# Fix: Update type hints in PDF modules
- Fix `Parameter #4 $curY of method pdf_standard_evaluation::printLine() expects int, float given.`
- Updated some other type hints
- Removed unnecessary reference symbols (&) from method parameters
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Qual: Fix 'SqlInjection' notices
# Qual: Fix 'SqlInjection' notices
Batch of 25 files with changes to fix 'SqlInjection' Notices
* Qual: Enhance SQL injection prevention in CodingPhpTest.php
Improved the SQL injection prevention mechanism in the CodingPhpTest.php file by adding a check for integer and float casts in the IN clause of SQL queries to avoid false positives.
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* FIX#39190 wrong unit price when invoicing time spent with one line per declaration (#39215)
* FIX#39190 wrong unit price when invoicing time spent with one line per declaration
In projet/tasks/time.php, the 'onelineperperiod' mode (invoice generation option
"One line for each time spent declaration") computed the unit price as
$pu_ht = price2num($value['totalvaluetodivideby3600'] / 3600, 'MU');
but totalvaluetodivideby3600 is timespent_duration (seconds) * timespent_thm
(hourly rate), so dividing by 3600 yields "hours * hourly rate", which is the line
total and not a unit price. The quantity passed to addline() is the number of hours,
so the line was billed hours * (hours * rate) instead of hours * rate: the time is
over-billed by a factor equal to the number of hours.
The sibling modes are already correct: 'onelineperuser' and 'onelinepertask' divide
by the recorded number of seconds. Up to 16.0 'onelineperuser' had the same /3600
expression; it was fixed there and 'onelineperperiod' was left behind. Align it with
that reference implementation, including the same guard against a zero duration.
Also reset $pu_ht for each generated line. $pu_ht is initialized once before the loops
(with the price of the selected product/service, or 0) and this mode only had an
"if (empty($pu_ht))" test, so once a price was computed for the first line every
following line reused it, and lines of users with a different hourly rate got the rate
of the first line. The base price is saved before the loop and restored on each
iteration, so the product/service price path is preserved.
* Rename variable for clarity in time.php
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* FIX isInt() does not detect sized integer types (tinyint, bigint) (#39236)
CommonObject::isInt() decides whether a list-page column gets numeric
search mode and is also used when resolving $this->id. The regex
/(^int|int$)/ missed sized integer types such as tinyint(4) and
bigint(20): they neither start nor end with "int".
These types are not exotic: tinyint(4) is used in several core $fields
definitions (societe, contact, entrepot, companypaymentmode, ...) and
ModuleBuilder-generated tables use bigint(20) for rowid, so isInt()
should recognise them rather than requiring callers to change the
column type.
The new regex /^(?:tiny|small|medium|big)?int|int$/ also handles
smallint/mediumint with a size. Anchoring is preserved on purpose so
that strings which merely contain "int" (e.g. sellist:Table:...) are
still NOT matched, while the Dolibarr foreign-key syntax
"integer:Class:path" keeps being detected.
Signed-off-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
* FIX#34667 checkUserAccessToObject: skip entity check for non-multientity objects (multicompany) (#39246)
When the multicompany module is enabled, checkUserAccessToObject() (used
by restrictedArea(), e.g. from an ajax tooltip) ran the entity check
unconditionally in its default/custom-object branch, building
"AND dbt.entity IN (...)". For a custom object whose table has no entity
column (ismultientitymanaged = 0), that SQL fails, nb comes back 0 and
access is wrongly denied.
Guard the branch so the entity test only runs when the object is actually
multi-entity managed. Keep the test for legacy classes that never define
ismultientitymanaged (null/unset) and for a non-object $object, and skip
it only when a class explicitly sets ismultientitymanaged = 0.
Supersedes the stale #34667 (by @jyhere) and applies the condition
requested by @eldy in its review.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* FIX mo_production: show very-short unit label instead of untranslated 'UnitPShort' (#39253)
The "Unit" column of the consume/produce tables used
measuringUnitString(..., 2), which translates a <Label>Short key. Those
keys do not exist for most units (e.g. a Piece -> 'UnitPShort', kg ->
'WeightUnitkgShort'), so the raw untranslated key was displayed. Use
param 1 (the very-short DB short_label: 'p', 'kg', ...) like every other
unit column in this file and across the codebase.
Supersedes #31706.
Signed-off-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
* FIX#32217 Fire BILL_CREATE with create-form extrafields on next situation invoice (#39254)
When creating the next situation invoice, the create-form extrafields were
saved AFTER createFromCurrent() had already fired BILL_CREATE, so triggers
listening to BILL_CREATE never saw them. Passing 'BILL_CREATE' to
insertExtraFields() (as first proposed) would fire the trigger a second time.
Instead, set the extrafields on $object before createFromCurrent() and let
create() insert them and fire BILL_CREATE once with the values present.
createFromCurrent() now skips its fetch_optionals() when array_options is
already set by the caller, so the form values are no longer overwritten by
the source invoice values. The two other createFromCurrent() callers do not
pre-set array_options, so their behaviour is unchanged.
Supersedes #32217.
Signed-off-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
* FIX#33065 page hangs when displaying a very long html content
dol_escape_htmltag() protects the tags listed in $noescapetags before calling
htmlentities(). For the tags carrying attributes it used a do/while loop that,
on each round, searched the first '<tag ...>' with preg_match, replaced every
occurrence of that exact string with str_replace, then compared the whole
content with strcmp to decide whether to loop again.
That loop only consumes one distinct attribute string per round, and each round
scans, rebuilds and compares the whole content. With the 'common' tag list (48
tags) the cost is O(48 * number of distinct attributed tags * length), so it
degrades quadratically with the size of the content while the memory usage stays
flat. A long note or ticket message therefore burns CPU until
max_execution_time is reached instead of raising a memory error.
Replace that loop with a single preg_replace_callback() pass per tag. The
replacement string contains no '<', so it can never build a new tag to protect
and one pass is enough. The attribute string is transformed by exactly the same
operations, in the same order, so the output is unchanged.
Measured on the same content (48 tags, distinct attributes per tag), before and
after, with identical output:
spans length before after speedup
500 29 KB 0.044s 0.006s 7.9x
1000 59 KB 0.140s 0.010s 13.4x
2000 121 KB 0.822s 0.028s 29.1x
4000 245 KB 2.361s 0.042s 56.2x
8000 493 KB 11.813s 0.171s 69.0x
Equivalence was checked on 26 hand written cases (attributes with brackets,
quotes, forbidden characters, unclosed tags, '<' inside an attribute, reserved
keywords, upper case tags, tabs and newlines) and on 3000 randomly generated
inputs: the old and the new code return the same string for all of them.
---------
Signed-off-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Update SQL queries to use getEntity for entity filtering
* Update file path handling for ficheinter module
* Refactor output directory handling in card.php
* Fix#39247: Fix phan notices by reorganising code
# Fix#39247: Fix phan notices by reorganising code
Phan typing analysis was disturbed by conditional assignment to array fields of array items.
This reorganises the the code and uses a foreach and a loop item by reference.
The result array is filtered after the initial loop to find matching ECM items.
Not that this does not fix an unreported issue when paging is applied for filtered items
(paging is applied on the full list, not the filtered items and may result in small(er)
or empty pages).
* Qual: Fix Phan notices
# Qual: Fix Phan notices
- The page_count value was simply ceil(...) which is typed float, now casting to int.
- Add missing properties share and agenda_id to EcmFilesLine
When creating the next situation invoice, the create-form extrafields were
saved AFTER createFromCurrent() had already fired BILL_CREATE, so triggers
listening to BILL_CREATE never saw them. Passing 'BILL_CREATE' to
insertExtraFields() (as first proposed) would fire the trigger a second time.
Instead, set the extrafields on $object before createFromCurrent() and let
create() insert them and fire BILL_CREATE once with the values present.
createFromCurrent() now skips its fetch_optionals() when array_options is
already set by the caller, so the form values are no longer overwritten by
the source invoice values. The two other createFromCurrent() callers do not
pre-set array_options, so their behaviour is unchanged.
Supersedes #32217.
Signed-off-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
The "Unit" column of the consume/produce tables used
measuringUnitString(..., 2), which translates a <Label>Short key. Those
keys do not exist for most units (e.g. a Piece -> 'UnitPShort', kg ->
'WeightUnitkgShort'), so the raw untranslated key was displayed. Use
param 1 (the very-short DB short_label: 'p', 'kg', ...) like every other
unit column in this file and across the codebase.
Supersedes #31706.
Signed-off-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
When the multicompany module is enabled, checkUserAccessToObject() (used
by restrictedArea(), e.g. from an ajax tooltip) ran the entity check
unconditionally in its default/custom-object branch, building
"AND dbt.entity IN (...)". For a custom object whose table has no entity
column (ismultientitymanaged = 0), that SQL fails, nb comes back 0 and
access is wrongly denied.
Guard the branch so the entity test only runs when the object is actually
multi-entity managed. Keep the test for legacy classes that never define
ismultientitymanaged (null/unset) and for a non-object $object, and skip
it only when a class explicitly sets ismultientitymanaged = 0.
Supersedes the stale #34667 (by @jyhere) and applies the condition
requested by @eldy in its review.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Solve pb to manage cash control
* Finish cash control feature of v23
* Fix reopen button
* Fix default sort
* Debug v23
* Debug v23
* Debug v23
* Fix sql
* css
* Trans
* Debug v23
* Debug v23
* Fix warning
* Fix warnings
* Fix warning
* fix phpstan for v23 (#36774)
* fix phpstan
* Update functions.lib.php
* Update admin.lang
* Update errors.lang
* Update fournisseur.commande.class.php
* Update fournisseur.commande.class.php
* Update blockedlog_archives.php
* Update blockedlog_archives.php
* Update blockedlog_archives.php
* Update blockedlog_archives.php
* Debug v23 and migration
* Fix : presend on reception resulted in fatal error (#36794)
* Fix : wrong html end of fiche section (#36793)
* Fix : wrong html end of fiche section
* Update card.php
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Debug v23
* Debug v23
* Fix warning
* Debug v23
* Debug v23
* Fix warnings
* Fix warning
* Fix warning
* Fix warnings
* Fix merge on wrong branch
* Fix warning
* Fix warning
* Fix missing line number when bom card in sub bom mode (#36805)
* FIX: reception reopening lacks of message when an error occurs (#36752)
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Fix warnings
* FIX API content-type assignment (#36771)
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* css
* Debug v23
* CSS
* Add printFieldListWhere / printFieldListTitle missing hooks in invoice template list (#36778)
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Fix CI
* Make CommonObject::cloneCategories() generic (#36758)
It was working only for products
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* ActionComm clone also categories when cloning object (#36761)
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Fix fill news & product on email template (#36756)
* Fix fill news & product on email template
* fix CI
* Update mailtemplate.php
---------
Co-authored-by: Lucas Marcouiller <lmarcouiller@dolicloud.com>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Missing translation (#36806)
* Missing link to language file
* Missing link to language file
* css
* css
* Debug v23
* FIX #GHSA-w5j3-8fcr-h87w
* Fix with accent like é are allowed in path
* More phpuint tests
* Fix #GHSA-px39-mwcr-hvxp
* Trans
* Fix#36709
* Clean files
* Fix warning
* Clean code
* Debug v23
* FIX: getCombination response is way too big (even db object is serialized) (#36830)
* Ajout d'une div responsive autour du formulaire pour améliorer la mise en page (#36825)
Co-authored-by: Anthony Berton <anthony.berton@bb2a.fr>
* css
* css
* Trans
* Doc
* Trans
* Trans
* Debug v23
* Debug v23
* Debug v23
* css
* Debug v23
* Debug
* Debug v23
* Debug v23
* Debug v23
* Trans
* Debug v23
* Debug v23
* Trans
* Fix case
* Fix CI
* CLOSE issue 36744 fix user can delete some actioncomm on which he has not the right (#36747)
* CLOSE issue 36744 fix user can delete some actioncomm on which he has not the right
* Fix whitespace
* Refactor delete confirmation logic for user access
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* FIX icon of mastodon social network
* Backport some fixes of #36851
* css
* CSS
* Debug v23
* CSS v23
* Fix CI
* Doc
* Debug v23
* Debug v23
* Debug v23
* Prepare 23.0
* Prepare 23.0
* Debug v23
* Debug v23
* Debug v23
* CSS
* Fix css
* Fix warning
* CSS
* Fix missing state
* Fix add missing message once token has been saved
* Fix warning oauth
* Fix name of Oauth entry must not have special chars
* Doc
* Fix generic password type
* FIX css
* Fix warning
* FIX Debug v23 - Pb in export accountancy. Var not defined. Missing
conditions for dol_dir_list. Pb cache not used when not found. Header
set at end.
* Init var
* Fix export for quadratus
* Trans
* Clean sql
* Debug v23
* Demo template
* Fix demo file
* css
* Fix CI
* CSS
* css
* Fix trans
* Debug v23
* Fix agenda search for holiday or birthday (#36878)
Co-authored-by: Lucas Marcouiller <lmarcouiller@dolicloud.com>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Fix css regression
* Fix description
* Debug v23
* Debug v23
* Debug v23
* Debug v23 - migrate_reload_modules was broken
* Debug v23 - PDF generation error if additional PDF name not set
* Debug v23
* Add PGK currency
* Missing PGK currency
* Debug v23
* Debug v23
* Doc
* Sync transifex
* Fix trans
* Debug v23 - Fix label of dispute status
* Fix color of status
* Fix no translate
* Fix label in list
* Fix status of dispute
* Disable remote access in test
* Trans
* Trans
* FIX#36902
* Debug v23
* Fix warning
* Fix#36896
* Ignore phan false positive
* Fix civility_code vs civility_id
* Fix CI
* Try to run phan and phpstan on modified files only
* Fix CI
* Fix CI
* Fix CI
* Fix shellcheck
* Fix CI
* Fix CI
* Fix ci
* Ci
* ci
* cs
* ci
* ci
* Ci
* Fix ci
* Fix id ci
* Fix ci
* Fix ci
* CI
* Try to fix ci
* Fix CI
* Fix CI
* Fix CI
* Close#36889 manually, too many conflict due to non atomic PR.
* Merge manually #36851 emailcollector phpimap in reply to oauth v22.
* Try to force phan version
* Fix CI
* Fix PROPAL_ENABLE_NEGATIVE_QTY and ORDER_ENABLE_NEGATIVE_QTY
* FIX Accountancy - Chart of account - Some problem on backtopage (#36910)
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Debug v23
* Fix link
* CSS
* Fix css
* Fix trans
* Fix css and responsive pb
* Debug v23
* Debug v23
* Debug v23
* Fix ci
* Fix email layout selector for product (#36948)
Co-authored-by: Lucas Marcouiller <lmarcouiller@dolicloud.com>
* Fix ci
* FIX missmatch of permission check of button and action of cancel delivery note (expedition) (#36943)
In expedition/card.php there is the action "confirm_cancel" which checks for the right supprimer of expedition. The corresponding UI Button checks for creer of expedition. This means some people can see the button, but nothing happens when clicking on it (also no error message).
* Debug v23
* Add log
* Log
* Fix log
* Fix round in stripe amount
* Fix label
* Need a label for autorecord stripe payouts
* Label
* Fix message on button tooltip
* Fix label
* Fix CI
* Trans
* Fix CSS
* Debug v23
* Fix email collector ticket fetch (#36968)
* Fix email collector ticket fetch
* fix CI
---------
Co-authored-by: Lucas Marcouiller <lmarcouiller@dolicloud.com>
* Fix bad trans for member subscription on import (#36969)
* Fix bad trans for member subscription on import
* fix CI
---------
Co-authored-by: Lucas Marcouiller <lmarcouiller@dolicloud.com>
* fix: exclude special lines from supplier order dispatch count (#36964)
Co-authored-by: Zakaria Boushaba <z.boushaba@vold.africa>
* Change resource selection index from 1 to 2 (#36955)
fix warning causing by returning array (1 to 2) and suppress search button (0 to 2)
* Fix select resource
* Fix count into badge
* Debug v23
* Debug v23 - Stock management on parent kit does not work yet (for example when creating/closing shipment). Edit interface to be more clear with that.
* Clean code
* Fix ci
* Fix code action
* Fix ci
* Fix CSS (#36977)
* Fix CSS
* Hide on smartphone
* Same on journal view
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Debug v23
* Fix ci
* Debug v23 - navigation into fiscal years
* FIX substitution of vars in donation templates
* Fix SMTP OAuth refresh scopes (#36950)
Recreate the OAuth service with its configured scopes when refreshing an access token (required by some providers like Microsoft v2).
Also keep the previous refresh token when the refreshed token does not include one (e.g. Google returns it only once).
Co-authored-by: caminotravelcenter <caminotravelcenter@localhost>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Debug v23 - Fix trans
* Debug v23
* Trans
* FIX wrong backtopage after editing agenda event on product messaging page
The $param variable used to build edit links in the agenda timeline was
copied from thirdparty/messaging.php and used socid instead of product id.
After saving an event, the redirect pointed to product/messaging.php?&socid=0
instead of product/messaging.php?id=XXXX.
Signed-off-by: Olivier ANDRADE SANCHEZ <oandrade@aplose.fr>
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Signed-off-by: Olivier ANDRADE SANCHEZ <oandrade@aplose.fr>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
Co-authored-by: Frédéric FRANCE <frederic34@users.noreply.github.com>
Co-authored-by: Maxime Kohlhaas <maxime@atm-consulting.fr>
Co-authored-by: Francis Appels <francis.appels@yahoo.com>
Co-authored-by: Jyhere <jyhere@gmail.com>
Co-authored-by: ptibogxiv <support@ptibogxiv.net>
Co-authored-by: spsolauv <stephane.pellier@solauv.fr>
Co-authored-by: Lucas Marcouiller <45882981+Hystepik@users.noreply.github.com>
Co-authored-by: Lucas Marcouiller <lmarcouiller@dolicloud.com>
Co-authored-by: Alexandre SPANGARO <alexandre.spangaro@gmail.com>
Co-authored-by: Laurent Destailleur <eldy@users.sourceforge.net>
Co-authored-by: Anthony Berton <34568357+BB2A-Anthony@users.noreply.github.com>
Co-authored-by: Anthony Berton <anthony.berton@bb2a.fr>
Co-authored-by: splohmer <113967431+splohmer@users.noreply.github.com>
Co-authored-by: Zakaria Boushaba <48571684+Boushabazakaria@users.noreply.github.com>
Co-authored-by: Zakaria Boushaba <z.boushaba@vold.africa>
Co-authored-by: Charlène Benke <1179011+defrance@users.noreply.github.com>
Co-authored-by: Braito <braito4@hotmail.com>
Co-authored-by: caminotravelcenter <caminotravelcenter@localhost>
Co-authored-by: Cursor <cursoragent@cursor.com>
CommonObject::isInt() decides whether a list-page column gets numeric
search mode and is also used when resolving $this->id. The regex
/(^int|int$)/ missed sized integer types such as tinyint(4) and
bigint(20): they neither start nor end with "int".
These types are not exotic: tinyint(4) is used in several core $fields
definitions (societe, contact, entrepot, companypaymentmode, ...) and
ModuleBuilder-generated tables use bigint(20) for rowid, so isInt()
should recognise them rather than requiring callers to change the
column type.
The new regex /^(?:tiny|small|medium|big)?int|int$/ also handles
smallint/mediumint with a size. Anchoring is preserved on purpose so
that strings which merely contain "int" (e.g. sellist:Table:...) are
still NOT matched, while the Dolibarr foreign-key syntax
"integer:Class:path" keeps being detected.
Signed-off-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
* Sec: sql injection via api in POST of thirdparties/id/banckaccount - reported by MDnyn
* Sec: sql injection via api in POST of thirdparties/id/banckaccount -
reported by MDnyn
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
