The reply form serializes TICKET_MESSAGE_MAIL_INTRO and TICKET_MESSAGE_MAIL_SIGNATURE
through dolPrintHTMLForAttribute() which only allows br/b/font/hr/span, so anchors,
divs and strong are stripped before the email is sent. Pass an extended whitelist for
these two hidden transport inputs so admin formatted footers and intros survive.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
llx_categorie.fk_parent had no application-level guard against fk_parent = rowid,
so a stray UPDATE (or future code path) could set a category as its own parent and
break the recursive tree walk in get_full_arbo / get_filles. Reject the case at
the start of Categorie::update() with a translated error and a syslog warning.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
The trash button in takepos index.php was rendered without server-side check, and
the deleteline action in invoice.php only required 'takepos > run' which every POS
user has. Wrap the button with hasRight('takepos','editlines') and tighten the
action guard, so users without the edit-lines permission can no longer remove
ticket lines from the keypad before validation.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
If old mod_syslog_chromephp.php / mod_syslog_firephp.php / logHandlerInterface.php
files are left over from a v9 install (e.g. when files were not cleaned by upgrade2),
their require_once or constructor breaks the admin/syslog.php page silently. Wrap
the handler load in a try/catch with a class_exists guard so the page keeps listing
the working handlers and just logs a warning for stale files.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
floors.php hid the previous-floor arrow as soon as floor was 1 ("if ($floor > 1)"),
and the click-handler also fell back to 1 instead of decrementing past it, so users
could never get back to floor 0 once they navigated away. Lower both thresholds to
"$floor > 0" so the arrow stays visible at floor 1 and decrements to 0.
Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
