From 7c144b22ffe5b14ceed304a1f4d24fdb1701050f Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Thu, 21 May 2026 21:22:07 +0200 Subject: [PATCH 1/8] FIX out of dynamically recalculated unit price inc tax was missing relative discount. --- htdocs/core/class/commonobject.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php index c2b390e7431..964e5fe480d 100644 --- a/htdocs/core/class/commonobject.class.php +++ b/htdocs/core/class/commonobject.class.php @@ -5610,7 +5610,7 @@ abstract class CommonObject // Recalculate unit price with tax if not defined if (empty($line->subprice_ttc) && $line->qty) { // subprice_ttc may be not stored on old version or not defined for lines with no unit price (like a discount) // So we calculate an estimated value just to show something on screen - $line->subprice_ttc = (float) price2num($line->total_ttc / $line->qty, 'MU'); + $line->subprice_ttc = (float) price2num($line->total_ttc / $line->qty * (1 - $line->remise_percent / 100), 'MU'); //other method is less accurate // $line->subprice_ttc = (float) price2num((!empty($line->subprice) ? $line->subprice : 0) * (1 + ((!empty($line->tva_tx) ? $line->tva_tx : 0) / 100)), 'MU'); } From 92b10c71eb3971de1120d9144f457aaaeddd555b Mon Sep 17 00:00:00 2001 From: Alexandre SPANGARO Date: Thu, 21 May 2026 21:52:11 +0200 Subject: [PATCH 2/8] ChangeLog (#38315) --- ChangeLog | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3c4d5c9b10d..ea7407d4ef2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,16 +4,16 @@ English Dolibarr ChangeLog ***** ChangeLog for 23.0.3 compared to 23.0.2 ***** -FIX: #36589 (#38037) -FIX: #37552 (#38073) -FIX: #37649 (#38101) -FIX: #37759 -FIX: #37760 -FIX: #37761 -FIX: #37762 -FIX: #37805 -FIX: #38074 (#38075) -FIX: #38131 (#38140) +FIX: #36589 (#38037) There is no save button in the "Variant attributes extrafields" and "Variant attributes values extrafields" tabs of the product variant module +FIX: #37552 (#38073) Webportal Proposals, Sales orders and Invoices links not working +FIX: #37649 (#38101) Gross price not calculated in supplier orders +FIX: #37759 Security: Sales Orders API Cross Customer Creation Privilege Escalation +FIX: #37760 Security: Commercial Proposals API Cross Customer Creation Privilege Escalation +FIX: #37761 Security: Tickets API Cross Customer Ticket Targeted Read Privilege Escalation +FIX: #37762 Security: Tickets API Cross Customer Ticket Targeted Update Privilege Escalation +FIX: #37805 Api endpoint /proposals/ref/{ref} fail with message : "Bad Request" - No proposal with id=0 can exist when using propal API and searching by ref +FIX: #38074 (#38075) Asset Depreciation List - SQL error message +FIX: #38131 (#38140) Bug in Recurring Customer Invoice FIX: Accountancy - Select journal - Problem with the label (#37979) FIX: AccountingAccount cache — silent reference mutation in accounting journals (#37981) FIX: a param must not come from end user entry. @@ -39,7 +39,7 @@ FIX: IDOR on messaging.php - Credit Aksoum Abderrahmane FIX: Some remaining cross-customer object creation on API (proposal, orders) - Credit Mitch311 FIX: add permission test on legacy filemanager - Credit Aksoum Abderrahmane FIX: Can use AI module to make SSRF call. Credit Dilip -FIX: #GHSA-crgg-h74r-2m8r (#37636) +FIX: #GHSA-crgg-h74r-2m8r (#37636) - FIX: Access to documents via the API for external users FIX: #GHSA-hq5j-39f9-qxcv (#37812) FIX: SQL Injection via Operator Injection in Contract Service List SEC: Better sanitization param for GETPOST of htmlheader of website page - See commit bbbbb56c6455514dcd0acca53afc17a92ed21bb9 From 37c0b3eeb684195a170de924ee0354ee40484ab6 Mon Sep 17 00:00:00 2001 From: Christian Humpel <78662388+Humml87@users.noreply.github.com> Date: Thu, 21 May 2026 21:57:30 +0200 Subject: [PATCH 3/8] Fix selectobject.php unknown-Array Key (#23392 AJAX endless turning) (#38323) * Fix selectobject.php unknown-Array Key * remove Debug line * remove Withespace --- htdocs/core/ajax/selectobject.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/htdocs/core/ajax/selectobject.php b/htdocs/core/ajax/selectobject.php index 94092e1f935..96660904582 100644 --- a/htdocs/core/ajax/selectobject.php +++ b/htdocs/core/ajax/selectobject.php @@ -108,7 +108,10 @@ if ($objectdesc) { $InfoFieldList[3] = preg_replace('/:\w*$/', '', $vartmp); // take the filter field $classname = $InfoFieldList[0]; - $classpath = dol_sanitizePathName($InfoFieldList[1]); + $classpath = ''; + if (!empty($InfoFieldList[1])) { + $classpath = dol_sanitizePathName($InfoFieldList[1]); + } //$addcreatebuttonornot = empty($InfoFieldList[2]) ? 0 : $InfoFieldList[2]; $filter = empty($InfoFieldList[3]) ? '' : $InfoFieldList[3]; From 1213bccb241130316c925debb7a88fe8addd1ac9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iv=C3=A1n=20Guevara?= Date: Thu, 21 May 2026 16:10:32 -0400 Subject: [PATCH 4/8] Fix: avoid undefined method stdClass::isEmpty() on PHP 8.1 (#38258) * Fix: avoid undefined method stdClass::isEmpty() on PHP 8.1 This fixes a fatal error when updating product prices on PHP 8.1 due to stdClass object handling. * Update ProductCombination.class.php --------- Co-authored-by: Laurent Destailleur --- htdocs/variants/class/ProductCombination.class.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/variants/class/ProductCombination.class.php b/htdocs/variants/class/ProductCombination.class.php index d960b07551e..c00439241e1 100644 --- a/htdocs/variants/class/ProductCombination.class.php +++ b/htdocs/variants/class/ProductCombination.class.php @@ -523,10 +523,10 @@ class ProductCombination $child->price_autogen = $parent->price_autogen; $child->weight = $parent->weight; // Only when Parent Status are updated - if (is_object($parent->oldcopy) && !$parent->oldcopy->isEmpty() && ($parent->status != $parent->oldcopy->status)) { + if (is_object($parent->oldcopy) && !empty($parent->oldcopy->id) && ($parent->status != $parent->oldcopy->status)) { $child->status = $parent->status; } - if (is_object($parent->oldcopy) && !$parent->oldcopy->isEmpty() && ($parent->status_buy != $parent->oldcopy->status_buy)) { + if (is_object($parent->oldcopy) && !empty($parent->oldcopy->id) && ($parent->status_buy != $parent->oldcopy->status_buy)) { $child->status_buy = $parent->status_buy; } From 92e7a03dc43858f46bdcb8c81b73cd5bc7c271b7 Mon Sep 17 00:00:00 2001 From: John BOTELLA <68917336+thersane-john@users.noreply.github.com> Date: Thu, 21 May 2026 22:12:17 +0200 Subject: [PATCH 5/8] Fix : product weight default selection (#38374) --- htdocs/product/class/html.formproduct.class.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/htdocs/product/class/html.formproduct.class.php b/htdocs/product/class/html.formproduct.class.php index f265f65af6e..c7219ece947 100644 --- a/htdocs/product/class/html.formproduct.class.php +++ b/htdocs/product/class/html.formproduct.class.php @@ -619,11 +619,12 @@ class FormProduct $return .= '"'; if ($mode == 1 && $lines->short_label == $selected) { $return .= ' selected'; - } elseif ($mode == 2 && $lines->scale == $selected) { + } elseif ($mode == 2 && (int) $lines->scale === (int) $selected) { // Careful null !== 0 !== '0' and when 0 is saved bdd store null $return .= ' selected'; } elseif ($mode == 0 && $lines->id == $selected) { $return .= ' selected'; } + $return .= '>'; if ($measuring_style == 'time') { $return .= $langs->trans(ucfirst((string) $lines->label)); From 2d050a58a6bc9436339fea17b8cdc8e418ca7e34 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 22 May 2026 11:11:22 +0200 Subject: [PATCH 6/8] ci --- htdocs/core/class/extrafields.class.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php index 74e8884eb95..bfc7a0511b9 100644 --- a/htdocs/core/class/extrafields.class.php +++ b/htdocs/core/class/extrafields.class.php @@ -2477,7 +2477,7 @@ class ExtraFields while ($obj = $this->db->fetch_object($resql)) { $c = new Categorie($this->db); $c->fetch($obj->rowid); - if ($mode != 'list') { + if ((string) $mode != 'list') { $ways = $c->print_all_ways(); // $ways[0] = "ccc2 >> ccc2a >> ccc2a1" with html formatted text foreach ($ways as $way) { $toprint[] = '
  • color ? ' style="background: #'.$c->color.';"' : ' style="background: #bbb"').'>'.img_object('', 'category').' '.$way.'
    • '; @@ -2491,7 +2491,7 @@ class ExtraFields } } - $s = '
  • color ? ' style="background: #'.$c->color.';"' : ' style="background: #bbb"').'>'; + $s = '
  • color ? ' style="background: #'.$c->color.';"' : ' style="background: #bbb"').'>'; if ($numElem >= 2) { $s .= img_object($c->label, 'category', 'class="small"'); } else { From 928b2065148092ae568d8fd8e0dacff4048c7fb2 Mon Sep 17 00:00:00 2001 From: John BOTELLA <68917336+thersane-john@users.noreply.github.com> Date: Fri, 22 May 2026 11:24:48 +0200 Subject: [PATCH 7/8] Fix hard reading on bad screen (#38344) --- htdocs/core/lib/functions.lib.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index db3588850ec..25d08b637a4 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -3666,7 +3666,7 @@ function dol_banner_tab($object, $paramid, $morehtml = '', $shownav = 1, $fieldi if (in_array($object->element, array('product', 'bank_account', 'project_task'))) { /** @var Product|Account|Task $object */ if (!empty($object->label)) { - $morehtmlref .= '
    ' . $object->label . '
    '; + $morehtmlref .= ''; } } // Show address and email @@ -3701,7 +3701,7 @@ function dol_banner_tab($object, $paramid, $morehtml = '', $shownav = 1, $fieldi // $morehtmlstatus is part under the status // $morehtmlright is part of htmlright - print '
    '; + print '
    '; print $form->showrefnav($object, $paramid, $morehtml, $shownav, $fieldid, $fieldref, $morehtmlref, $moreparam, $nodbprefix, $morehtmlleft, $morehtmlstatus, $morehtmlright); print '
    '; print '
    '; From 8f04bb91e36efb23186c06f146a53da79bf5a362 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 22 May 2026 11:27:13 +0200 Subject: [PATCH 8/8] css --- htdocs/theme/eldy/global.inc.php | 3 +++ htdocs/theme/md/style.css.php | 3 +++ 2 files changed, 6 insertions(+) diff --git a/htdocs/theme/eldy/global.inc.php b/htdocs/theme/eldy/global.inc.php index e844a415bec..72034186a76 100644 --- a/htdocs/theme/eldy/global.inc.php +++ b/htdocs/theme/eldy/global.inc.php @@ -818,6 +818,9 @@ input.pageplusone { .undertopmenu { scroll-margin-top: 80px; } +.banner-object-label { + opacity: 0.8; +} select:invalid, select.--error { color: gray; diff --git a/htdocs/theme/md/style.css.php b/htdocs/theme/md/style.css.php index 334b7037009..59e50cc91d1 100644 --- a/htdocs/theme/md/style.css.php +++ b/htdocs/theme/md/style.css.php @@ -978,6 +978,9 @@ input.pageplusone { .undertopmenu { scroll-margin-top: 80px; } +.banner-object-label { + opacity: 0.8; +} select:invalid, select.--error { color: gray;