Merge branch '17.0' of git@github.com:Dolibarr/dolibarr.git into 18.0

ChangeLog

@@ -477,6 +477,117 @@ Note that to find all the parameters that are encrypted into the setup database,
 * The method getCheckOption() and deleteCPUser() of class Holiday has been removed (it was not used)
 
 
+***** ChangeLog for 17.0.4 compared to 17.0.3 *****
+FIX: $this->newref already exists and could have been modified by trigger but we still use a local variable for the filesystem-based renaming
+FIX: 16.0 only, backport fix for SQL error on global search product
+FIX: 17.0: deprecated field should only be a fallback
+FIX: 17.0 PHP8: supplier invoice class:
+FIX: 17.0 - php8 warnings: test for $field existence before checking is_null
+FIX: #25399 (#26694)
+FIX: #25458 intervention localizations (backport v17) (#26757)
+FIX: #25580 install/step1.php - wrong command line argument used for $main_dir (#25581)
+FIX: #25919
+FIX: #25934 #25929
+FIX: #26100 - Ticket - On edit, list of closed project must be excluded (#26223)
+FIX: #26195 - Various payment - List of project excluded those assigned to third parties (#26222)
+FIX: #26735 FIX: #26994
+FIX: #27262 Recurrent invoice - user to string conversion
+FIX: Accountancy - Possibility to write in bookkeeping expense report operation with some line not bound (#26545)
+FIX: Accountancy - Update Quadra export format
+FIX: add action update_extras to don card
+FIX: add_customer_ref_on_linked_shipment (#26349)
+FIX: add display of an error when attempting to delete a committed transaction (#26573)
+FIX: Adding the $encode parameter to recursive _replaceHtmlWithOdtTag() utilisation
+FIX: add warning in the changelog
+FIX: avoid php8 warnings (#25596)
+FIX: avoid warning : Cannot use a scalar value as an array (#26437)
+FIX: Backport memory fix for fatal error when +100000 products
+FIX: backport SQL error on global search product
+FIX: bad accountancy code autoselection for supplier ventilation
+FIX: Bad calculation of localtax when price_base_type not defined.
+FIX: bad check return for sendfile
+FIX: bad from and to
+FIX: Bad value of accounting account shown in list. Edit fails.
+FIX: Barcode header cell not well displayed
+FIX: Bar code verification should be done by entity because generation does (#28087)
+FIX: # Bug Estimated Stock at date value in V14 (#26479)
+FIX: Can't access to rec supplier invoice card
+FIX: Can't delete a fourn commande row if a commande ligne is linked
+FIX: check tva_tx before comparing price_min_ttc (#25220)
+FIX: commande context (#26497)
+FIX: compare the result of the send mail file function
+FIX: could not delete a fourn commande row if a commande ligne is linked
+FIX: count cronjob list differs of lines shown nb
+FIX: crabe PDF is generating in conf->entity instead of object->entity
+FIX: creation of invoice from contract with discount lines
+FIX: CVE-2024-23817 (#28089)
+FIX: dir output path for ODT models on reception card
+FIX: disable pointer events on jQuery-UI tooltips to prevent a glitch (fast-blinking tooltip)
+FIX: Error handling for computed values on import (#24897)
+FIX: escape HTML tags in return value of getFullName() (#26735)
+FIX: export FEC
+FIX: Fatal error converting object of class User to string (php8)
+FIX: fatal error with bad definition of dictionaries
+FIX: filter by entity on contact is missing
+FIX: Fix supplier invoice security check
+FIX: HTML in ODT templates (#26181)
+FIX: include
+FIX: label
+FIX: line special_code never saved (#28051)
+FIX: link to create purchase order from sale order
+FIX: menu auguria
+FIX: message order in ticket public view is not coherent with tickets events tab
+FIX: Missing begin transaction when updating supplier recurring invoice
+FIX: missing contact_id for the trigger
+FIX: Missing error message on CommandeFourn creation
+FIX: missing fk_account situation invoice
+FIX: missing project entity filter (Issue #26243) (#26247)
+FIX: modification of complementary attributes in commercial proposals
+FIX: modification of complementary attributes in invoices (#26180)
+FIX: more correctly parse the select part to be replaced in sql queries
+FIX: not create/update extrafields for visibility 0,2 and 5
+FIX: notification information on intervention validated confirmation message (v17+)
+FIX: payment card: misleading message when delete button disabled
+FIX: payment : language is not propagated to following pages
+FIX: pdf cornas page head multicell width (backport v17)
+FIX: possible inconsistency between llx_ecm_files and file system when BILL_SUPPLIER_VALIDATES changes ref
+FIX: Prices visible on TakePOS KO with multiprices support
+FIX: product list accounting length
+FIX: propal list : warning if product module is not enabled (#25583)
+FIX: Propal's negative quantities
+FIX: Quick search Intervention redirect to wrong page
+FIX: reception odt dir output path
+FIX: regression on rounding stocks fields on product list
+FIX_reload_linked_objects_on_propal_closeas
+FIX: Return right content type
+FIX: right access on salary card and tabs
+FIX: rights paymentsc paiementcharge
+FIX: same broken feature as v18 (Multicompany)
+FIX: Save user modif id when changing a contact status
+FIX: search by ref & rowid in don list
+FIX: search by thirdparty in don list
+FIX: special_code update line keep old value. (#26819)
+FIX: SQL concatenation error
+FIX: SQL request parenthesis
+FIX: substitute project variables in invoice documents (#26445)
+FIX: Suppliers addlines never have VAT if buyprice for this supplier
+FIX: [TAKEPOS] display prices with or without taxes depending on setup (TAKEPOS_CHANGE_PRICE_HT)
+FIX: TakePOS receipt preview in admin #25648
+FIX: template invoice list extrafield filters (backport v17) (#26227)
+FIX: thirdparty object in proposal card is not loaded
+FIX: too long output
+FIX: translation button
+FIX: use event.key instead event.which to avoid keyboard difference
+FIX: Use of line->insert instead of line->create
+FIX: user creation when LDAP is configured (#26332)
+FIX: Use the wrong logo size on PDF
+FIX: v17: Param $notrigger in $societe->create() causes method to return true regardless of actual result of database functions (#26499)
+FIX: warning param $lineID getSpecialCode is negatif (#26826)
+FIX: warning php8.2 undefined_array_key (#26830)
+FIX: warning when Workboard Responses display non numeric strings
+FIX: Wrong backtopage given for the stocktransfer button from the stocktransfer list (#26271)
+FIX: wrong place of trigger delete
+
 ***** ChangeLog for 17.0.3 compared to 17.0.2 *****
 FIX: #20304 propaldates update
 FIX: #24508 Label not reported when creating a supplier invoice template (#25340)

dev/setup/codesniffer/ruleset.xml

@@ -5,20 +5,20 @@
 	<arg name="tab-width" value="4"/>
 	<arg name="extensions" value="php" />
 
-	<exclude-pattern type="relative">build/html</exclude-pattern>
-	<exclude-pattern type="relative">build/aps</exclude-pattern>
-	<exclude-pattern type="relative">dev/tools/test/namespacemig</exclude-pattern>
-	<!-- <exclude-pattern type="relative">dev/initdata/dbf/includes</exclude-pattern> -->
-	<exclude-pattern type="relative">documents</exclude-pattern>
-	<exclude-pattern type="relative">htdocs/core/class/lessc.class.php</exclude-pattern>
-	<exclude-pattern type="relative">htdocs/custom</exclude-pattern>
-	<exclude-pattern type="relative">htdocs/includes</exclude-pattern>
-	<exclude-pattern type="relative">htdocs/install/doctemplates/websites</exclude-pattern>
-	<exclude-pattern type="relative">htdocs/conf.php</exclude-pattern>
-	<exclude-pattern type="relative">*/nltechno*</exclude-pattern>
-	<exclude-pattern type="relative">source</exclude-pattern>
-	<exclude-pattern type="relative">.git</exclude-pattern>
-	<exclude-pattern type="relative">.cache</exclude-pattern>
+	<!-- info: '*' is replaced with '.*', so better use '+' in some cases -->
+	<!-- info: 'relative' paths are relative to the examined file, so not ok. -->
+	<exclude-pattern>/build/(html|aps)/</exclude-pattern>
+	<exclude-pattern>/dev/tools/test/namespacemig/</exclude-pattern>
+	<!-- <exclude-pattern>dev/initdata/dbf/includes</exclude-pattern> -->
+	<exclude-pattern>/documents/</exclude-pattern>
+	<exclude-pattern>/htdocs/core/class/lessc\.class\.php</exclude-pattern>
+	<exclude-pattern>/htdocs/(custom|includes)/</exclude-pattern>
+	<exclude-pattern>/htdocs/install/doctemplates/websites</exclude-pattern>
+	<exclude-pattern>/htdocs/([^/]+/)?conf\.php</exclude-pattern>
+	<exclude-pattern>*/nltechno*</exclude-pattern>
+	<exclude-pattern>/source/</exclude-pattern>
+	<exclude-pattern>/\.git/</exclude-pattern>
+	<exclude-pattern>/\.cache/</exclude-pattern>
 
 	<!-- List of all tests -->
 

htdocs/comm/action/card.php

@@ -1000,7 +1000,7 @@ if (empty($reshook) && GETPOST('actionmove', 'alpha') == 'mupdate') {
 
 	$newdate = GETPOST('newdate', 'alpha');
 	if (empty($newdate) || strpos($newdate, 'dayevent_') != 0) {
-		header("Location: ".$backtopage);
+		header("Location: ".$backtopage, true, 307);
 		exit;
 	}
 
@@ -1085,7 +1085,7 @@ if (empty($reshook) && GETPOST('actionmove', 'alpha') == 'mupdate') {
 		}
 	}
 	if (!empty($backtopage)) {
-		header("Location: ".$backtopage);
+		header("Location: ".$backtopage, true, 307);
 		exit;
 	} else {
 		$action = '';

htdocs/core/class/notify.class.php

@@ -549,6 +549,7 @@ class Notify
 								$link = '<a href="'.$urlwithroot.'/fourn/commande/card.php?id='.$object->id.'&entity='.$object->entity.'">'.$newref.'</a>';
 								$dir_output = $conf->fournisseur->commande->multidir_output[$object->entity]."/".get_exdir(0, 0, 0, 1, $object);
 								$object_type = 'order_supplier';
+								$labeltouse = isset($conf->global->ORDER_SUPPLIER_VALIDATE_TEMPLATE) ? $conf->global->ORDER_SUPPLIER_VALIDATE_TEMPLATE : '';
 								$mesg = $outputlangs->transnoentitiesnoconv("Hello").",\n\n";
 								$mesg .= $outputlangs->transnoentitiesnoconv("EMailTextOrderValidatedBy", $link, $user->getFullName($outputlangs));
 								$mesg .= "\n\n".$outputlangs->transnoentitiesnoconv("Sincerely").".\n\n";
@@ -557,6 +558,7 @@ class Notify
 								$link = '<a href="'.$urlwithroot.'/fourn/commande/card.php?id='.$object->id.'&entity='.$object->entity.'">'.$newref.'</a>';
 								$dir_output = $conf->fournisseur->commande->multidir_output[$object->entity]."/".get_exdir(0, 0, 0, 1, $object);
 								$object_type = 'order_supplier';
+								$labeltouse = isset($conf->global->ORDER_SUPPLIER_APPROVE_TEMPLATE) ? $conf->global->ORDER_SUPPLIER_APPROVE_TEMPLATE : '';
 								$mesg = $outputlangs->transnoentitiesnoconv("Hello").",\n\n";
 								$mesg .= $outputlangs->transnoentitiesnoconv("EMailTextOrderApprovedBy", $link, $user->getFullName($outputlangs));
 								$mesg .= "\n\n".$outputlangs->transnoentitiesnoconv("Sincerely").".\n\n";
@@ -565,6 +567,7 @@ class Notify
 								$link = '<a href="'.$urlwithroot.'/fourn/commande/card.php?id='.$object->id.'&entity='.$object->entity.'">'.$newref.'</a>';
 								$dir_output = $conf->fournisseur->commande->multidir_output[$object->entity]."/".get_exdir(0, 0, 0, 1, $object);
 								$object_type = 'order_supplier';
+								$labeltouse = isset($conf->global->ORDER_SUPPLIER_REFUSE_TEMPLATE) ? $conf->global->ORDER_SUPPLIER_REFUSE_TEMPLATE : '';
 								$mesg = $outputlangs->transnoentitiesnoconv("Hello").",\n\n";
 								$mesg .= $outputlangs->transnoentitiesnoconv("EMailTextOrderRefusedBy", $link, $user->getFullName($outputlangs));
 								$mesg .= "\n\n".$outputlangs->transnoentitiesnoconv("Sincerely").".\n\n";

htdocs/delivery/class/delivery.class.php

@@ -1107,7 +1107,7 @@ class Delivery extends CommonObject
 	 *  @param     int			$hideref        Hide ref
 	 *  @return    int             				0 if KO, 1 if OK
 	 */
-	public function generateDocument($modele, $outputlangs = '', $hidedetails = 0, $hidedesc = 0, $hideref = 0)
+	public function generateDocument($modele, $outputlangs, $hidedetails = 0, $hidedesc = 0, $hideref = 0)
 	{
 		global $conf, $langs;
 

htdocs/product/stock/class/entrepot.class.php

@@ -941,7 +941,7 @@ class Entrepot extends CommonObject
 	 *  @param     int			$hideref        Hide ref
 	 *  @return    int             				0 if KO, 1 if OK
 	 */
-	public function generateDocument($modele, $outputlangs = '', $hidedetails = 0, $hidedesc = 0, $hideref = 0)
+	public function generateDocument($modele, $outputlangs, $hidedetails = 0, $hidedesc = 0, $hideref = 0)
 	{
 		global $conf, $user, $langs;
 

htdocs/product/stock/class/mouvementstock.class.php

@@ -1195,7 +1195,7 @@ class MouvementStock extends CommonObject
 	 *  @param     int			$hideref        Hide ref
 	 *  @return    int             				0 if KO, 1 if OK
 	 */
-	public function generateDocument($modele, $outputlangs = '', $hidedetails = 0, $hidedesc = 0, $hideref = 0)
+	public function generateDocument($modele, $outputlangs, $hidedetails = 0, $hidedesc = 0, $hideref = 0)
 	{
 		global $conf, $user, $langs;
 

htdocs/product/stock/stocktransfer/stocktransfer_card.php

@@ -39,6 +39,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/modules/stocktransfer/modules_stocktransfe
 $langs->loadLangs(array("stocks", "other", "productbatch", "companies"));
  if (isModEnabled('incoterm')) $langs->load('incoterm');
 
+
 // Get parameters
 $id = GETPOST('id', 'int');
 $ref        = GETPOST('ref', 'alpha');
@@ -954,12 +955,12 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea
 					}
 				}
 			} elseif ($object->status == $object::STATUS_VALIDATED && $permissiontoadd) {
-				print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=destock">'.$langs->trans("StockTransferDecrementation").'</a>';
+				print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=destock&token='.newToken().'">'.$langs->trans("StockTransferDecrementation").'</a>';
 			} elseif ($object->status == $object::STATUS_TRANSFERED && $permissiontoadd) {
-				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=destockcancel">'.$langs->trans("StockTransferDecrementationCancel").'</a>';
-				print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=addstock">'.$langs->trans("StockTransferIncrementation").'</a>';
+				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=destockcancel&token='.newToken().'">'.$langs->trans("StockTransferDecrementationCancel").'</a>';
+				print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=addstock&token='.newToken().'">'.$langs->trans("StockTransferIncrementation").'</a>';
 			} elseif ($object->status == $object::STATUS_CLOSED && $permissiontoadd) {
-				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=addstockcancel">'.$langs->trans("StockTransferIncrementationCancel").'</a>';
+				print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=addstockcancel&token='.newToken().'">'.$langs->trans("StockTransferIncrementationCancel").'</a>';
 			}
 
 			// Clone