From 444fce0bd9ccecef83a3dbbb8ed2704efcbd264d Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 11 Mar 2016 18:34:05 +0100 Subject: [PATCH 01/10] Prepare 3.7.4 --- ChangeLog | 17 +++++++++++++++++ htdocs/filefunc.inc.php | 2 +- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index ce76d999605..b28b5a4be64 100644 --- a/ChangeLog +++ b/ChangeLog @@ -9,6 +9,23 @@ Upgrading to any other version or database system is abolutely required BEFORE t make a Dolibarr upgrade. +***** ChangeLog for 3.7.4 compared to 3.7.3 ***** +FIX: #3694 +FIX: #4239 +FIX: #4291 Correctly filter external calendar GETPOSTs +FIX: #4341 +FIX: #4414 Supplier invoices use FAC_FORCE_DATE_VALIDATION client invoices property +FIX: #4440 Wrong price is filled by Product::fetch into multiprices arrays +FIX: add missing global def for ttc column +FIX: Contrat card don't consider user permissions to show active/unactive service button +FIX: CVE CVE-2015-8685 +FIX: Email templates not compatible with Multicompany +Fix: for avoid division by 0 +FIX: ISSUE #4506 : make working the PROPAL_CLONE_ON_CREATE_PAGE hidden constant +FIX: $outputlangs is not defined (dolibarr 3.7, 3.8, 3.9) +FIX: sql injection even when code is on several lines +FIX: The third dashboard don't consider user permissions + ***** ChangeLog for 3.7.3 compared to 3.7.2 ***** FIX: #3734 Do not show empty links of deleted source objects in stock movement list FIX: #3890 Expected transactions bank account page, shows negative numbers diff --git a/htdocs/filefunc.inc.php b/htdocs/filefunc.inc.php index fc909577415..66b0582b17b 100644 --- a/htdocs/filefunc.inc.php +++ b/htdocs/filefunc.inc.php @@ -29,7 +29,7 @@ * \brief File that include conf.php file and commons lib like functions.lib.php */ -if (! defined('DOL_VERSION')) define('DOL_VERSION','3.7.3'); +if (! defined('DOL_VERSION')) define('DOL_VERSION','3.7.4'); if (! defined('EURO')) define('EURO',chr(128)); // Define syslog constants From 99ceb006e444e2591a68e91d809f5764c968ec82 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 21 Mar 2016 11:47:32 +0100 Subject: [PATCH 02/10] FIX Bad include and param for project numbering module call --- htdocs/projet/class/project.class.php | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/htdocs/projet/class/project.class.php b/htdocs/projet/class/project.class.php index 68aa963ca8c..d8e1d9d4cb0 100644 --- a/htdocs/projet/class/project.class.php +++ b/htdocs/projet/class/project.class.php @@ -1140,14 +1140,21 @@ class Project extends CommonObject //Generate next ref $defaultref=''; $obj = empty($conf->global->PROJECT_ADDON)?'mod_project_simple':$conf->global->PROJECT_ADDON; - if (! empty($conf->global->PROJECT_ADDON) && is_readable(DOL_DOCUMENT_ROOT ."/core/modules/project/".$conf->global->PROJECT_ADDON.".php")) + // Search template files + $file=''; $classname=''; $filefound=0; + $dirmodels=array_merge(array('/'),(array) $conf->modules_parts['models']); + foreach($dirmodels as $reldir) { - - require_once DOL_DOCUMENT_ROOT ."/core/modules/project/".$conf->global->PROJECT_ADDON.'.php'; - $modProject = new $obj; - $defaultref = $modProject->getNextValue(is_object($clone_project->thirdparty)?$clone_project->thirdparty->id:0,$clone_project); + $file=dol_buildpath($reldir."core/modules/project/".$obj.'.php',0); + if (file_exists($file)) + { + $filefound=1; + dol_include_once($reldir."core/modules/project/".$obj.'.php'); + $modProject = new $obj; + $defaultref = $modProject->getNextValue(is_object($clone_project->thirdparty)?$clone_project->thirdparty:null, $clone_project); + break; + } } - if (is_numeric($defaultref) && $defaultref <= 0) $defaultref=''; $clone_project->ref=$defaultref; From 876484dfb565e9284a2645e4b7e6c5bb209494e7 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 22 Mar 2016 12:54:26 +0100 Subject: [PATCH 03/10] FIX Duplicate records into export --- htdocs/core/modules/modCommande.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/modules/modCommande.class.php b/htdocs/core/modules/modCommande.class.php index eabf8e17160..a4d13904153 100644 --- a/htdocs/core/modules/modCommande.class.php +++ b/htdocs/core/modules/modCommande.class.php @@ -224,7 +224,7 @@ class modCommande extends DolibarrModules $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'c_country as co ON s.fk_pays = co.rowid,'; $this->export_sql_end[$r] .=' '.MAIN_DB_PREFIX.'commande as c'; $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'user as uc ON c.fk_user_author = uc.rowid'; - $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'user as uv ON c.fk_user_valid = uc.rowid'; + $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'user as uv ON c.fk_user_valid = uv.rowid'; $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'commande_extrafields as extra ON c.rowid = extra.fk_object'; $this->export_sql_end[$r] .=' , '.MAIN_DB_PREFIX.'commandedet as cd'; $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'product as p on cd.fk_product = p.rowid'; From 4f3f1eda7b51ae72bbda68db496804964cd493a7 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 22 Mar 2016 12:55:29 +0100 Subject: [PATCH 04/10] FIX Duplicate records into export --- htdocs/core/modules/modPropale.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/modules/modPropale.class.php b/htdocs/core/modules/modPropale.class.php index 8a14e85b578..440b09fa146 100644 --- a/htdocs/core/modules/modPropale.class.php +++ b/htdocs/core/modules/modPropale.class.php @@ -217,7 +217,7 @@ class modPropale extends DolibarrModules $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'c_country as co ON s.fk_pays = co.rowid,'; $this->export_sql_end[$r] .=' '.MAIN_DB_PREFIX.'propal as c'; $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'user as uc ON c.fk_user_author = uc.rowid'; - $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'user as uv ON c.fk_user_valid = uc.rowid'; + $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'user as uv ON c.fk_user_valid = uv.rowid'; $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'propal_extrafields as extra ON c.rowid = extra.fk_object'; $this->export_sql_end[$r] .=', '.MAIN_DB_PREFIX.'propaldet as cd'; $this->export_sql_end[$r] .=' LEFT JOIN '.MAIN_DB_PREFIX.'product as p on (cd.fk_product = p.rowid)'; From 52d88db5c3e9565fa4a3074ef9353916c81bb293 Mon Sep 17 00:00:00 2001 From: fmarcet Date: Tue, 29 Dec 2015 10:35:10 +0100 Subject: [PATCH 05/10] FIX: Email templates not compatible with Multicompany Conflicts: htdocs/admin/dict.php --- htdocs/admin/dict.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index 8c751f42980..501e1d242bf 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -165,7 +165,7 @@ $tabsql[21]= "SELECT c.rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX $tabsql[22]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_input_reason"; $tabsql[23]= "SELECT t.rowid as rowid, t.taux, c.label as country, c.code as country_code, t.fk_pays as country_id, t.note, t.active, t.accountancy_code_sell, t.accountancy_code_buy FROM ".MAIN_DB_PREFIX."c_revenuestamp as t, ".MAIN_DB_PREFIX."c_country as c WHERE t.fk_pays=c.rowid"; $tabsql[24]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_type_resource"; -$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates"; +$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity = ".$conf->entity; $tabsql[26]= "SELECT rowid as rowid, code, label, short_label, active FROM ".MAIN_DB_PREFIX."c_units"; $tabsql[27]= "SELECT id as rowid, code, libelle, active FROM ".MAIN_DB_PREFIX."c_stcomm"; $tabsql[28]= "SELECT h.rowid as rowid, h.code, h.label, h.delay, h.newByMonth, h.fk_country as country_id, c.code as country_code, c.label as country, h.active FROM ".MAIN_DB_PREFIX."c_holiday_types as h LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON h.fk_country=c.rowid"; @@ -293,7 +293,7 @@ $tabfieldinsert[21]= "code,label"; $tabfieldinsert[22]= "code,label"; $tabfieldinsert[23]= "fk_pays,taux,accountancy_code_sell,accountancy_code_buy,note"; $tabfieldinsert[24]= "code,label"; -$tabfieldinsert[25]= "label,type_template,position,topic,content"; +$tabfieldinsert[25]= "label,type_template,private,position,topic,content,entity"; $tabfieldinsert[26]= "code,label,short_label"; $tabfieldinsert[27]= "code,libelle"; $tabfieldinsert[28]= "code,label,delay,newByMonth,fk_country"; From e2b4d39292de9daf9f65489faa6d951e7239acb0 Mon Sep 17 00:00:00 2001 From: fmarcet Date: Tue, 29 Dec 2015 11:22:18 +0100 Subject: [PATCH 06/10] FIX: Email templates not compatible with Multicompany Conflicts: htdocs/admin/dict.php --- htdocs/admin/dict.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index 501e1d242bf..6bb26854e14 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -165,7 +165,7 @@ $tabsql[21]= "SELECT c.rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX $tabsql[22]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_input_reason"; $tabsql[23]= "SELECT t.rowid as rowid, t.taux, c.label as country, c.code as country_code, t.fk_pays as country_id, t.note, t.active, t.accountancy_code_sell, t.accountancy_code_buy FROM ".MAIN_DB_PREFIX."c_revenuestamp as t, ".MAIN_DB_PREFIX."c_country as c WHERE t.fk_pays=c.rowid"; $tabsql[24]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_type_resource"; -$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity = ".$conf->entity; +$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity = ".getEntity('email_template',1); $tabsql[26]= "SELECT rowid as rowid, code, label, short_label, active FROM ".MAIN_DB_PREFIX."c_units"; $tabsql[27]= "SELECT id as rowid, code, libelle, active FROM ".MAIN_DB_PREFIX."c_stcomm"; $tabsql[28]= "SELECT h.rowid as rowid, h.code, h.label, h.delay, h.newByMonth, h.fk_country as country_id, c.code as country_code, c.label as country, h.active FROM ".MAIN_DB_PREFIX."c_holiday_types as h LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON h.fk_country=c.rowid"; From 84e5c8b437ebeee7afea8f9c609eb457ba4b876f Mon Sep 17 00:00:00 2001 From: fmarcet Date: Mon, 4 Jan 2016 09:12:27 +0100 Subject: [PATCH 07/10] FIX: Email templates not compatible with Multicompany Conflicts: htdocs/admin/dict.php --- htdocs/admin/dict.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index 6bb26854e14..0357bd02b6d 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -165,7 +165,7 @@ $tabsql[21]= "SELECT c.rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX $tabsql[22]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_input_reason"; $tabsql[23]= "SELECT t.rowid as rowid, t.taux, c.label as country, c.code as country_code, t.fk_pays as country_id, t.note, t.active, t.accountancy_code_sell, t.accountancy_code_buy FROM ".MAIN_DB_PREFIX."c_revenuestamp as t, ".MAIN_DB_PREFIX."c_country as c WHERE t.fk_pays=c.rowid"; $tabsql[24]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_type_resource"; -$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity = ".getEntity('email_template',1); +$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity IN ".getEntity('email_template',1); $tabsql[26]= "SELECT rowid as rowid, code, label, short_label, active FROM ".MAIN_DB_PREFIX."c_units"; $tabsql[27]= "SELECT id as rowid, code, libelle, active FROM ".MAIN_DB_PREFIX."c_stcomm"; $tabsql[28]= "SELECT h.rowid as rowid, h.code, h.label, h.delay, h.newByMonth, h.fk_country as country_id, c.code as country_code, c.label as country, h.active FROM ".MAIN_DB_PREFIX."c_holiday_types as h LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON h.fk_country=c.rowid"; From b8bc881e5af2a40702901fa42905de07a16ef808 Mon Sep 17 00:00:00 2001 From: fmarcet Date: Thu, 7 Jan 2016 08:18:36 +0100 Subject: [PATCH 08/10] FIX: Email templates not compatible with Multicompany Conflicts: htdocs/admin/dict.php --- htdocs/admin/dict.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index 0357bd02b6d..9af2b3fe0af 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -165,7 +165,7 @@ $tabsql[21]= "SELECT c.rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX $tabsql[22]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_input_reason"; $tabsql[23]= "SELECT t.rowid as rowid, t.taux, c.label as country, c.code as country_code, t.fk_pays as country_id, t.note, t.active, t.accountancy_code_sell, t.accountancy_code_buy FROM ".MAIN_DB_PREFIX."c_revenuestamp as t, ".MAIN_DB_PREFIX."c_country as c WHERE t.fk_pays=c.rowid"; $tabsql[24]= "SELECT rowid as rowid, code, label, active FROM ".MAIN_DB_PREFIX."c_type_resource"; -$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity IN ".getEntity('email_template',1); +$tabsql[25]= "SELECT rowid as rowid, label, type_template, private, position, topic, content, active FROM ".MAIN_DB_PREFIX."c_email_templates WHERE entity IN (".getEntity('email_template',1).")"; $tabsql[26]= "SELECT rowid as rowid, code, label, short_label, active FROM ".MAIN_DB_PREFIX."c_units"; $tabsql[27]= "SELECT id as rowid, code, libelle, active FROM ".MAIN_DB_PREFIX."c_stcomm"; $tabsql[28]= "SELECT h.rowid as rowid, h.code, h.label, h.delay, h.newByMonth, h.fk_country as country_id, c.code as country_code, c.label as country, h.active FROM ".MAIN_DB_PREFIX."c_holiday_types as h LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON h.fk_country=c.rowid"; From bdead30e751e655e218dac821f3910ccfd9c84dc Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 25 Mar 2016 14:42:16 +0100 Subject: [PATCH 09/10] FIX Missing function --- htdocs/compta/localtax/quadri_detail.php | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/htdocs/compta/localtax/quadri_detail.php b/htdocs/compta/localtax/quadri_detail.php index 7c1e99b3537..e8b77636d3f 100644 --- a/htdocs/compta/localtax/quadri_detail.php +++ b/htdocs/compta/localtax/quadri_detail.php @@ -210,9 +210,8 @@ $total = 0; $i=0; // Load arrays of datas -$x_coll= local_by_date($db, 0, 0, $date_start, $date_end, $modetax, 'sell', $local); -//$x_coll = vat_by_date($db, 0, 0, $date_start, $date_end, $modetax, 'sell'); -$x_paye = local_by_date($db, 0, 0, $date_start, $date_end, $modetax, 'buy', $local); +$x_coll = vat_by_date($db, 0, 0, $date_start, $date_end, $modetax, 'sell'); +$x_paye = vat_by_date($db, 0, 0, $date_start, $date_end, $modetax, 'buy'); echo ''; @@ -235,9 +234,9 @@ else { //foreach($x_coll[$my_coll_rate][localtax1_list]){ $x_both[$my_coll_rate]['coll']['totalht'] = $x_coll[$my_coll_rate]['totalht']; - $x_both[$my_coll_rate]['coll']['vat'] = $x_coll[$my_coll_rate]['vat']; + $x_both[$my_coll_rate]['coll']['localtax'.$local] = $x_coll[$my_coll_rate]['localtax'.$local]; $x_both[$my_coll_rate]['paye']['totalht'] = 0; - $x_both[$my_coll_rate]['paye']['vat'] = 0; + $x_both[$my_coll_rate]['paye']['localtax'.$local] = 0; $x_both[$my_coll_rate]['coll']['links'] = ''; $x_both[$my_coll_rate]['coll']['detail'] = array(); foreach($x_coll[$my_coll_rate]['facid'] as $id=>$dummy) From 5e55f0ecceaaa5eebfd9c562f651b0b3e99bfc89 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 25 Mar 2016 16:07:42 +0100 Subject: [PATCH 10/10] Fix bad function name into hook --- htdocs/compta/tva/index.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/htdocs/compta/tva/index.php b/htdocs/compta/tva/index.php index 6445eb09f02..87c4e682161 100644 --- a/htdocs/compta/tva/index.php +++ b/htdocs/compta/tva/index.php @@ -160,9 +160,10 @@ for ($m = 1 ; $m < 13 ; $m++ ) $parameters["mode"] = $modetax; $parameters["year"] = $y; $parameters["month"] = $m; + // Initialize technical object to manage hooks of expenses. Note that conf->hooks_modules contains array array $hookmanager->initHooks(array('externalbalance')); - $reshook=$hookmanager->executeHooks('addStatisticLine',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks + $reshook=$hookmanager->executeHooks('addVatLine',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks if (! is_array($coll_listbuy) && $coll_listbuy == -1) {