) $this->id); $result = $this->db->query($sql); if ($result) { diff --git a/htdocs/adherents/class/subscription.class.php b/htdocs/adherents/class/subscription.class.php index 65b01991100..1285b12b2d0 100644 --- a/htdocs/adherents/class/subscription.class.php +++ b/htdocs/adherents/class/subscription.class.php @@ -165,7 +165,7 @@ class Subscription extends CommonObject } else { $type = $this->fk_type; } - $sql .= " VALUES (".$this->fk_adherent.", '".$this->db->escape($type)."', '".$this->db->idate($now)."',"; + $sql .= " VALUES (".((int) $this->fk_adherent).", '".$this->db->escape($type)."', '".$this->db->idate($now)."',"; $sql .= " '".$this->db->idate($this->dateh)."',"; $sql .= " '".$this->db->idate($this->datef)."',"; $sql .= " ".$this->amount.","; @@ -217,7 +217,7 @@ class Subscription extends CommonObject $sql .= " datef,"; $sql .= " subscription, note, fk_bank"; $sql .= " FROM ".MAIN_DB_PREFIX."subscription"; - $sql .= " WHERE rowid=".$rowid; + $sql .= " WHERE rowid=".((int) $rowid); dol_syslog(get_class($this)."::fetch", LOG_DEBUG); $resql = $this->db->query($sql); diff --git a/htdocs/adherents/list.php b/htdocs/adherents/list.php index 9560a284e2a..b713362912e 100644 --- a/htdocs/adherents/list.php +++ b/htdocs/adherents/list.php @@ -318,7 +318,7 @@ if ($sall) { $sql .= natural_search(array_keys($fieldstosearchall), $sall); } if ($search_type > 0) { - $sql .= " AND t.rowid=".$db->escape($search_type); + $sql .= " AND t.rowid=".((int) $search_type); } if ($search_filter == 'withoutsubscription') { $sql .= " AND (datefin IS NULL OR t.subscription = 0)"; diff --git a/htdocs/adherents/subscription.php b/htdocs/adherents/subscription.php index 54729e5ba8a..ec9b2c3a65e 100644 --- a/htdocs/adherents/subscription.php +++ b/htdocs/adherents/subscription.php @@ -677,7 +677,7 @@ if ($rowid > 0) { $sql .= " FROM ".MAIN_DB_PREFIX."adherent as d, ".MAIN_DB_PREFIX."subscription as c"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank as b ON c.fk_bank = b.rowid"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank_account as ba ON b.fk_account = ba.rowid"; - $sql .= " WHERE d.rowid = c.fk_adherent AND d.rowid=".$rowid; + $sql .= " WHERE d.rowid = c.fk_adherent AND d.rowid=".((int) $rowid); $sql .= $db->order($sortfield, $sortorder); $result = $db->query($sql); diff --git a/htdocs/adherents/subscription/list.php b/htdocs/adherents/subscription/list.php index 7322f92fccd..55cafade309 100644 --- a/htdocs/adherents/subscription/list.php +++ b/htdocs/adherents/subscription/list.php @@ -170,7 +170,7 @@ if (isset($date_select) && $date_select != '') { } if ($search_ref) { if (is_numeric($search_ref)) { - $sql .= " AND (c.rowid = ".$db->escape($search_ref).")"; + $sql .= " AND c.rowid = ".((int) $search_ref); } else { $sql .= " AND 1 = 2"; // Always wrong } diff --git a/htdocs/adherents/type.php b/htdocs/adherents/type.php index 25c44baa7db..c9b98784142 100644 --- a/htdocs/adherents/type.php +++ b/htdocs/adherents/type.php @@ -500,7 +500,7 @@ if ($rowid > 0) { $sql .= " FROM ".MAIN_DB_PREFIX."adherent as d, ".MAIN_DB_PREFIX."adherent_type as t"; $sql .= " WHERE d.fk_adherent_type = t.rowid "; $sql .= " AND d.entity IN (".getEntity('adherent').")"; - $sql .= " AND t.rowid = ".$object->id; + $sql .= " AND t.rowid = ".((int) $object->id); if ($sall) { $sql .= natural_search(array("f.firstname", "d.lastname", "d.societe", "d.email", "d.login", "d.address", "d.town", "d.note_public", "d.note_private"), $sall); } diff --git a/htdocs/admin/accountant.php b/htdocs/admin/accountant.php index 3ed43f1664f..56c9605c460 100644 --- a/htdocs/admin/accountant.php +++ b/htdocs/admin/accountant.php @@ -17,7 +17,7 @@ /** * \file htdocs/admin/accountant.php - * \ingroup accountant + * \ingroup core * \brief Setup page to configure accountant / auditor */ diff --git a/htdocs/admin/accounting.php b/htdocs/admin/accounting.php new file mode 100644 index 00000000000..e775f5bd8e3 --- /dev/null +++ b/htdocs/admin/accounting.php @@ -0,0 +1,68 @@ + + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +/** + * \file htdocs/admin/accounting.php + * \ingroup accounting + * \brief Setup page to configure accountanting module + */ + +require '../main.inc.php'; +require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php'; +require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php'; +require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php'; +require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php'; +require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php'; + +$action = GETPOST('action', 'aZ09'); +$contextpage = GETPOST('contextpage', 'aZ') ?GETPOST('contextpage', 'aZ') : 'adminaccoutant'; // To manage different context of search + +// Load translation files required by the page +$langs->loadLangs(array('admin', 'companies')); + +if (!$user->admin) { + accessforbidden(); +} + +$error = 0; + + +/* + * Actions + */ + +// Nothing + + +/* + * View + */ + +$help_url = ''; +llxHeader('', $langs->trans("ConfigAccountingExpert"), $help_url); + +$linkback = ''.$langs->trans("BackToModuleList").''; + +print load_fiche_titre($langs->trans("ConfigAccountingExpert"), $linkback, 'title_setup'); + +print "
\n"; +print ''.$langs->trans("AccountancySetupDoneFromAccountancyMenu", $langs->transnoentitiesnoconv("Accounting").' - '.$langs->transnoentitiesnoconv("Setup"))."
\n"; +print "
\n"; + +llxFooter(); + +$db->close(); diff --git a/htdocs/admin/boxes.php b/htdocs/admin/boxes.php index e8793ca3c30..44629525a26 100644 --- a/htdocs/admin/boxes.php +++ b/htdocs/admin/boxes.php @@ -114,8 +114,8 @@ if ($action == 'add') { if (empty($arrayofexistingboxid[$boxid['value']])) { $sql = "INSERT INTO ".MAIN_DB_PREFIX."boxes ("; $sql .= "box_id, position, box_order, fk_user, entity"; - $sql .= ") values ("; - $sql .= $boxid['value'].", ".$pos.", '".(($nbboxonleft > $nbboxonright) ? 'B01' : 'A01')."', ".$fk_user.", ".$conf->entity; + $sql .= ") VALUES ("; + $sql .= $boxid['value'].", ".((int) $pos).", '".(($nbboxonleft > $nbboxonright) ? 'B01' : 'A01')."', ".$fk_user.", ".$conf->entity; $sql .= ")"; dol_syslog("boxes.php activate box", LOG_DEBUG); @@ -156,7 +156,7 @@ if ($action == 'delete') { $sql = "DELETE FROM ".MAIN_DB_PREFIX."boxes"; $sql .= " WHERE entity = ".$conf->entity; - $sql .= " AND box_id=".$obj->box_id; + $sql .= " AND box_id=".((int) $obj->box_id); $resql = $db->query($sql); @@ -255,7 +255,7 @@ if ($resql) { // We renumber the order of the boxes if one of them is in '' // This occurs just after an insert. if ($decalage) { - $sql = "UPDATE ".MAIN_DB_PREFIX."boxes SET box_order='".$db->escape($decalage)."' WHERE rowid=".$obj->rowid; + $sql = "UPDATE ".MAIN_DB_PREFIX."boxes SET box_order='".$db->escape($decalage)."' WHERE rowid=".((int) $obj->rowid); $db->query($sql); } } diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index 636278dd6fb..455c01d0337 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -1151,7 +1151,7 @@ if ($id) { $sql .= " WHERE 1 = 1"; } if ($search_country_id > 0) { - $sql .= " AND c.rowid = ".$search_country_id; + $sql .= " AND c.rowid = ".((int) $search_country_id); } if ($search_code != '' && $id == 9) { $sql .= natural_search("code_iso", $search_code); diff --git a/htdocs/admin/external_rss.php b/htdocs/admin/external_rss.php index b8b412ad6f8..71086096e4f 100644 --- a/htdocs/admin/external_rss.php +++ b/htdocs/admin/external_rss.php @@ -136,7 +136,7 @@ if (GETPOST("delete")) { $sql = "DELETE FROM ".MAIN_DB_PREFIX."boxes"; $sql .= " WHERE entity = ".$conf->entity; - $sql .= " AND box_id = ".$obj->rowid; + $sql .= " AND box_id = ".((int) $obj->rowid); $resql = $db->query($sql); $sql = "DELETE FROM ".MAIN_DB_PREFIX."boxes_def"; diff --git a/htdocs/admin/mails.php b/htdocs/admin/mails.php index 0252f149d10..8fcbc898844 100644 --- a/htdocs/admin/mails.php +++ b/htdocs/admin/mails.php @@ -719,7 +719,7 @@ if ($action == 'edit') { $liste['user'] = $langs->trans('UserEmail'); $liste['company'] = $langs->trans('CompanyEmail').' ('.(empty($conf->global->MAIN_INFO_SOCIETE_MAIL) ? $langs->trans("NotDefined") : $conf->global->MAIN_INFO_SOCIETE_MAIL).')'; $sql = 'SELECT rowid, label, email FROM '.MAIN_DB_PREFIX.'c_email_senderprofile'; - $sql .= ' WHERE active = 1 AND (private = 0 OR private = '.$user->id.')'; + $sql .= ' WHERE active = 1 AND (private = 0 OR private = '.((int) $user->id).')'; $resql = $db->query($sql); if ($resql) { $num = $db->num_rows($resql); diff --git a/htdocs/admin/modules.php b/htdocs/admin/modules.php index 84bf924139c..142d5accb0f 100644 --- a/htdocs/admin/modules.php +++ b/htdocs/admin/modules.php @@ -521,8 +521,8 @@ if ($mode == 'common' || $mode == 'commonkanban') { $moreforfilter = '
'; $moreforfilter .= ''; @@ -584,6 +584,7 @@ if ($mode == 'common' || $mode == 'commonkanban') { // Show list of modules $oldfamily = ''; + $foundoneexternalmodulewithupdate = 0; $linenum = 0; foreach ($orders as $key => $value) { $linenum++; @@ -915,6 +916,7 @@ if ($mode == 'common' || $mode == 'commonkanban') { if ($objMod->needUpdate) { $versionTitle = $langs->trans('ModuleUpdateAvailable').' : '.$objMod->lastVersion; print ''.$versiontrans.''; + $foundoneexternalmodulewithupdate++; } else { print $versiontrans; } @@ -934,6 +936,14 @@ if ($mode == 'common' || $mode == 'commonkanban') { } } + if ($action == 'checklastversion') { + if ($foundoneexternalmodulewithupdate) { + setEventMessages($langs->trans("ModuleUpdateAvailable"), null, 'mesgs'); + } else { + setEventMessages($langs->trans("NoExternalModuleWithUpdate"), null, 'mesgs'); + } + } + if ($oldfamily) { if ($mode == 'commonkanban') { print '
'; diff --git a/htdocs/admin/payment.php b/htdocs/admin/payment.php index e540d561d04..9b380b676b4 100644 --- a/htdocs/admin/payment.php +++ b/htdocs/admin/payment.php @@ -189,7 +189,7 @@ foreach ($dirmodels as $reldir) { if ($conf->global->PAYMENT_ADDON == $file || $conf->global->PAYMENT_ADDON.'.php' == $file) { print img_picto($langs->trans("Activated"), 'switch_on'); } else { - print ''.img_picto($langs->trans("Disabled"), 'switch_off').''; + print ''.img_picto($langs->trans("Disabled"), 'switch_off').''; } print ''; diff --git a/htdocs/admin/security.php b/htdocs/admin/security.php index 9ce22b7c08e..e3521f1d0af 100644 --- a/htdocs/admin/security.php +++ b/htdocs/admin/security.php @@ -71,7 +71,7 @@ if ($action == 'activate_encrypt') { if (dol_hash($obj->pass)) { $sql = "UPDATE ".MAIN_DB_PREFIX."user"; $sql .= " SET pass_crypted = '".dol_hash($obj->pass)."', pass = NULL"; - $sql .= " WHERE rowid=".$obj->rowid; + $sql .= " WHERE rowid=".((int) $obj->rowid); //print $sql; $resql2 = $db->query($sql); diff --git a/htdocs/admin/system/filecheck.php b/htdocs/admin/system/filecheck.php index 0f77b9d9d41..b506231a59b 100644 --- a/htdocs/admin/system/filecheck.php +++ b/htdocs/admin/system/filecheck.php @@ -124,7 +124,7 @@ if ($enableremotecheck) { print ' = '; print '
'; } else { - print ' '.$langs->trans("RemoteSignature").' = '.$xmlremote; + print ' '.$langs->trans("RemoteSignature").' = '.dol_escape_htmltag($xmlremote); if (!GETPOST('xmlremote')) { print ' ('.$langs->trans("FeatureAvailableOnlyOnStable").')'; } diff --git a/htdocs/admin/translation.php b/htdocs/admin/translation.php index 315673f1582..f5ab2af51e3 100644 --- a/htdocs/admin/translation.php +++ b/htdocs/admin/translation.php @@ -289,7 +289,7 @@ if ($mode == 'overwrite') { print "\n"; print ''; - print $formadmin->select_language(GETPOST('langcode'), 'langcode', 0, null, 1, 0, $disablededit ? 1 : 0, 'maxwidthonsmartphone', 1); + print $formadmin->select_language(GETPOST('langcode'), 'langcode', 0, null, 1, 0, $disablededit ? 1 : 0, 'maxwidth250', 1); print ''."\n"; print ''; print ''; @@ -338,7 +338,7 @@ if ($mode == 'overwrite') { print ''.$obj->transkey.''."\n"; // Value - print ''; + print ''; /*print ''; print ''; print ''; @@ -482,7 +482,7 @@ if ($mode == 'searchkey') { print ''; //print $formadmin->select_language($langcode,'langcode',0,null,$langs->trans("All"),0,0,'',1); - print $formadmin->select_language($langcode, 'langcode', 0, null, 0, 0, 0, 'maxwidthonsmartphone', 1); + print $formadmin->select_language($langcode, 'langcode', 0, null, 0, 0, 0, 'maxwidth250', 1); print ''."\n"; print ''; print ''; @@ -529,7 +529,7 @@ if ($mode == 'searchkey') { if ($i > ($offset + $limit)) { break; } - print ''.$langcode.''.$key.''; + print ''.$langcode.''.$key.''; print dol_escape_htmltag($val); print ''; if (!empty($newlangfileonly->tab_translate[$key])) { diff --git a/htdocs/api/class/api.class.php b/htdocs/api/class/api.class.php index 356caa24ec2..6cb40825ee7 100644 --- a/htdocs/api/class/api.class.php +++ b/htdocs/api/class/api.class.php @@ -73,22 +73,24 @@ class DolibarrApi } /** - * Executed method when API is called without parameter + * Check and convert a string depending on its type/name. * * Display a short message an return a http code 200 * - * @return array + * @param string $field Field name + * @param string $value Value to check/clean + * @param stdClass $object Object + * @return string Value cleaned */ - /* Disabled, most APIs does not share same signature for method index - function index() + protected function checkValForAPI($field, $value, $object) { - return array( - 'success' => array( - 'code' => 200, - 'message' => __class__.' is up and running!' - ) - ); - }*/ + // TODO Use type detected in $object->fields + if (in_array($field, array('note', 'note_private', 'note_public', 'desc', 'description'))) { + return checkVal($value, 'restricthtml'); + } else { + return checkVal($value, 'alphanohtml'); + } + } // phpcs:disable PEAR.NamingConventions.ValidFunctionName.PublicUnderscore /** diff --git a/htdocs/api/class/api_login.class.php b/htdocs/api/class/api_login.class.php index df5b9945a76..7afdb74b89d 100644 --- a/htdocs/api/class/api_login.class.php +++ b/htdocs/api/class/api_login.class.php @@ -31,8 +31,13 @@ class Login */ public function __construct() { - global $db; + global $conf, $db; $this->db = $db; + + //$conf->global->MAIN_MODULE_API_LOGIN_DISABLED = 1; + if (!empty($conf->global->MAIN_MODULE_API_LOGIN_DISABLED)) { + throw new RestException(403, "Error login APIs are disabled. You must get the token from backoffice to be able to use APIs"); + } } /** diff --git a/htdocs/api/class/api_setup.class.php b/htdocs/api/class/api_setup.class.php index ca716712189..ceaf5f8f7d8 100644 --- a/htdocs/api/class/api_setup.class.php +++ b/htdocs/api/class/api_setup.class.php @@ -1631,8 +1631,8 @@ class Setup extends DolibarrApi global $langs, $conf; if (!DolibarrApiAccess::$user->admin - && (empty($conf->global->API_LOGIN_ALLOWED_FOR_INTEGRITY_CHECK) || DolibarrApiAccess::$user->login != $conf->global->API_LOGIN_ALLOWED_FOR_INTEGRITY_CHECK)) { - throw new RestException(403, 'Error API open to admin users only or to the users with logins defined into constant API_LOGIN_ALLOWED_FOR_INTEGRITY_CHECK'); + && (empty($conf->global->API_LOGINS_ALLOWED_FOR_INTEGRITY_CHECK) || DolibarrApiAccess::$user->login != $conf->global->API_LOGINS_ALLOWED_FOR_INTEGRITY_CHECK)) { + throw new RestException(403, 'Error API open to admin users only or to the users with logins defined into constant API_LOGINS_ALLOWED_FOR_INTEGRITY_CHECK'); } require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; @@ -1937,8 +1937,8 @@ class Setup extends DolibarrApi global $conf; if (!DolibarrApiAccess::$user->admin - && (empty($conf->global->API_LOGIN_ALLOWED_FOR_GET_MODULES) || DolibarrApiAccess::$user->login != $conf->global->API_LOGIN_ALLOWED_FOR_GET_MODULES)) { - throw new RestException(403, 'Error API open to admin users only or to the users with logins defined into constant API_LOGIN_ALLOWED_FOR_GET_MODULES'); + && (empty($conf->global->API_LOGINS_ALLOWED_FOR_GET_MODULES) || DolibarrApiAccess::$user->login != $conf->global->API_LOGINS_ALLOWED_FOR_GET_MODULES)) { + throw new RestException(403, 'Error API open to admin users only or to the users with logins defined into constant API_LOGINS_ALLOWED_FOR_GET_MODULES'); } sort($conf->modules); diff --git a/htdocs/api/index.php b/htdocs/api/index.php index 89b5a696462..d19754f9c35 100644 --- a/htdocs/api/index.php +++ b/htdocs/api/index.php @@ -119,7 +119,7 @@ if (preg_match('/api\/index\.php\/explorer/', $url) && !empty($conf->global->API // Analyze URLs // index.php/explorer do a redirect to index.php/explorer/ -// index.php/explorer/ called by swagger to build explorer page +// index.php/explorer/ called by swagger to build explorer page index.php/explorer/index.html // index.php/explorer/.../....png|.css|.js called by swagger for resources to build explorer page // index.php/explorer/resources.json called by swagger to get list of all services // index.php/explorer/resources.json/xxx called by swagger to get detail of services xxx @@ -218,6 +218,11 @@ if (!empty($reg[1]) && $reg[1] == 'explorer' && ($reg[2] == '/swagger.json' || $ continue; } + //$conf->global->MAIN_MODULE_API_LOGIN_DISABLED = 1; + if ($file_searched == 'api_login.class.php' && !empty($conf->global->MAIN_MODULE_API_LOGIN_DISABLED)) { + continue; + } + $regapi = array(); if (is_readable($dir_part.$file_searched) && preg_match("/^api_(.*)\.class\.php$/i", $file_searched, $regapi)) { $classname = ucwords($regapi[1]); @@ -291,6 +296,29 @@ if (!empty($reg[1]) && ($reg[1] != 'explorer' || ($reg[2] != '/swagger.json' && $classname = ucwords($moduleobject); + // Test rules on endpoints. For example: + // $conf->global->API_ENDPOINT_RULES = 'endpoint1:1,endpoint2:1,...' + if (!empty($conf->global->API_ENDPOINT_RULES)) { + $listofendpoints = explode(',', $conf->global->API_ENDPOINT_RULES); + $endpointisallowed = false; + + foreach ($listofendpoints as $endpointrule) { + $tmparray = explode(':', $endpointrule); + if ($classfile == $tmparray[0] && $tmparray[1] == 1) { + $endpointisallowed = true; + break; + } + } + + if (! $endpointisallowed) { + dol_syslog('The API with endpoint /'.$classfile.' is forbidden by config API_ENDPOINT_RULES', LOG_WARNING); + print 'The API with endpoint /'.$classfile.' is forbidden by config API_ENDPOINT_RULES'; + header('HTTP/1.1 501 API is forbidden by API_ENDPOINT_RULES'); + //session_destroy(); + exit(0); + } + } + dol_syslog('Search api file /'.$moduledirforclass.'/class/api_'.$classfile.'.class.php => dir_part_file='.$dir_part_file.' classname='.$classname); $res = false; @@ -314,7 +342,7 @@ if (!empty($reg[1]) && ($reg[1] != 'explorer' || ($reg[2] != '/swagger.json' && //var_dump($api->r->apiVersionMap); //exit; -// We do not want that restler output data if we use native compression (default behaviour) but we want to have it returned into a string. +// We do not want that restler outputs data if we use native compression (default behaviour) but we want to have it returned into a string. Luracast\Restler\Defaults::$returnResponse = (empty($conf->global->API_DISABLE_COMPRESSION) && !empty($_SERVER['HTTP_ACCEPT_ENCODING'])); // Call API (we suppose we found it). diff --git a/htdocs/asset/class/asset_type.class.php b/htdocs/asset/class/asset_type.class.php index 99205d2b3f3..36c654c28ba 100644 --- a/htdocs/asset/class/asset_type.class.php +++ b/htdocs/asset/class/asset_type.class.php @@ -188,7 +188,7 @@ class AssetType extends CommonObject $sql .= "accountancy_code_depreciation_asset = '".$this->db->escape($this->accountancy_code_depreciation_asset)."',"; $sql .= "accountancy_code_depreciation_expense = '".$this->db->escape($this->accountancy_code_depreciation_expense)."',"; $sql .= "note = '".$this->db->escape($this->note)."'"; - $sql .= " WHERE rowid =".$this->id; + $sql .= " WHERE rowid = ".((int) $this->id); $result = $this->db->query($sql); if ($result) { diff --git a/htdocs/blockedlog/class/authority.class.php b/htdocs/blockedlog/class/authority.class.php index 9fc10fdc59e..2071eb03c47 100644 --- a/htdocs/blockedlog/class/authority.class.php +++ b/htdocs/blockedlog/class/authority.class.php @@ -148,7 +148,7 @@ class BlockedLogAuthority global $langs; - dol_syslog(get_class($this)."::fetch id=".$id, LOG_DEBUG); + dol_syslog(get_class($this)."::fetch id=".((int) $id), LOG_DEBUG); if (empty($id) && empty($signature)) { $this->error = 'BadParameter'; diff --git a/htdocs/bom/bom_agenda.php b/htdocs/bom/bom_agenda.php index dc3421dea0c..0f18c39d2af 100644 --- a/htdocs/bom/bom_agenda.php +++ b/htdocs/bom/bom_agenda.php @@ -126,7 +126,7 @@ $form = new Form($db); if ($object->id > 0) { $title = $langs->trans("Agenda"); //if (! empty($conf->global->MAIN_HTML_TITLE) && preg_match('/thirdpartynameonly/',$conf->global->MAIN_HTML_TITLE) && $object->name) $title=$object->name." - ".$title; - $help_url = ''; + $help_url = 'EN:Module_Agenda_En|FR:Module_Agenda|ES:Módulo_Agenda'; llxHeader('', $title, $help_url); if (!empty($conf->notification->enabled)) { diff --git a/htdocs/bom/bom_card.php b/htdocs/bom/bom_card.php index 37ec67e1ba3..ae35eae14f4 100644 --- a/htdocs/bom/bom_card.php +++ b/htdocs/bom/bom_card.php @@ -241,8 +241,8 @@ $formfile = new FormFile($db); $title = $langs->trans('BOM'); - -llxHeader('', $title, ''); +$help_url ='EN:Module_BOM'; +llxHeader('', $title, $help_url); // Example : Adding jquery code print ' - - + + - + + @@ -37,6 +41,10 @@ url = "swagger.json"; } + hljs.configure({ + highlightSizeThreshold: 5000 + }); + // Pre load translate... if(window.SwaggerTranslator) { window.SwaggerTranslator.translate(); @@ -51,8 +59,8 @@ clientId: "your-client-id", clientSecret: "your-client-secret-if-required", realm: "your-realms", - appName: "your-app-name", - scopeSeparator: ",", + appName: "your-app-name", + scopeSeparator: " ", additionalQueryStringParams: {} }); } @@ -60,11 +68,7 @@ if(window.SwaggerTranslator) { window.SwaggerTranslator.translate(); } - - $('pre code').each(function(i, e) { - hljs.highlightBlock(e) - }); - + addApiKeyAuthorization(); }, onFailure: function(data) { @@ -74,8 +78,12 @@ jsonEditor: false, apisSorter: "alpha", operationsSorter: "alpha", - defaultModelRendering: 'schema', - showRequestHeaders: false + defaultModelRendering: 'model', /* example or model or schema */ + defaultModelsExpandDepth: -1, + showRequestHeaders: false, + showOperationIds: false, + displayOperationIds: false, + displayRequestDuration: true }); function addApiKeyAuthorization(){ @@ -100,13 +108,7 @@ } $('#input_apiKey').change(addApiKeyAuthorization); - - // if you have an apiKey you would like to pre-populate on the page for demonstration purposes... - /* - var apiKey = "myApiKeyXXXX123456789"; - $('#input_apiKey').val(apiKey); - */ - + window.swaggerUi.load(); function log() { @@ -118,14 +120,14 @@ -