Commit graph

170 commits

Author SHA1 Message Date
Laurent Destailleur
b18a83f629 Merge branch '23.0' of git@github.com:Dolibarr/dolibarr.git into develop 2026-06-26 11:20:52 +02:00
w3houde
08e9766c2a
Fix #37282 dispatch API classes whose name ends with the 'Api' suffix (#38819)
The API discovery loop in htdocs/api/index.php (around line 308) accepts
both Foo and FooApi class names when scanning module directories. The
dispatch loop on the request-handling side (line 422) only checked
class_exists($classname), so a module exposing class MyModuleApi from
api_mymodule.class.php would appear in the API Explorer yet 501 with
'API not found' when the endpoint was actually called.

Probe class_exists($classname.'Api') first to mirror the discovery
behavior. Falls back to the plain class name so existing modules keep
working.

Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
2026-06-25 21:32:02 +02:00
Laurent Destailleur
c7b0f1e10e Automated merge from 23.0 to develop 2026-06-09 00:27:55 +02:00
Laurent Destailleur
e1eb9de6ef Automated merge from 22.0 to 23.0 by tool pullmerge.sh 2026-06-09 00:11:42 +02:00
Laurent Destailleur
5acee1b470 Automated merge from 21.0 to 22.0 by tool pullmerge.sh 2026-06-09 00:04:20 +02:00
w3houde
4d2b73e18e
Fix #37445 Suppress PHP message display in API responses (#38512)
API endpoints return JSON or XML. When PHP display_errors is on (the
default outside production), any warning or notice raised before the
response is written ends up in the response body and breaks the parser
on the caller side. The reporter noted that "HTML should never appear
before a JSON answer", which is exactly what happens to a development
or staging install whose conf.php does not set dolibarr_main_prod.

Set display_errors=0 and log_errors=1 at the top of api/index.php so
that the messages stay visible in the server log while the response
body stays clean. This applies to every API call independently of the
production flag handled by filefunc.inc.php.

Reported by @gagarine.

Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
2026-05-30 23:18:06 +02:00
Laurent Destailleur
299c0946df Login API are off by default (API must be used with the bearer token). 2026-04-20 00:26:46 +02:00
Laurent Destailleur
3fb593e758 NEW Move deprecated option
MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER into conf.php
file.
2026-03-25 22:33:03 +01:00
Laurent Destailleur
19f8fe8e63 Merge branch '23.0' of git@github.com:Dolibarr/dolibarr.git into develop 2026-03-02 03:14:24 +01:00
Laurent Destailleur
26c38c52f9 Clean code 2026-03-02 02:15:10 +01:00
Laurent Destailleur
103d350fb8 Merge branch '22.0' of git@github.com:Dolibarr/dolibarr.git into 22.0 2026-01-07 15:46:27 +01:00
Laurent Destailleur
94d1a25d67 Merge branch '21.0' of git@github.com:Dolibarr/dolibarr.git into 22.0 2025-11-03 14:10:57 +01:00
ldestailleur
62760d6195 Merge branch '20.0' of git@github.com:Dolibarr/dolibarr.git into 21.0 2025-11-03 14:05:58 +01:00
Regis Houssin
6e5f044e31
FIX check if service is activated only for api product (#35911) 2025-10-23 16:36:42 +02:00
ldestailleur
df7ee5e392 Has been replaced with API_ENABLE_COUNT_CALLS 2025-07-28 15:17:14 +02:00
ldestailleur
a7d5d15c58 Merge branch '19.0' of git@github.com:Dolibarr/dolibarr.git into 20.0 2025-07-28 15:12:10 +02:00
ldestailleur
c740b8aa7d Fix make var visible 2025-07-28 14:38:03 +02:00
ldestailleur
fe7eda2a4c Move api counter at a better place 2025-07-28 14:31:17 +02:00
Jon Bendtsen
783807af14
Tiniest event attendee API - just the POST endpoint (#33934)
* check if MAIN_AGENDA_XCAL_EXPORTKEY is set before using it

* suggestion from frederic34

* adding 5 new statuses and their functions

* adding 5 new statuses and their functions

* copy and modified from email template api

* remove some unset because they are present in the database

* all objects are ConferenceOrBoothAttendee's

* load eventattendee API file from eventorganization/ folder

* ref is not required and should perhaps be banned because it is ignored during create + nonexisting apifetch function replaced with call to just fetch + making usre to use the correct class

* variable named paid is unused?

* get all event attendees

* fixing the sql statement

* adjusting function checking access rights

* UNTESTED! multicompany support by leftjoining with the projet table which does have an entity column + adjusting checkAccessRights function to prepare for testing project visibility

* adding more statuses and explaining boarding pass better

* expanding access rights checks with a project id and starting to use that after fetch so we know the project_id

* checking if the user has access to the project specified in fk_project

* phan fix getting  right

* checking if isModEnabled('multicompany')

* will only show rows of projects which is either public or the user is a contact of

* 2 new status changing functions and some protection for the existing status changing functions

* fix pre-commit check

* typo fix = that should be ==

* adding extrafields and linkedobjectids to event attendee

* should be back to develop branch contents so PR can be smaller

* reducing PR size, just GET and POST

* smallest commit, just the post and functions needed by post

---------

Co-authored-by: Jon Bendtsen <xcodeauthor@jonb.dk>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
2025-04-22 11:45:50 +02:00
Charlène Benke
5fe018cdba
NEW ; Add hook on API call (#33501)
* NEW ; Add hook on API call

* Update index.php

---------

Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
2025-03-19 13:53:17 +01:00
Laurent Destailleur
66989d4fef Clean files 2026-01-07 19:15:06 +01:00
Laurent Destailleur
4bfda08f7f Fix #GHSA-px39-mwcr-hvxp 2026-01-07 15:10:47 +01:00
Laurent Destailleur
74cc41c460 Merge branch '22.0' of git@github.com:Dolibarr/dolibarr.git into develop 2025-11-03 14:27:58 +01:00
Maxime Kohlhaas
24952c3916
Fix : CI feedbacks (#36045)
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
2025-11-01 01:01:10 +01:00
Laurent Destailleur
63ec276f5c Add DOLAPIENTITY into allowed http headers 2025-10-31 17:01:07 +01:00
Laurent Destailleur
e660f0f35a Enhance log 2025-10-31 16:10:06 +01:00
Laurent Destailleur
4c84650e39 NEW Add API for Holidays/Leaves 2025-10-29 18:58:06 +01:00
Jon Bendtsen
8f52485172
NEW Api mass emailing (#35531)
* adding function to set it to draft mode

* New API endpoint for controlling mass mailings

* report which id we could not find + unset some fields not on this object + write that source was com/propal/class/api_propal.class.php

* extending the fetch function for the mailing object so the API can show all columns in the database

* filling more data into the object and don't unset it later

* adding notrigger to clone creation

* still some cleaning up from when cloning api_proposals.class.php

* do not unset the ID, because we want the ID so we can use it

* adding endpoint to clone a mass mailing

* extending count function with 'all' that just returns all rows, no matter the status

* API endpoints to delete all targets of a mass mailing

* setting which http method to use

* pretty print clone endpoint in API explorer

* endpoint resetTargetsStatus of mass mailing

* Typo receipients fixed

* Update api_mailings.class.php

* Update api_mailings.class.php

* Update api_mailings.class.php

---------

Co-authored-by: Jon Bendtsen <xcodeauthor@jonb.dk>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
2025-10-01 17:37:43 +02:00
ldestailleur
61f907c347 NEW Add option API_ENABLE_COUNT_CALLS 2025-08-21 13:05:47 +02:00
minimexat
92562150ec
QUAL Replace var_export() with json_encode() in dol_syslog() calls (#37138)
var_export() produces multiline output that breaks log aggregators
(Loki, Splunk, Elasticsearch, Graylog) as each line becomes a separate
log entry.

json_encode() produces single-line structured output that works correctly
with all log aggregation tools. This pattern is already used elsewhere
in Dolibarr (accountancy, install modules).

Files changed:
- core/class/commoninvoice.class.php (payment intent logging)
- core/class/commonobject.class.php (payment terms logging)
- core/modules/mailings/advthirdparties.modules.php (mailing targets)
- core/modules/oauth/google_oauthcallback.php (userinfo logging)
- core/modules/oauth/generic_oauthcallback.php (userinfo logging)
- public/payment/newpayment.php (GET/POST debug logging)
- public/payment/paymentok.php (payment tag logging)
- public/stripe/ipn.php (Stripe event data logging)
- paypal/lib/paypal.lib.php (PayPal response logging)
- api/index.php (API debug logging)
- stripe/class/stripe.class.php (payment/setup intent logging)

Co-authored-by: f-hoedl <hoefla14@htl-kaindorf.ac.at>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
2026-02-11 01:44:21 +01:00
hansemschnokeloch
16cec77d5b
Replace var_export with new function formatLogObject (#37178) 2026-02-10 15:01:34 +01:00
Jon Bendtsen
e22ec699c0
FIX better error when api tempdir is not writeable (#32150)
* When api/temp folder does not exist or isn't writeable dol_syslog what the folder is and print where to find that information

* flipping line order

* putting suslog line first

* back to original print

---------

Co-authored-by: Jon Bendtsen <xcodeauthor@jonb.dk>
2024-12-01 23:18:38 +01:00
Frédéric FRANCE
1adc883b56
add baseline exclude for phpstan (#31632)
* add baseline exclude for phpstan

* update

* update

* update

* update

* update

* merge

* restore one filter

* delete old errors

* fix

* fix

* fix

* $moreforfilter can t be empty

* fix

* enable check

* refresh baseline

* add phpdoc

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* update phpstan baseline

* fix

* fix

* fix

* fix

* fix

* fix

* fix

* fix

* fix

* fix

* fix

* fix

* fix

---------

Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
2024-11-04 23:53:20 +01:00
Laurent Destailleur
2f643b8f99 Fix API_DISABLE_LOGIN_API 2024-08-17 16:30:47 +02:00
Laurent Destailleur
03bc26dcbb Fix API_DISABLE_LOGIN_API 2024-08-17 16:29:52 +02:00
Lucas Marcouiller
2655cd156b
New api call counter (#29323)
Co-authored-by: Hystepik <lmarcouiller@nltechno.com>
2024-04-11 19:14:10 +02:00
Laurent Destailleur
990216b13f NEW Api parameters are sanitized by the WAF, same code than GET/POST 2024-04-02 13:07:13 +02:00
MDW
a408288ba1
Fix & enable PhanPluginUnknownClosureParamType
# Fix & enable PhanPluginUnknownClosureParamType

Typing of anonymous functions to fix this notice.
Optimised some minor things.
2024-03-14 22:42:26 +01:00
MDW
ec8f2a420d
Fix: Use of deprecated fichinter in dynamic modulename (#28456)
# Fix: Use of deprecated fichinter in dynamic modulename

The modulename is computed dynamically and could use deprecated fichinter
module name.
Also optimised the test.
2024-02-27 15:29:58 +01:00
Laurent Destailleur
200fd95074 NEW All apis has a hook context of "api" initialized 2024-02-12 05:25:45 +01:00
Laurent Destailleur
6c91d3d8b7 Fix typo english 2024-01-18 15:15:05 +01:00
Laurent Destailleur
8706d58ea6 Move code only if required 2024-01-18 12:39:45 +01:00
Mathieu "rid" Soula
1bece7f104
Fix PHPStan / php-stan check failure 2024-01-18 10:52:39 +01:00
Mathieu "rid" Soula
b1b16677ae
Fix indentation. 2024-01-18 10:36:10 +01:00
Mathieu "rid" Soula
480d35ccc9
Move termination callback back to api/index.php
As discussed in the pull request conversation : 
- remove unnecessary flush calls ;
- remove termination callback method from Restler code and set it back into api/index.php
2024-01-18 10:26:42 +01:00
Mathieu "rid" Soula
12a30cb907
Update index.php
Fix PHPScan error
2024-01-17 11:37:10 +01:00
Mathieu "rid" Soula
85b90373f5
QUAL Sending API response data to clients before completing post-processing tasks.
This commit allows Rester to immediately send response data back to the client before completing some time consuming post-processing tasks (such as sending emails) in a termination callback if defined.

Termination callback should be created into the same class as the API method it terminates. Callback name must match the following format : "_terminate_" + <API_METHOD_NAME> + "_" + <API_METHOD_RESPONSE_FORMAT_EXTENSION>.

For instance, termination callback for orders "post" method defined in htdocs/commande/class/api_orders.class.php must be named "_terminate_post_json".
2024-01-17 11:16:43 +01:00
MDW
85ad4ecdf8
Qual: Spelling for htdocs/[a-b]* (#27422)
Mostly comments, one variable changed from misspelling to .
Also changed CNAT to C.N.A.T in comment to avoid fix from CNAT to CAN'T.

Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
2024-01-12 20:58:09 +01:00
Laurent Destailleur
fb083a6cfc Fix warning with rector 2023-12-13 16:33:17 +01:00
Laurent Destailleur
987d6c41b9 Fix with php-cs-fixer 2023-12-04 11:41:14 +01:00