# Qual: Fix Phan notices
Some phan notices are not reported in ci.
This fixes new ones that appeared:
- Update imap.phan_php to provide IMAP related typing info;
- Add typing info to variables;
- Decleare some variables global (htdocs/admin/dict.php) as reused in function;
- Cast potential null to string;
- Adjust param typing to correspond to default null value (getOnlineSignatureUrl);
- Check that parameter is object as expected by function all (dol_format_address);
* FIX phpstan: Societe::$client (int<0,3>) does not accept -1 (#39244)
Societe::$client is annotated @var int<0,3> (domain 0=no customer,
1=customer, 2=prospect, 3=both) in societe.class.php, but the create
form in societe/card.php pre-set it to -1 as a transient "nothing
pre-selected" placeholder, tripping PHPStan level 10 on develop.
The value is never persisted (save paths compute 0..3) and the only
reader, the switch() building the form, treats -1 and 0 identically via
its default case. Use 0 (the property's own default) so the assignment
matches the declared type. No behavior change.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Qual: Fix entity handling in bonprelevement.class.php
The variable name 'entities' was changed to 'entity' to better reflect the singular nature of the value being retrieved.
It was also casted to an int instead of using an unquoted db->escape.
* Qual: Improve SQL query construction in company.lib.php
By escaping the concatenated string, injection verification does not identify a false positive.
* Qual: Avoid void positive, sanitize instead of escape
* Qual: Avoid false positive, sanitize instead of escape
* Sec: Fix potential injection with cast to int (timespent_duration)
* Qual: Avoid false positive, sanitize instead of escape
* Qual: Avoid false positive, sanitize instead of escape
* fix: Replace escape() with sanitize() in SQL queries
# FIX: Replace escape() with sanitize() in SQL queries
- Replace escape() with sanitize() in SQL queries to ensure proper SQL injection protection
- Update SQL queries in multiple files to use sanitize() instead of escape()
- Ensure consistent use of sanitize() across the codebase for better security
* fix(sql): Replace escape with sanitize in SQL queries
# FIX: Replace escape with sanitize in SQL queries
- Replace `escape` with `sanitize` in SQL queries to ensure proper SQL injection prevention
* Qual: Improve field escaping/quoting
# Qual: Qual: Improve field escaping/quoting
---------
Co-authored-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The dict.php renderer translated 'label' for some tables (c_units, c_product_nature,
c_productbatch_qcstatus) but left the 'libelle' column of c_stcomm and
c_stcommcontact as the raw English seed text. Map the row to its StatusProspect{id}
translation key when present so the French (or any other locale) shows the
expected label instead of 'Do not contact' / 'Never contacted' etc.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
htdocs/admin/dict.php:2402 guards the edit-form rendering with
'$rowid == (!empty($obj->rowid) ? $obj->rowid : $obj->code)'. PHP empty(0)
returns true, so the ternary falls back to $obj->code for any row whose
rowid is 0 - the comparison becomes '0' == 'ST_NEVER' and the form
never renders. ST_NEVER in llx_c_stcomm is inserted with id = 0 and is
therefore stuck non-editable for label, picto, etc.
Switch the guard to isset() so rowid = 0 is treated as a real rowid.
The same fallback exists at line 2415 for the name attribute of the
hidden div; apply the same change for consistency.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
* Fix#36510 advance pg sequence after forced-rowid dictionary insert (#38741)
Dictionary entry creation in admin/dict.php computes $newid = MAX(rowid)+1
in PHP and INSERTs with that rowid explicitly. On PostgreSQL the matching
serial sequence (<table>_rowid_seq) is never told about the manually
chosen value, so the next auto-increment insert (the next dictionary
entry, or any other code path that pulls from the same sequence) hits a
duplicate-key error mis-reported to the user as
'already existing record'.
Bump the sequence with setval(pg_get_serial_sequence(...), GREATEST(MAX,1))
right after a successful forced-rowid INSERT, gated on $db->type == 'pgsql'
so MySQL/MariaDB behaviour is unchanged.
Diagnosis by @hregis (#36510).
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
* Fix#35661 drop duplicated ref segment in notify pdf path (#38746)
The fixed-target branch of Notify::send built the PDF path as
"$dir_output/$ref/$ref.pdf" while $dir_output already includes the
get_exdir(...) ref subdirectory. The double ref segment made
dol_is_file always fail and the PDF was never attached when a
notification was routed to a fixed email address. The matching block
just above for user/group targets has always used the correct
"$dir_output/$ref.pdf" form.
Drop the extra ref segment so both branches produce the same path.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
* Fix#38614 align extrafield help-row position with create form (#38753)
In admin/extrafields the create page renders the Help tooltip row right
after Totalizable, before the Css rows. The edit page renders it after
all Css rows, so jumping from create to edit visually moves the field
without any meaningful reason.
Move the <tr class="help"> row in admin_extrafields_edit.tpl.php to the
same position as in admin_extrafields_add.tpl.php (after Totalizable,
before Css edit). Pure markup ordering, no logic change.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
* Fix#37266 write document backup tar to a temp dir outside its own source tree
htdocs/admin/tools/export_files.php at line 189 used to write the tar
archive directly under $outputdir = DOL_DATA_ROOT/admin/documents.
$outputdir is itself inside the directory being archived. Even with
`--exclude='documents/admin/documents'`, GNU tar notices the output
directory growing while reading the source and exits with code 1 plus
'file changed as we read it'. The check at line 194 treated any non-zero
return as fatal, short-circuited the gzip / bzip2 / zstd step and left
the user with an uncompressed .tar plus 'Error tar generation return 1'.
Write the tar to $conf->admin->dir_temp (which is outside the documents
tree), run the compression step against that temp file, then rename the
compressed artefact into $outputdir as the last step. Add the matching
cleanup paths so a failure does not leave temp tar / compressed temp
files lying around.
Signed-off-by: Dolicraft <contact@dolicraft.com>
---------
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
Dictionary entry creation in admin/dict.php computes $newid = MAX(rowid)+1
in PHP and INSERTs with that rowid explicitly. On PostgreSQL the matching
serial sequence (<table>_rowid_seq) is never told about the manually
chosen value, so the next auto-increment insert (the next dictionary
entry, or any other code path that pulls from the same sequence) hits a
duplicate-key error mis-reported to the user as
'already existing record'.
Bump the sequence with setval(pg_get_serial_sequence(...), GREATEST(MAX,1))
right after a successful forced-rowid INSERT, gated on $db->type == 'pgsql'
so MySQL/MariaDB behaviour is unchanged.
Diagnosis by @hregis (#36510).
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
* Fix: Correct manifest.json.php for logo handling
# FIX: Update manifest.json.php for logo handling
All the alternative logo settings were applied only when MAIN_INFO_SOCIETE_LOGO_SQUARRED is true,
also implying a duplicate test.
It seems more likely that only one of the options is needed.
So changed it to a simple else clause (no extra condition)
* Qual: Ignore PHPStan notice
* Fix: PHPStan notice
When `!empty($valuetoshow)` already tests `(string) $valuetoshow != '0'`.
* Qual: Fix Phan notices in modulebuilder updates
# Qual: Fix Phan notices in modulebuilder updates
Fix PhanCompatibleTypedProperty, PhanPluginRedundantReturnComment notices
