';
+print '';
+print '| '.$langs->trans("Parameters").' | '."\n";
+print ''.$langs->trans("Value").' | '."\n";
+print '
'."\n";
+
// Use Ajax form to select a product
print '';
@@ -624,9 +658,10 @@ if (empty($conf->global->PRODUIT_USE_SEARCH_TO_SELECT)) {
print '
';
print '| '.$langs->trans("OnProductSelectAddProductDesc").' | ';
print '';
+print '';
print $form->selectarray(
"activate_FillProductDescAuto",
- array(1=>'AutoFillFormFieldBeforeSubmit', 0=>'DoNotAutofillButAutoConcat', -1=>'DoNotUseDescriptionOfProdut'),
+ array(0=>'DoNotAutofillButAutoConcat', 1=>'AutoFillFormFieldBeforeSubmit', 2=>'DoNotUseDescriptionOfProdut'),
empty($conf->global->PRODUIT_AUTOFILL_DESC) ? 0 : $conf->global->PRODUIT_AUTOFILL_DESC,
0,
0,
@@ -682,22 +717,6 @@ if (!empty($conf->global->MAIN_MULTILANGS)) {
print ' |
';
}
-if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SUPPLIERMOD)) || !empty($conf->supplier_order->enabled) || !empty($conf->supplier_invoice->enabled)) {
- print '';
- print '| '.$langs->trans("UseProductFournDesc").' | ';
- print '';
- print $form->selectyesno("activate_useProdFournDesc", (!empty($conf->global->PRODUIT_FOURN_TEXTS) ? $conf->global->PRODUIT_FOURN_TEXTS : 0), 1);
- print ' | ';
- print '
';
-
- print '';
- print '| '.$langs->trans("UseProductSupplierPackaging").' | ';
- print '';
- print $form->selectyesno("activate_useProdSupplierPackaging", (!empty($conf->global->PRODUCT_USE_SUPPLIER_PACKAGING) ? $conf->global->PRODUCT_USE_SUPPLIER_PACKAGING : 0), 1);
- print ' | ';
- print '
';
-}
-
if (!empty($conf->global->PRODUCT_CANVAS_ABILITY)) {
// Add canvas feature
diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php
index fdc50d5fe87..0ac8cba1391 100644
--- a/htdocs/product/class/product.class.php
+++ b/htdocs/product/class/product.class.php
@@ -2236,7 +2236,7 @@ class Product extends CommonObject
// Check parameters
if (!$id && !$ref && !$ref_ext && !$barcode) {
$this->error = 'ErrorWrongParameters';
- dol_syslog(get_class($this)."::fetch ".$this->error);
+ dol_syslog(get_class($this)."::fetch ".$this->error, LOG_ERR);
return -1;
}
@@ -2286,7 +2286,7 @@ class Product extends CommonObject
$sql .= " LEFT JOIN " . MAIN_DB_PREFIX . "product_perentity as ppe ON ppe.fk_product = p.rowid AND ppe.entity = " . ((int) $conf->entity);
}
if ($separatedStock) {
- $sql .= " LEFT JOIN " . MAIN_DB_PREFIX . "product_stock as sp ON sp.fk_product = p.rowid";
+ $sql .= " LEFT JOIN " . MAIN_DB_PREFIX . "product_stock as sp ON sp.fk_product = p.rowid AND sp.fk_entrepot IN (SELECT rowid FROM ".MAIN_DB_PREFIX."entrepot WHERE entity IN (".$this->db->sanitize($visibleWarehousesEntities)."))";
}
if ($id) {
$sql .= " WHERE p.rowid = ".((int) $id);
@@ -2300,9 +2300,6 @@ class Product extends CommonObject
$sql .= " AND p.barcode = '".$this->db->escape($barcode)."'";
}
}
- if ($separatedStock) {
- $sql .= " AND sp.fk_entrepot IN (SELECT rowid FROM ".MAIN_DB_PREFIX."entrepot WHERE entity IN (".$this->db->sanitize($visibleWarehousesEntities)."))";
- }
if ($separatedStock) {
$sql .= " GROUP BY p.rowid, p.ref, p.ref_ext, p.label, p.description, p.url, p.note_public, p.note, p.customcode, p.fk_country, p.fk_state, p.lifetime, p.qc_frequency, p.price, p.price_ttc,";
$sql .= " p.price_min, p.price_min_ttc, p.price_base_type, p.cost_price, p.default_vat_code, p.tva_tx, p.recuperableonly, p.localtax1_tx, p.localtax2_tx, p.localtax1_type, p.localtax2_type, p.tosell,";
diff --git a/htdocs/theme/md/style.css.php b/htdocs/theme/md/style.css.php
index aa87a36f01d..8a642a0e170 100644
--- a/htdocs/theme/md/style.css.php
+++ b/htdocs/theme/md/style.css.php
@@ -3091,8 +3091,8 @@ div.tabsElem a {
div.tabBar {
color: #;
padding-top: 21px;
- padding-left: 18px;
- padding-right: 18px;
+ padding-left: 24px;
+ padding-right: 24px;
padding-bottom: 18px;
margin: 0px 0px 18px 0px;
-webkit-border-radius: 3px;
@@ -3439,9 +3439,9 @@ tr.liste_titre_filter td.liste_titre {
}
.liste_titre_create td, .liste_titre_create th, .liste_titre_create .tagtd
{
- /*border-top-width: 1px;
+ border-top-width: 1px;
border-top-color: rgb();
- border-top-style: solid;*/
+ border-top-style: solid;
}
.liste_titre_add td, .liste_titre_add th, .liste_titre_add .tagtd
{
@@ -3830,7 +3830,7 @@ div.liste_titre_bydiv, .liste_titre div.tagtr, tr.liste_titre, tr.liste_titre_se
{
background: rgb();
font-weight: ;
- border-bottom: 1px solid #FDFFFF;
+ /* border-bottom: 1px solid #FDFFFF; */
color: rgb();
font-family: ;
diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php
index 37ce6544cd0..0bde31dec50 100644
--- a/htdocs/user/class/user.class.php
+++ b/htdocs/user/class/user.class.php
@@ -442,7 +442,7 @@ class User extends CommonObject
if ($entity < 0) {
if ((empty($conf->multicompany->enabled) || empty($conf->global->MULTICOMPANY_TRANSVERSE_MODE)) && (!empty($user->entity))) {
- $sql .= " WHERE u.entity IN (0, ".$this->db->sanitize($conf->entity).")";
+ $sql .= " WHERE u.entity IN (0, ".((int) $conf->entity).")";
} else {
$sql .= " WHERE u.entity IS NOT NULL"; // multicompany is on in transverse mode or user making fetch is on entity 0, so user is allowed to fetch anywhere into database
}
@@ -451,7 +451,7 @@ class User extends CommonObject
if (!empty($conf->multicompany->enabled) && !empty($conf->global->MULTICOMPANY_TRANSVERSE_MODE)) {
$sql .= " WHERE u.entity IS NOT NULL"; // multicompany is on in transverse mode or user making fetch is on entity 0, so user is allowed to fetch anywhere into database
} else {
- $sql .= " WHERE u.entity IN (0, ".$this->db->sanitize(($entity != '' && $entity >= 0) ? $entity : $conf->entity).")"; // search in entity provided in parameter
+ $sql .= " WHERE u.entity IN (0, ".((int) (($entity != '' && $entity >= 0) ? $entity : $conf->entity)).")"; // search in entity provided in parameter
}
}
@@ -2109,8 +2109,8 @@ class User extends CommonObject
$outputlangs = new Translate("", $conf);
if (isset($this->conf->MAIN_LANG_DEFAULT)
- && $this->conf->MAIN_LANG_DEFAULT != 'auto') { // If user has defined its own language (rare because in most cases, auto is used)
- $outputlangs->getDefaultLang($this->conf->MAIN_LANG_DEFAULT);
+ && $this->conf->MAIN_LANG_DEFAULT != 'auto') { // If user has defined its own language (rare because in most cases, auto is used)
+ $outputlangs->getDefaultLang($this->conf->MAIN_LANG_DEFAULT);
}
if ($this->conf->MAIN_LANG_DEFAULT) {
@@ -2184,7 +2184,7 @@ class User extends CommonObject
'',
'',
$trackid
- );
+ );
if ($mailfile->sendfile()) {
return 1;
@@ -3222,7 +3222,7 @@ class User extends CommonObject
foreach ($this->users as $key => $val) {
if (preg_match('/'.$keyfilter1.'/', $val['fullpath']) || preg_match('/'.$keyfilter2.'/', $val['fullpath'])
|| preg_match('/'.$keyfilter3.'/', $val['fullpath']) || preg_match('/'.$keyfilter4.'/', $val['fullpath'])) {
- unset($this->users[$key]);
+ unset($this->users[$key]);
}
}
}
diff --git a/test/phpunit/SecurityTest.php b/test/phpunit/SecurityTest.php
index 08d4ec88703..d75ec962020 100644
--- a/test/phpunit/SecurityTest.php
+++ b/test/phpunit/SecurityTest.php
@@ -321,6 +321,10 @@ class SecurityTest extends PHPUnit\Framework\TestCase
$test="XSS";
$result=testSqlAndScriptInject($test, 0);
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject lll');
+
+ $test="Text with ' encoded with the numeric html entity converted into text entity ' (like when submited by CKEditor)";
+ $result=testSqlAndScriptInject($test, 0);
+ $this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject mmm');
}
/**
@@ -358,6 +362,7 @@ class SecurityTest extends PHPUnit\Framework\TestCase
$_POST["param12"]='aaa';
$_POST["param13"]='n n > < " XSS';
$_POST["param13b"]='n n > < " XSS';
+ $_POST["param14"]="Text with ' encoded with the numeric html entity converted into text entity ' (like when submited by CKEditor)";
//$_POST["param13"]='javascript%26colon%26%23x3B%3Balert(1)';
//$_POST["param14"]='javascripT&javascript#x3a alert(1)';
@@ -494,6 +499,10 @@ class SecurityTest extends PHPUnit\Framework\TestCase
print __METHOD__." result=".$result."\n";
$this->assertEquals('n n > < " XSS', $result, 'Test 13b that HTML entities are decoded with restricthtml, but only for common alpha chars');
+ $result=GETPOST("param14", 'restricthtml');
+ print __METHOD__." result=".$result."\n";
+ $this->assertEquals("Text with ' encoded with the numeric html entity converted into text entity ' (like when submited by CKEditor)", $result, 'Test 14');
+
// Special test for GETPOST of backtopage, backtolist or backtourl parameter
$_POST["backtopage"]='//www.google.com';