From 306e353d4b17d1c3d0a1518f2a1fb6219d80a226 Mon Sep 17 00:00:00 2001 From: Eric - CAP-REL <1468823+rycks@users.noreply.github.com> Date: Fri, 19 Jun 2026 04:03:06 +0200 Subject: [PATCH 01/10] fix adherent table name (#38875) --- htdocs/install/mysql/migration/21.0.0-22.0.0.sql | 2 ++ 1 file changed, 2 insertions(+) diff --git a/htdocs/install/mysql/migration/21.0.0-22.0.0.sql b/htdocs/install/mysql/migration/21.0.0-22.0.0.sql index 6ad5d277a2e..43f2a4faf08 100644 --- a/htdocs/install/mysql/migration/21.0.0-22.0.0.sql +++ b/htdocs/install/mysql/migration/21.0.0-22.0.0.sql @@ -331,3 +331,5 @@ ALTER TABLE llx_webhook_history ADD COLUMN error_message text; ALTER TABLE llx_webhook_history MODIFY COLUMN url varchar(255); UPDATE llx_c_socialnetworks SET icon = 'fa-mastodon' WHERE icon = '' AND code = 'mastodon'; + +ALTER TABLE llx_adherent MODIFY COLUMN societe VARCHAR(128); From 0661a9c10ea8bbb2825af3d5ff1659e66d3645d4 Mon Sep 17 00:00:00 2001 From: Francis Appels Date: Sat, 20 Jun 2026 00:58:42 +0200 Subject: [PATCH 02/10] FIX issue on PRODUIT_SOUSPRODUITS_ALSO_ENABLE_PARENT_STOCK_MOVE Other 38847 (#38907) * Other fix for PR #38847 * Try fix phan --- htdocs/expedition/card.php | 2 +- htdocs/fichinter/card.php | 2 +- htdocs/product/class/product.class.php | 3 +++ 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/htdocs/expedition/card.php b/htdocs/expedition/card.php index 1b0a958c93b..793876564f6 100644 --- a/htdocs/expedition/card.php +++ b/htdocs/expedition/card.php @@ -1348,7 +1348,7 @@ if ($action == 'create') { if ($res < 0) { dol_print_error($db, $product->error, $product->errors); } - if (getDolGlobalInt('PRODUIT_SOUSPRODUITS') && !getDolGlobalInt('PRODUIT_SOUSPRODUITS_ALSO_ENABLE_PARENT_STOCK_MOVE')) { + if (getDolGlobalInt('PRODUIT_SOUSPRODUITS')) { $productChildrenNb = $product->hasFatherOrChild(1); } if ($productChildrenNb > 0) { diff --git a/htdocs/fichinter/card.php b/htdocs/fichinter/card.php index 4bebdf0dfd1..12f5a9a77d2 100644 --- a/htdocs/fichinter/card.php +++ b/htdocs/fichinter/card.php @@ -1167,7 +1167,7 @@ if ($action == 'create') { print ''.$langs->trans("ThirdParty").''; $filter = '(s.status:=:1)'; - print $form->select_company('', 'socid', $filter, 'SelectThirdParty', 1, 0, null, 0, 'minwidth300'); + print $form->select_company('', 'socid', $filter, 'SelectThirdParty', 1, 0, array(), 0, 'minwidth300'); print ' '; print ''; print ''; diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php index 493167c6d53..710808b0d3f 100644 --- a/htdocs/product/class/product.class.php +++ b/htdocs/product/class/product.class.php @@ -6568,6 +6568,9 @@ class Product extends CommonObject break; } } + } elseif (getDolGlobalInt('PRODUIT_SOUSPRODUITS_ALSO_ENABLE_PARENT_STOCK_MOVE') && empty($productCachedList)) { + // if all sub product are not stock managed when use parent stock + $this->load_stock('warehouseopen'); } } From e42d6883e556315b7e2c26daace2c2aa023cf7e2 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sun, 21 Jun 2026 15:26:05 +0200 Subject: [PATCH 03/10] ci --- htdocs/admin/dict.php | 2 +- htdocs/fichinter/card.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index 41cb11626db..73b1694ecac 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -2338,7 +2338,7 @@ if ($id > 0) { print ''; print '
'; - print ''; + print ''; print ''; if (!is_null($withentity)) { print ''; diff --git a/htdocs/fichinter/card.php b/htdocs/fichinter/card.php index db1e3b7bb17..e382a400727 100644 --- a/htdocs/fichinter/card.php +++ b/htdocs/fichinter/card.php @@ -1155,7 +1155,7 @@ if ($action == 'create') { print ''.$langs->trans("ThirdParty").''; $filter = '(s.status:=:1)'; - print $form->select_company('', 'socid', $filter, 'SelectThirdParty', 1, 0, null, 0, 'minwidth300'); + print $form->select_company('', 'socid', $filter, 'SelectThirdParty', 1, 0, array(), 0, 'minwidth300'); print ' '; print ''; print ''; From b5a8a01eaea42dd6eba1715db9238628239516ef Mon Sep 17 00:00:00 2001 From: MDW Date: Sun, 21 Jun 2026 15:27:28 +0200 Subject: [PATCH 04/10] SEC: Sanitize SQL query parameters (#38942) # SEC: Sanitize SQL query parameters Sanitize SQL query parameters. Replace urlencode with explicit type casting to int for fk_statut and signed_status parameters. --- htdocs/fichinter/list.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/htdocs/fichinter/list.php b/htdocs/fichinter/list.php index 665a9470b61..fb57d56ba43 100644 --- a/htdocs/fichinter/list.php +++ b/htdocs/fichinter/list.php @@ -9,7 +9,7 @@ * Copyright (C) 2021-2024 Frédéric France * Copyright (C) 2022 Charlène Benke * Copyright (C) 2024 William Mead - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2024 Benjamin Falière * * This program is free software; you can redistribute it and/or modify @@ -343,10 +343,10 @@ if ($search_desc) { } } if ($search_status != '' && $search_status >= 0) { - $sql .= ' AND f.fk_statut = '.urlencode($search_status); + $sql .= ' AND f.fk_statut = '.((int) ($search_status)); } if ($search_signed_status != '' && $search_signed_status >= 0) { - $sql .= ' AND f.signed_status = '.urlencode($search_signed_status); + $sql .= ' AND f.signed_status = '.((int) $search_signed_status); } if (!getDolGlobalString('FICHINTER_DISABLE_DETAILS') && $atleastonefieldinlines) { if ($search_date_start) { From edcde65dfc7ee250995d1e16173af833feb3ebe3 Mon Sep 17 00:00:00 2001 From: MDW Date: Sun, 21 Jun 2026 16:52:51 +0200 Subject: [PATCH 05/10] SEC: Correct SQL escaping for signed_status (#38943) * SEC: Correct SQL escaping for signed_status # SEC: Correct SQL escaping for signed_status Escape signed_status using $db->escape instead of urlencode. * Update list.php * Update list.php --------- Co-authored-by: Laurent Destailleur --- htdocs/expedition/list.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/htdocs/expedition/list.php b/htdocs/expedition/list.php index 59d22552d38..82fdfce1e74 100644 --- a/htdocs/expedition/list.php +++ b/htdocs/expedition/list.php @@ -6,7 +6,7 @@ * Copyright (C) 2019 Nicolas ZABOURI * Copyright (C) 2020 Thibault FOUCART * Copyright (C) 2023 Christophe Battarel - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2024 Benjamin Falière * Copyright (C) 2024 Vincent Maury * Copyright (C) 2024 William Mead @@ -743,13 +743,13 @@ if ($search_status != '' && $search_status >= 0) { $sql .= " AND e.fk_statut = ".((int) $search_status); } if ($search_signed_status != '' && $search_signed_status >= 0) { - $sql .= ' AND e.signed_status = '.urlencode($search_signed_status); + $sql .= " AND e.signed_status = ".((int) $search_signed_status); } if ($search_ref_customer != '') { $sql .= natural_search('e.ref_customer', $search_ref_customer); } if ($search_billed != '' && $search_billed >= 0) { - $sql .= ' AND e.billed = '.((int) $search_billed); + $sql .= " AND e.billed = ".((int) $search_billed); } if ($search_town) { $sql .= natural_search('s.town', $search_town); From 957f117d0903519591d51392b3d754c1942576b6 Mon Sep 17 00:00:00 2001 From: MDW Date: Sun, 21 Jun 2026 19:18:18 +0200 Subject: [PATCH 06/10] SEC: Fix SQL injection vulnerability in contract list (#38941) # SEC: Fix SQL injection vulnerability in contract list - Update the SQL query to properly escape the search_signed_status parameter --- htdocs/contrat/list.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/contrat/list.php b/htdocs/contrat/list.php index 5dc7e793af9..0438ec109ca 100644 --- a/htdocs/contrat/list.php +++ b/htdocs/contrat/list.php @@ -9,7 +9,7 @@ * Copyright (C) 2016-2018 Ferran Marcet * Copyright (C) 2019 Nicolas Zabouri * Copyright (C) 2021-2024 Alexandre Spangaro - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2024 Frédéric France * Copyright (C) 2024 Benjamin Falière * @@ -501,7 +501,7 @@ if ($search_date_modif_end) { $sql .= " AND c.tms <= '".$db->idate($search_date_modif_end)."'"; } if ($search_signed_status != '' && $search_signed_status >= 0) { - $sql .= ' AND c.signed_status = '.urlencode($search_signed_status); + $sql .= " AND c.signed_status = '".$db->escape($search_signed_status)."'"; } // Add where from extra fields From 2e2d2718c2f14a9b3912d29a56658d560354a01c Mon Sep 17 00:00:00 2001 From: Jyhere Date: Mon, 22 Jun 2026 03:20:47 +0200 Subject: [PATCH 07/10] FIX : Change translation method for loading message (ecm javascript) (#38903) Co-authored-by: Laurent Destailleur --- htdocs/ecm/tpl/enablefiletreeajax.tpl.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/ecm/tpl/enablefiletreeajax.tpl.php b/htdocs/ecm/tpl/enablefiletreeajax.tpl.php index 10840b3f643..b3e107b7fc0 100644 --- a/htdocs/ecm/tpl/enablefiletreeajax.tpl.php +++ b/htdocs/ecm/tpl/enablefiletreeajax.tpl.php @@ -82,7 +82,7 @@ $(document).ready(function() { $('#refreshbutton').click( function() { console.log("Click on refreshbutton"); - dolBlockUI("trans('PleaseBePatient'); ?>"); + dolBlockUI("transnoentities('PleaseBePatient'); ?>"); $.get("", { action: 'build', From e4cbeb123c0d37303960f2e3d8a9acffe8e80920 Mon Sep 17 00:00:00 2001 From: lvessiller-opendsi Date: Mon, 22 Jun 2026 03:45:52 +0200 Subject: [PATCH 08/10] FIX search billed in order line list (#38854) --- htdocs/commande/list_det.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/commande/list_det.php b/htdocs/commande/list_det.php index 7e7dbcaabbe..8755b0511a6 100644 --- a/htdocs/commande/list_det.php +++ b/htdocs/commande/list_det.php @@ -132,7 +132,7 @@ $search_multicurrency_montant_vat = GETPOST('search_multicurrency_montant_vat', $search_multicurrency_montant_ttc = GETPOST('search_multicurrency_montant_ttc', 'alpha'); $search_login = GETPOST('search_login', 'alpha'); $search_categ_cus = GETPOST("search_categ_cus", 'intcomma'); -$search_billed = GETPOST('search_billed', 'intcomma') ? GETPOST('search_billed', 'intcomma') : GETPOST('billed', 'intcomma'); +$search_billed = GETPOST('search_billed', 'intcomma'); $search_status = GETPOST('search_status', 'intcomma'); $search_project_ref = GETPOST('search_project_ref', 'alpha'); $search_project = GETPOST('search_project', 'alpha'); From 058c2341cea0d26df8770543c099e86ab6da6120 Mon Sep 17 00:00:00 2001 From: atm-jonathan <146709163+atm-jonathan@users.noreply.github.com> Date: Mon, 22 Jun 2026 03:46:41 +0200 Subject: [PATCH 09/10] FIX : fix duplicate contact names in messaging timeline (#38855) Cache key was using legacy fk_contact field instead of the current contact id ($cid), causing all contacts after the first to resolve to the same cached entry in show_actions_messaging(). --- htdocs/core/lib/functions.lib.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 206892e6fff..d85dd880996 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -13510,12 +13510,12 @@ function show_actions_messaging($conf, $langs, $db, $filterobj, $objcon = '', $n if (isset($histo[$key]['socpeopleassigned']) && is_array($histo[$key]['socpeopleassigned']) && count($histo[$key]['socpeopleassigned']) > 0) { $contactList = ''; foreach ($histo[$key]['socpeopleassigned'] as $cid => $Tab) { - if (empty($conf->cache['contact'][$histo[$key]['contact_id']])) { + if (empty($conf->cache['contact'][$cid])) { $contact = new Contact($db); $contact->fetch($cid); - $conf->cache['contact'][$histo[$key]['contact_id']] = $contact; + $conf->cache['contact'][$cid] = $contact; } else { - $contact = $conf->cache['contact'][$histo[$key]['contact_id']]; + $contact = $conf->cache['contact'][$cid]; } if ($contact) { From 9f6306bfebe503c97c08807f817a64978ce49357 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 22 Jun 2026 12:18:56 +0200 Subject: [PATCH 10/10] Fix whitespace --- htdocs/admin/dict.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index f88e9bdb164..9eab23d2835 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -2045,7 +2045,7 @@ if ($id > 0) { } print ''; } - + if ($action == 'edit' && ($rowid == (isset($obj->rowid) ? $obj->rowid : $obj->code))) { $tmpaction = 'edit'; $parameters = array('fieldlist'=>$fieldlist, 'tabname'=>$tabname[$id]);