diff --git a/htdocs/accountancy/bookkeeping/export.php b/htdocs/accountancy/bookkeeping/export.php index 2c5aec4c11a..3b937fcd358 100644 --- a/htdocs/accountancy/bookkeeping/export.php +++ b/htdocs/accountancy/bookkeeping/export.php @@ -1,7 +1,7 @@ * Copyright (C) 2013-2016 Florian Henry - * Copyright (C) 2013-2024 Alexandre Spangaro + * Copyright (C) 2013-2026 Alexandre Spangaro * Copyright (C) 2022 Lionel Vessiller * Copyright (C) 2016-2017 Laurent Destailleur * Copyright (C) 2018-2021 Frédéric France @@ -849,7 +849,7 @@ if ($action == 'export_file') { ); } - $formconfirm = $form->formconfirm($_SERVER["PHP_SELF"].'?'.$param, $langs->trans("ExportFilteredList").'...', $langs->trans('ConfirmExportFile'), 'export_fileconfirm', $form_question, '', 1, 390, 700); + $formconfirm = $form->formconfirm($_SERVER["PHP_SELF"].'?'.$param, $langs->trans("ExportFilteredList").'...', $langs->trans('ConfirmExportFile'), 'export_fileconfirm', $form_question, '', 1, 500, 700); } // Print form confirm diff --git a/htdocs/compta/resultat/index.php b/htdocs/compta/resultat/index.php index a2b35d82de3..cf8974a6850 100644 --- a/htdocs/compta/resultat/index.php +++ b/htdocs/compta/resultat/index.php @@ -45,7 +45,7 @@ $date_endyear = GETPOSTINT('date_endyear'); $nbofyear = 4; -// Change this to test different cases of setup +// Change this to test different cases of setup. //$conf->global->SOCIETE_FISCAL_MONTH_START = 7; diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php index 40ad9008968..16717b064ef 100644 --- a/htdocs/core/class/commonobject.class.php +++ b/htdocs/core/class/commonobject.class.php @@ -4709,6 +4709,8 @@ abstract class CommonObject $this->context = array_merge($this->context, array('newstatus' => $status)); if ($trigkey) { + $this->oldcopy = dol_clone($this); + // Call trigger $result = $this->call_trigger($trigkey, $user); if ($result < 0) { diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php index f78adf88881..c8d2d5e2633 100644 --- a/htdocs/core/class/html.form.class.php +++ b/htdocs/core/class/html.form.class.php @@ -15,7 +15,7 @@ * Copyright (C) 2012-2016 Marcos García * Copyright (C) 2012 Cedric Salvador * Copyright (C) 2012-2015 Raphaël Doursenaud - * Copyright (C) 2014-2023 Alexandre Spangaro + * Copyright (C) 2014-2026 Alexandre Spangaro * Copyright (C) 2018-2022 Ferran Marcet * Copyright (C) 2018-2024 Frédéric France * Copyright (C) 2018 Nicolas ZABOURI @@ -6653,7 +6653,7 @@ class Form if (!empty($user) && $user->admin && preg_match('/\'(..)\'/', $country_code, $reg)) { $langs->load("errors"); $new_country_code = $reg[1]; - $country_id = dol_getIdFromCode($this->db, $new_country_code, 'c_pays', 'code', 'rowid'); + $country_id = dol_getIdFromCode($this->db, $new_country_code, 'c_country', 'code', 'rowid'); $this->error .= '
'.$langs->trans("ErrorFixThisHere", DOL_URL_ROOT.'/admin/dict.php?id=10'.($country_id > 0 ? '&countryidforinsert='.$country_id : '')); } $this->error .= ''; diff --git a/htdocs/societe/class/societe.class.php b/htdocs/societe/class/societe.class.php index 03d081b8d19..dcec1fb32db 100644 --- a/htdocs/societe/class/societe.class.php +++ b/htdocs/societe/class/societe.class.php @@ -8,7 +8,7 @@ * Copyright (C) 2008 Patrick Raguin * Copyright (C) 2010-2018 Juanjo Menent * Copyright (C) 2013 Florian Henry - * Copyright (C) 2013-2023 Alexandre Spangaro + * Copyright (C) 2013-2026 Alexandre Spangaro * Copyright (C) 2013 Peter Fontaine * Copyright (C) 2014-2015 Marcos García * Copyright (C) 2015 Raphaël Doursenaud @@ -1403,7 +1403,7 @@ class Societe extends CommonObject $this->supplier_order_min_amount = price2num($this->supplier_order_min_amount); $this->tva_assuj = (is_numeric($this->tva_assuj)) ? (int) trim((string) $this->tva_assuj) : 0; - $this->tva_intra = dol_sanitizeFileName($this->tva_intra, ''); + $this->tva_intra = trim($this->tva_intra); $this->vat_reverse_charge = empty($this->vat_reverse_charge) ? 0 : 1; if (empty($this->status)) { $this->status = 0; diff --git a/htdocs/ticket/card.php b/htdocs/ticket/card.php index 8c991e49b49..5508d511f22 100644 --- a/htdocs/ticket/card.php +++ b/htdocs/ticket/card.php @@ -600,8 +600,9 @@ if (empty($reshook)) { // Reopen ticket if ($object->fetch(GETPOSTINT('id'), GETPOST('track_id', 'alpha')) >= 0) { $new_status = GETPOSTINT('new_status'); - //$old_status = $object->status; - $res = $object->setStatut($new_status); + + $res = $object->setStatut($new_status, null, '', 'TICKET_MODIFY'); + if ($res) { $url = 'card.php?track_id=' . $object->track_id; header("Location: " . $url); diff --git a/htdocs/ticket/class/ticket.class.php b/htdocs/ticket/class/ticket.class.php index 06e293519d9..bf17cc9f0bc 100644 --- a/htdocs/ticket/class/ticket.class.php +++ b/htdocs/ticket/class/ticket.class.php @@ -3016,7 +3016,7 @@ class Ticket extends CommonObject if (($object->status < self::STATUS_IN_PROGRESS && !$user->socid && !$private) || ($object->status > self::STATUS_IN_PROGRESS && $public_area) ) { - $object->setStatut($object::STATUS_IN_PROGRESS); + $object->setStatut($object::STATUS_IN_PROGRESS, null, '', 'TICKET_MODIFY'); } return 1; } else { diff --git a/htdocs/ticket/list.php b/htdocs/ticket/list.php index ea06f4fc308..b2de7d96e9c 100644 --- a/htdocs/ticket/list.php +++ b/htdocs/ticket/list.php @@ -289,7 +289,7 @@ if (empty($reshook)) { $result = $objecttmp->fetch($toselectid); if ($result > 0) { if ($objecttmp->status == Ticket::STATUS_CLOSED || $objecttmp->status == Ticket::STATUS_CANCELED) { - $result = $objecttmp->setStatut(Ticket::STATUS_ASSIGNED); + $result = $objecttmp->setStatut(Ticket::STATUS_ASSIGNED, null, '', 'TICKET_MODIFY'); if ($result < 0) { setEventMessages($objecttmp->error, $objecttmp->errors, 'errors'); $error++; diff --git a/htdocs/website/class/websitepage.class.php b/htdocs/website/class/websitepage.class.php index bdeb6e734db..6479c26dde0 100644 --- a/htdocs/website/class/websitepage.class.php +++ b/htdocs/website/class/websitepage.class.php @@ -224,6 +224,18 @@ class WebsitePage extends CommonObject // Remove spaces and be sure we have main language only $this->lang = preg_replace('/[_-].*$/', '', trim($this->lang)); // en_US or en-US -> en + // Test if page contains dynamic PHP content + if (!$user->hasRight('website', 'writephp')) { + // Check there is no PHP content into the imported file (must be only HTML + JS) + $phpcontent = dolKeepOnlyPhpCode($this->content); + + if ($phpcontent) { + $this->error = 'Error: you try to create a page with PHP content without having permissions for that.'; + $this->errors = $this->error; + return -1; + } + } + return $this->createCommon($user, $notrigger); } diff --git a/htdocs/website/index.php b/htdocs/website/index.php index b17f0e6f92c..bf7021cf40b 100644 --- a/htdocs/website/index.php +++ b/htdocs/website/index.php @@ -855,6 +855,7 @@ if ($action == 'addcontainer' && $usercanedit) { // Remove comments $tmp['content'] = removeHtmlComment($tmp['content']); + /* disable this, moved into the create() method // Check there is no PHP content into the imported file (must be only HTML + JS) $phpcontent = dolKeepOnlyPhpCode($tmp['content']); if ($phpcontent) { @@ -862,6 +863,7 @@ if ($action == 'addcontainer' && $usercanedit) { setEventMessages('Error getting '.$urltograb.': file that include PHP content is not allowed', null, 'errors'); $action = 'createcontainer'; } + */ } if (!$error) { @@ -1238,6 +1240,7 @@ if ($action == 'addcontainer' && $usercanedit) { $pageid = 0; if (!$error) { + // Create page. This also check there is no PHP content if user has no pemrissions for that. $pageid = $objectpage->create($user); if ($pageid <= 0) { $error++;