Merge remote-tracking branch 'origin/3.4' into 3.4_backported

ChangeLog

@@ -7,6 +7,7 @@ English Dolibarr ChangeLog
 Fix: Warning into bank conciliation feature.
 Fix: Bad get of localtaxes into contracts add lines.
 Fix: Add a limit into list to avoid browser to hang when database is too large.
+Fix: [ bug #1212 ] 'jqueryFileTree.php' directory traversal vulnerability
 
 ***** ChangeLog for 3.4.2 compared to 3.4.1 *****
 Fix: field's problem into company's page (RIB).

dev/dolibarr_changes.txt

@@ -53,3 +53,9 @@ window.location.href=pRef
 JCROP:
 ------
 * Remove analytics tag into file index.html
+
+
+JQUERYFILETREE:
+---------------
+* Remove directory htdocs/includes/jquery/plugins/jqueryFileTree/connectors
+

htdocs/expedition/fiche.php

@@ -51,9 +51,9 @@
 
 $origin		= GETPOST('origin','alpha')?GETPOST('origin','alpha'):'expedition';   // Example: commande, propal
 $origin_id 	= GETPOST('id','int')?GETPOST('id','int'):'';
+$id = $origin_id;
 if (empty($origin_id)) $origin_id  = GETPOST('origin_id','int');    // Id of order or propal
 if (empty($origin_id)) $origin_id  = GETPOST('object_id','int');    // Id of order or propal
-$id = $origin_id;
 $ref=GETPOST('ref','alpha');
 
 // Security check
@@ -917,7 +917,7 @@
         }
     }
 }
-else
+else if ($id || $ref)
 /* *************************************************************************** */
 /*                                                                             */
 /* Edit and view mode                                                          */