The POST /documents endpoint with generateThumbs=1 called
image_format_supported() after requiring only files.lib.php, but that
function is defined in images.lib.php, which was never included on this
path. The call raised a fatal error and the request returned a bare
HTTP 500 with no JSON body. Add the missing require_once.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
* Fix#39247: Fix phan notices by reorganising code
# Fix#39247: Fix phan notices by reorganising code
Phan typing analysis was disturbed by conditional assignment to array fields of array items.
This reorganises the the code and uses a foreach and a loop item by reference.
The result array is filtered after the initial loop to find matching ECM items.
Not that this does not fix an unreported issue when paging is applied for filtered items
(paging is applied on the full list, not the filtered items and may result in small(er)
or empty pages).
* Qual: Fix Phan notices
# Qual: Fix Phan notices
- The page_count value was simply ceil(...) which is typed float, now casting to int.
- Add missing properties share and agenda_id to EcmFilesLine
Switch four list endpoints that still used the legacy DolibarrApi::_checkFilters
+ bare preg_replace_callback path to the hardened forgeSQLFromUniversalSearchCriteria()
already used by the rest of the same files. The legacy path only validated
parenthesis balance and concatenated non-matching text verbatim into the WHERE
clause, while the hardened path applies the dummy-criteria syntax check first.
Endpoints touched:
- htdocs/api/class/api_setup.class.php getListOfRegions
- htdocs/api/class/api_setup.class.php getListOfIncoterms
- htdocs/api/class/api_setup.class.php getListOfVAT
- htdocs/multicurrency/class/api_multicurrencies.class.php index
See #38768 for the report.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: w3houde <clement@pixodeo.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
The API discovery loop in htdocs/api/index.php (around line 308) accepts
both Foo and FooApi class names when scanning module directories. The
dispatch loop on the request-handling side (line 422) only checked
class_exists($classname), so a module exposing class MyModuleApi from
api_mymodule.class.php would appear in the API Explorer yet 501 with
'API not found' when the endpoint was actually called.
Probe class_exists($classname.'Api') first to mirror the discovery
behavior. Falls back to the plain class name so existing modules keep
working.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
Switch four list endpoints that still used the legacy DolibarrApi::_checkFilters
+ bare preg_replace_callback path to the hardened forgeSQLFromUniversalSearchCriteria()
already used by the rest of the same files. The legacy path only validated
parenthesis balance and concatenated non-matching text verbatim into the WHERE
clause, while the hardened path applies the dummy-criteria syntax check first.
Endpoints touched:
- htdocs/api/class/api_setup.class.php getListOfRegions
- htdocs/api/class/api_setup.class.php getListOfIncoterms
- htdocs/api/class/api_setup.class.php getListOfVAT
- htdocs/multicurrency/class/api_multicurrencies.class.php index
See #38768 for the report.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
API endpoints return JSON or XML. When PHP display_errors is on (the
default outside production), any warning or notice raised before the
response is written ends up in the response body and breaks the parser
on the caller side. The reporter noted that "HTML should never appear
before a JSON answer", which is exactly what happens to a development
or staging install whose conf.php does not set dolibarr_main_prod.
Set display_errors=0 and log_errors=1 at the top of api/index.php so
that the messages stay visible in the server log while the response
body stays clean. This applies to every API call independently of the
production flag handled by filefunc.inc.php.
Reported by @gagarine.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
