From e87e4eb18749e494075063055166321c7ce2153d Mon Sep 17 00:00:00 2001 From: Zakaria Boushaba <48571684+Boushabazakaria@users.noreply.github.com> Date: Mon, 13 Apr 2026 12:25:05 +0100 Subject: [PATCH 1/6] Fix: fallback to numeric VAT rate match when default_vat_code is null (#37830) * Fix: fallback to numeric VAT rate match when default_vat_code is not set on product * fix: restore VAT rate assignment for input box case alongside combo fallback --------- Co-authored-by: Zakaria Boushaba --- htdocs/core/tpl/objectline_create.tpl.php | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/htdocs/core/tpl/objectline_create.tpl.php b/htdocs/core/tpl/objectline_create.tpl.php index da6c68d3897..3226c49f6f5 100644 --- a/htdocs/core/tpl/objectline_create.tpl.php +++ b/htdocs/core/tpl/objectline_create.tpl.php @@ -943,13 +943,20 @@ if (!empty($usemargins) && $user->hasRight('margins', 'creer')) { } - // Set vat rate if field is an input box - $('#tva_tx').val(tva_tx); - // Set vat rate by selecting the combo - //$('#tva_tx option').val(tva_tx); // This is bugged, it replaces the vat key of all options - $('#tva_tx option').removeAttr('selected'); - console.log("stringforvatrateselection="+stringforvatrateselection+" -> value of option label for this key="+$('#tva_tx option[value="'+stringforvatrateselection+'"]').val()); - $('#tva_tx option[value="'+stringforvatrateselection+'"]').prop('selected', true); + // Set vat rate: handle both input box and combo cases + if ($('#tva_tx option').length) { + // It is a combo: try exact match first (rate + code), fallback to numeric match + if ($('#tva_tx option[value="' + stringforvatrateselection + '"]').length) { + $('#tva_tx').val(stringforvatrateselection); + } else { + $('#tva_tx option').filter(function () { + return parseFloat($(this).val()) === parseFloat(tva_tx); + }).first().prop('selected', true); + } + } else { + // It is an input box + $('#tva_tx').val(tva_tx); + } Date: Tue, 14 Apr 2026 19:31:07 +0200 Subject: [PATCH 2/6] FIX SQL Injection via Operator Injection in Contract Service List This vulnerability was discovered and reported by Nguy Minh Tuan (@minhtuanact) of Sun Cyber Security Research Team. --- htdocs/contrat/services_list.php | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/htdocs/contrat/services_list.php b/htdocs/contrat/services_list.php index c120a3add47..6860bf941ba 100644 --- a/htdocs/contrat/services_list.php +++ b/htdocs/contrat/services_list.php @@ -323,28 +323,28 @@ if ($filter_datecloture_start != '' && $filter_opcloture == -1) { } if (!empty($filter_opouvertureprevue) && $filter_opouvertureprevue != -1 && $filter_opouvertureprevue != ' BETWEEN ' && $filter_dateouvertureprevue_start != '') { - $sql .= " AND cd.date_ouverture_prevue ".$filter_opouvertureprevue." '".$db->idate($filter_dateouvertureprevue_start)."'"; + $sql .= " AND cd.date_ouverture_prevue ".preg_replace('/[^<>]/', '', $filter_opouvertureprevue)." '".$db->idate($filter_dateouvertureprevue_start)."'"; } if (!empty($filter_opouvertureprevue) && $filter_opouvertureprevue == ' BETWEEN ') { - $sql .= " AND cd.date_ouverture_prevue ".$filter_opouvertureprevue." '".$db->idate($filter_dateouvertureprevue_start)."' AND '".$db->idate($filter_dateouvertureprevue_end)."'"; + $sql .= " AND cd.date_ouverture_prevue ".$db->sanitize($filter_opouvertureprevue)." '".$db->idate($filter_dateouvertureprevue_start)."' AND '".$db->idate($filter_dateouvertureprevue_end)."'"; } if (!empty($filter_op1) && $filter_op1 != -1 && $filter_op1 != ' BETWEEN ' && $filter_date1_start != '') { - $sql .= " AND cd.date_ouverture ".$filter_op1." '".$db->idate($filter_date1_start)."'"; + $sql .= " AND cd.date_ouverture ".preg_replace('/[^<>]/', '', $filter_op1)." '".$db->idate($filter_date1_start)."'"; } if (!empty($filter_op1) && $filter_op1 == ' BETWEEN ') { - $sql .= " AND cd.date_ouverture ".$filter_op1." '".$db->idate($filter_date1_start)."' AND '".$db->idate($filter_date1_end)."'"; + $sql .= " AND cd.date_ouverture ".$db->sanitize($filter_op1)." '".$db->idate($filter_date1_start)."' AND '".$db->idate($filter_date1_end)."'"; } if (!empty($filter_op2) && $filter_op2 != -1 && $filter_op2 != ' BETWEEN ' && $filter_date2_start != '') { - $sql .= " AND cd.date_fin_validite ".$filter_op2." '".$db->idate($filter_date2_start)."'"; + $sql .= " AND cd.date_fin_validite ".preg_replace('/[^<>]/', '', $filter_op2)." '".$db->idate($filter_date2_start)."'"; } if (!empty($filter_op2) && $filter_op2 == ' BETWEEN ') { - $sql .= " AND cd.date_fin_validite ".$filter_op2." '".$db->idate($filter_date2_start)."' AND '".$db->idate($filter_date2_end)."'"; + $sql .= " AND cd.date_fin_validite ".$db->sanitize($filter_op2)." '".$db->idate($filter_date2_start)."' AND '".$db->idate($filter_date2_end)."'"; } if (!empty($filter_opcloture) && $filter_opcloture != ' BETWEEN ' && $filter_opcloture != -1 && $filter_datecloture_start != '') { - $sql .= " AND cd.date_cloture ".$filter_opcloture." '".$db->idate($filter_datecloture_start)."'"; + $sql .= " AND cd.date_cloture ".preg_replace('/[^<>]/', '', $filter_opcloture)." '".$db->idate($filter_datecloture_start)."'"; } if (!empty($filter_opcloture) && $filter_opcloture == ' BETWEEN ') { - $sql .= " AND cd.date_cloture ".$filter_opcloture." '".$db->idate($filter_datecloture_start)."' AND '".$db->idate($filter_datecloture_end)."'"; + $sql .= " AND cd.date_cloture ".$db->sanitize($filter_opcloture)." '".$db->idate($filter_datecloture_start)."' AND '".$db->idate($filter_datecloture_end)."'"; } // Add where from extra fields include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_sql.tpl.php'; From 3686e70c1e33714bc22fe385b753cfbd4b449273 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 15 Apr 2026 16:07:59 +0200 Subject: [PATCH 3/6] Doc --- htdocs/core/lib/geturl.lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/lib/geturl.lib.php b/htdocs/core/lib/geturl.lib.php index 339abf89c3c..c8df855a399 100644 --- a/htdocs/core/lib/geturl.lib.php +++ b/htdocs/core/lib/geturl.lib.php @@ -30,7 +30,7 @@ * * @param string $url URL to call. * @param string $postorget 'POST', 'GET', 'HEAD', 'PUT', 'PUTALREADYFORMATED', 'POSTALREADYFORMATED', 'DELETE' - * @param string|array $param Parameters of URL (x=value1&y=value2) or may be a formated content with $postorget='PUTALREADYFORMATED' + * @param string|array $param Parameters of URL (x=value1&y=value2) or may be a formatted content with $postorget='PUTALREADYFORMATED' * @param integer $followlocation 0=Do not follow, 1=Follow location. * @param string[] $addheaders Array of string to add into header. Example: ('Accept: application/xrds+xml', ....) * @param string[] $allowedschemes List of schemes that are allowed ('http' + 'https' only by default) From d30da98414328e97dc3df69bfb103369a43d0f54 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 15 Apr 2026 18:40:59 +0200 Subject: [PATCH 4/6] Fix warning --- htdocs/accountancy/journal/bankjournal.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/accountancy/journal/bankjournal.php b/htdocs/accountancy/journal/bankjournal.php index 9a57dbaa93b..05cdfdf861a 100644 --- a/htdocs/accountancy/journal/bankjournal.php +++ b/htdocs/accountancy/journal/bankjournal.php @@ -671,7 +671,7 @@ if (!$error && $action == 'writebookkeeping' && $user->hasRight('accounting', 'b $accountingaccountpayment->fetch(0, getDolGlobalString('SALARIES_ACCOUNTING_ACCOUNT_PAYMENT'), true); $accountingaccountexpensereport = new AccountingAccount($db); - $accountingaccountexpensereport->fetch(0, $conf->global->ACCOUNTING_ACCOUNT_EXPENSEREPORT, true); + $accountingaccountexpensereport->fetch(0, getDolGlobalString('ACCOUNTING_ACCOUNT_EXPENSEREPORT'), true); $accountingaccountsuspense = new AccountingAccount($db); $accountingaccountsuspense->fetch(0, getDolGlobalString('ACCOUNTING_ACCOUNT_SUSPENSE'), true); From a5307001c6444f9d9d21c83b9cba9583eebbb57f Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 15 Apr 2026 18:52:59 +0200 Subject: [PATCH 5/6] Make a dangerous and very unstable feature hidden. Should never be on as it ha sno doubt that option is not stable and dev not complete. A lot of side effect not yet managed must be managed first before beeing enabled. Related to #37878 --- htdocs/admin/payment.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/htdocs/admin/payment.php b/htdocs/admin/payment.php index f60bed8f0c9..fe1111aed8b 100644 --- a/htdocs/admin/payment.php +++ b/htdocs/admin/payment.php @@ -270,12 +270,14 @@ print ' '; print "\n"; // Allow payments on different thirdparties bills but same parent company +/* print ''; print $langs->trans("PaymentOnDifferentThirdBills"); print ''; print $form->selectyesno("FACTURE_PAYMENTS_ON_DIFFERENT_THIRDPARTIES_BILLS", getDolGlobalInt('FACTURE_PAYMENTS_ON_DIFFERENT_THIRDPARTIES_BILLS'), 1); print ''; print "\n"; +*/ // Allow to group payments by mod in rapports print ''; From d6f53cf07892062ba08328749d467569f15afd15 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 15 Apr 2026 18:52:59 +0200 Subject: [PATCH 6/6] Make a dangerous and very unstable feature hidden. Should never be on as it ha sno doubt that option is not stable and dev not complete. A lot of side effect not yet managed must be managed first before beeing enabled. Related to #37878 --- htdocs/admin/payment.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/htdocs/admin/payment.php b/htdocs/admin/payment.php index 9b380b676b4..19ac365c107 100644 --- a/htdocs/admin/payment.php +++ b/htdocs/admin/payment.php @@ -253,12 +253,14 @@ print ' '; print "\n"; // Allow payments on different thirdparties bills but same parent company +/* print ''; print $langs->trans("PaymentOnDifferentThirdBills"); print ''; print $form->selectyesno("FACTURE_PAYMENTS_ON_DIFFERENT_THIRDPARTIES_BILLS", $conf->global->FACTURE_PAYMENTS_ON_DIFFERENT_THIRDPARTIES_BILLS, 1); print ''; print "\n"; +*/ // Allow to group payments by mod in rapports print '';