From 95701131bc817c0a22de84447a09888a82eac564 Mon Sep 17 00:00:00 2001
From: minimexat <minimexat@gmail.com>
Date: Mon, 13 Jul 2026 11:45:45 +0200
Subject: [PATCH] FIX: use generic online signature token fallback (#39138)

* FIX: Use generic online signature token fallback

* FIX: Avoid nullable source in signature token lookup

* FIX: Initialize online signature message

* FIX: Print online signature error directly

---------

Co-authored-by: f-hoedl <hoefla14@htl-kaindorf.ac.at>
---
 ChangeLog                                  |  1 +
 htdocs/public/onlinesign/newonlinesign.php | 11 ++++-------
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 3a3987fc063..5428d157fde 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -167,6 +167,7 @@ NEW: Add delivery date in supplier order linked object block (#38351)
 NEW: A lot of look and feel enhancement in the immutable log pages.
 NEW: Enhance the tools to check file integrity.
 NEW: The OAuth login with Google stay on the requested page after the redirect instead of reaching the home page.
+FIX: Use generic online signature security token for unlisted source verifier.
 NEW: Add shipment online url to substitution array
 NEW: ModuleBuilder - selectable object tabs (+ fixes for multi-object generation)
 NEW: Add hook getTicketMessageEmailFrom to override sender in Ticket::sendTicketMessageByEmail
diff --git a/htdocs/public/onlinesign/newonlinesign.php b/htdocs/public/onlinesign/newonlinesign.php
index 750a3a949df..f615b08f33b 100644
--- a/htdocs/public/onlinesign/newonlinesign.php
+++ b/htdocs/public/onlinesign/newonlinesign.php
@@ -97,7 +97,6 @@ $ref = $REF = GETPOST("ref", 'alpha');
 $urlok = '';
 $urlko = '';
 
-
 if ($source == '') {
 	$source = 'proposal';
 }
@@ -155,6 +154,8 @@ if ($source == 'proposal') {
 	$securekeyseed = getDolGlobalString('FICHINTER_ONLINE_SIGNATURE_SECURITY_TOKEN', $defaultsalt);
 } elseif ($source == 'societe_rib') {
 	$securekeyseed = getDolGlobalString('SOCIETE_RIB_ONLINE_SIGNATURE_SECURITY_TOKEN', $defaultsalt);
+} else {
+	$securekeyseed = getDolGlobalString(dol_strtoupper((string) $source).'_ONLINE_SIGNATURE_SECURITY_TOKEN', $defaultsalt);
 }
 if (!dol_verifyHash($securekeyseed.$type.$ref.(isModEnabled('multicompany') ? $entity : ''), $SECUREKEY, 'hash')) {
 	httponly_accessforbidden('Bad value for securitykey. Value provided '.dol_escape_htmltag($SECUREKEY).' does not match expected value for ref='.dol_escape_htmltag($ref), 403, 1);
@@ -686,12 +687,8 @@ if ($source == 'proposal') {
 $parameters = array('source' => $source);
 $reshook = $hookmanager->executeHooks('addFormSign', $parameters, $object, $action); // Note that $action and $object may have been modified by hook
 
-if (!$found && !$mesg) {
-	$mesg = $langs->transnoentitiesnoconv("ErrorBadParameters");
-}
-
-if ($mesg) {
-	print '<tr><td class="center" colspan="2"><br><div class="warning">'.dol_escape_htmltag($mesg).'</div></td></tr>'."\n";
+if (!$found) {
+	print '<tr><td class="center" colspan="2"><br><div class="warning">'.dol_escape_htmltag($langs->transnoentitiesnoconv("ErrorBadParameters")).'</div></td></tr>'."\n";
 }
 
 print '</table>'."\n";