diff --git a/htdocs/contrat/card.php b/htdocs/contrat/card.php index 91b88838b0d..7eea9ca3b61 100644 --- a/htdocs/contrat/card.php +++ b/htdocs/contrat/card.php @@ -374,6 +374,7 @@ if (empty($reshook)) { $fk_parent_line = 0; $num = count($lines); + $rang = 0; for ($i = 0; $i < $num; $i++) { $product_type = ($lines[$i]->product_type ? $lines[$i]->product_type : 0); @@ -443,7 +444,7 @@ if (empty($reshook)) { $lines[$i]->pa_ht, $array_options, (int) $lines[$i]->fk_unit, - $num + 1 + $rang++ ); if ($result < 0) { diff --git a/htdocs/core/tpl/extrafields_view.tpl.php b/htdocs/core/tpl/extrafields_view.tpl.php index 735d12f5606..346f232e244 100644 --- a/htdocs/core/tpl/extrafields_view.tpl.php +++ b/htdocs/core/tpl/extrafields_view.tpl.php @@ -281,7 +281,7 @@ if (empty($reshook) && !empty($object->table_element) && isset($extrafields->att $datenotinstring = $db->jdate($datenotinstring); } //print 'x'.$object->array_options['options_' . $tmpkeyextra].'-'.$datenotinstring.' - '.dol_print_date($datenotinstring, 'dayhour'); - $value = GETPOSTISSET("options_".$tmpkeyextra) ? dol_mktime(12, 0, 0, GETPOSTINT("options_".$tmpkeyextra."month"), GETPOSTINT("options_".$tmpkeyextra."day"), GETPOSTINT("options_".$tmpkeyextra."year")) : $datenotinstring; + $value = ($action == 'edit_extras' && GETPOSTISSET("options_".$tmpkeyextra)) ? dol_mktime(12, 0, 0, GETPOSTINT("options_".$tmpkeyextra."month"), GETPOSTINT("options_".$tmpkeyextra."day"), GETPOSTINT("options_".$tmpkeyextra."year")) : $datenotinstring; } if (in_array($extrafields->attributes[$object->table_element]['type'][$tmpkeyextra], array('datetime'))) { $datenotinstring = empty($object->array_options['options_'.$tmpkeyextra]) ? '' : $object->array_options['options_'.$tmpkeyextra]; @@ -290,7 +290,7 @@ if (empty($reshook) && !empty($object->table_element) && isset($extrafields->att $datenotinstring = $db->jdate($datenotinstring); } //print 'x'.$object->array_options['options_' . $tmpkeyextra].'-'.$datenotinstring.' - '.dol_print_date($datenotinstring, 'dayhour'); - $value = GETPOSTISSET("options_".$tmpkeyextra) ? dol_mktime(GETPOSTINT("options_".$tmpkeyextra."hour"), GETPOSTINT("options_".$tmpkeyextra."min"), GETPOSTINT("options_".$tmpkeyextra."sec"), GETPOSTINT("options_".$tmpkeyextra."month"), GETPOSTINT("options_".$tmpkeyextra."day"), GETPOSTINT("options_".$tmpkeyextra."year"), 'tzuserrel') : $datenotinstring; + $value = ($action == 'edit_extras' && GETPOSTISSET("options_".$tmpkeyextra)) ? dol_mktime(GETPOSTINT("options_".$tmpkeyextra."hour"), GETPOSTINT("options_".$tmpkeyextra."min"), GETPOSTINT("options_".$tmpkeyextra."sec"), GETPOSTINT("options_".$tmpkeyextra."month"), GETPOSTINT("options_".$tmpkeyextra."day"), GETPOSTINT("options_".$tmpkeyextra."year"), 'tzuserrel') : $datenotinstring; } // TODO Improve element and rights detection diff --git a/htdocs/fourn/class/fournisseur.commande.class.php b/htdocs/fourn/class/fournisseur.commande.class.php index 38fb90e959b..19e14b0af72 100644 --- a/htdocs/fourn/class/fournisseur.commande.class.php +++ b/htdocs/fourn/class/fournisseur.commande.class.php @@ -164,7 +164,7 @@ class CommandeFournisseur extends CommonOrder public $date_approve2; /** - * @var int|'' Date of the purchase order ordering + * @var int|''|null Date of the purchase order ordering */ public $date_commande; @@ -1955,7 +1955,7 @@ class CommandeFournisseur extends CommonOrder $this->date = dol_now(); $this->date_creation = 0; $this->date_validation = 0; - $this->date_commande = 0; + $this->date_commande = null; $this->ref_supplier = ''; $this->user_approve_id = 0; $this->user_approve_id2 = 0; diff --git a/htdocs/install/index.php b/htdocs/install/index.php index c089a90fdf4..41dd768a0e1 100644 --- a/htdocs/install/index.php +++ b/htdocs/install/index.php @@ -27,6 +27,11 @@ define('ALLOWED_IF_UPGRADE_UNLOCK_FOUND', 1); include_once 'inc.php'; +/** + * @var string $conffile + * @var ?string $dolibarr_main_url_root + */ +'@phan-var-force string $conffile'; // From inc.php include_once '../core/class/html.form.class.php'; include_once '../core/class/html.formadmin.class.php'; @@ -36,6 +41,7 @@ $err = 0; // If the config file exists and is filled, we're not on first install so we skip the language selection page if (file_exists($conffile) && isset($dolibarr_main_url_root)) { + //header("Location: '.$dolibarr_main_url_root.'/install/check.php?testget=ok"); header("Location: check.php?testget=ok"); exit; } diff --git a/htdocs/user/card.php b/htdocs/user/card.php index f24f36cb993..7f33fb4cc61 100644 --- a/htdocs/user/card.php +++ b/htdocs/user/card.php @@ -165,6 +165,13 @@ if ($id > 0) { $permissiontoeditpasswordandsend = ((($user->id == $id) && $user->hasRight("user", "self", "password")) || (($user->id != $id) && $user->hasRight("user", "user", "password")))&& (empty($user->socid) || $user->socid == $object->socid); } +// Permission to read salary and hourly rate +$permissiontoseesalary = (empty($user->socid) && ( + (isModEnabled('salaries') && $user->hasRight("salaries", "read") && ($id == 0 || in_array($id, $childids))) // If user is a manager of employee + || (isModEnabled('salaries') && $user->hasRight("salaries", "readall")) + || (isModEnabled('hrm') && $user->hasRight("hrm", "employee", "read"))) + || (!isModEnabled('salaries') && !isModEnabled('hrm') && ($user->admin || $id == 0 || in_array($id, $childids)))); + $passwordismodified = false; $ldap = null; @@ -337,16 +344,18 @@ if (empty($reshook)) { $object->fk_user_holiday_validator = GETPOSTINT("fk_user_holiday_validator") > 0 ? GETPOSTINT("fk_user_holiday_validator") : 0; $object->employee = GETPOSTINT('employee'); - $object->thm = GETPOST("thm", 'alphanohtml') != '' ? GETPOSTFLOAT("thm") : ''; - $object->thm = price2num($object->thm); - $object->tjm = GETPOST("tjm", 'alphanohtml') != '' ? GETPOSTFLOAT("tjm") : ''; - $object->tjm = price2num($object->tjm); - $object->salary = GETPOST("salary", 'alphanohtml') != '' ? GETPOSTFLOAT("salary") : ''; - $object->salary = price2num($object->salary); - $object->salaryextra = GETPOST("salaryextra", 'alphanohtml'); - //$object->salaryextra = price2num($object->salaryextra); - $object->weeklyhours = GETPOST("weeklyhours", 'alphanohtml') != '' ? GETPOSTFLOAT("weeklyhours") : ''; - $object->weeklyhours = price2num($object->weeklyhours); + if ($permissiontoseesalary) { + $object->thm = GETPOST("thm", 'alphanohtml') != '' ? GETPOSTFLOAT("thm") : ''; + $object->thm = price2num($object->thm); + $object->tjm = GETPOST("tjm", 'alphanohtml') != '' ? GETPOSTFLOAT("tjm") : ''; + $object->tjm = price2num($object->tjm); + $object->salary = GETPOST("salary", 'alphanohtml') != '' ? GETPOSTFLOAT("salary") : ''; + $object->salary = price2num($object->salary); + $object->salaryextra = GETPOST("salaryextra", 'alphanohtml') != '' ? GETPOSTFLOAT("salaryextra") : ''; + $object->salaryextra = price2num($object->salaryextra); + $object->weeklyhours = GETPOST("weeklyhours", 'alphanohtml') != '' ? GETPOSTFLOAT("weeklyhours") : ''; + $object->weeklyhours = price2num($object->weeklyhours); + } $object->color = GETPOST("color", 'alphanohtml') != '' ? str_replace('#', '', (string) GETPOST("color", 'alphanohtml')) : ''; @@ -530,16 +539,19 @@ if (empty($reshook)) { $object->fk_user_holiday_validator = GETPOSTINT("fk_user_holiday_validator") > 0 ? GETPOSTINT("fk_user_holiday_validator") : 0; $object->employee = GETPOSTINT('employee'); - $object->thm = GETPOST("thm", 'alphanohtml') != '' ? GETPOSTFLOAT("thm") : ''; - $object->thm = price2num($object->thm); - $object->tjm = GETPOST("tjm", 'alphanohtml') != '' ? GETPOSTFLOAT("tjm") : ''; - $object->tjm = price2num($object->tjm); - $object->salary = GETPOST("salary", 'alphanohtml') != '' ? GETPOSTFLOAT("salary") : ''; - $object->salary = price2num($object->salary); - $object->salaryextra = GETPOST("salaryextra", 'alphanohtml') != '' ? GETPOSTFLOAT("salaryextra") : ''; - //$object->salaryextra = price2num($object->salaryextra); - $object->weeklyhours = GETPOST("weeklyhours", 'alphanohtml') != '' ? GETPOSTFLOAT("weeklyhours") : ''; - $object->weeklyhours = price2num($object->weeklyhours); + // Only users allowed to see salary/HR fields can modify them (issue #32909) + if ($permissiontoseesalary) { + $object->thm = GETPOST("thm", 'alphanohtml') != '' ? GETPOSTFLOAT("thm") : ''; + $object->thm = price2num($object->thm); + $object->tjm = GETPOST("tjm", 'alphanohtml') != '' ? GETPOSTFLOAT("tjm") : ''; + $object->tjm = price2num($object->tjm); + $object->salary = GETPOST("salary", 'alphanohtml') != '' ? GETPOSTFLOAT("salary") : ''; + $object->salary = price2num($object->salary); + $object->salaryextra = GETPOST("salaryextra", 'alphanohtml') != '' ? GETPOSTFLOAT("salaryextra") : ''; + $object->salaryextra = price2num($object->salaryextra); + $object->weeklyhours = GETPOST("weeklyhours", 'alphanohtml') != '' ? GETPOSTFLOAT("weeklyhours") : ''; + $object->weeklyhours = price2num($object->weeklyhours); + } $object->color = GETPOST("color", 'alphanohtml') != '' ? str_replace('#', '', (string) GETPOST("color", 'alphanohtml')) : ''; $object->dateemployment = $dateemployment; @@ -1500,9 +1512,7 @@ if ($action == 'create' || $action == 'adduserldap') { print ''; print ''; - if ((isModEnabled('salaries') && $user->hasRight("salaries", "read") && in_array($id, $childids)) - || (isModEnabled('salaries') && $user->hasRight("salaries", "readall")) - || (isModEnabled('hrm') && $user->hasRight("hrm", "employee", "read"))) { + if ($permissiontoseesalary) { $langs->load("salaries"); // THM @@ -1812,9 +1822,7 @@ if ($action == 'create' || $action == 'adduserldap') { print "\n"; // Sensitive salary/value information - if ((empty($user->socid) && in_array($id, $childids)) // A user can always see salary/value information for its subordinates - || (isModEnabled('salaries') && $user->hasRight("salaries", "readall")) - || (isModEnabled('hrm') && $user->hasRight("hrm", "employee", "read"))) { + if ($permissiontoseesalary) { $langs->load("salaries"); // Salary @@ -3084,9 +3092,7 @@ if ($action == 'create' || $action == 'adduserldap') { print "\n"; // Sensitive salary/value information - if ((empty($user->socid) && in_array($id, $childids)) // A user can always see salary/value information for its subordinates - || (isModEnabled('salaries') && $user->hasRight("salaries", "readall")) - || (isModEnabled('hrm') && $user->hasRight("hrm", "employee", "read"))) { + if ($permissiontoseesalary) { $langs->load("salaries"); // Salary