From ea1611a425f20948daaf42583fc279217979ca63 Mon Sep 17 00:00:00 2001 From: Florian HENRY Date: Thu, 26 Mar 2026 08:28:47 +0100 Subject: [PATCH 1/4] FIX: do not print Extrafields in PDF if printable is 0 --- htdocs/core/class/commondocgenerator.class.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/htdocs/core/class/commondocgenerator.class.php b/htdocs/core/class/commondocgenerator.class.php index a333a0b5fc2..0c51aae6945 100644 --- a/htdocs/core/class/commondocgenerator.class.php +++ b/htdocs/core/class/commondocgenerator.class.php @@ -1458,8 +1458,8 @@ abstract class CommonDocGenerator } $disableOnEmpty = 0; - if ($enabled && !empty($extrafields->attributes[$object->table_element]['printable'][$key])) { - $printable = intval($extrafields->attributes[$object->table_element]['printable'][$key]); + $printable = intval($extrafields->attributes[$object->table_element]['printable'][$key]); + if ($enabled && !empty($printable)) { if (in_array($printable, $params['printableEnable']) || in_array($printable, $params['printableEnableNotEmpty'])) { $enabled = 1; } @@ -1469,7 +1469,7 @@ abstract class CommonDocGenerator } } - if (empty($enabled)) { + if (empty($enabled) || empty($printable)) { continue; } From cec448fcea25b29251b8fef0aa76ec24abb7929f Mon Sep 17 00:00:00 2001 From: Florian HENRY Date: Thu, 26 Mar 2026 10:57:44 +0100 Subject: [PATCH 2/4] FIX: do not print Extrafields in PDF if printable is 0 --- htdocs/core/lib/geturl.lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/lib/geturl.lib.php b/htdocs/core/lib/geturl.lib.php index 001ffaf555d..b32d9e840bf 100644 --- a/htdocs/core/lib/geturl.lib.php +++ b/htdocs/core/lib/geturl.lib.php @@ -30,7 +30,7 @@ * * @param string $url URL to call. * @param string $postorget 'POST', 'GET', 'HEAD', 'PUT', 'PUTALREADYFORMATED', 'POSTALREADYFORMATED', 'DELETE' - * @param string|array $param Parameters of URL (x=value1&y=value2) or may be a formated content with $postorget='PUTALREADYFORMATED' + * @param string|array $param Parameters of URL (x=value1&y=value2) or may be a formatted content with $postorget='PUTALREADYFORMATED' * @param integer $followlocation 0=Do not follow, 1=Follow location. * @param string[] $addheaders Array of string to add into header. Example: ('Accept: application/xrds+xml', ....) * @param string[] $allowedschemes List of schemes that are allowed ('http' + 'https' only by default) From cdb7d97a7be394f7b3175e662d0ff14af513c295 Mon Sep 17 00:00:00 2001 From: Florian HENRY Date: Fri, 27 Mar 2026 08:35:59 +0100 Subject: [PATCH 3/4] fix CI --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 58eafa4a37c..6db7b2e81f0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,7 +39,7 @@ FIX: 18.0: GETPOSTDATE and buildParamDate assumed HTTP param names 'minute' and FIX: not remove value of others extra-fields on update extras action NEW: Automatically release docker image for each GitHub release FIX: getDolGlobalInt -SEC: fix IDOR attack on employee evaluation. Missing permision test https://github.com/atm-florianm/dolibarr/commit/7ed0af2a138a34e7c7005b95c85ffc791976a6cf +SEC: fix IDOR attack on employee evaluation. Missing permission test https://github.com/atm-florianm/dolibarr/commit/7ed0af2a138a34e7c7005b95c85ffc791976a6cf FIX: Implementation of multi-company compatibility with inventory/warehouse management FIX: 17.0: perweek.php resets task progress to 0% when: (#36401) FIX: DA027383: permissions not checked on HRM evaluation card (#36328) (#36399) @@ -61,7 +61,7 @@ FIX: wrong check of hook return FIX: 16.0: extrafield of type link to category causes SQL error in selectForFormsList() (#36074) FIX: 16.0 (up to 19.0): extrafield of type link to category causes SQL error in selectForFormsList FIX: missing "printFieldListValue" hook (#35990) -FIX: add action paramter +FIX: add action parameter FIX: remove duplicate object FIX: expense report card: use correct bank module designator for detection FIX: wrong check of hook return From 894f2c175f6c0749ffa91eecf12e29cf183fd606 Mon Sep 17 00:00:00 2001 From: Florian HENRY Date: Thu, 9 Apr 2026 07:44:36 +0200 Subject: [PATCH 4/4] review btter fix for not print extrafields --- htdocs/core/class/commondocgenerator.class.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/htdocs/core/class/commondocgenerator.class.php b/htdocs/core/class/commondocgenerator.class.php index 0c51aae6945..f9e1fa816f2 100644 --- a/htdocs/core/class/commondocgenerator.class.php +++ b/htdocs/core/class/commondocgenerator.class.php @@ -1458,7 +1458,10 @@ abstract class CommonDocGenerator } $disableOnEmpty = 0; - $printable = intval($extrafields->attributes[$object->table_element]['printable'][$key]); + $printable = 0; + if (isset($extrafields->attributes[$object->table_element]['printable'][$key])) { + $printable = (int) $extrafields->attributes[$object->table_element]['printable'][$key]; + } if ($enabled && !empty($printable)) { if (in_array($printable, $params['printableEnable']) || in_array($printable, $params['printableEnableNotEmpty'])) { $enabled = 1;