Merge remote-tracking branch 'upstream/develop' into zapier

COPYRIGHT

@@ -13,7 +13,7 @@ Component              Version       License                     GPL Compatible
 -------------------------------------------------------------------------------------
 PHP libraries:
 AdoDb-Date             0.36          Modified BSD License        Yes             Date convertion (not into rpm package)
-CKEditor               4.11.4        LGPL-2.1+                   Yes             Editor WYSIWYG
+CKEditor               4.12.1        LGPL-2.1+                   Yes             Editor WYSIWYG
 EvalMath               1.0           BSD                         Yes             Safe math expressions evaluation
 Escpos-php             ?             MIT License                 Yes             Thermal receipt printer library, for use with ESC/POS compatible printers
 GeoIP                  1.4           LGPL-2.1+                   Yes             Sample code to make geoip convert (not into deb package)

ChangeLog

@@ -20,8 +20,110 @@ Following changes may create regressions for some external modules, but were nec
 * The deprecated method get_OutstandingBill has been removed. You can use getOutstandingBills() instead.
 * The hook "moreFamily" must return payment into var "totalpayment" and no more "paiement" (english replace french).
 * Removed deprecated method actioncomm->add(), use create() instead
+* If you have developed your own emailing target selector and used parent::add_to_target(...), you must now use parent::addToTargets(...)
+* Removed function dol_micro_time. Use native PHP microtime instead.
 
 
+***** ChangeLog for 10.0.2 compared to 10.0.1 *****
+
+FIX: #10460 compatibility with MariaDB 10.4
+FIX: #11401 Adherent unknown language key
+FIX: #11422 Can't edit his own events with standard rights
+FIX: #11427 require product class (fixes POST /supplierinvoices REST API endpoint)
+FIX: #11570
+FIX: #11591 FIX: #11592
+FIX: #11671 CVE-2019-15062
+FIX: #11672
+FIX: #11685
+FIX: #11702
+FIX: #11711
+FIX: #11720
+FIX: #11746 Unable to modify amount of insurance of a loan
+FIX: #11752
+FIX: #11789 FIX: #11790
+FIX: #11804 list of tickets from a customer card display ALL tickets
+FIX: #11834
+FIX: Add char $ and ; in sanitizing of filenames.
+FIX: Add comment before protected functions
+FIX: Add log and type of content in dolWebsiteOutput and
+FIX: Add repair.php option 'restore' to restore user picture after v10
+FIX: amount opened on thirdparty card dont care of credit note not converted
+FIX: Api of documents work with value 'thirdparty'
+FIX: author in message / ticket API
+FIX: avoid sql error if fk_project is empty during update
+FIX: avoid Warning: A non-numeric value encountered
+FIX: bad consistency in list of invoice for direct debit order.
+FIX: Bad error management in zip compress and web site export
+FIX: bad substitution for extrafields type checkbox
+FIX: better help message with multicompany
+FIX: calculation of $products_dispatched
+FIX: Can't add a new chart of account
+FIX: Can't delete a draft leave even if it should
+FIX: Can't save setup of mailman module
+FIX: column jabberid missing
+FIX: Confirmation of deletion
+FIX: Consistency in direct debit order lists.
+FIX: Content send before header warning
+FIX: credit note can be split
+FIX: credit note used on list
+FIX: Css was saved on wrong website.
+FIX: delivery extrafields
+FIX: Disabling a website does not put it offline
+FIX: display only stripe sources for customer
+FIX: display payment intent in stripe's charge list
+FIX: document list for products in API
+FIX: dol_thirdparty_id for stripe PI
+FIX: Do not show tooltip if tooltip is empty
+FIX: duplicate css tag, decrease padding-bottom for boxes in eldy theme
+FIX: duration when creating service
+FIX: EDB-ID:47370
+FIX: Enable web site
+FIX: error management when adding a property with type real
+FIX: Fatal situation if payment removed on expense report. Action
+FIX: filepath of generated documents doesn't handle products with special characters
+FIX: for MAIN_MAXTABS_IN_CARD = $i card
+FIX: gzip and bzip2 must use option -f
+FIX: It was possible to create cashfence without entering data.
+FIX: javascript error when using dol_use_jmobile=1
+FIX: logout redirect to takepos.php
+FIX: Look and feel v10
+FIX: Make protected all pfd models functions
+FIX: management of extrafields in modulebuilder
+FIX: Missing div for buttons in tax, loan, various payment modules
+FIX: missing include (dol_convert_file not found)
+FIX: Missing some replacements in website module
+FIX: missing test on permission on button to delete ledger record
+FIX: Missing the filter fields in export of expense report and leaves
+FIX: Missing ticket icon on md theme
+FIX: Missing transaction
+FIX: Mode smartphone was not triggered when there is too loo menu
+FIX: Must escape shell
+FIX: Must exclude logs and some dirs for compressed backup
+FIX: name and position of hook FIX: #11710
+FIX: Not showing MAIN_INVERT_SENDER_RECIPIENT when edit field
+FIX: Nowrap missing on amount in boxes
+FIX: Option to use ZipArchive instead of PclZip bugged with large files.
+FIX: order or proposals billed if both workflow conf activated
+FIX: permission check on API intervention
+FIX: phpcs
+FIX: placement function
+FIX: qty in invoice list on product's stats
+FIX: remove disabled product type from product list
+FIX: Return code of pdf_einstein.modules.php and proformat
+FIX: round for application fee in stripe
+FIX: Sens of the balance (Debit - Credit in accountancy not contrary)
+FIX: Several pb in export of documents
+FIX: SQL syntax error and CSRF check on vat reports
+FIX: takepos layout clear or focus search
+FIX: too many record in sql request. Whena criteria is a filter, we must
+FIX: Translation of month
+FIX: USEDOLIBARREDITOR not always set
+FIX: VAT number for Monaco (it uses FR)
+FIX: vulenrability in uploading file found by 美创科技安全实验室
+FIX: wrong display (and hidden input) for already dispatched quantity
+FIX: wrong parameters (same error in branch 9, 10, develop)
+FIX: Wrong variable. Must be PROJECT_HIDE_UNSELECTABLES
+
 ***** ChangeLog for 10.0.1 compared to 10.0.0 *****
 FIX: #10930
 FIX: #10984 

build/doxygen/doxygen_footer.html

@@ -10,7 +10,6 @@
 
 <br>
 
-</div>
 
 
 <!-- Global site tag (gtag.js) - Google Analytics -->
@@ -24,13 +23,30 @@
 </script>
 
 
+<!-- Facebook Pixel Code -->
+<script>
+!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?
+n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;
+n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;
+t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,
+document,'script','//connect.facebook.net/en_US/fbevents.js');
+
+fbq('init', '1998533953704960');
+fbq('track', "PageView");</script>
+<noscript><img height="1" width="1" style="display:none"
+src="https://www.facebook.com/tr?id=1998533953704960&ev=PageView&noscript=1"
+/></noscript>
+<!-- End Facebook Pixel Code -->
+
+
 <!-- Twitter ad collector -->
-<script src="//platform.twitter.com/oct.js" type="text/javascript"></script>
+<script src="//static.ads-twitter.com/oct.js" type="text/javascript"></script>
 <script type="text/javascript">twttr.conversion.trackPid('ntm4n', { tw_sale_amount: 0, tw_order_quantity: 0 });</script>
 <noscript>
 <img height="1" width="1" style="display:none;" alt="" src="https://analytics.twitter.com/i/adsct?txn_id=ntm4n&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />
 <img height="1" width="1" style="display:none;" alt="" src="//t.co/i/adsct?txn_id=ntm4n&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />
 </noscript>
 
+
 </body>
 </html>

build/doxygen/doxygen_header.html

@@ -30,7 +30,6 @@
 </head>
 
 <body>
-<div id="top">
 
 <div class="topmaincol">
 <div class="divpath">

htdocs/accountancy/bookkeeping/balance.php

@@ -1,7 +1,7 @@
 <?php
 /* Copyright (C) 2016       Olivier Geffroy         <jeff@jeffinfo.com>
  * Copyright (C) 2016       Florian Henry           <florian.henry@open-concept.pro>
- * Copyright (C) 2016-2018  Alexandre Spangaro      <aspangaro@open-dsi.fr>
+ * Copyright (C) 2016-2019  Alexandre Spangaro      <aspangaro@open-dsi.fr>
  * Copyright (C) 2018       Frédéric France         <frederic.france@netlogic.fr>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -164,7 +164,7 @@
 		print $object->get_compte_desc($line->numero_compte) . $sep;
 		print price($line->debit) . $sep;
 		print price($line->credit) . $sep;
-		print price($line->credit - $line->debit) . $sep;
+		print price($line->debit - $line->credit) . $sep;
 		print "\n";
 	}
 
@@ -293,9 +293,9 @@
 
 		print '<td>' . length_accountg($line->numero_compte) . '</td>';
 		print '<td>' . $description . '</td>';
-		print '<td class="right">' . price($line->debit) . '</td>';
-		print '<td class="right">' . price($line->credit) . '</td>';
-		print '<td class="right">' . price($line->credit - $line->debit) . '</td>';
+		print '<td class="nowraponall right">' . price($line->debit) . '</td>';
+		print '<td class="nowraponall right">' . price($line->credit) . '</td>';
+		print '<td class="nowraponall right">' . price($line->debit - $line->credit) . '</td>';
 		print '<td class="center">' . $link;
 		print '</td>';
 		print "</tr>\n";
@@ -305,11 +305,11 @@
 		$sous_total_credit += $line->credit;
 	}
 
-	print '<tr class="liste_total"><td class="right" colspan="2">' . $langs->trans("SubTotal") . ':</td><td class="nowrap right">' . price($sous_total_debit) . '</td><td class="nowrap right">' . price($sous_total_credit) . '</td><td class="nowrap right">' . price(price2num($sous_total_credit - $sous_total_debit)) . '</td>';
+	print '<tr class="liste_total"><td class="right" colspan="2">' . $langs->trans("SubTotal") . ':</td><td class="nowrap right">' . price($sous_total_debit) . '</td><td class="nowrap right">' . price($sous_total_credit) . '</td><td class="nowrap right">' . price(price2num($sous_total_debit - $sous_total_credit)) . '</td>';
 	print "<td>&nbsp;</td>\n";
 	print '</tr>';
 
-	print '<tr class="liste_total"><td class="right" colspan="2">' . $langs->trans("AccountBalance") . ':</td><td class="nowrap right">' . price($total_debit) . '</td><td class="nowrap right">' . price($total_credit) . '</td><td class="nowrap right">' . price(price2num($total_credit - $total_debit)) . '</td>';
+	print '<tr class="liste_total"><td class="right" colspan="2">' . $langs->trans("AccountBalance") . ':</td><td class="nowrap right">' . price($total_debit) . '</td><td class="nowrap right">' . price($total_credit) . '</td><td class="nowrap right">' . price(price2num($total_debit - $total_credit)) . '</td>';
 	print "<td>&nbsp;</td>\n";
 	print '</tr>';
 

htdocs/adherents/class/adherent.class.php

@@ -1740,8 +1740,7 @@ public function subscriptionComplementaryActions($subscriptionid, $option, $acco
 				$paiement->datepaye     = $paymentdate;
 				$paiement->amounts      = $amounts;
 				$paiement->paiementid   = dol_getIdFromCode($this->db, $operation, 'c_paiement', 'code', 'id', 1);
-				$paiement->num_paiement = $num_chq;
-				$paiement->note         = $label;
+				$paiement->num_payment  = $num_chq;
 				$paiement->note_public  = $label;
 
 				if (! $error)
@@ -2072,10 +2071,8 @@ public function getNomUrl($withpictoimg = 0, $maxlen = 0, $option = 'card', $mod
 
 		if (! empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER) && $withpictoimg) $withpictoimg=0;
 
-		$notooltip=0;
-
 		$result=''; $label='';
-		$link=''; $linkstart=''; $linkend='';
+		$linkstart=''; $linkend='';
 
 		if (! empty($this->photo))
 		{
@@ -2108,7 +2105,7 @@ public function getNomUrl($withpictoimg = 0, $maxlen = 0, $option = 'card', $mod
 			if ($add_save_lastsearch_values) $url.='&save_lastsearch_values=1';
 		}
 
-		$link = '<a href="'.$url.'"';
+		$linkstart.= '<a href="'.$url.'"';
 		$linkclose="";
 		if (empty($notooltip))
 		{
@@ -2122,10 +2119,10 @@ public function getNomUrl($withpictoimg = 0, $maxlen = 0, $option = 'card', $mod
 			$linkclose.= ' class="classfortooltip'.($morecss?' '.$morecss:'').'"';
 		}
 
-		$link.=$linkclose.'>';
+		$linkstart.=$linkclose.'>';
 		$linkend='</a>';
 
-		$result.=$link;
+		$result.=$linkstart;
 		if ($withpictoimg) $result.='<div class="inline-block nopadding valignmiddle">';
 		if ($withpictoimg)
 		{

htdocs/adherents/class/adherent_type.class.php

@@ -424,7 +424,7 @@ public function getmorphylib($morphy = '')
 		global $langs;
 		if ($morphy == 'phy') { return $langs->trans("Physical"); }
 		elseif ($morphy == 'mor') { return $langs->trans("Moral"); }
-        else return $langs->trans("Physical & Morale");
+        else return $langs->trans("MorPhy");
 		//return $morphy;
 	}
 

htdocs/adherents/list.php

@@ -261,7 +261,7 @@
 $parameters=array();
 $reshook=$hookmanager->executeHooks('printFieldListSelect', $parameters);    // Note that $action and $object may have been modified by hook
 $sql.=preg_replace('/^,/', '', $hookmanager->resPrint);
-$sql =preg_replace('/, $/', '', $sql);
+$sql =preg_replace('/,\s*$/', '', $sql);
 $sql.= " FROM ".MAIN_DB_PREFIX."adherent as d";
 if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label'])) $sql.= " LEFT JOIN ".MAIN_DB_PREFIX.$object->table_element."_extrafields as ef on (d.rowid = ef.fk_object)";
 if (! empty($search_categ) || ! empty($catid)) $sql.= ' LEFT JOIN '.MAIN_DB_PREFIX."categorie_member as cm ON d.rowid = cm.fk_member"; // We need this table joined to the select in order to filter by categ

htdocs/adherents/type.php

@@ -283,7 +283,7 @@
             print '<td class="center">';
 			if ($objp->morphy == 'phy') { print $langs->trans("Physical"); }
 			elseif ($objp->morphy == 'mor') { print $langs->trans("Moral"); }
-			else print $langs->trans("Physical & Morale");
+			else print $langs->trans("MorPhy");
             print '</td>';
 			print '<td class="center">'.yn($objp->subscription).'</td>';
 			print '<td class="center">'.yn($objp->vote).'</td>';

htdocs/admin/dict.php

@@ -204,7 +204,7 @@
 $tabsql[29]= "SELECT rowid   as rowid, code, label, percent, position, active FROM ".MAIN_DB_PREFIX."c_lead_status";
 $tabsql[30]= "SELECT rowid, code, name, paper_size, orientation, metric, leftmargin, topmargin, nx, ny, spacex, spacey, width, height, font_size, custom_x, custom_y, active FROM ".MAIN_DB_PREFIX."c_format_cards";
 //$tabsql[31]= "SELECT s.rowid as rowid, pcg_version, s.label, s.active FROM ".MAIN_DB_PREFIX."accounting_system as s";
-$tabsql[32]= "SELECT a.id    as rowid, a.entity, a.code, a.fk_country as country_id, c.code as country_code, c.label as country, a.day, a.month, a.year, a.active FROM ".MAIN_DB_PREFIX."c_hrm_public_holiday as a LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON a.fk_country=c.rowid AND c.active=1";
+$tabsql[32]= "SELECT a.id    as rowid, a.entity, a.code, a.fk_country as country_id, c.code as country_code, c.label as country, a.dayrule, a.day, a.month, a.year, a.active FROM ".MAIN_DB_PREFIX."c_hrm_public_holiday as a LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON a.fk_country=c.rowid AND c.active=1";
 $tabsql[33]= "SELECT rowid, pos, code, label, active FROM ".MAIN_DB_PREFIX."c_hrm_department";
 $tabsql[34]= "SELECT rowid, pos, code, label, c_level, active FROM ".MAIN_DB_PREFIX."c_hrm_function";
 $tabsql[35]= "SELECT c.rowid, c.label, c.active, c.entity FROM ".MAIN_DB_PREFIX."c_exp_tax_cat c";
@@ -244,7 +244,7 @@
 $tabsqlsort[29]="position ASC";
 $tabsqlsort[30]="code ASC";
 //$tabsqlsort[31]="pcg_version ASC";
-$tabsqlsort[32]="year ASC, month ASC, day ASC";
+$tabsqlsort[32]="country, year ASC, month ASC, day ASC";
 $tabsqlsort[33]="code ASC";
 $tabsqlsort[34]="code ASC";
 $tabsqlsort[35]="c.label ASC";
@@ -284,7 +284,7 @@
 $tabfield[29]= "code,label,percent,position";
 $tabfield[30]= "code,name,paper_size,orientation,metric,leftmargin,topmargin,nx,ny,spacex,spacey,width,height,font_size,custom_x,custom_y";
 //$tabfield[31]= "pcg_version,label";
-$tabfield[32]= "code,year,month,day,country_id,country";
+$tabfield[32]= "code,dayrule,year,month,day,country_id,country";
 $tabfield[33]= "code,label";
 $tabfield[34]= "code,label";
 $tabfield[35]= "label";
@@ -324,7 +324,7 @@
 $tabfieldvalue[29]= "code,label,percent,position";
 $tabfieldvalue[30]= "code,name,paper_size,orientation,metric,leftmargin,topmargin,nx,ny,spacex,spacey,width,height,font_size,custom_x,custom_y";
 //$tabfieldvalue[31]= "pcg_version,label";
-$tabfieldvalue[32]= "code,day,month,year,country";
+$tabfieldvalue[32]= "code,dayrule,day,month,year,country";
 $tabfieldvalue[33]= "code,label";
 $tabfieldvalue[34]= "code,label";
 $tabfieldvalue[35]= "label";
@@ -365,7 +365,7 @@
 $tabfieldinsert[30]= "code,name,paper_size,orientation,metric,leftmargin,topmargin,nx,ny,spacex,spacey,width,height,font_size,custom_x,custom_y";
 //$tabfieldinsert[31]= "pcg_version,label";
 //$tabfieldinsert[32]= "code,label,range_account,sens,category_type,formula,position,fk_country";
-$tabfieldinsert[32]= "code,day,month,year,fk_country";
+$tabfieldinsert[32]= "code,dayrule,day,month,year,fk_country";
 $tabfieldinsert[33]= "code,label";
 $tabfieldinsert[34]= "code,label";
 $tabfieldinsert[35]= "label";
@@ -487,7 +487,7 @@
 $tabhelp[29] = array('code'=>$langs->trans("EnterAnyCode"), 'percent'=>$langs->trans("OpportunityPercent"), 'position'=>$langs->trans("PositionIntoComboList"));
 $tabhelp[30] = array('code'=>$langs->trans("EnterAnyCode"), 'name'=>$langs->trans("LabelName"), 'paper_size'=>$langs->trans("LabelPaperSize"));
 //$tabhelp[31] = array('pcg_version'=>$langs->trans("EnterAnyCode"));
-$tabhelp[32] = array('code'=>$langs->trans("EnterAnyCode"), 'daterule'=>"Use 'date'", 'country'=>$langs->trans("EnterACountryOnlyIfSpecificToOneCountry"), 'year'=>$langs->trans("ZeroMeansEveryYear"));
+$tabhelp[32] = array('code'=>$langs->trans("EnterAnyCode"), 'dayrule'=>"Keep empty for a date defined with month and day (most common case).<br>Use a keyword like 'easter', 'eastermonday', ... for a date predefined by complex rules.", 'country'=>$langs->trans("EnterACountryOnlyIfSpecificToOneCountry"), 'year'=>$langs->trans("ZeroMeansEveryYear"));
 $tabhelp[33] = array('code'=>$langs->trans("EnterAnyCode"));
 $tabhelp[34] = array('code'=>$langs->trans("EnterAnyCode"));
 $tabhelp[35] = array();

htdocs/categories/class/categorie.class.php

@@ -746,13 +746,19 @@ public function del_type($obj, $type)
 	/**
 	 * Return list of fetched instance of elements having this category
 	 *
-	 * @param   string     $type       Type of category ('customer', 'supplier', 'contact', 'product', 'member')
-	 * @param   int        $onlyids    Return only ids of objects (consume less memory)
-	 * @return  array|int              -1 if KO, array of instance of object if OK
+	 * @param   string     	$type       Type of category ('customer', 'supplier', 'contact', 'product', 'member')
+	 * @param   int        	$onlyids    Return only ids of objects (consume less memory)
+	 * @param	int			$limit		Limit
+	 * @param	int			$offset		Offset
+	 * @param	string		$sortfield	Sort fields
+	 * @param	string		$sortorder	Sort order ('ASC' or 'DESC');
+	 * @return  array|int              	-1 if KO, array of instance of object if OK
 	 * @see containsObject()
 	 */
-	public function getObjectsInCateg($type, $onlyids = 0)
+	public function getObjectsInCateg($type, $onlyids = 0, $limit = 0, $offset = 0, $sortfield = '', $sortorder = 'ASC')
 	{
+		global $user;
+
 		$objs = array();
 
 		$obj = new $this->MAP_OBJ_CLASS[$type]( $this->db );
@@ -761,8 +767,15 @@ public function getObjectsInCateg($type, $onlyids = 0)
 		$sql .= " FROM " . MAIN_DB_PREFIX . "categorie_" . $this->MAP_CAT_TABLE[$type] . " as c";
 		$sql .= ", " . MAIN_DB_PREFIX . $this->MAP_OBJ_TABLE[$type] . " as o";
 		$sql .= " WHERE o.entity IN (" . getEntity($obj->element).")";
-		$sql.= " AND c.fk_categorie = ".$this->id;
+		$sql .= " AND c.fk_categorie = ".$this->id;
 		$sql .= " AND c.fk_" . $this->MAP_CAT_FK[$type] . " = o.rowid";
+		// Protection for external users
+		if (($type == 'customer' || $type == 'supplier') && $user->societe_id > 0)
+		{
+			$sql.= " AND o.rowid = ".$user->societe_id;
+		}
+		if ($limit > 0 || $offset > 0)  $sql .= $this->db->plimit($limit + 1, $offset);
+		$sql .= $this->db->order($sortfield, $sortorder);
 
 		dol_syslog(get_class($this)."::getObjectsInCateg", LOG_DEBUG);
 		$resql = $this->db->query($sql);