* FIX: Escape session list fields
* FIX: Cast nullable session fields before escaping
* Update ChangeLog with new features and fixes
---------
Co-authored-by: f-hoedl <hoefla14@htl-kaindorf.ac.at>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
The MCP server (htdocs/ai/server/mcp_server.php) loads a service user
from AI_MCP_USER_ID but does not expose it as the PHP global $user.
Several tool classes call 'global $user' to identify the caller --
they therefore see no authenticated user in HTTP MCP context (no PHP
web session exists) and return 'User not authenticated' even though
authentication via X-API-Key/Bearer has already succeeded.
This breaks roughly 40% of the MCP tools shipped by the module when
called from external clients (Claude Desktop Custom Connectors,
Claude Code CLI, MCP Inspector, custom scripts).
Two complementary fixes applied:
1. mcp_server.php: after successfully loading the service user,
assign it to $GLOBALS['user'] and the local $user variable. This
acts as a safety net for any tool (current or third-party) that
relies on the legacy 'global $user' pattern.
2. Three tool classes harmonize their constructor signatures with
the McpHandler contract -- new $className($db, $user, $conf):
- ToolCrudObjects (htdocs/ai/tools/crud_objects.class.php)
- ToolInvoices (htdocs/ai/tools/invoices.class.php)
- ToolReports (htdocs/ai/tools/reports.class.php)
These now accept $user via constructor (matching the pattern
already used in ToolThirdParty, ToolCategories, ToolProducts)
and store it as $this->user. Methods that previously called
'global $user' (execute, validateInvoice, payInvoice) now use
the injected $this->user, with a fallback to the global for
web-session contexts.
Tested with:
- create_other_document (proposal, supplier_invoice): works
- search_invoice, validate_invoice, pay_invoice: works
- get_sales_report, get_purchase_report: works
- AI Assistant web UI: unchanged, no regression
Canvas::display_canvas() (htdocs/core/class/canvas.class.php) includes these
templates from inside a method and only imports $db,$conf,$langs,$user,
$canvas,$form,$formfile via 'global'. $objcanvas and $socid are never
brought into that scope, so they were undefined at runtime (the templates
already reconstruct the thirdparty object from $GLOBALS['objcanvas']).
- Derive $socid from the in-scope thirdparty object ($soc->id / $object->id),
fixing the empty socid used for $filedir/$urlsource/showdocuments().
- Replace the bare $objcanvas->control->object with the already-derived $soc
(company) / $object (individual).
For the company template $socid was previously masked from PHPStan by a
'@var int $socid' docblock; it is now actually defined.
# Qual: Fix database typo (DoliDb -> DoliDB)
The database handler type was updated from `DoliDb` to `DoliDB` in both `bookkeepingtemplate.class.php` and `bookkeepingtemplateline.class.php`.
# Qual: Update PHPDoc for setAsSelect method
- Update the type definition of the $fieldOptions parameter in the setAsSelect method to make the color, picto, labelhtml, and note fields optional.
The massaction sendEmail feature added to this page for v24 by 8f0b7e3f
(#37937) reads $conf->invoice->dir_output and includes
core/actions_massactions.inc.php on every page load. When the invoice
module is disabled, dir_output is empty, so the include hits its
protection ('$objectclass or $uploaddir was not defined') and exits.
The referers tab built by product_prepare_head() links to this page
unconditionally, so any v24 install without the invoice module gets a
fatal error on the product referers tab. In 23.0 the page had no mass
action code and rendered fine without the module.
Make the whole massaction machinery conditional on isModEnabled('invoice'):
do not read dir_output, do not propose the mass action, neutralize
$massaction and skip the actions_massactions include when the module is
off. This restores the 23.0 behavior for installs without the invoice
module and changes nothing when the module is enabled.
Signed-off-by: GregcodeOhm <greg.aliot@gmail.com>
Co-authored-by: GregcodeOhm <greg.aliot@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* TEST : add test for bon_prelevement generation
* TEST : add tests for bank transfer SEPA file generation
* FIX WARNING : dol_syslog(array) outputs a warning.
* FIX bon prelevement : non-default IBAN were not used in the generated XML.
* BonPrelevement test : add validation against XSD
* BonVirement test : add validation against XSD
* FIX codesniffer
* Enhance test error messages
* Avoid PHP warning during tests
* TEST FIX : one bank account was not created
* TEST FIX : runnning all tests makes this one fail because is corrupted by a previous test.
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
