diff --git a/htdocs/core/ajax/objectonoff.php b/htdocs/core/ajax/objectonoff.php
index 81b5a3d18a3..080cf0804a2 100644
--- a/htdocs/core/ajax/objectonoff.php
+++ b/htdocs/core/ajax/objectonoff.php
@@ -91,7 +91,7 @@ if (!empty($user->socid)) {
 // Check is done on $user->rights->element->create or $user->rights->element->subelement->create (because $action = 'set')
 if (preg_match('/stat[u][st]$/', $field) || ($field == 'evenunsubscribe' && $object->table_element == 'mailing')) {
 	restrictedArea($user, $object->module, $object, $object->table_element, $usesublevelpermission);
-} elseif ($element == 'product' && in_array($field, array('tosell', 'tobuy', 'tobatch'))) {	// Special case for products
+} elseif ($element == 'product' && in_array($field, array('status', 'status_buy', 'status_batch', 'tosell', 'tobuy', 'tobatch'))) {	// Special case for products
 	restrictedArea($user, 'produit|service', $object, 'product&product', '', '', 'rowid');
 } else {
 	httponly_accessforbidden("Bad value for combination of parameters element/field: Field not supported.");	// This includes the exit.
diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php
index 8fb07432226..5f8a6049a7f 100644
--- a/htdocs/core/class/commonobject.class.php
+++ b/htdocs/core/class/commonobject.class.php
@@ -2284,9 +2284,16 @@ abstract class CommonObject
 			$id_field = 'rowid';
 		}
 
+		$propfield = $field;
+
 		// Special case
 		if ($table == 'product' && $field == 'note_private') {
 			$field = 'note';
+			$propfield = 'note_private';
+		}
+		if ($table == 'product' && $field == 'status') {
+			$field = 'tosell';
+			$propfield = 'status';
 		}
 
 		if (in_array($table, array('actioncomm', 'adherent', 'advtargetemailing', 'cronjob', 'establishment'))) {
@@ -2298,9 +2305,9 @@ abstract class CommonObject
 
 		$oldvalue = null;
 		if ($trigkey) {
-			$sql = "SELECT " . $field;
-			$sql .= " FROM " . MAIN_DB_PREFIX . $table;
-			$sql .= " WHERE " . $id_field . " = " . ((int) $id);
+			$sql = "SELECT " . $this->db->sanitize($field);
+			$sql .= " FROM " . MAIN_DB_PREFIX . $this->db->sanitize($table);
+			$sql .= " WHERE " . $this->db->sanitize($id_field) . " = " . ((int) $id);
 
 			$resql = $this->db->query($sql);
 			if ($resql) {
@@ -2326,13 +2333,13 @@ abstract class CommonObject
 		$sql = "UPDATE ".$this->db->prefix().$table." SET ";
 
 		if ($format == 'text') {
-			$sql .= $field." = '".$this->db->escape($value)."'";
+			$sql .= $this->db->sanitize($field)." = '".$this->db->escape($value)."'";
 		} elseif ($format == 'int') {
-			$sql .= $field." = ".((int) $value);
+			$sql .= $this->db->sanitize($field)." = ".((int) $value);
 		} elseif ($format == 'date') {
-			$sql .= $field." = ".($value ? "'".$this->db->idate($value)."'" : "null");
+			$sql .= $this->db->sanitize($field)." = ".($value ? "'".$this->db->idate($value)."'" : "null");
 		} elseif ($format == 'dategmt') {
-			$sql .= $field." = ".($value ? "'".$this->db->idate($value, 'gmt')."'" : "null");
+			$sql .= $this->db->sanitize($field)." = ".($value ? "'".$this->db->idate($value, 'gmt')."'" : "null");
 		}
 
 		if ($fk_user_field) {
@@ -2343,7 +2350,7 @@ abstract class CommonObject
 			}
 		}
 
-		$sql .= " WHERE ".$id_field." = ".((int) $id);
+		$sql .= " WHERE ".$this->db->sanitize($id_field)." = ".((int) $id);
 
 		$resql = $this->db->query($sql);
 		if ($resql) {
@@ -2354,9 +2361,16 @@ abstract class CommonObject
 				} else {
 					$result = $this->fetchCommon($id);
 				}
+				if (property_exists($this, $field)) {	// Set again the property field because it may have been erased by the previous fetch
+					$this->$field = $value;
+				}
+				if ($propfield != $field && property_exists($this, $propfield)) {	// Set again the property field because it may have been erased by the previous fetch
+					$this->$propfield = $value;
+				}
+
 				$this->oldcopy = clone $this;
-				if (property_exists($this->oldcopy, $field)) {
-					$this->oldcopy->$field = $oldvalue;
+				if (property_exists($this->oldcopy, $propfield)) {
+					$this->oldcopy->$propfield = $oldvalue;
 				}
 
 				if (empty($this->context['actionmsgmore'])) {
@@ -2369,15 +2383,25 @@ abstract class CommonObject
 				if ($result < 0) {
 					$error++;
 				}
-			}
-
-			if (!$error) {
+			} else {
 				if (property_exists($this, $field)) {
 					$this->$field = $value;
 				}
+				if ($propfield != $field && property_exists($this, $propfield)) {
+					$this->$propfield = $value;
+				}
+			}
+
+			if (!$error) {
 				$this->db->commit();
 				return 1;
 			} else {
+				if (property_exists($this, $field)) {
+					$this->$field = $oldvalue;
+				}
+				if ($propfield != $field && property_exists($this, $propfield)) {
+					$this->$propfield = $oldvalue;
+				}
 				$this->db->rollback();
 				return -2;
 			}
diff --git a/htdocs/core/triggers/README b/htdocs/core/triggers/README
index 32669cede97..26429f29ac5 100644
--- a/htdocs/core/triggers/README
+++ b/htdocs/core/triggers/README
@@ -3,7 +3,7 @@ Directory content
 This directory contains all available Dolibarr triggers.
 
 Trigger file name syntax is:
-> interface_modModule_Mytrigger.php[-NORUN]
+> interface_xx_modModule_Mytrigger.php[-NORUN]
 
 where:
 > modModule is part of module descriptor file name found in core/modules
diff --git a/htdocs/core/triggers/README-FR b/htdocs/core/triggers/README-FR
deleted file mode 100644
index 51907e648aa..00000000000
--- a/htdocs/core/triggers/README-FR
+++ /dev/null
@@ -1,17 +0,0 @@
-Contenu du répertoire
---------------------------------------------------------
-Ce répertoire contient tous les triggers Dolibarr.
-
-La syntaxe d'un fichier Trigger est:
-> interface_modModule_Mytrigger.php[-NORUN]
-
-où:
-> modModule est la partie du nom du descripteur de module trouvé dans le
-            répertoire core/modules pour lequel le trigger doit être.
-            actif ou la valeur 'all' si ne doit pas être actif pour un
-			module particulier.
-> Mytrigger est le nom du trigger. La classe PHP dans le fichier trigger
-            aura pour nom InterfaceMytrigger.
-> -NORUN est optionnel et désactive le fichier trigger si défini. Pour
-            utiliser un tel fichier trigger, renommer le fichier afin
-			d'enlever la partie -NORUN.