Dolibarr/dolibarr 24.0.2

on GitHub

FIX: #33502
FIX: #32312
FIX: #36232 : Drop reference to non-existent fk_user_done in events box (#40271)
FIX: #36239 Fix the workstation cost in the manufacturing order cost (#36466)
FIX: #36903 Backport to 20.0: API POST expensereports/{id}/payments always fails (#40711)
FIX: #39680 Disable unavailable BookCal document generation (#39948)
FIX: #40120 Tell the administrator how to recover a table that refuses any new field (#40121)
FIX: #40149 Supplier invoice - Payment report is not accessible
FIX: #40175 Email templates: restore the Private field removed from $tabfield[25] (#40176)
FIX: #40274
FIX: #40277
FIX: #40317 Supplier invoice transferred into accountancy can no longer be deleted (#40370)
FIX: #40325 Customer specific price propagation to subsidiaries was inconsistent between create and delete (#40326)
FIX: #40383 BonPrelevement::create() fires swapped trigger names, amount unset (#40475)
FIX: #40404
FIX: #40407
FIX: #40428 Events/Agenda view for Contacts/Addresses: UNION query column count mismatch (#40477)
FIX: #40450 Various payment clone: apply the bank account chosen in the dialog (#40451)
FIX: #40464 Ticket notification email template setting reset on save (#40465)
FIX: #40630 Documents backup embeds all previous database dumps (#40631)
FIX: #40635 Backup: do not offer compression formats blocked by dolibarr_main_restrict_os_commands (#40636)
FIX: #40714 standalone shipment: show line extrafields (#40715)
FIX: #40883
FIX: #40906 Load balances before scheduled invoice emails (#40929)
FIX: #40907 emailcollector inline images dumped as base64 (php-imap getBoundary) (#41067)
FIX: #40999 Accountancy - Switching from PCG14-DEV to PCG25-DEV loads no account (#41000)
FIX: #41001 Draft receptions counted as received when validating a reception (#41002)
FIX: #41147
FIX: #41223
FIX: ability for a non admin user with permission to set password to know
FIX: Accountancy - Error "Data too long for column 'ref'" on manual transaction ref (#40710)
FIX: activating or disabling prices by quantity on a price level replaced the price of the level by the default price (#41197)
FIX: "Add time spent" link from project's element tab refused by CSRF protection (#40963)
FIX: AdherentType::delete() committed without opening a transaction and left the translations and extrafields of the type (#41200)
FIX: AI assistant fatal on get_product_details (#40463)
FIX: Allow '/' and other chars in lot/serial numbers (stock correction + barcode scan) (#40661)
FIX: Allow choosing supplier when creating purchase order from proposal (#40802)
FIX: Amount base of the depreciation is never displayed, so the plan stays empty (#40295)
FIX: Amount not visible on tooltips and pb of label of cheque
FIX: An email collected on an object without thirdparty ignored the thirdparty of its project (#41109)
FIX: An intervention created from a proposal or an order ignored the translated label of the products (#41183)
FIX: An intervention generated from time spent lost the description of the project (#41185)
FIX: An intervention validated through the API or on closing a ticket got a ref without the customer code (#41189)
FIX: A paid social contribution can be deleted, leaving its bank line alone (#40769)
FIX: A paid supplier invoice can be deleted through the API (#40773)
FIX: A paid VAT declaration can be deleted, leaving its payment and bank line (#40771)
FIX: A photo refused at upload on a member or a contact replaced the photo by a missing file, without any message (#41181)
FIX: API BOM putLine must not accept a line of another BOM (#40526)
FIX: API category link/unlink must check access to the target object (#40525)
FIX: API contract and supplier invoice line endpoints must check the line belongs to the object (#40523)
FIX: API createInvoiceFromContract must check access to the source contract (#40522)
FIX: API DELETE /receptions/{id}/lines/{lineid} called a method that does not exist (#40527)
FIX: API documents: list the files of a supplier invoice (#40759)
FIX: API documents: supplier_invoice/supplier_order modulepart refused to non admin users (#40712)
FIX: API intervention line endpoints must check the line belongs to the intervention (#40524)
FIX: API POST expensereports/{id}/payments: bank line or nothing, report paid once settled (#40756)
FIX: API POST expensereports/{id}/payments: no PHP warning when accountid is missing (#40768)
FIX: API POST salaries/{id}/payments: bank line or nothing, on the salary of the URL (#40766)
FIX: API usage counter never updated when API_IN_TOKEN_TABLE is on (#41154)
FIX: A project with an end date before its start date showed an untranslated error key (#41192)
FIX: a sell price computed from a margin or mark rate is rounded as a unit price, not as a total (#41209)
FIX: Asset dispose()/reopen() PHP warning on null thirdparty with multilangs (#40727)
FIX: Asset module document generation is entirely non-functional (#40663)
FIX: a subscription created with Subscription::create() did not update the end date of the member (#41199)
FIX: A supplier payment higher than the remainder to pay showed an untranslated warning key (#41204)
FIX: Attached files lost from an asset when it is validated (#40431)
FIX: Avoid 500 fatal error when generating a barcode image with an invalid value (#40429)
FIX: Avoid PHP warning when a module declares an unknown permission family (#40422)
FIX: bank: rollback in update_conciliation() when the statement number is refused (#40725)
FIX: Birthday events not loading for the whole week in agenda week view (#40596)
FIX: BonPrelevementTest corrupts global $mysoc's DB connection across the suite (#40518)
FIX: box_lastlogin shows wrong "Last password change" date (1970) (#40134)
FIX: Buying price of a line stored multiplied by 1000 when thousand separator is a dot (#40657)
FIX: cast nullable key/table/label to string in natural_search() sellist subquery (#40157)
FIX: Cast price2num() result to float for mass payment remain to pay
FIX: Cast trim() args to string in Categorie class (PHP 8.1 deprecation) (#40458)
FIX: Cast trim() args to string in ContratLigne::update() (PHP 8.1 deprecation) (#40462)
FIX: Cast trim() args to string in FactureFournisseur::create() (PHP 8.1 deprecation) (#40455)
FIX: Cast trim() args to string in Salary class (PHP 8.1 deprecation) (#40457)
FIX: Cast trim() arg to string in CommandeFournisseur::addline() (PHP 8.1 deprecation) (#40460)
FIX: Cast trim() arg to string in Reception::updatelinefree() (PHP 8.1 deprecation) (#40459)
FIX: Check the user on every invoice reached by the customer payment page (#40396)
FIX: CI
FIX: Computed extrafields are evaluated against the wrong record (#40484)
FIX: Contact par défaut du tiers non ajouté aux tickets #1909 (#40535)
FIX: Contract: close the margin script block on line edit (#40654)
FIX: Create shipment action missing on service-only orders with SHIPMENT_SUPPORTS_SERVICES (#40735)
FIX: CSRF "Token not provided" error on "Classify abandoned" invoice button (backport to 24.0) (#40558)
FIX: defineBuyPrice() ignored line quantity for supplier price ranges (#40632)
FIX: deleting a product lot left its extrafields and its documents and fired no trigger (#41177)
FIX: Deleting a Stripe card of a thirdparty always failed (#41092)
FIX: deleting a user group left its extrafields in database (#41231)
FIX: deleting a user group was allowed with the permission to modify instead of the permission to delete (#41230)
FIX: Depreciation options of an asset cannot be saved from the interface (#40344)
FIX: Document backup fails after a "Clean temporary files" purge (#40470)
FIX: documents API cannot write bank files (requires non-existent banque->creer) (#40723)
FIX: Donation CERFA receipt inserts a spurious "cents" word for any amount whose hundreds digit is 0 (#40602)
FIX: donation payment card always refused and VAT payment card refused to restricted users (#41174)
FIX: Do not generate the signed PDF when the online signature is refused (#41141)
FIX: Draft lists on comm/index.php ignore the configured shortlist size (#40546)
FIX: Drag and drop was broken
FIX: drop always-true left operand of && (phpstan booleanAnd.leftAlwaysTrue) (#40156)
FIX: Duplicate popup id makes both outstanding dialogs open at once (#40751)
FIX: Dynamic property deprecation on SupplierInvoiceLine::$libelle (#40540)
FIX: editing an admin resets its entity to 0 when multicompany is off (#41039)
FIX: emailcollector hook context (#40485)
FIX: Email collector PHP 8 warnings on missing Subject/to/message_id (#40613)
FIX: encrypted key with non ascii char were not correctly decoed
FIX: Event messages are lost on pages defining DISABLE_JQUERY_JNOTIFY (#40551)
FIX: Expense report: tooltip of a line breaking several rules showed a literal \n (#41226)
FIX: Export datasets missing sales-rep / hierarchy scoping (mass IDOR
FIX: External ICS calendars with local time + TZID are never displayed (#40944)
FIX: GeoIP country lookup fails when a City database is used as country datafile (#40180)
FIX: getMultidirOutput() warned and returned a relative path for an entity with no declared directory (#40251)
FIX: Guard the 'filtre' parameter of the supplier invoice list against a missing value (#40392)
FIX: Hide payment fields for zero-price events (#40600)
FIX: HTML entities shown in the popup title of thirdparty outstanding tiles (#40749)
FIX: iCal export: attendees missing and "Undefined array key assignedUsers" warning (#40753)
FIX: import_key of a product lot was quoted with double quotes in SQL (#41187)
FIX: Install button must be Re-install or Upgrade
FIX: Invoices generated from time spent lost the local taxes of the product (#41094)
FIX: Kanban group by: drag and drop answers 403 after a new login (#40697)
FIX: Kanban group by view: drag and drop saved nothing without the deprecated edit in place option
FIX: Keep import icon visible in additional linked object blocks (#40671)
FIX: Keep import icon visible in linked proposal block (#40667)
FIX: Ldap::getAttributeValues() crash when ldap_search() fails (#40978)
FIX: LDAP groups sync: existing groups not found on second run (#40980)
FIX: Leaves auto-validated from a group leave request had no validator (#41093)
FIX: Lost Contract and Project search filters on intervention list (#40748)
FIX: Mailing card inline edits of title/from/replyto/errorsto/unsubscribe never saved (#40568)
FIX: make_substition corrupting nature html/no html when trying to insert
FIX: member setup pages showed a raw translation key when the save failed (#41218)
FIX: Menu "Tools" and its BI entry always shown to external users (#40675)
FIX: Messages into backup tool
FIX: Missing access control on the salary documents (#40430)
FIX: Missing access control on the supplier invoice payment page (#40394)
FIX: Missing access control on the VAT payment page (#40420)
FIX: Missing authorization in core/ajax/mailtemplate.php (IDOR - CWE-862) (#40403)
FIX: Missing authorization in core/ajax/mailtemplate.php lets any authenticated user read arbitrary Website page content (IDOR)
FIX: Missing ownership check on the salary payment page (#40447)
FIX: MO (manufacturing order) REST API list endpoint ignores sales rep customer restriction (#40610)
FIX: Mo::processBOM() ignores qty value for qty_frozen BOM lines (#40263)
FIX: MRP REST API produceAndConsumeAll records produced goods at price 0 (#39942)
FIX: Multiprice export drops products priced in a shared entity (#40270)
FIX: New supplier proposal form never prefills the bank account field (#40607)
FIX: Next date of recurring invoices shifted when the server timezone is ahead of UTC (#41210)
FIX: Octopus invoice PDF model: misleading "Remain to pay" label
FIX: Octopus invoice PDF model: VAT-by-rate table always showing 0%
FIX: opensurvey public page accepted comments when comments are disabled (#41063)
FIX: Opportunity probability set 100x too high on opportunity status change (#40620)
FIX: Order PDF eratosthene/proforma: sender block drawn over the logo when MAIN_PDF_USE_ISO_LOCATION is enabled (#40185)
FIX: packaging rounding of quantities saved wrong amounts on update and lost the sign (#41111)
FIX: Partnerships REST API list endpoint ignores sales rep customer restriction (#40608)
FIX: PaymentLoan::update() assigns trimmed note_private/note_public into note (#40461)
FIX: PDF: keep translating a product description turned into HTML by the editor (#40405)
FIX: Persist member civility when set through the civility_code property (#39992)
FIX: Phan fails on any PR touching htdocs/core/triggers/ (#40967)
FIX: PHP warning on undefined property when showing the currency rate in lists (#40209)
FIX: Possible SSRF in Dolibarr external calendar import via DNS rebinding
FIX: preg_match() called without a subject in make_substitutions() (#40398)
FIX: Productbatch::findAllForProduct() returned the stock of the lots of other products with the same batch number (#41178)
FIX: Product description not refilled into line textarea after a manual edit (#40755)
FIX: product lot card and documents tab did not check the entity of the lot (#41180)
FIX: product lot card: the lifetime field could not be edited and the edit pencils used another permission than the actions (#41176)
FIX: product lots API listed the lots of all entities again and refused updates to restricted users (#41179)
FIX: Product merge moves the attached files only when the merge fails (#40395)
FIX: Prof id pasted with its separator spaces is truncated (SIREN, SIRET) (#39679)
FIX: Project Beluga PDF lists no linked object (#41085)
FIX: Project category AND/OR search operator ignored, and clobbers user category operator (#40567)
FIX: Project documents: linked objects missing from Beluga PDF and ODT (#40408)
FIX: Project extrafield edit link/save broken on Time spent tab (#40617)
FIX: Propagate project contacts with task roles (#40588)
FIX: Proposal list user filter no longer defaults to the current user (#40275)
FIX: prorate situation invoice buy price in progress mode (INVOICE_USE_SITUATION = 2) (#40034)
FIX: public agenda export and website wrapper showed the server path of a file (#41121)
FIX: public agenda export could be served as text/html with any contenttype (#41112)
FIX: public bookcal ajax answered when the module Bookcal is disabled (#41124)
FIX: Public conference/booth vote page never defines $suffix it uses (#40606)
FIX: public intervention export could be served as text/html and showed a server path (#41113)
FIX: Public job application page never defines $entity/$suffix it uses (#40605)
FIX: public job position page accepted applications when disabled and showed drafts (#41108)
FIX: public member subscription form accepted a member type that it does not propose (#41219)
FIX: Public Stripe checkout page breaks silently when Session::create() fails (#40603)
FIX: Quadratic update_price when creating an invoice from an origin (#40280)
FIX: Rang collision on contract line create/delete #1897 (#40219)
FIX: Reactivating Bank, Supplier proposal or Lot/serial module never recreates their dedicated tables (#40638)
FIX: Recruitment job position REST API list endpoint ignores sales rep customer restriction (#40609)
FIX: refresh the buying price when cloning a proposal with "Update prices" (#40946)
FIX: Reject invalid SEPA direct debit sequence types (#40572)
FIX: Release checksum file lists files removed by the buildroot cleanup (#40649)
FIX: reminder of expired subscription used the third party of the previous member for a member without third party (#41198)
FIX: remove all extrafields filters on bank account list for remove filters action (#40323)
FIX: Roll back failed free registration validation (#40599)
FIX: Sales journal keeps only the last deposit when an invoice consumes several (#40375)
FIX: Save resubmitted unpaid attendee details (#40598)
FIX: Security: Authorization bypass in leave API update/create (IDOR) (#40314)
FIX: Security: Authorization Bypass in Project/Task Comment Update/Delete (IDOR) - reported by soulaimane bouabid (#40284)
FIX: security: restore restrictedArea() on payment_vat, donation payment and stocktransfer note pages (#40281)
FIX: Setting TICKET_NOTIFICATION_EMAIL_TEMPLATE was saved but never used (#40961)
FIX: Shipment: service line silently dropped when STOCK_DISALLOW_NEGATIVE_TRANSFER is set (#40496)
FIX: SQL syntax when validating a conference (#40601)
FIX: Stock at date: label the Movements column and show the record count
FIX: stock transfer card and tabs did not check the entity nor the third party of the record (#41175)
FIX: stock transfer PDF eagle, untranslated null weight/volume total (#40970)
FIX: stock transfer PDF eagle, warehouse label overlaps next line (#40969)
FIX: [stocktransfer] PDF models load a lang file that doesn't exist (#40972)
FIX: subscriptions API and member subscription endpoints did not check the entity of the member (#41214)
FIX: Subtotals - escape line description when rendered in templates (#39971)
FIX: Subtotals: no 'Total incl. tax' printed on title and subtotal lines of PDF (#40641)
FIX: Subtotals: supplier order and invoice PDFs print line values on title lines (#40694)
FIX: Supplier invoices created from receptions lost local taxes, service dates and product type (#41104)
FIX: Supplier invoices point-of-tax date (#40329)
FIX: Supplier order is not classified billed when documents use a foreign currency (#40178)
FIX: switch of birthday events not working in some cases in the agenda
FIX: the ajax price lookup accepted a price by quantity of another product (#41221)
FIX: The "Cancel" mass action on a non validated order showed an untranslated error key (#41203)
FIX: The confirmation of the deletion of a reception had an untranslated title (#41205)
FIX: The customer prices tab of a thirdparty lost its filters when changing page (#41161)
FIX: the end date of a member was the end of its last started subscription instead of its latest end (#41217)
FIX: The error branch of the member and contact photo upload was unreachable (#40087)
FIX: The HRM comparison never showed the job of the users (#41102)
FIX: the language of the member was ignored in the emails sent to the member (#41212)
FIX: The linked objects block never showed the end date of a task (#41101)
FIX: The margin rate alerts of a new line showed HTML entities (#41191)
FIX: The order list showed an untranslated key when the stock is not enough for all orders (#41206)
FIX: The partnership list never showed that a member subscription was not received (#41105)
FIX: The Partnerships tab of a member listed the partnerships of all members (#41107)
FIX: The Partnerships tab of a member showed an empty banner and login (#41106)
FIX: The payment of a loan never preselected the bank account of the loan (#41098)
FIX: The public payment page of a donation never showed the company name (#41099)
FIX: The reception PDF squille never showed the supplier ref of the order (#41096)
FIX: The reception PDF squille never showed the tracking link (#41095)
FIX: the reminder email of an expired subscription ignored the language of the member (#41232)
FIX: The replenishment always counted the draft supplier orders, whatever the checkbox (#41190)
FIX: The "Send by email" mass action on a draft proposal or order showed an untranslated error key (#41202)
FIX: The supplier ref column of the invoices of a credit transfer order was always empty (#41184)
FIX: The thumbnails of an AVIF image were generated at the lowest quality (#41193)
FIX: Third-party autocomplete broken by a LIMIT placed before ORDER BY (#40278)
FIX: Ticket::update() overwrites timing with type/category/severity_code instead of trimming them (#40355)
FIX: Town, Zip and State search filters of the contract list (#41052)
FIX: Translate::load() keeps $forceloadifalreadynotfound in fallback calls (#40747)
FIX: trim() on a null value when importing an empty cell from a xlsx file (#40391)
FIX: Typo in incoterm location parameter (#40297)
FIX: Undefined array key "imagebackground" in admin/ihm.php (#40160)
FIX: Undefined array key warning on task extrafield search filters in project's task tab (#40616)
FIX: Undefined array key warnings on advtargetemailing.php's filter form (#40513)
FIX: Undefined property stdClass::$fk_user_assign on ticket assignment (#40691)
FIX: Undefined variables $customer and $charge on each Stripe online payment (#41164)
FIX: Undefined variable warnings on the public event booth/conference suggestion forms (#40604)
FIX: Unit price incl. tax shows price excl. tax on option lines (#40511)
FIX: Update AGENTS.md PR description limit and security convention (#40334)
FIX: user creation ignores backtopage (#40493)
FIX: users with the unalterable log read right get "access forbidden" on the file check pages (#40795)
FIX: Warning on task edit form when the project has no third party (#40498)
FIX: warnings on the pages of a direct debit or credit transfer order not found (#41125)
FIX: with prices by quantity and by level, the price of the level of the customer was ignored when no quantity price is selected (#41196)
FIX: Wrong page number on setPage() when a subtotals line starts below the break margin (#40543)
FIX: zstd backup dump is written uncompressed despite the .zst extension (#40336)
FIX: zstd compression always results in a false positive error message (#40315)
FIX: type is forced by MEMBER_NEWFORM_FORCETYPE, the type posted is already ignored