diff --git a/htdocs/adherents/class/api_members.class.php b/htdocs/adherents/class/api_members.class.php
index c8462e36db8..05ddabc1cb6 100644
--- a/htdocs/adherents/class/api_members.class.php
+++ b/htdocs/adherents/class/api_members.class.php
@@ -380,6 +380,14 @@ class Members extends DolibarrApi
 
 		$member = new Adherent($this->db);
 		foreach ($request_data as $field => $value) {
+			if (in_array($field, array('pass', 'pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key'))) {
+				// This properties can't be set/modified with API
+				throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs");
+			}
+			if (in_array($field, array('user_id') && !DolibarrApiAccess::$user->hasRight('user', 'user', 'creer'))) {
+				// This properties can't be set/modified with API without permission user->user->creer
+				throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs without permission user->user->create");
+			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
 				$member->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
@@ -423,7 +431,17 @@ class Members extends DolibarrApi
 			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
+		$sav_user_id = $member->user_id;
+
 		foreach ($request_data as $field => $value) {
+			if (in_array($field, array('pass', 'pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key'))) {
+				// This properties can't be set/modified with API
+				throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs");
+			}
+			if (in_array($field, array('user_id') && !DolibarrApiAccess::$user->hasRight('user', 'user', 'creer'))) {
+				// This properties can't be set/modified with API without permission user->user->creer
+				throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs without the permission user->user->create");
+			}
 			if ($field == 'id') {
 				continue;
 			}
@@ -464,7 +482,9 @@ class Members extends DolibarrApi
 
 		// If there is no error, update() returns the number of affected rows
 		// so if the update is a no op, the return value is zero.
-		if ($member->update(DolibarrApiAccess::$user) >= 0) {
+		$nosyncuser = 0;
+		$nosyncpassword = 1;										// Disable password sync. Management of password must be done using the user API only.
+		if ($member->update(DolibarrApiAccess::$user, 0, $nosyncuser, $nosyncpassword) >= 0) {
 			return $this->get($id);
 		} else {
 			throw new RestException(500, 'Error when updating member: '.$member->error);
@@ -565,6 +585,9 @@ class Members extends DolibarrApi
 			unset($object->fk_delivery_address);
 			unset($object->shipping_method_id);
 
+			unset($object->pass);
+			unset($object->pass_crypted);
+
 			unset($object->total_ht);
 			unset($object->total_ttc);
 			unset($object->total_tva);
diff --git a/htdocs/core/actions_massactions.inc.php b/htdocs/core/actions_massactions.inc.php
index 797b2c77fd4..684698af331 100644
--- a/htdocs/core/actions_massactions.inc.php
+++ b/htdocs/core/actions_massactions.inc.php
@@ -1946,7 +1946,7 @@ if (!$error && ($massaction == 'clonetasks' || ($action == 'clonetasks' && $conf
 	if (empty($newproject->public)) {
 		$tmps = $newproject->getProjectsAuthorizedForUser($user, 0, 1, 0, '(fk_statut:=:1)');	// We check only open project (cloning on closed is not allowed)
 		$tmparray = explode(',', $tmps);
-		if (!in_array($newproject->id, $tmparray)) {
+		if (in_array($newproject->id, $tmparray)) {
 			$iscontactofnewproject = 1;
 		}
 	}
diff --git a/htdocs/core/lib/ticket.lib.php b/htdocs/core/lib/ticket.lib.php
index 35f35c75674..fade752e8b1 100644
--- a/htdocs/core/lib/ticket.lib.php
+++ b/htdocs/core/lib/ticket.lib.php
@@ -218,7 +218,7 @@ function showDirectPublicLink($object)
 	$email = CMailFile::getValidAddress($object->origin_email, 2);
 	$url = '';
 	if ($email) {
-		$url = getDolGlobalString('TICKET_URL_PUBLIC_INTERFACE', dol_buildpath('/public/ticket/', 3)).'view.php?track_id='.$object->track_id.'&email='.$email;
+		$url = getDolGlobalString('TICKET_URL_PUBLIC_INTERFACE', dol_buildpath('/public/ticket/', 3)).'view.php?track_id='.urlencode($object->track_id).'&email='.urlencode($email);
 	}
 
 	$out = '';
diff --git a/htdocs/user/bank.php b/htdocs/user/bank.php
index 6d9117a3cf0..f79a61e8c01 100644
--- a/htdocs/user/bank.php
+++ b/htdocs/user/bank.php
@@ -99,6 +99,14 @@ if (!$bankid) {
 	$account->fetch(0, '', $id);
 } else {
 	$account->fetch($bankid);
+	if ($account->id > 0) {
+		if ((int) $account->userid !== (int) $object->id) {
+			accessforbidden();
+		}
+		if ((int) $account->entity !== (int) $conf->entity) {
+			accessforbidden();
+		}
+	}
 }
 if (empty($account->userid)) {
 	$account->userid = $object->id;