From 5b245ba99b5232f288779005a23ee38bd018dacb Mon Sep 17 00:00:00 2001 From: kkhelifa-opendsi Date: Thu, 23 Apr 2026 18:38:29 +0200 Subject: [PATCH 1/6] FIX : calculate the files count on ECM when add multiple files in one time (#31866) Calculate the files count on ECM when add multiple files in one time #19493, end fix will become in next PR --- htdocs/ecm/class/ecmdirectory.class.php | 27 ++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/htdocs/ecm/class/ecmdirectory.class.php b/htdocs/ecm/class/ecmdirectory.class.php index d0c3657ca07..c02ff7ea0ba 100644 --- a/htdocs/ecm/class/ecmdirectory.class.php +++ b/htdocs/ecm/class/ecmdirectory.class.php @@ -296,12 +296,37 @@ class EcmDirectory extends CommonObject */ public function changeNbOfFiles($value) { + global $conf; + + if ($value == '+') { + $relativepath = $conf->ecm->dir_output . '/' . $this->getRelativePath(); // Ex: dir1/dir2/dir3/ + $relativepath = preg_replace('/^' . preg_quote(DOL_DATA_ROOT, '/') . '/', '', $relativepath); + $relativepath = trim($relativepath, '/'); + + // Get nb file in relative path + $sql = "SELECT COUNT(*) AS nb"; + $sql .= " FROM " . $this->db->prefix() . "ecm_files"; + $sql .= " WHERE filepath = '" . $this->db->escape($relativepath) . "'"; + + dol_syslog(get_class($this) . "::changeNbOfFiles - Get nb file in relative path", LOG_DEBUG); + $resql = $this->db->query($sql); + if (!$resql) { + $this->error = "Error " . $this->db->lasterror(); + return -1; + } else { + $value = 0; + if ($obj = $this->db->fetch_object($resql)) { + $value = (int) $obj->nb; + } + } + } + // Update request $sql = "UPDATE ".MAIN_DB_PREFIX."ecm_directories SET"; if (preg_match('/[0-9]+/', $value)) { $sql .= " cachenbofdoc = ".(int) $value; } else { - $sql .= " cachenbofdoc = cachenbofdoc ".$value." 1"; + $sql .= " cachenbofdoc = cachenbofdoc " . preg_replace('/[^\-]/', '', $value) . " 1"; } $sql .= " WHERE rowid = ".((int) $this->id); From 75cce0b7b5a32512f7f8335b4c62adf1e57ed641 Mon Sep 17 00:00:00 2001 From: Eric - CAP-REL <1468823+rycks@users.noreply.github.com> Date: Sun, 26 Apr 2026 22:47:09 +0200 Subject: [PATCH 2/6] next step for PR #31866 / Issue #19493 (#37988) --- htdocs/ecm/class/ecmdirectory.class.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/ecm/class/ecmdirectory.class.php b/htdocs/ecm/class/ecmdirectory.class.php index c02ff7ea0ba..45e47da86e1 100644 --- a/htdocs/ecm/class/ecmdirectory.class.php +++ b/htdocs/ecm/class/ecmdirectory.class.php @@ -291,14 +291,14 @@ class EcmDirectory extends CommonObject /** * Update cache of nb of documents into database * - * @param string $value '+' or '-' or new number + * @param string $value '+' (one more) or '-' (one less) or new number (like '5') or 'database' (recompute from database) * @return int <0 if KO, >0 if OK */ public function changeNbOfFiles($value) { global $conf; - if ($value == '+') { + if ($value == 'database') { $relativepath = $conf->ecm->dir_output . '/' . $this->getRelativePath(); // Ex: dir1/dir2/dir3/ $relativepath = preg_replace('/^' . preg_quote(DOL_DATA_ROOT, '/') . '/', '', $relativepath); $relativepath = trim($relativepath, '/'); From ab434beee48b18e2e666f62cffb8f9cb11e0f6a9 Mon Sep 17 00:00:00 2001 From: lvessiller-opendsi Date: Tue, 28 Apr 2026 13:26:24 +0200 Subject: [PATCH 3/6] FIX autofill price with multicurrency on supplier doc (backport commit 391aca5) (#38028) --- htdocs/core/class/html.form.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php index f9f83a238fa..3ec2663647b 100644 --- a/htdocs/core/class/html.form.class.php +++ b/htdocs/core/class/html.form.class.php @@ -3692,7 +3692,7 @@ class Form $optstart .= ' data-supplier-ref="' . dol_escape_htmltag($objp->ref_fourn) . '"'; if (isModEnabled('multicurrency')) { $optstart .= ' data-multicurrency-code="' . dol_escape_htmltag($objp->multicurrency_code) . '"'; - $optstart .= ' data-multicurrency-up="' . dol_escape_htmltag($objp->multicurrency_unitprice) . '"'; + $optstart .= ' data-multicurrency-unitprice="' . dol_escape_htmltag(price2num($objp->multicurrency_unitprice)) . '"'; // the price with numeric international format } } $optstart .= ' data-description="' . dol_escape_htmltag($objp->description, 0, 1) . '"'; From 10ed656ee082a0c04dd4701ab2aa462aaa84ebc5 Mon Sep 17 00:00:00 2001 From: atm-jonathan <146709163+atm-jonathan@users.noreply.github.com> Date: Fri, 1 May 2026 23:16:22 +0200 Subject: [PATCH 4/6] FIX double transaction db begin (#38033) * Limit standard on price list * Remove redundant $db->begin() call that caused transaction mismatch. --------- Co-authored-by: ATM-Lucas --- htdocs/ticket/class/ticket.class.php | 2 -- 1 file changed, 2 deletions(-) diff --git a/htdocs/ticket/class/ticket.class.php b/htdocs/ticket/class/ticket.class.php index bf17cc9f0bc..8e8806cebb2 100644 --- a/htdocs/ticket/class/ticket.class.php +++ b/htdocs/ticket/class/ticket.class.php @@ -1713,8 +1713,6 @@ class Ticket extends CommonObject $this->status = Ticket::STATUS_READ; - $this->db->begin(); - $sql = "UPDATE ".MAIN_DB_PREFIX."ticket"; $sql .= " SET fk_statut = ".((int) $this->status) .", date_read = '".$this->db->idate(dol_now())."'"; $sql .= " WHERE rowid = ".((int) $this->id); From e142f7618a2f3c1c8b70c1f97212b1f3281bd4b1 Mon Sep 17 00:00:00 2001 From: Alexandre SPANGARO Date: Mon, 4 May 2026 17:41:37 +0200 Subject: [PATCH 5/6] FIX #38054 Societe - Export - Problem on stcomm & typent (#38065) * FIX Societe - Export - Problem on stcomm & typent * remove mistake --- htdocs/core/modules/modSociete.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/modules/modSociete.class.php b/htdocs/core/modules/modSociete.class.php index 43d8a9ac94b..c3ba6f08ec5 100644 --- a/htdocs/core/modules/modSociete.class.php +++ b/htdocs/core/modules/modSociete.class.php @@ -402,7 +402,7 @@ class modSociete extends DolibarrModules 's.code_compta' => "Text", 's.code_compta_fournisseur' => "Text", 's.client' => "Numeric", 's.fournisseur' => "Numeric", 's.address' => "Text", 's.zip' => "Text", 's.town' => "Text", 's.phone' => "Text", 's.email' => "Text", - 't.code' => "List:c_stcomm:libelle:code", + 't.code' => "List:c_typent:libelle:code", 'c.entity' => 'List:entity:label:rowid', 's.entity' => 'List:entity:label:rowid', ); From be15e9f4012111f60046fcbefc25dc3cac5f6476 Mon Sep 17 00:00:00 2001 From: Eric Seigne Date: Thu, 7 May 2026 09:17:38 +0200 Subject: [PATCH 6/6] Prepare 18.0.10 --- ChangeLog | 10 ++++++++++ htdocs/filefunc.inc.php | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 6db7b2e81f0..10e6c9589a8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -2,6 +2,16 @@ English Dolibarr ChangeLog -------------------------------------------------------------- +***** ChangeLog for 18.0.10 compared to 18.0.9 ***** + +FIX: autofill price with multicurrency on supplier doc (backport commit 391aca5) (#38028) +FIX: calculate the files count on ECM when add multiple files in one time (#31866) +FIX: #GHSA-hq5j-39f9-qxcv (#37812) +FIX: SQL Injection via Operator Injection in Contract Service List +FIX: #GHSA-crgg-h74r-2m8r (#37636) +FIX: do not print Extrafields in PDF if printable is 0 +FIX: a param must not come from end user entry. + ***** ChangeLog for 18.0.9 compared to 18.0.8 ***** 100 files changed, 2283 insertions(+), 591 deletions(-) diff --git a/htdocs/filefunc.inc.php b/htdocs/filefunc.inc.php index c8d6878d597..d607eae2845 100644 --- a/htdocs/filefunc.inc.php +++ b/htdocs/filefunc.inc.php @@ -34,7 +34,7 @@ if (!defined('DOL_APPLICATION_TITLE')) { define('DOL_APPLICATION_TITLE', 'Dolibarr'); } if (!defined('DOL_VERSION')) { - define('DOL_VERSION', '18.0.9'); // a.b.c-alpha, a.b.c-beta, a.b.c-rcX or a.b.c + define('DOL_VERSION', '18.0.10'); // a.b.c-alpha, a.b.c-beta, a.b.c-rcX or a.b.c } if (!defined('EURO')) {