diff --git a/ChangeLog b/ChangeLog index 58eafa4a37c..6db7b2e81f0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,7 +39,7 @@ FIX: 18.0: GETPOSTDATE and buildParamDate assumed HTTP param names 'minute' and FIX: not remove value of others extra-fields on update extras action NEW: Automatically release docker image for each GitHub release FIX: getDolGlobalInt -SEC: fix IDOR attack on employee evaluation. Missing permision test https://github.com/atm-florianm/dolibarr/commit/7ed0af2a138a34e7c7005b95c85ffc791976a6cf +SEC: fix IDOR attack on employee evaluation. Missing permission test https://github.com/atm-florianm/dolibarr/commit/7ed0af2a138a34e7c7005b95c85ffc791976a6cf FIX: Implementation of multi-company compatibility with inventory/warehouse management FIX: 17.0: perweek.php resets task progress to 0% when: (#36401) FIX: DA027383: permissions not checked on HRM evaluation card (#36328) (#36399) @@ -61,7 +61,7 @@ FIX: wrong check of hook return FIX: 16.0: extrafield of type link to category causes SQL error in selectForFormsList() (#36074) FIX: 16.0 (up to 19.0): extrafield of type link to category causes SQL error in selectForFormsList FIX: missing "printFieldListValue" hook (#35990) -FIX: add action paramter +FIX: add action parameter FIX: remove duplicate object FIX: expense report card: use correct bank module designator for detection FIX: wrong check of hook return diff --git a/htdocs/core/class/commondocgenerator.class.php b/htdocs/core/class/commondocgenerator.class.php index a333a0b5fc2..f9e1fa816f2 100644 --- a/htdocs/core/class/commondocgenerator.class.php +++ b/htdocs/core/class/commondocgenerator.class.php @@ -1458,8 +1458,11 @@ abstract class CommonDocGenerator } $disableOnEmpty = 0; - if ($enabled && !empty($extrafields->attributes[$object->table_element]['printable'][$key])) { - $printable = intval($extrafields->attributes[$object->table_element]['printable'][$key]); + $printable = 0; + if (isset($extrafields->attributes[$object->table_element]['printable'][$key])) { + $printable = (int) $extrafields->attributes[$object->table_element]['printable'][$key]; + } + if ($enabled && !empty($printable)) { if (in_array($printable, $params['printableEnable']) || in_array($printable, $params['printableEnableNotEmpty'])) { $enabled = 1; } @@ -1469,7 +1472,7 @@ abstract class CommonDocGenerator } } - if (empty($enabled)) { + if (empty($enabled) || empty($printable)) { continue; } diff --git a/htdocs/core/lib/geturl.lib.php b/htdocs/core/lib/geturl.lib.php index 001ffaf555d..b32d9e840bf 100644 --- a/htdocs/core/lib/geturl.lib.php +++ b/htdocs/core/lib/geturl.lib.php @@ -30,7 +30,7 @@ * * @param string $url URL to call. * @param string $postorget 'POST', 'GET', 'HEAD', 'PUT', 'PUTALREADYFORMATED', 'POSTALREADYFORMATED', 'DELETE' - * @param string|array $param Parameters of URL (x=value1&y=value2) or may be a formated content with $postorget='PUTALREADYFORMATED' + * @param string|array $param Parameters of URL (x=value1&y=value2) or may be a formatted content with $postorget='PUTALREADYFORMATED' * @param integer $followlocation 0=Do not follow, 1=Follow location. * @param string[] $addheaders Array of string to add into header. Example: ('Accept: application/xrds+xml', ....) * @param string[] $allowedschemes List of schemes that are allowed ('http' + 'https' only by default)