* FIX phpstan: Societe::$client (int<0,3>) does not accept -1 (#39244)
Societe::$client is annotated @var int<0,3> (domain 0=no customer,
1=customer, 2=prospect, 3=both) in societe.class.php, but the create
form in societe/card.php pre-set it to -1 as a transient "nothing
pre-selected" placeholder, tripping PHPStan level 10 on develop.
The value is never persisted (save paths compute 0..3) and the only
reader, the switch() building the form, treats -1 and 0 identically via
its default case. Use 0 (the property's own default) so the assignment
matches the declared type. No behavior change.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* FIX supplier product combo does not preselect a product without supplier price ('idprod_ID' selected value)
Form::select_produits_fournisseurs() only fills the ajax search input when
the selected value is a supplier price id ((int) > 0). When the value is
'idprod_ID' (product without supplier price for this supplier — the format
documented for the $selected parameter and used by the backtopage of the
product creation popup), nothing was preselected.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add copyright
* chore: retrigger CI (lock check setup canceled by GitHub infra)
---------
Co-authored-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* FIX phpstan: Societe::$client (int<0,3>) does not accept -1 (#39244)
Societe::$client is annotated @var int<0,3> (domain 0=no customer,
1=customer, 2=prospect, 3=both) in societe.class.php, but the create
form in societe/card.php pre-set it to -1 as a transient "nothing
pre-selected" placeholder, tripping PHPStan level 10 on develop.
The value is never persisted (save paths compute 0..3) and the only
reader, the switch() building the form, treats -1 and 0 identically via
its default case. Use 0 (the property's own default) so the assignment
matches the declared type. No behavior change.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* FIX Whole session loses its menus after a login done from inside a dialog popup
The URLs opened by dolButtonToOpenUrlInDialogPopup() carry
dol_hide_topmenu=1 and dol_hide_leftmenu=1. If the session expires and
the user logs in again from inside the popup iframe, these flags were
stored into $_SESSION at login and applied to every following page: the
user 'loses' the top and left menus for the whole session, until logout.
Do not persist the two hide-menu flags when the login is done in a
dol_openinpopup context.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* FIX phpstan: Societe::$client (int<0,3>) does not accept -1 (#39244)
Societe::$client is annotated @var int<0,3> (domain 0=no customer,
1=customer, 2=prospect, 3=both) in societe.class.php, but the create
form in societe/card.php pre-set it to -1 as a transient "nothing
pre-selected" placeholder, tripping PHPStan level 10 on develop.
The value is never persisted (save paths compute 0..3) and the only
reader, the switch() building the form, treats -1 and 0 identically via
its default case. Use 0 (the property's own default) so the assignment
matches the declared type. No behavior change.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* NEW Accountancy - FEC export - Add constant ACCOUNTING_EXPORT_FEC_ADD_TIMESTAMP to add a timestamp in export file name
* The test on dolibarr_main_restrict_os_commands was moved into
dumpDatabase()
* Fix missing extrafields propagation and object links when creating supplier credit note (#39285)
Co-authored-by: Zakaria Boushaba <z.boushaba@vold.africa>
* NEW Filecheck can show diff of modified files (#39022)
* NEW: Show diff against original file in filecheck integrity report
* NEW: Compare against develop branch for alpha/beta versions in filecheck diff
* NEW: Improve filecheck diff granularity on large files with anchor-based split
* Update version.inc.php
* FIX: Undefined array key "text" in dolGetButtonAction dropdown
Button entries built without a 'text' key (e.g. the subtotals module's
"Add title line"/"Add subtotal line" dropdown) triggered a PHP warning on the multi-button branch, which already guarded every other optional key the same way.
---------
Co-authored-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
Co-authored-by: Alexandre SPANGARO <alexandre.spangaro@gmail.com>
Co-authored-by: Alexandre SPANGARO <aspangaro.dolibarr@gmail.com>
Co-authored-by: Zakaria Boushaba <48571684+Boushabazakaria@users.noreply.github.com>
Co-authored-by: Zakaria Boushaba <z.boushaba@vold.africa>
* NEW : Add support of customer discount of the invoice in the sell journal
* Correction phpstan
* Correction phpstan
* Correction phpstan
* Correction phan
* Correction phan
* Correction phan
* Correction phan
* FIX#39146 : add SQL structure in llx_societe_perentity
* FIX phpstan: Societe::$client (int<0,3>) does not accept -1 (#39244)
Societe::$client is annotated @var int<0,3> (domain 0=no customer,
1=customer, 2=prospect, 3=both) in societe.class.php, but the create
form in societe/card.php pre-set it to -1 as a transient "nothing
pre-selected" placeholder, tripping PHPStan level 10 on develop.
The value is never persisted (save paths compute 0..3) and the only
reader, the switch() building the form, treats -1 and 0 identically via
its default case. Use 0 (the property's own default) so the assignment
matches the declared type. No behavior change.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* NEW Accountancy - FEC export - Add constant ACCOUNTING_EXPORT_FEC_ADD_TIMESTAMP to add a timestamp in export file name
* The test on dolibarr_main_restrict_os_commands was moved into
dumpDatabase()
* Fix missing extrafields propagation and object links when creating supplier credit note (#39285)
Co-authored-by: Zakaria Boushaba <z.boushaba@vold.africa>
* NEW Filecheck can show diff of modified files (#39022)
* NEW: Show diff against original file in filecheck integrity report
* NEW: Compare against develop branch for alpha/beta versions in filecheck diff
* NEW: Improve filecheck diff granularity on large files with anchor-based split
* Update version.inc.php
* Fix member subscription with empty date valid
* Create migration script 24.0.0-25.0.0.sql
* FIX#39146: Fos thirdparties, Manage fk_account, payment method and payment term per entity if MAIN_COMPANY_PERENTITY_SHARED is set.
* Missign migration file
* Update paymentok.php
---------
Co-authored-by: Kamel Khelifa <kkhelifa@open-dsi.fr>
Co-authored-by: tnegre <tnegre@open-dsi.fr>
Co-authored-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
Co-authored-by: Alexandre SPANGARO <alexandre.spangaro@gmail.com>
Co-authored-by: Alexandre SPANGARO <aspangaro.dolibarr@gmail.com>
Co-authored-by: Zakaria Boushaba <48571684+Boushabazakaria@users.noreply.github.com>
Co-authored-by: Zakaria Boushaba <z.boushaba@vold.africa>
Co-authored-by: Frédéric FRANCE <frederic34@users.noreply.github.com>
Even if trunc is deprecated in pirce()'s function, we should truncate if it exceeds the MAIN_MAX_DECIMALS_SHOWN, as it is on the total_ttc
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
# Qual: Fix Phan notices
Some phan notices are not reported in ci.
This fixes new ones that appeared:
- Update imap.phan_php to provide IMAP related typing info;
- Add typing info to variables;
- Decleare some variables global (htdocs/admin/dict.php) as reused in function;
- Cast potential null to string;
- Adjust param typing to correspond to default null value (getOnlineSignatureUrl);
- Check that parameter is object as expected by function all (dol_format_address);
# Qual: Update SQL query variables for situation mode in margin reports
In the situation mode, the SQL queries for agentMargins, customerMargins, productMargins, and productMargins tab were updated to use new variable names ($sql_delta_pct and $sql_delta_ht) instead of the old ones ($delta_pct and $delta_ht).
This allows correct analysis by SqlInjection
* FIX phpstan: Societe::$client (int<0,3>) does not accept -1 (#39244)
Societe::$client is annotated @var int<0,3> (domain 0=no customer,
1=customer, 2=prospect, 3=both) in societe.class.php, but the create
form in societe/card.php pre-set it to -1 as a transient "nothing
pre-selected" placeholder, tripping PHPStan level 10 on develop.
The value is never persisted (save paths compute 0..3) and the only
reader, the switch() building the form, treats -1 and 0 identically via
its default case. Use 0 (the property's own default) so the assignment
matches the declared type. No behavior change.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Qual: Fix entity handling in bonprelevement.class.php
The variable name 'entities' was changed to 'entity' to better reflect the singular nature of the value being retrieved.
It was also casted to an int instead of using an unquoted db->escape.
* Qual: Improve SQL query construction in company.lib.php
By escaping the concatenated string, injection verification does not identify a false positive.
* Qual: Avoid void positive, sanitize instead of escape
* Qual: Avoid false positive, sanitize instead of escape
* Sec: Fix potential injection with cast to int (timespent_duration)
* Qual: Avoid false positive, sanitize instead of escape
* Qual: Avoid false positive, sanitize instead of escape
* fix: Replace escape() with sanitize() in SQL queries
# FIX: Replace escape() with sanitize() in SQL queries
- Replace escape() with sanitize() in SQL queries to ensure proper SQL injection protection
- Update SQL queries in multiple files to use sanitize() instead of escape()
- Ensure consistent use of sanitize() across the codebase for better security
* fix(sql): Replace escape with sanitize in SQL queries
# FIX: Replace escape with sanitize in SQL queries
- Replace `escape` with `sanitize` in SQL queries to ensure proper SQL injection prevention
* Qual: Improve field escaping/quoting
# Qual: Qual: Improve field escaping/quoting
---------
Co-authored-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* FIX: Do not quote NULL for fk_user_author & fk_element on insert
* Qual: Remove unnecessary quotes around integer values in SQL queries
# Qual: Remove unnecessary quotes around integer values in SQL queries
Removed unnecessary single quotes around integer values in SQL queries across multiple files.
