Commit graph

155418 commits

Author SHA1 Message Date
Laurent Destailleur
ef6e4bc7b8 Doc 2026-07-20 15:36:29 +02:00
Laurent Destailleur
63a2b0fe49 CI 2026-07-20 15:22:16 +02:00
Laurent Destailleur
b3d342393c Clean code 2026-07-20 14:58:04 +02:00
Laurent Destailleur
7335438ee1 Fix rewrite api /documents to solve duplicate and missing security check
at object-level
2026-07-20 14:57:23 +02:00
Laurent Destailleur
dd1c124349 Debug v24 2026-07-20 12:38:35 +02:00
Laurent Destailleur
b12734dd36 Fix missing object-level control on api to reopen or billed an order -
reported by Phan Long
2026-07-20 12:03:14 +02:00
Laurent Destailleur
7dc44c9665 CSS 2026-07-20 11:50:24 +02:00
Laurent Destailleur
6b607bc21e Debug v24 2026-07-20 11:41:52 +02:00
Laurent Destailleur
3d1eeb35af Fix sanitize urlfrom like backtopage - reported by codex 2026-07-20 11:09:58 +02:00
Laurent Destailleur
5130a49591 Fix test on permissions 2026-07-20 10:52:14 +02:00
Laurent Destailleur
0dd9e6acc2 Fix missing test on external user id - reported by Codex 2026-07-20 10:12:24 +02:00
Laurent Destailleur
11aec08ff4 Merge branch 'develop' of git@github.com:Dolibarr/dolibarr.git into develop 2026-07-20 09:46:23 +02:00
Laurent Destailleur
f7e3af214d Better test 2026-07-20 09:45:24 +02:00
MDW
352b0ac6b4
Qual: Fix 'SqlInjection' notices (#39225)
# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
2026-07-20 02:52:07 +02:00
MDW
6196491e1b
Qual: Fix 'SqlInjection' notices (#39224)
# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
2026-07-20 02:51:54 +02:00
MDW
b51b38ef64
Qual: Fix 'SqlInjection' notices (#39223)
# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
2026-07-20 02:51:42 +02:00
MDW
1df0531b43
Qual: Fix 'SqlInjection' notices (#39222)
# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
2026-07-20 02:51:25 +02:00
MDW
7cc8ae1efb
Qual: Fix 'SqlInjection' notices (#39221)
# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
2026-07-20 02:51:11 +02:00
MDW
1a8825d759
Qual: Fix 'SqlInjection' notices (#39220)
# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
2026-07-20 02:51:00 +02:00
MDW
1dcd497c69
Qual: Fix 'SqlInjection' notices (#39219)
# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
2026-07-20 02:50:44 +02:00
Ushindi Gedeon
2fb564d438
FIX accounting export: enhance file metadata return and secure access checks (#39218)
Co-authored-by: gedeonts <gedeontshobowa1@gmail.com>
2026-07-20 02:50:31 +02:00
Camile
fa5fe7ebf8
FIX|Fix #34947 PDF top margin breaks layout in multiple templates (#35919)
* Fix pdf top margin break layout

* Fix others pdf theme's top margin
2026-07-20 00:09:32 +02:00
マルコメ
db8babd39c
FIX #35786 Allow situation credit notes regardless of payment (#39207)
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
2026-07-19 17:36:10 +02:00
MDW
679c6eaf29
Qual: Fix SqlInjection notices in scripts (#39214) 2026-07-19 17:32:57 +02:00
MDW
5db08a3151
Qual: Fix 'SqlInjection' notices (#39213)
# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
2026-07-19 17:32:14 +02:00
w3houde
cbe0335455
Fix #39143 store computed extrafields with object context (#39172)
When MAIN_STORE_COMPUTED_EXTRAFIELDS is enabled, insertExtraFields() and
updateExtraField() evaluated the computed formula without setting the global
$objectoffield to the current object, so formulas relying on
$objectoffield->array_options returned a wrong value (often 0) when stored,
unlike fetch_optionals() which already sets it.

The list template also always recomputed computed extrafields, but the raw
row available in a list has no object context, giving wrong display and wrong
totals. When MAIN_STORE_COMPUTED_EXTRAFIELDS is enabled the value stored in
database is now used instead.

Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
2026-07-19 16:22:57 +02:00
github-actions[bot]
f495b92d1f
PHPStan > Update baseline (#39193)
Co-authored-by: Dolibot <dolibarr-bot@users.noreply.github.com>
2026-07-19 16:17:31 +02:00
bomuux
4c903ef62a
FIX #37381 Cancelling shipping shouldn't remove its linked objects association (#39212)
* FIX #37381

* Fix #37381

Cancelling shipping shouldn't remove its linked objects association #37381
2026-07-19 15:58:14 +02:00
MDW
6dac0c7263
Qual: Fix 'SqlInjection' notices (#39203)
# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
2026-07-19 15:53:14 +02:00
Pichinov-Jose
159802c08f
FIX Stripe payout: store payout reference (po_) in bank transfer (#39204)
The payout.paid IPN handler recorded the bank transfer line with an empty
num_chq (a "// TODO Store the po ref from $event->data" placeholder). The
Stripe payout id is available as $event->data->object->id, so store it as
the transfer reference. This makes auto-recorded payouts traceable and
reconcilable against Stripe.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-19 15:52:16 +02:00
Laurent Destailleur
281cbabf6c Automated merge from 23.0 to develop 2026-07-19 15:44:45 +02:00
Laurent Destailleur
b2723688a9 Automated merge from 22.0 to 23.0 by tool pullmerge.sh 2026-07-19 15:41:05 +02:00
Laurent Destailleur
6251488091 Automated merge from 21.0 to 22.0 by tool pullmerge.sh 2026-07-19 15:41:02 +02:00
Laurent Destailleur
2693fd8c92 css 2026-07-19 15:26:01 +02:00
Laurent Destailleur
37017da5f5 css 2026-07-19 15:22:56 +02:00
TowyTowy
b305e6a0cc
FIX getFirstDayOfEachWeek()/getLastDayOfEachWeek() use the wrong year for weeks overlapping 2 years (#39198)
In a January that starts with week 52 or 53 of the previous year (for
example January 2022), getFirstDayOfEachWeek() wrongly shifted week 01
to the next year, and the $year++ inside the loop then also corrupted
all the following weeks of the month: every first day returned was the
one of the next year (02, 09, 16, 23, 30 instead of 03, 10, 17, 24, 31
for January 2022). getLastDayOfEachWeek() had no year handling at all,
so the trailing/leading weeks of the other year were resolved in the
wrong year too.

This made the per-month time spent view (projet/activity/permonth.php)
display wrong week date ranges, link to the wrong week and compute the
weekly holiday overlap on wrong date ranges for such months.

Co-authored-by: Claude <noreply@anthropic.com>
2026-07-18 19:40:57 +02:00
atm-jonathan
aea6a5fe99
FIX : situation invoice credit note wrong amount in progressive mode (#39197)
When creating a credit note "with same lines" from a situation invoice,
the code always subtracts the previous situation invoice's line values
before inverting the sign, assuming lines are stored cumulative
(INVOICE_USE_SITUATION = 1, legacy mode).

In progressive mode (INVOICE_USE_SITUATION = 2), each situation invoice
line already stores its own delta amount and percent, so this extra
subtraction credits the wrong amount and percent (e.g. 60% / 1272
instead of the correct 20% / 424 on a real cycle).

Skip the subtraction in progressive mode so the credit note reuses the
source line's own delta values, as expected.
2026-07-18 19:27:39 +02:00
Laurent Destailleur
f02aba5488 Clean code 2026-07-18 18:31:45 +02:00
Laurent Destailleur
e4c593e0f9 Fix use of & char inside of mysql backup 2026-07-18 18:31:26 +02:00
Laurent Destailleur
61916b9039 Sec: Fix wrong test on salary id - reported by Arpit Jain 2026-07-18 18:12:35 +02:00
Laurent Destailleur
0d414fcb51 Merge branch '23.0' of git@github.com:Dolibarr/dolibarr.git into develop 2026-07-18 16:17:03 +02:00
Laurent Destailleur
b4e5998f2c Merge branch '23.0' of git@github.com:Dolibarr/dolibarr.git into 23.0 2026-07-18 02:49:17 +02:00
Laurent Destailleur
1057ad6c7e Sec: sql injection via api in POST of thirdparties/id/banckaccount -
reported by MDnyn
2026-07-18 02:49:05 +02:00
Laurent Destailleur
19991c8ffa Sec: sql injection via api in POST of thirdparties/id/banckaccount - reported by MDnyn 2026-07-18 02:48:07 +02:00
Laurent Destailleur
2e65e0ea23 Clean code 2026-07-18 01:21:54 +02:00
Laurent Destailleur
07db77f071 Debug v24 2026-07-17 12:52:13 +02:00
Laurent Destailleur
1d5373325f Merge branch 'develop' of git@github.com:Dolibarr/dolibarr.git into develop 2026-07-17 11:31:57 +02:00
Laurent Destailleur
fb4d379786 Debug 2026-07-17 11:28:00 +02:00
Régis Houssin
0194d44266
FIX BLOCKEDLOG_HMAC_KEY can not be the same by entity (#39067)
* FIX BLOCKEDLOG_HMAC_KEY can not be the same by entity

* FIX migrate for all entities
2026-07-16 14:06:54 +02:00
Jam Balaya
b2eae1b7d7
FIX #37826 country_code must be an ISO code, not a label (#39191)
* FIX #37826 country_code must be an ISO code, not a label

On a proposal/order, the 2nd+ line got VAT 0% with the error "no vat rates
defined for country 'France'/'Suisse'". Root cause: the seller country_code
held a translated country label instead of the ISO code, so the
"c.code IN (...)" lookup in Form::load_cache_vatrates() matched nothing.

- Societe::setMysoc(): the canonical MAIN_INFO_SOCIETE_COUNTRY is
  "id:code:label"; a legacy "id:label" value put the label into
  country_code. Only treat the full 3-token form as "id:code:label" and
  otherwise rebuild code/label from the authoritative country id.
- Form::load_tva(): defensively recover the seller ISO code from its
  country id when country_code is not a known c_country code, so a bad
  value can never silently force the VAT rate to 0%.

Signed-off-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>

* FIX #37826 avoid useless SQL per page: recover country ISO code from id only when code is not a 2-char ISO code

---------

Signed-off-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
2026-07-16 13:56:33 +02:00