From 27ac538e74d88965c1398bc2b8b824eb105a925e Mon Sep 17 00:00:00 2001
From: "Laurent Destailleur (aka Eldy)" <eldy@destailleur.fr>
Date: Wed, 18 Dec 2024 15:54:48 +0100
Subject: [PATCH 01/10] Fix security. Make bypass of checkPHPCode more
 difficult

---
 htdocs/core/lib/website2.lib.php | 34 ++++++++++++++++++++------------
 test/phpunit/WebsiteTest.php     | 20 +++++++++++++++----
 2 files changed, 37 insertions(+), 17 deletions(-)

diff --git a/htdocs/core/lib/website2.lib.php b/htdocs/core/lib/website2.lib.php
index 8ed23b7d88b63..ef67cd4ca0424 100644
--- a/htdocs/core/lib/website2.lib.php
+++ b/htdocs/core/lib/website2.lib.php
@@ -694,8 +694,8 @@ function showWebsiteTemplates(Website $website)
 
 /**
  * Check a new string containing only php code (including <php tag)
- * - Block if bad code in the new string.
- * - Block also if user has no permission to change PHP code.
+ * - Block if user has no permission to change PHP code.
+ * - Block also if bad code found in the new string.
  *
  * @param	string		$phpfullcodestringold		PHP old string (before the change). For example "<?php echo 'a' ?><php echo 'b' ?>"
  * @param	string		$phpfullcodestring			PHP new string. For example "<?php echo 'a' ?><php echo 'c' ?>"
@@ -742,21 +742,21 @@ function checkPHPCode(&$phpfullcodestringold, &$phpfullcodestring)
 		$forbiddenphpmethods = array('invoke', 'invokeArgs');	// Method of ReflectionFunction to execute a function
 
 		foreach ($forbiddenphpstrings as $forbiddenphpstring) {
-			if (preg_match('/'.preg_quote($forbiddenphpstring, '/').'/ms', $phpfullcodestring)) {
+			if (preg_match('/'.preg_quote($forbiddenphpstring, '/').'/ims', $phpfullcodestring)) {
 				$error++;
 				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", $forbiddenphpstring), null, 'errors');
 				break;
 			}
 		}
-		foreach ($forbiddenphpfunctions as $forbiddenphpcommand) {
-			if (preg_match('/'.$forbiddenphpcommand.'\s*\(/ms', $phpfullcodestring)) {
+		foreach ($forbiddenphpfunctions as $forbiddenphpfunction) {
+			if (preg_match('/'.$forbiddenphpfunction.'\s*\(/ims', $phpfullcodestring)) {
 				$error++;
-				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", $forbiddenphpcommand), null, 'errors');
+				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", $forbiddenphpfunction), null, 'errors');
 				break;
 			}
 		}
 		foreach ($forbiddenphpmethods as $forbiddenphpmethod) {
-			if (preg_match('/->'.$forbiddenphpmethod.'/ms', $phpfullcodestring)) {
+			if (preg_match('/->'.$forbiddenphpmethod.'/ims', $phpfullcodestring)) {
 				$error++;
 				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", $forbiddenphpmethod), null, 'errors');
 				break;
@@ -764,14 +764,14 @@ function checkPHPCode(&$phpfullcodestringold, &$phpfullcodestring)
 		}
 	}
 
-	// This char can be used to execute RCE for example using with echo `ls`
+	// This char can be used to execute RCE for example by using  echo `ls`
 	if (!$error) {
 		$forbiddenphpchars = array();
 		if (!getDolGlobalString('WEBSITE_PHP_ALLOW_DANGEROUS_CHARS')) {    // If option is not on, we disallow functions to execute commands
 			$forbiddenphpchars = array("`");
 		}
 		foreach ($forbiddenphpchars as $forbiddenphpchar) {
-			if (preg_match('/'.$forbiddenphpchar.'/ms', $phpfullcodestring)) {
+			if (preg_match('/'.$forbiddenphpchar.'/ims', $phpfullcodestring)) {
 				$error++;
 				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", $forbiddenphpchar), null, 'errors');
 				break;
@@ -779,17 +779,25 @@ function checkPHPCode(&$phpfullcodestringold, &$phpfullcodestring)
 		}
 	}
 
-	// Deny dynamic functions '${a}('  or  '$a[b]('  => So we refuse '}('  and  ']('
+	// Deny code to call a function obfuscated with comment, like  "exec/*...*/ ('ls')";
 	if (!$error) {
-		if (preg_match('/[}\]]\(/ims', $phpfullcodestring)) {
+		if (preg_match('/\*\/\s*\(/ims', $phpfullcodestring)) {
+				$error++;
+				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", $forbiddenphpmethod), null, 'errors');
+		}
+	}
+
+	// Deny dynamic functions  '${a}('  or  '$a[b]('  => So we refuse '}('  and  ']('
+	if (!$error) {
+		if (preg_match('/[}\]]\s*\(/ims', $phpfullcodestring)) {
 			$error++;
 			setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", ']('), null, 'errors');
 		}
 	}
 
-	// Deny dynamic functions '$xxx('
+	// Deny dynamic functions '$xxx(' or '$xxx ('  or '$xxx" ('
 	if (!$error) {
-		if (preg_match('/\$[a-z0-9_\-\/\*]+\(/ims', $phpfullcodestring)) {
+		if (preg_match('/\$[a-z0-9_\-\/\*\"]+\s*\(/ims', $phpfullcodestring)) {
 			$error++;
 			setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", '$...('), null, 'errors');
 		}
diff --git a/test/phpunit/WebsiteTest.php b/test/phpunit/WebsiteTest.php
index 6ccccb17b23cd..a067202ef85fc 100644
--- a/test/phpunit/WebsiteTest.php
+++ b/test/phpunit/WebsiteTest.php
@@ -65,11 +65,11 @@
 	print "Load permissions for admin user nb 1\n";
 	$user->fetch(1);
 	$user->loadRights();
-
-	if (empty($user->rights->website)) {
-		$user->rights->website = new stdClass();
-	}
 }
+if (empty($user->rights->website)) {
+	$user->rights->website = new stdClass();
+}
+
 $conf->global->MAIN_DISABLE_ALL_MAILS = 1;
 
 
@@ -143,6 +143,18 @@ public function testCheckPHPCode()
 		print __METHOD__." result checkPHPCode=".$result."\n";
 		$this->assertEquals($result, 1, 'checkPHPCode did not detect the string was dangerous');
 
+		$t = '';
+		$s = '<?php eXec  ("eee"); ?>';
+		$result = checkPHPCode($t, $s);
+		print __METHOD__." result checkPHPCode=".$result."\n";
+		$this->assertEquals($result, 1, 'checkPHPCode did not detect the string was dangerous');
+
+		$t = '';
+		$s = '<?php $a="xec"; "e$a" ("ee"); ?>';
+		$result = checkPHPCode($t, $s);
+		print __METHOD__." result checkPHPCode=".$result."\n";
+		$this->assertEquals($result, 1, 'checkPHPCode did not detect the string was dangerous');
+
 		$t = '';
 		$s = '<?php $_="{"; $_=($_^"<").($_^">;").($_^"/"); ?><?=${\'_\'.$_}["_"](${\'_\'.$_}["__"]);?>';
 		$result = checkPHPCode($t, $s);

From 23a0c427ea96fb085761fef9cc2f20d2d1845c73 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20FRANCE?= <frederic.france@free.fr>
Date: Wed, 18 Dec 2024 17:56:41 +0100
Subject: [PATCH 02/10] fix CI

---
 htdocs/imports/import.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/imports/import.php b/htdocs/imports/import.php
index 4d42caf99def5..b66cfc1f399f4 100644
--- a/htdocs/imports/import.php
+++ b/htdocs/imports/import.php
@@ -375,7 +375,7 @@
 			$label = $objimport->array_import_label[$key];
 			print '<div class="twolinesmax-normallineheight minwidth200onall">';
 			print img_object($objimport->array_import_module[$key]['module']->getName(), $entityicon, 'class="pictofixedwidth"');
-			print dolPrintHtml($label);
+			print dolPrintHTML($label);
 			print '</div>';
 			print '</td><td style="text-align: right">';
 			if ($objimport->array_import_perms[$key]) {

From 6145b2acef3dec5799d7c29b307ec374a3842f10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20FRANCE?= <frederic.france@free.fr>
Date: Wed, 18 Dec 2024 18:01:13 +0100
Subject: [PATCH 03/10] fix CI

---
 htdocs/core/lib/website2.lib.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/core/lib/website2.lib.php b/htdocs/core/lib/website2.lib.php
index ef67cd4ca0424..01abafc8a113b 100644
--- a/htdocs/core/lib/website2.lib.php
+++ b/htdocs/core/lib/website2.lib.php
@@ -783,7 +783,7 @@ function checkPHPCode(&$phpfullcodestringold, &$phpfullcodestring)
 	if (!$error) {
 		if (preg_match('/\*\/\s*\(/ims', $phpfullcodestring)) {
 				$error++;
-				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", $forbiddenphpmethod), null, 'errors');
+				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", $phpfullcodestring), null, 'errors');
 		}
 	}
 

From 55fe6f9caa2f22dc66e55c3f6e6d50060322598d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20FRANCE?= <frederic.france@free.fr>
Date: Wed, 18 Dec 2024 18:06:08 +0100
Subject: [PATCH 04/10] fix CI

---
 htdocs/core/lib/website2.lib.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/core/lib/website2.lib.php b/htdocs/core/lib/website2.lib.php
index 01abafc8a113b..18b55bc4a3244 100644
--- a/htdocs/core/lib/website2.lib.php
+++ b/htdocs/core/lib/website2.lib.php
@@ -783,7 +783,7 @@ function checkPHPCode(&$phpfullcodestringold, &$phpfullcodestring)
 	if (!$error) {
 		if (preg_match('/\*\/\s*\(/ims', $phpfullcodestring)) {
 				$error++;
-				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", $phpfullcodestring), null, 'errors');
+				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", "exec/*...*/ ('ls')"), null, 'errors');
 		}
 	}
 

From 7f4b2b08b44757fb5a66129021f1e854a5fa792b Mon Sep 17 00:00:00 2001
From: "Laurent Destailleur (aka Eldy)" <eldy@destailleur.fr>
Date: Wed, 18 Dec 2024 19:00:33 +0100
Subject: [PATCH 05/10] Complete phpunit and tests to avoid use of non expected
 function

---
 htdocs/comm/card.php               |  50 +++++++-------
 htdocs/core/lib/functions.lib.php  |  11 ++-
 htdocs/core/lib/website2.lib.php   |  25 +++++--
 test/phpunit/AllTests.php          |   2 +
 test/phpunit/SecurityLoginTest.php | 106 +++++++++++++++++++++++++++++
 test/phpunit/SecurityTest.php      |  46 +++----------
 test/phpunit/WebsiteTest.php       |  29 +++++++-
 7 files changed, 200 insertions(+), 69 deletions(-)
 create mode 100644 test/phpunit/SecurityLoginTest.php

diff --git a/htdocs/comm/card.php b/htdocs/comm/card.php
index 57ce524af6bdf..5ed10dc2bd11e 100644
--- a/htdocs/comm/card.php
+++ b/htdocs/comm/card.php
@@ -1712,35 +1712,37 @@
 		}
 
 		// Add invoice
-		if ($user->socid == 0) {
-			if (isModEnabled('deplacement') && $object->status == 1) {
-				$langs->load("trips");
-				print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/compta/deplacement/card.php?socid='.$object->id.'&amp;action=create">'.$langs->trans("AddTrip").'</a></div>';
-			}
+		if (isModEnabled('deplacement') && $object->status == 1) {
+			$langs->load("trips");
+			print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/compta/deplacement/card.php?socid='.$object->id.'&amp;action=create">'.$langs->trans("AddTrip").'</a></div>';
+		}
+
+		if (isModEnabled('invoice') && $object->status == 1) {
+			if (!$user->hasRight('facture', 'creer')) {
+				$langs->load("bills");
+				print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("NotAllowed")).'" href="#">'.$langs->trans("AddBill").'</a></div>';
+			} else {
+				$langs->loadLangs(array("orders", "bills"));
 
-			if (isModEnabled('invoice') && $object->status == 1) {
-				if (!$user->hasRight('facture', 'creer')) {
-					$langs->load("bills");
-					print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("NotAllowed")).'" href="#">'.$langs->trans("AddBill").'</a></div>';
+				if ($object->client != 0 && $object->client != 2) {
+					print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/compta/facture/card.php?action=create&socid='.$object->id.'">'.$langs->trans("AddBill").'</a></div>';
 				} else {
-					$langs->loadLangs(array("orders", "bills"));
-
-					if (isModEnabled('order')) {
-						if ($object->client != 0 && $object->client != 2) {
-							if (!empty($orders2invoice) && $orders2invoice > 0) {
-								print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/commande/list.php?socid='.$object->id.'&search_billed=0&autoselectall=1">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
-							} else {
-								print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("NoOrdersToInvoice")).'" href="#">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
-							}
-						} else {
-							print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("ThirdPartyMustBeEditAsCustomer")).'" href="#">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
-						}
-					}
+					print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("ThirdPartyMustBeEditAsCustomer")).'" href="#">'.$langs->trans("AddBill").'</a></div>';
+				}
+			}
+		}
 
+		if (isModEnabled('invoice') && $object->status == 1) {
+			if ($user->hasRight('facture', 'creer')) {
+				if (isModEnabled('order')) {
 					if ($object->client != 0 && $object->client != 2) {
-						print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/compta/facture/card.php?action=create&socid='.$object->id.'">'.$langs->trans("AddBill").'</a></div>';
+						if (!empty($orders2invoice) && $orders2invoice > 0) {
+							print '<div class="inline-block divButAction"><a class="butAction" href="'.DOL_URL_ROOT.'/commande/list.php?socid='.$object->id.'&search_billed=0&autoselectall=1">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
+						} else {
+							print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("NoOrdersToInvoice")).'" href="#">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
+						}
 					} else {
-						print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("ThirdPartyMustBeEditAsCustomer")).'" href="#">'.$langs->trans("AddBill").'</a></div>';
+						print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" title="'.dol_escape_js($langs->trans("ThirdPartyMustBeEditAsCustomer")).'" href="#">'.$langs->trans("CreateInvoiceForThisCustomer").'</a></div>';
 					}
 				}
 			}
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index a3849578d8b97..6f47d17176133 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -10586,6 +10586,7 @@ function dol_eval($s, $returnvalue = 1, $hideerrors = 1, $onlysimplestring = '1'
 			while ($scheck && $savescheck != $scheck) {
 				$savescheck = $scheck;
 				$scheck = preg_replace('/->[a-zA-Z0-9_]+\(/', '->__METHOD__', $scheck);	// accept parenthesis in '...->method(...'
+				$scheck = preg_replace('/::[a-zA-Z0-9_]+\(/', '->__METHOD__', $scheck);	// accept parenthesis in '...::method(...'
 				$scheck = preg_replace('/^\(/', '__PARENTHESIS__ ', $scheck);	// accept parenthesis in '(...'. Must replace with __PARENTHESIS__ with a space after to allow following substitutions
 				$scheck = preg_replace('/\s\(/', '__PARENTHESIS__ ', $scheck);	// accept parenthesis in '... (' like in 'if ($a == 1)'. Must replace with __PARENTHESIS__ with a space after to allow following substitutions
 				$scheck = preg_replace('/^!?[a-zA-Z0-9_]+\(/', '__FUNCTION__', $scheck); // accept parenthesis in 'function(' and '!function('
@@ -10646,22 +10647,26 @@ function dol_eval($s, $returnvalue = 1, $hideerrors = 1, $onlysimplestring = '1'
 		$forbiddenphpstrings = array('$$', '$_', '}[');
 		$forbiddenphpstrings = array_merge($forbiddenphpstrings, array('_ENV', '_SESSION', '_COOKIE', '_GET', '_POST', '_REQUEST', 'ReflectionFunction'));
 
+		// We list all forbidden function as keywords we don't want to see (we don't mind it if is "kewyord(" or just "keyword", we don't want "keyword" at all)
 		$forbiddenphpfunctions = array();
 		// @phpcs:ignore
 		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("base64"."_"."decode", "rawurl"."decode", "url"."decode", "str"."_rot13", "hex"."2bin")); // name of forbidden functions are split to avoid false positive
-		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("fopen", "file_put_contents", "fputs", "fputscsv", "fwrite", "fpassthru", "require", "include", "mkdir", "rmdir", "symlink", "touch", "unlink", "umask"));
 		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("override_function", "session_id", "session_create_id", "session_regenerate_id"));
 		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("get_defined_functions", "get_defined_vars", "get_defined_constants", "get_declared_classes"));
-		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("function", "call_user_func"));
+		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("function", "call_user_func", "call_user_func_array"));
 		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("require", "include", "require_once", "include_once"));
 		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("exec", "passthru", "shell_exec", "system", "proc_open", "popen"));
 		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("dol_eval", "executeCLI", "verifCond"));	// native dolibarr functions
 		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("eval", "create_function", "assert", "mb_ereg_replace")); // function with eval capabilities
 		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("dol_compress_dir", "dol_decode", "dol_delete_file", "dol_delete_dir", "dol_delete_dir_recursive", "dol_copy", "archiveOrBackupFile")); // more dolibarr functions
+		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("fopen", "file_put_contents", "fputs", "fputscsv", "fwrite", "fpassthru", "mkdir", "rmdir", "symlink", "touch", "unlink", "umask"));
+		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("require", "include"));
 
 		$forbiddenphpmethods = array('invoke', 'invokeArgs');	// Method of ReflectionFunction to execute a function
 
-		$forbiddenphpregex = 'global\s+\$|\b('.implode('|', $forbiddenphpfunctions).')\b';
+		$forbiddenphpregex = 'global\s*\$';
+		$forbiddenphpregex .= '|';
+		$forbiddenphpregex .= '\b('.implode('|', $forbiddenphpfunctions).')\b';
 
 		$forbiddenphpmethodsregex = '->('.implode('|', $forbiddenphpmethods).')';
 
diff --git a/htdocs/core/lib/website2.lib.php b/htdocs/core/lib/website2.lib.php
index ef67cd4ca0424..78a5e6a002947 100644
--- a/htdocs/core/lib/website2.lib.php
+++ b/htdocs/core/lib/website2.lib.php
@@ -722,13 +722,15 @@ function checkPHPCode(&$phpfullcodestringold, &$phpfullcodestring)
 
 	// Then check forbidden commands
 	if (!$error) {
-		$forbiddenphpstrings = array('$$', '}[');
-		$forbiddenphpstrings = array_merge($forbiddenphpstrings, array('ReflectionFunction'));
+		$forbiddenphpstrings = array('$$', '$_', '}[');
+		//$forbiddenphpstrings = array_merge($forbiddenphpstrings, array('_ENV', '_SESSION', '_COOKIE', '_GET', '_POST', '_REQUEST', 'ReflectionFunction'));
+		$forbiddenphpstrings = array_merge($forbiddenphpstrings, array('_ENV', 'ReflectionFunction'));
 
 		$forbiddenphpfunctions = array();
+		//$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("base64"."_"."decode", "rawurl"."decode", "url"."decode", "str"."_rot13", "hex"."2bin")); // name of forbidden functions are split to avoid false positive
 		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("override_function", "session_id", "session_create_id", "session_regenerate_id"));
 		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("get_defined_functions", "get_defined_vars", "get_defined_constants", "get_declared_classes"));
-		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("call_user_func"));
+		$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("call_user_func", "call_user_func_array"));
 		//$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("require", "include", "require_once", "include_once"));
 		if (!getDolGlobalString('WEBSITE_PHP_ALLOW_EXEC')) {    // If option is not on, we disallow functions to execute commands
 			$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("exec", "passthru", "shell_exec", "system", "proc_open", "popen"));
@@ -736,8 +738,10 @@ function checkPHPCode(&$phpfullcodestringold, &$phpfullcodestring)
 			$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("eval", "create_function", "assert", "mb_ereg_replace")); // function with eval capabilities
 		}
 		if (!getDolGlobalString('WEBSITE_PHP_ALLOW_WRITE')) {    // If option is not on, we disallow functions to write files
+			$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("dol_compress_dir", "dol_decode", "dol_delete_file", "dol_delete_dir", "dol_delete_dir_recursive", "dol_copy", "archiveOrBackupFile")); // more dolibarr functions
 			$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("fopen", "file_put_contents", "fputs", "fputscsv", "fwrite", "fpassthru", "mkdir", "rmdir", "symlink", "touch", "unlink", "umask"));
 		}
+		//$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("require", "include"));
 
 		$forbiddenphpmethods = array('invoke', 'invokeArgs');	// Method of ReflectionFunction to execute a function
 
@@ -748,13 +752,22 @@ function checkPHPCode(&$phpfullcodestringold, &$phpfullcodestring)
 				break;
 			}
 		}
-		foreach ($forbiddenphpfunctions as $forbiddenphpfunction) {
-			if (preg_match('/'.$forbiddenphpfunction.'\s*\(/ims', $phpfullcodestring)) {
+		/* replaced with next block
+		foreach ($forbiddenphpfunctions as $forbiddenphpfunction) {	// Check "function(" but also "'function'(" and "function ("
+			if (preg_match('/'.$forbiddenphpfunction.'[\'\s]*\(/ims', $phpfullcodestring)) {
+				$error++;
+				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", $forbiddenphpfunction), null, 'errors');
+				break;
+			}
+		}*/
+		foreach ($forbiddenphpfunctions as $forbiddenphpfunction) {	// Check "function" whatever is "function(" or "function'(" or "function (" or "function"
+			if (preg_match('/\b'.$forbiddenphpfunction.'\b/ims', $phpfullcodestring)) {
 				$error++;
 				setEventMessages($langs->trans("DynamicPHPCodeContainsAForbiddenInstruction", $forbiddenphpfunction), null, 'errors');
 				break;
 			}
 		}
+
 		foreach ($forbiddenphpmethods as $forbiddenphpmethod) {
 			if (preg_match('/->'.$forbiddenphpmethod.'/ims', $phpfullcodestring)) {
 				$error++;
@@ -803,7 +816,7 @@ function checkPHPCode(&$phpfullcodestringold, &$phpfullcodestring)
 		}
 	}
 
-	// No need to block $conf->global->aaa() because PHP try to run method aaa an not function into $conf->global->aaa.
+	// No need to block $conf->global->aaa() because PHP try to run the method aaa of $conf->global and not the function into $conf->global->aaa.
 
 	// Then check if installmodules does not block dynamic PHP code change.
 	if ($phpfullcodestringold != $phpfullcodestring) {
diff --git a/test/phpunit/AllTests.php b/test/phpunit/AllTests.php
index 12e58357aa479..ae5b2c0359574 100644
--- a/test/phpunit/AllTests.php
+++ b/test/phpunit/AllTests.php
@@ -134,6 +134,8 @@ public static function suite()
 		$suite->addTestSuite('SecurityTest');
 		require_once dirname(__FILE__).'/SecurityGETPOSTTest.php';
 		$suite->addTestSuite('SecurityGETPOSTTest');
+		require_once dirname(__FILE__).'/SecurityLoginTest.php';
+		$suite->addTestSuite('SecurityLoginTest');
 
 		require_once dirname(__FILE__).'/UserTest.php';
 		$suite->addTestSuite('UserTest');
diff --git a/test/phpunit/SecurityLoginTest.php b/test/phpunit/SecurityLoginTest.php
new file mode 100644
index 0000000000000..2e4d190567c3b
--- /dev/null
+++ b/test/phpunit/SecurityLoginTest.php
@@ -0,0 +1,106 @@
+<?php
+/* Copyright (C) 2010 Laurent Destailleur  <eldy@users.sourceforge.net>
+ * Copyright (C) 2023 Alexandre Janniaux   <alexandre.janniaux@gmail.com>
+ * Copyright (C) 2024       Frédéric France         <frederic.france@free.fr>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ * or see https://www.gnu.org/
+ */
+
+/**
+ *      \file       test/phpunit/SecurityTest.php
+ *		\ingroup    test
+ *      \brief      PHPUnit test
+ *		\remarks	To run this script as CLI:  phpunit filename.php
+ */
+
+global $conf,$user,$langs,$db;
+//define('TEST_DB_FORCE_TYPE','mysql');	// This is to force using mysql driver
+//require_once 'PHPUnit/Autoload.php';
+
+if (! defined('NOREQUIRESOC')) {
+	define('NOREQUIRESOC', '1');
+}
+if (! defined('NOCSRFCHECK')) {
+	define('NOCSRFCHECK', '1');
+}
+if (! defined('NOTOKENRENEWAL')) {
+	define('NOTOKENRENEWAL', '1');
+}
+if (! defined('NOREQUIREMENU')) {
+	define('NOREQUIREMENU', '1'); // If there is no menu to show
+}
+if (! defined('NOREQUIREHTML')) {
+	define('NOREQUIREHTML', '1'); // If we don't need to load the html.form.class.php
+}
+if (! defined('NOREQUIREAJAX')) {
+	define('NOREQUIREAJAX', '1');
+}
+if (! defined("NOLOGIN")) {
+	define("NOLOGIN", '1');       // If this page is public (can be called outside logged session)
+}
+if (! defined("NOSESSION")) {
+	define("NOSESSION", '1');
+}
+
+require_once dirname(__FILE__).'/../../htdocs/main.inc.php';	// We force include of main.inc.php instead of master.inc.php even if we are in CLI mode because it contains a lot of security components we want to test.
+require_once dirname(__FILE__).'/../../htdocs/core/lib/security.lib.php';
+require_once dirname(__FILE__).'/../../htdocs/core/lib/security2.lib.php';
+require_once dirname(__FILE__).'/CommonClassTest.class.php';
+
+if (empty($user->id)) {
+	print "Load permissions for admin user nb 1\n";
+	$user->fetch(1);
+	$user->loadRights();
+}
+$conf->global->MAIN_DISABLE_ALL_MAILS = 1;
+
+
+/**
+ * Class for PHPUnit tests
+ *
+ * @backupGlobals disabled
+ * @backupStaticAttributes enabled
+ * @remarks	backupGlobals must be disabled to have db,conf,user and lang not erased.
+ */
+class SecurityLoginTest extends CommonClassTest
+{
+	/**
+	 * testCheckLoginPassEntity
+	 *
+	 * @return	void
+	 */
+	public function testCheckLoginPassEntity()
+	{
+		$login = checkLoginPassEntity('loginbidon', 'passwordbidon', 1, array('dolibarr'));
+		print __METHOD__." login=".$login."\n";
+		$this->assertEquals($login, '');
+
+		$login = checkLoginPassEntity('admin', 'passwordbidon', 1, array('dolibarr'));
+		print __METHOD__." login=".$login."\n";
+		$this->assertEquals($login, '');
+
+		$login = checkLoginPassEntity('admin', 'admin', 1, array('dolibarr'));            // Should works because admin/admin exists
+		print __METHOD__." login=".$login."\n";
+		$this->assertEquals($login, 'admin', 'The test to check if pass of user "admin" is "admin" has failed');
+
+		$login = checkLoginPassEntity('admin', 'admin', 1, array('http','dolibarr'));    // Should work because of second authentication method
+		print __METHOD__." login=".$login."\n";
+		$this->assertEquals($login, 'admin');
+
+		$login = checkLoginPassEntity('admin', 'admin', 1, array('forceuser'));
+		print __METHOD__." login=".$login."\n";
+		$this->assertEquals('', $login, 'Error');    // Expected '' because should failed because login 'auto' does not exists
+	}
+}
diff --git a/test/phpunit/SecurityTest.php b/test/phpunit/SecurityTest.php
index 294d1596fec84..9b5db827bc3b5 100644
--- a/test/phpunit/SecurityTest.php
+++ b/test/phpunit/SecurityTest.php
@@ -636,13 +636,13 @@ public function testDolEval()
 		$this->assertEquals('Bad string syntax to evaluate: new __forbiddenstring__(\'abc\')', $result);
 
 
-		$result = (string) dol_eval('$a=function() { }; $a;', 1, 1, '0');
-		print "result5 = ".$result."\n";
-		$this->assertStringContainsString('Bad string syntax to evaluate', $result);
+		$result = dol_eval('$a=function() { }; $a', 1, 1, '0');		// result of dol_eval may be an object Closure
+		print "result5 = ".json_encode($result)."\n";
+		$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result));
 
-		$result = (string) dol_eval('$a=function() { }; $a;', 1, 1, '1');
-		print "result6 = ".$result."\n";
-		$this->assertStringContainsString('Bad string syntax to evaluate', $result);
+		$result = dol_eval('$a=function() { }; $a();', 1, 1, '1');
+		print "result6 = ".json_encode($result)."\n";
+		$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result));
 
 		$result = (string) dol_eval('$a=exec("ls");', 1, 1);
 		print "result7 = ".$result."\n";
@@ -723,6 +723,11 @@ public function testDolEval()
 		$result = (string) dol_eval('($a = "ex") && ($b = "ec") && ($cmd = "$a$b") && $cmd ("curl localhost:5555")', 1, 0);
 		print "result22 = ".$result."\n";
 		$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 22');
+
+
+		$result = (string) dol_eval('\'exec\'("aaa")', 1, 0);
+		print "result1 = ".$result."\n";
+		$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result), 'Cant find the string Bad string syntaxwhen i should');
 	}
 
 	/**
@@ -966,33 +971,4 @@ public function testDolHtmlWithNoJs()
 
 		return 0;
 	}
-
-
-	/**
-	 * testCheckLoginPassEntity
-	 *
-	 * @return	void
-	 */
-	public function testCheckLoginPassEntity()
-	{
-		$login = checkLoginPassEntity('loginbidon', 'passwordbidon', 1, array('dolibarr'));
-		print __METHOD__." login=".$login."\n";
-		$this->assertEquals($login, '');
-
-		$login = checkLoginPassEntity('admin', 'passwordbidon', 1, array('dolibarr'));
-		print __METHOD__." login=".$login."\n";
-		$this->assertEquals($login, '');
-
-		$login = checkLoginPassEntity('admin', 'admin', 1, array('dolibarr'));            // Should works because admin/admin exists
-		print __METHOD__." login=".$login."\n";
-		$this->assertEquals($login, 'admin', 'The test to check if pass of user "admin" is "admin" has failed');
-
-		$login = checkLoginPassEntity('admin', 'admin', 1, array('http','dolibarr'));    // Should work because of second authentication method
-		print __METHOD__." login=".$login."\n";
-		$this->assertEquals($login, 'admin');
-
-		$login = checkLoginPassEntity('admin', 'admin', 1, array('forceuser'));
-		print __METHOD__." login=".$login."\n";
-		$this->assertEquals('', $login, 'Error');    // Expected '' because should failed because login 'auto' does not exists
-	}
 }
diff --git a/test/phpunit/WebsiteTest.php b/test/phpunit/WebsiteTest.php
index a067202ef85fc..bbf80cad4c59e 100644
--- a/test/phpunit/WebsiteTest.php
+++ b/test/phpunit/WebsiteTest.php
@@ -132,11 +132,22 @@ public function testDolStripPhpCode()
 	 */
 	public function testCheckPHPCode()
 	{
-		global $user;
+		global $conf, $user;
 
 		// Force permission so this is not the permission that will affect result of checkPHPCode
 		$user->rights->website->writephp = 1;
 
+		// Legitimate
+
+		$t = '';
+		$s = '<?php execu ?>';
+		$result = checkPHPCode($t, $s);
+		print __METHOD__." result checkPHPCode=".$result."\n";
+		$this->assertEquals($result, 0, 'checkPHPCode detect string as dangerous when it is legitimate');
+
+
+		// Dangerous
+
 		$t = '';
 		$s = '<?php exec("eee"); ?>';
 		$result = checkPHPCode($t, $s);
@@ -155,11 +166,27 @@ public function testCheckPHPCode()
 		print __METHOD__." result checkPHPCode=".$result."\n";
 		$this->assertEquals($result, 1, 'checkPHPCode did not detect the string was dangerous');
 
+		$t = '';
+		$s = '<?php $a=\'exec\'("ee"); ?>';
+		$result = checkPHPCode($t, $s);
+		print __METHOD__." result checkPHPCode=".$result."\n";
+		$this->assertEquals($result, 1, 'checkPHPCode did not detect the string was dangerous');
+
 		$t = '';
 		$s = '<?php $_="{"; $_=($_^"<").($_^">;").($_^"/"); ?><?=${\'_\'.$_}["_"](${\'_\'.$_}["__"]);?>';
 		$result = checkPHPCode($t, $s);
 		print __METHOD__." result checkPHPCode=".$result."\n";
 		$this->assertEquals($result, 1, 'checkPHPCode did not detect the string was dangerous');
+
+		// Dangerous but legitimate due to option WEBSITE_PHP_ALLOW_EXEC
+
+		$conf->global->WEBSITE_PHP_ALLOW_EXEC = 1;
+
+		$t = '';
+		$s = '<?php exec("eee"); ?>';
+		$result = checkPHPCode($t, $s);
+		print __METHOD__." result checkPHPCode=".$result."\n";
+		$this->assertEquals($result, 0, 'checkPHPCode did not accept the exec. it should when WEBSITE_PHP_ALLOW_EXEC is set.');
 	}
 
 	/**

From 8bab8f90c7167cb87ec2465426af9a90eae30996 Mon Sep 17 00:00:00 2001
From: "Laurent Destailleur (aka Eldy)" <eldy@destailleur.fr>
Date: Wed, 18 Dec 2024 19:47:53 +0100
Subject: [PATCH 06/10] Debug v21 - Must use USF

---
 htdocs/comm/action/card.php           |  6 ++--
 htdocs/core/class/html.form.class.php | 48 ++++++++++++++++-----------
 htdocs/societe/card.php               |  4 +--
 htdocs/societe/list.php               |  2 +-
 4 files changed, 35 insertions(+), 25 deletions(-)

diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index e7f8a9b1139a9..b00fe376ee1bd 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -1546,8 +1546,8 @@ function init_repeat()
 			$listofuserid[$firstelem['id']]['transparency'] = (GETPOSTISSET('transparency') ? GETPOST('transparency', 'alpha') : 0); // 0 by default when refreshing
 		}
 	}
-	print '<div class="assignedtouser">';
-	print $form->select_dolusers_forevent(($action == 'create' ? 'add' : 'update'), 'assignedtouser', 1, array(), 0, '', array(), 0, 0, 0, 'AND u.statut != 0', 1, $listofuserid, $listofcontactid, $listofotherid);
+	print '<!-- list of user to assign --><div class="assignedtouser">';
+	print $form->select_dolusers_forevent(($action == 'create' ? 'add' : 'update'), 'assignedtouser', 1, array(), 0, '', array(), 0, 0, 0, 'u.statut:<>:0', 1, $listofuserid, $listofcontactid, $listofotherid);
 	print '</div>';
 	print '</td></tr>';
 
@@ -2164,7 +2164,7 @@ function setdatefields()
 
 		print '<tr><td class="tdtop nowrap fieldrequired">'.$langs->trans("ActionAssignedTo").'</td><td colspan="3">';
 		print '<div class="assignedtouser">';
-		print $form->select_dolusers_forevent(($action == 'create' ? 'add' : 'update'), 'assignedtouser', 1, array(), 0, '', array(), 0, 0, 0, 'AND u.statut != 0', 1, $listofuserid, $listofcontactid, $listofotherid);
+		print $form->select_dolusers_forevent(($action == 'create' ? 'add' : 'update'), 'assignedtouser', 1, array(), 0, '', array(), 0, 0, 0, 'u.statut:<>:0', 1, $listofuserid, $listofcontactid, $listofotherid);
 		print '</div>';
 		/*if (in_array($user->id,array_keys($listofuserid)))
 		{
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index a291083bf6262..a47f07f170394 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -2228,7 +2228,13 @@ public function select_dolusers($selected = '', $htmlname = 'userid', $show_empt
 			$sql .= " AND u.fk_soc IS NULL";
 		}
 		if (!empty($morefilter)) {
-			$sql .= " " . $morefilter;
+			$errormessage = '';
+			$sql .= forgeSQLFromUniversalSearchCriteria($morefilter, $errormessage);
+			if ($errormessage) {
+				$this->errors[] = $errormessage;
+				dol_syslog(__METHOD__.' '.implode(',', $this->errors), LOG_ERR);
+				return -1;
+			}
 		}
 
 		//Add hook to filter on user (for example on usergroup define in custom modules)
@@ -2425,28 +2431,28 @@ public function select_dolusers($selected = '', $htmlname = 'userid', $show_empt
 	 * Return select list of users. Selected users are stored into session.
 	 * List of users are provided into $_SESSION['assignedtouser'].
 	 *
-	 * @param string 	$action 			Value for $action
-	 * @param string 	$htmlname			Field name in form
-	 * @param int<0,1> 	$show_empty 		0=list without the empty value, 1=add empty value
-	 * @param int[] 	$exclude 			Array list of users id to exclude
-	 * @param int<0,1>	$disabled 			If select list must be disabled
-	 * @param int[]|string 	$include 			Array list of users id to include or 'hierarchy' to have only supervised users
-	 * @param int[]|int	$enableonly 		Array list of users id to be enabled. All other must be disabled
-	 * @param string	$force_entity 		'0' or Ids of environment to force
-	 * @param int 		$maxlength 			Maximum length of string into list (0=no limit)
-	 * @param int<0,1>	$showstatus 		0=show user status only if status is disabled, 1=always show user status into label, -1=never show user status
-	 * @param string 	$morefilter 		Add more filters into sql request
-	 * @param int 		$showproperties 	Show properties of each attendees
-	 * @param int[] 	$listofuserid 		Array with properties of each user
-	 * @param int[] 	$listofcontactid 	Array with properties of each contact
-	 * @param int[] 	$listofotherid 		Array with properties of each other contact
-	 * @return    string                    HTML select string
+	 * @param 	string 								$action 			Value for $action
+	 * @param 	string 								$htmlname			Field name in form
+	 * @param 	int<0,1> 							$show_empty 		0=list without the empty value, 1=add empty value
+	 * @param 	int[] 								$exclude 			Array list of users id to exclude
+	 * @param 	int<0,1>							$disabled 			If select list must be disabled
+	 * @param 	int[]|''|'hierarchy'|'hierarchyme' 	$include 			Array list of users id to include or 'hierarchy' to have only supervised users
+	 * @param 	int[]|int							$enableonly 		Array list of users id to be enabled. All other must be disabled
+	 * @param 	string								$force_entity 		'0' or Ids of environment to force
+	 * @param 	int 								$maxlength 			Maximum length of string into list (0=no limit)
+	 * @param 	int<0,1>							$showstatus 		0=show user status only if status is disabled, 1=always show user status into label, -1=never show user status
+	 * @param 	string 								$morefilter 		Add more filters into sql request (Example: '(employee:=:1)'). This value must not come from user input.
+	 * @param 	int 								$showproperties 	Show properties of each attendees
+	 * @param 	int[] 								$listofuserid 		Array with properties of each user
+	 * @param 	int[] 								$listofcontactid 	Array with properties of each contact
+	 * @param 	int[] 								$listofotherid 		Array with properties of each other contact
+	 * @return  string    	    	            						HTML select string
 	 * @see select_dolgroups()
 	 */
 	public function select_dolusers_forevent($action = '', $htmlname = 'userid', $show_empty = 0, $exclude = null, $disabled = 0, $include = array(), $enableonly = array(), $force_entity = '0', $maxlength = 0, $showstatus = 0, $morefilter = '', $showproperties = 0, $listofuserid = array(), $listofcontactid = array(), $listofotherid = array())
 	{
 		// phpcs:enable
-		global $langs;
+		global $langs, $user;
 
 		$userstatic = new User($this->db);
 		$out = '';
@@ -2480,7 +2486,11 @@ public function select_dolusers_forevent($action = '', $htmlname = 'userid', $sh
 				$out .= ' (' . $langs->trans("Owner") . ')';
 			}
 			if ($nbassignetouser > 1 && $action != 'view') {
-				$out .= ' <input type="image" style="border: 0px;" src="' . img_picto($langs->trans("Remove"), 'delete', '', 0, 1) . '" value="' . $userstatic->id . '" class="removedassigned reposition" id="removedassigned_' . $userstatic->id . '" name="removedassigned_' . $userstatic->id . '">';
+				if ($user->hasRight('agenda', 'allactions', 'create') || $userstatic->id != $user->id) {
+					// If user has all permission, he should be ableto remove a assignee.
+					// If user has not all permission, he can onlyremove assignee of other (he can't remove itself)
+					$out .= ' <input type="image" style="border: 0px;" src="' . img_picto($langs->trans("Remove"), 'delete', '', 0, 1) . '" value="' . $userstatic->id . '" class="removedassigned reposition" id="removedassigned_' . $userstatic->id . '" name="removedassigned_' . $userstatic->id . '">';
+				}
 			}
 			// Show my availability
 			if ($showproperties) {
diff --git a/htdocs/societe/card.php b/htdocs/societe/card.php
index e4a3c6c47d5ec..9e149817d8308 100644
--- a/htdocs/societe/card.php
+++ b/htdocs/societe/card.php
@@ -1960,7 +1960,7 @@ function manageprospectcustomer(element) {
 			print '<td>'.$form->editfieldkey('AllocateCommercial', 'commercial_id', '', $object, 0).'</td>';
 			print '<td colspan="3" class="maxwidthonsmartphone">';
 			// TODO Use select_doluser in multiselect mode
-			$userlist = $form->select_dolusers($selected, '', 0, null, 0, '', '', '0', 0, 0, 'AND u.statut = 1', 0, '', '', 0, 2);
+			$userlist = $form->select_dolusers($selected, '', 0, null, 0, '', '', '0', 0, 0, 'u.statut:=:1', 0, '', '', 0, 2);
 			// Note: If user has no right to "see all thirdparties", we force selection of sale representative to him, so after creation he can see the record.
 			$selected = (GETPOSTISARRAY('commercial') ? GETPOST('commercial', 'array:int') : (GETPOSTINT('commercial') > 0 ? array(GETPOSTINT('commercial')) : array($user->id)));
 			print img_picto('', 'user').$form->multiselectarray('commercial', $userlist, $selected, 0, 0, 'quatrevingtpercent widthcentpercentminusx', 0, 0);
@@ -2812,7 +2812,7 @@ function init_check_no_email(input) {
 				print '<tr>';
 				print '<td>'.$form->editfieldkey('AllocateCommercial', 'commercial_id', '', $object, 0).'</td>';
 				print '<td colspan="3" class="maxwidthonsmartphone">';
-				$userlist = $form->select_dolusers('', '', 0, null, 0, '', '', 0, 0, 0, 'AND u.statut = 1', 0, '', '', 0, 1);
+				$userlist = $form->select_dolusers('', '', 0, null, 0, '', '', 0, 0, 0, 'u.statut:=:1', 0, '', '', 0, 1);
 				$arrayselected = GETPOST('commercial', 'array');
 				if (empty($arrayselected)) {
 					$arrayselected = $object->getSalesRepresentatives($user, 1);
diff --git a/htdocs/societe/list.php b/htdocs/societe/list.php
index aaa8868746761..70fe8a2f34f33 100644
--- a/htdocs/societe/list.php
+++ b/htdocs/societe/list.php
@@ -1290,7 +1290,7 @@
 }
 
 // If the user can view prospects other than his'
-$userlist = $form->select_dolusers('', '', 0, null, 0, '', '', 0, 0, 0, 'AND u.statut = 1', 0, '', '', 0, 1);
+$userlist = $form->select_dolusers('', '', 0, null, 0, '', '', 0, 0, 0, 'u.statut:=:1', 0, '', '', 0, 1);
 $userlist[-2] = $langs->trans("NoSalesRepresentativeAffected");
 if ($user->hasRight("societe", "client", "voir") || $socid) {
 	$moreforfilter .= '<div class="divsearchfield">';

From 93884e3424afc6addea5810608bfce0de1bba1cc Mon Sep 17 00:00:00 2001
From: "Laurent Destailleur (aka Eldy)" <eldy@destailleur.fr>
Date: Wed, 18 Dec 2024 20:23:21 +0100
Subject: [PATCH 07/10] Fix on auto event, can't change the owner of event.

---
 htdocs/comm/action/card.php           |  3 ++-
 htdocs/core/class/html.form.class.php | 18 ++++++++++++++++--
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index b00fe376ee1bd..338e63e57280e 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -2164,7 +2164,8 @@ function setdatefields()
 
 		print '<tr><td class="tdtop nowrap fieldrequired">'.$langs->trans("ActionAssignedTo").'</td><td colspan="3">';
 		print '<div class="assignedtouser">';
-		print $form->select_dolusers_forevent(($action == 'create' ? 'add' : 'update'), 'assignedtouser', 1, array(), 0, '', array(), 0, 0, 0, 'u.statut:<>:0', 1, $listofuserid, $listofcontactid, $listofotherid);
+		$canremoveowner = ($object->type != 'systemauto');
+		print $form->select_dolusers_forevent(($action == 'create' ? 'add' : 'update'), 'assignedtouser', 1, array(), 0, '', array(), 0, 0, 0, 'u.statut:<>:0', 1, $listofuserid, $listofcontactid, $listofotherid, $canremoveowner);
 		print '</div>';
 		/*if (in_array($user->id,array_keys($listofuserid)))
 		{
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index a47f07f170394..a0e1cd1985b4f 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -2446,10 +2446,11 @@ public function select_dolusers($selected = '', $htmlname = 'userid', $show_empt
 	 * @param 	int[] 								$listofuserid 		Array with properties of each user
 	 * @param 	int[] 								$listofcontactid 	Array with properties of each contact
 	 * @param 	int[] 								$listofotherid 		Array with properties of each other contact
+	 * @param	int									$canremoveowner		1 if we can remove owner, 0=no way
 	 * @return  string    	    	            						HTML select string
 	 * @see select_dolgroups()
 	 */
-	public function select_dolusers_forevent($action = '', $htmlname = 'userid', $show_empty = 0, $exclude = null, $disabled = 0, $include = array(), $enableonly = array(), $force_entity = '0', $maxlength = 0, $showstatus = 0, $morefilter = '', $showproperties = 0, $listofuserid = array(), $listofcontactid = array(), $listofotherid = array())
+	public function select_dolusers_forevent($action = '', $htmlname = 'userid', $show_empty = 0, $exclude = null, $disabled = 0, $include = array(), $enableonly = array(), $force_entity = '0', $maxlength = 0, $showstatus = 0, $morefilter = '', $showproperties = 0, $listofuserid = array(), $listofcontactid = array(), $listofotherid = array(), $canremoveowner = 1)
 	{
 		// phpcs:enable
 		global $langs, $user;
@@ -2485,8 +2486,21 @@ public function select_dolusers_forevent($action = '', $htmlname = 'userid', $sh
 				$ownerid = $value['id'];
 				$out .= ' (' . $langs->trans("Owner") . ')';
 			}
+			// Add picto to delete owner/assignee
 			if ($nbassignetouser > 1 && $action != 'view') {
-				if ($user->hasRight('agenda', 'allactions', 'create') || $userstatic->id != $user->id) {
+				$canremoveassignee = 1;
+				if ($i == 0) {
+					// We are on the owner of the event
+					if (!$canremoveowner) {
+						$canremoveassignee = 0;
+					}
+					if ($userstatic->id == $user->id && !$user->hasRight('agenda', 'allactions', 'create')) {
+						$canremoveassignee = 0;		// Can't remove myself if i am the owner
+					}
+				} else {
+					// We are not on the owner of the event but on a secondary assignee
+				}
+				if ($canremoveassignee) {
 					// If user has all permission, he should be ableto remove a assignee.
 					// If user has not all permission, he can onlyremove assignee of other (he can't remove itself)
 					$out .= ' <input type="image" style="border: 0px;" src="' . img_picto($langs->trans("Remove"), 'delete', '', 0, 1) . '" value="' . $userstatic->id . '" class="removedassigned reposition" id="removedassigned_' . $userstatic->id . '" name="removedassigned_' . $userstatic->id . '">';

From 50695e4dcf6ec0a3a63cc94c96bedfc3947fea62 Mon Sep 17 00:00:00 2001
From: "Laurent Destailleur (aka Eldy)" <eldy@destailleur.fr>
Date: Wed, 18 Dec 2024 21:19:15 +0100
Subject: [PATCH 08/10] Debug v21

---
 htdocs/comm/action/card.php           | 32 +++++++++++++++------------
 htdocs/core/class/html.form.class.php |  9 ++++----
 2 files changed, 23 insertions(+), 18 deletions(-)

diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index 338e63e57280e..2e02f37ebec26 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -1811,7 +1811,7 @@ function init_repeat()
 
 		print "\n".'<script type="text/javascript">';
 		print '$(document).ready(function () {
-				const reminderDefaultEventTypes = 	'.$reminderDefaultEventTypes.';
+				const reminderDefaultEventTypes = \''.dol_escape_js($reminderDefaultEventTypes).'\';
 				$("#actioncode").change(function(){
 					var selected_event_type = $("#actioncode option:selected").val();
 
@@ -1820,9 +1820,9 @@ function init_repeat()
 						$("#addreminder").prop("checked", true);
 
 						// Set period with default reminder period
-						$("[name=\"offsetvalue\"]").val("' . $reminderDefaultOffset . '");
+						$("[name=\"offsetvalue\"]").val(\'' . dol_escape_js($reminderDefaultOffset) . '\');
 						$("#select_offsetunittype_duration").select2("destroy");
-						$("#select_offsetunittype_duration").val("'.$reminderDefaultUnit.'");
+						$("#select_offsetunittype_duration").val(\''.dol_escape_js($reminderDefaultUnit).'\');
 						$("#select_offsetunittype_duration").select2();
 
 						$("#selectremindertype").select2("destroy");
@@ -1832,7 +1832,7 @@ function init_repeat()
 						// Set default reminder mail model
 						$("#select_actioncommsendmodel_mail").closest("tr").show();
 						$("#select_actioncommsendmodel_mail").select2("destroy");
-						$("#select_actioncommsendmodel_mail").val("'.$reminderDefaultEmailModel.'");
+						$("#select_actioncommsendmodel_mail").val(\''.dol_escape_js($reminderDefaultEmailModel).'\');
 						$("#select_actioncommsendmodel_mail").select2();
 					}
 				});
@@ -1955,6 +1955,8 @@ function selectremindertype() {
 	}
 
 	if ($action == 'edit') {
+		$caneditdateorowner = ($object->type != 'systemauto');
+
 		if (!empty($conf->use_javascript_ajax)) {
 			print "\n".'<script type="text/javascript">';
 			print '$(document).ready(function () {
@@ -1972,7 +1974,9 @@ function setdatefields()
 								$(".fulldayendmin").prop("disabled", true).val("59");
 	            			}
 	            		}
-	            		setdatefields();
+
+						'.($caneditdateorowner ? ' setdatefields();' : '').'
+
 	            		$("#fullday").change(function() {
 	            			setdatefields();
 	            		});
@@ -2052,7 +2056,8 @@ function setdatefields()
 		print '<tr><td'.(!getDolGlobalString('AGENDA_USE_EVENT_TYPE') ? ' class="fieldrequired titlefieldcreate"' : '').'>'.$langs->trans("Title").'</td><td colspan="3"><input type="text" name="label" class="soixantepercent" value="'.$object->label.'"></td></tr>';
 
 		// Full day event
-		print '<tr><td><span class="fieldrequired">'.$langs->trans("Date").'</span></td><td colspan="3" class="valignmiddle height30 small"><input type="checkbox" id="fullday" name="fullday" '.($object->fulldayevent ? ' checked' : '').'>';
+		print '<tr><td><span class="fieldrequired">'.$langs->trans("Date").'</span></td><td colspan="3" class="valignmiddle height30 small">';
+		print '<input '.($caneditdateorowner ? '' : ' disabled').' type="checkbox" id="fullday" name="fullday" '.($object->fulldayevent ? ' checked' : '').'>';
 		print '<label for="fullday">'.$langs->trans("EventOnFullDay").'</label>';
 
 		// // Recurring event
@@ -2123,9 +2128,9 @@ function setdatefields()
 		*/
 		print '</td><td td colspan="3">';
 		$tzforfullday = getDolGlobalString('MAIN_STORE_FULL_EVENT_IN_GMT');
-		print $form->selectDate($datep ? $datep : $object->datep, 'ap', 1, 1, 0, "action", 1, 2, 0, 'fulldaystart', '', '', '', 1, '', '', $object->fulldayevent ? ($tzforfullday ? $tzforfullday : 'tzuserrel') : 'tzuserrel');
+		print $form->selectDate($datep ? $datep : $object->datep, 'ap', 1, 1, 0, "action", 1, 2, ($caneditdateorowner ? 0 : 1), 'fulldaystart', '', '', '', 1, '', '', $object->fulldayevent ? ($tzforfullday ? $tzforfullday : 'tzuserrel') : 'tzuserrel');
 		print ' <span class="hideonsmartphone">&nbsp; &nbsp; - &nbsp; &nbsp;</span> ';
-		print $form->selectDate($datef ? $datef : $object->datef, 'p2', 1, 1, 1, "action", 1, 2, 0, 'fulldayend', '', '', '', 1, '', '', $object->fulldayevent ? ($tzforfullday ? $tzforfullday : 'tzuserrel') : 'tzuserrel');
+		print $form->selectDate($datef ? $datef : $object->datef, 'p2', 1, 1, 1, "action", 1, 2, ($caneditdateorowner ? 0 : 1), 'fulldayend', '', '', '', 1, '', '', $object->fulldayevent ? ($tzforfullday ? $tzforfullday : 'tzuserrel') : 'tzuserrel');
 		print '</td></tr>';
 
 		print '<tr><td class="">&nbsp;</td><td></td></tr>';
@@ -2164,8 +2169,7 @@ function setdatefields()
 
 		print '<tr><td class="tdtop nowrap fieldrequired">'.$langs->trans("ActionAssignedTo").'</td><td colspan="3">';
 		print '<div class="assignedtouser">';
-		$canremoveowner = ($object->type != 'systemauto');
-		print $form->select_dolusers_forevent(($action == 'create' ? 'add' : 'update'), 'assignedtouser', 1, array(), 0, '', array(), 0, 0, 0, 'u.statut:<>:0', 1, $listofuserid, $listofcontactid, $listofotherid, $canremoveowner);
+		print $form->select_dolusers_forevent(($action == 'create' ? 'add' : 'update'), 'assignedtouser', 1, array(), 0, '', array(), 0, 0, 0, 'u.statut:<>:0', 1, $listofuserid, $listofcontactid, $listofotherid, $caneditdateorowner);
 		print '</div>';
 		/*if (in_array($user->id,array_keys($listofuserid)))
 		{
@@ -2415,7 +2419,7 @@ function setdatefields()
 
 			print "\n".'<script type="text/javascript">';
 			print '$(document).ready(function () {
-					const reminderDefaultEventTypes = 	'.$reminderDefaultEventTypes.';
+					const reminderDefaultEventTypes = \''.dol_escape_js($reminderDefaultEventTypes).'\';
 					$("#actioncode").change(function(){
 						var selected_event_type = $("#actioncode option:selected").val();
 
@@ -2424,9 +2428,9 @@ function setdatefields()
 							$("#addreminder").prop("checked", true);
 
 							// Set period with default reminder period
-							$("#offsetvalue").val('.$reminderDefaultOffset.');
+							$("#offsetvalue").val(\''.dol_escape_js($reminderDefaultOffset).'\');
 							$("#select_offsetunittype_duration").select2("destroy");
-							$("#select_offsetunittype_duration").val("'.$reminderDefaultUnit.'");
+							$("#select_offsetunittype_duration").val(\''.dol_escape_js($reminderDefaultUnit).'\');
 							$("#select_offsetunittype_duration").select2();
 
 							$("#selectremindertype").select2("destroy");
@@ -2436,7 +2440,7 @@ function setdatefields()
 							// Set default reminder mail model
 							$("#select_actioncommsendmodel_mail").closest("tr").show();
 							$("#select_actioncommsendmodel_mail").select2("destroy");
-							$("#select_actioncommsendmodel_mail").val("'.$reminderDefaultEmailModel.'");
+							$("#select_actioncommsendmodel_mail").val(\''.dol_escape_js($reminderDefaultEmailModel).'\');
 							$("#select_actioncommsendmodel_mail").select2();
 						}
 					});
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index a0e1cd1985b4f..94468009dd16c 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -7428,6 +7428,7 @@ public function selectDate($set_time = '', $prefix = 're', $h = 0, $m = 0, $empt
 					$hourend = $hourstart;
 				}
 			}
+
 			// Show hour
 			$retstring .= '<select' . ($disabled ? ' disabled' : '') . ' class="flat valignmiddle maxwidth50 ' . ($fullday ? $fullday . 'hour' : '') . '" id="' . $prefix . 'hour" name="' . $prefix . 'hour">';
 			if ($emptyhours) {
@@ -7450,7 +7451,7 @@ public function selectDate($set_time = '', $prefix = 're', $h = 0, $m = 0, $empt
 
 		if ($m) {
 			// Show minutes
-			$retstring .= '<select' . ($disabled ? ' disabled' : '') . ' class="flat valignmiddle maxwidth50 ' . ($fullday ? $fullday . 'min' : '') . '" id="' . $prefix . 'min" name="' . $prefix . 'min">';
+			$retstring .= '<select ' . ($disabled ? ' disabled' : '') . ' class="flat valignmiddle maxwidth50 ' . ($fullday ? $fullday . 'min' : '') . '" id="' . $prefix . 'min" name="' . $prefix . 'min">';
 			if ($emptyhours) {
 				$retstring .= '<option value="-1">&nbsp;</option>';
 			}
@@ -7468,7 +7469,7 @@ public function selectDate($set_time = '', $prefix = 're', $h = 0, $m = 0, $empt
 		}
 
 		// Add a "Now" link
-		if (!empty($conf->use_javascript_ajax) && $addnowlink) {
+		if (!empty($conf->use_javascript_ajax) && $addnowlink && !$disabled) {
 			// Script which will be inserted in the onClick of the "Now" link
 			$reset_scripts = "";
 			if ($addnowlink == 2) { // local computer time
@@ -7555,7 +7556,7 @@ public function selectDate($set_time = '', $prefix = 're', $h = 0, $m = 0, $empt
 		}
 
 		// Add a "Plus one hour" link
-		if ($conf->use_javascript_ajax && $addplusone) {
+		if ($conf->use_javascript_ajax && $addplusone && !$disabled) {
 			// Script which will be inserted in the onClick of the "Add plusone" link
 			$reset_scripts = "";
 
@@ -7593,7 +7594,7 @@ public function selectDate($set_time = '', $prefix = 're', $h = 0, $m = 0, $empt
 		}
 
 		// Add a link to set data
-		if ($conf->use_javascript_ajax && !empty($adddateof)) {
+		if ($conf->use_javascript_ajax && !empty($adddateof) && !$disabled) {
 			if (!is_array($adddateof)) {
 				$arrayofdateof = array(array('adddateof' => $adddateof, 'labeladddateof' => $labeladddateof));
 			} else {

From ff2aa1014549196a2ede61252538dfb83fabb11d Mon Sep 17 00:00:00 2001
From: "Laurent Destailleur (aka Eldy)" <eldy@destailleur.fr>
Date: Wed, 18 Dec 2024 21:35:52 +0100
Subject: [PATCH 09/10] Debug v21

---
 htdocs/comm/action/index.php          | 4 ++--
 htdocs/comm/action/list.php           | 6 +++---
 htdocs/comm/action/pertype.php        | 2 +-
 htdocs/comm/action/peruser.php        | 2 +-
 htdocs/core/class/html.form.class.php | 4 ++--
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/htdocs/comm/action/index.php b/htdocs/comm/action/index.php
index a14381e1b46d5..4cd940f33fc3d 100644
--- a/htdocs/comm/action/index.php
+++ b/htdocs/comm/action/index.php
@@ -569,12 +569,12 @@
 $newparam = '';
 $newcardbutton = '';
 if ($user->hasRight('agenda', 'myactions', 'create') || $user->hasRight('agenda', 'allactions', 'create')) {
-	$tmpforcreatebutton = dol_getdate(dol_now(), true);
+	$tmpforcreatebutton = dol_getdate(dol_now('tzuserrel'), true);
 
 	$newparam .= '&month='.((int) $month).'&year='.((int) $tmpforcreatebutton['year']).'&mode='.urlencode($mode);
 
 	//$param='month='.$monthshown.'&year='.$year;
-	$hourminsec = dol_print_date(dol_mktime(10, 0, 0, 1, 1, 1970, 'gmt'), '%H', 'gmt').'0000';	// Set $hourminsec to '100000' to auto set hour to 10:00 at creation
+	//$hourminsec = dol_print_date(dol_mktime(10, 0, 0, 1, 1, 1970, 'gmt'), '%H', 'gmt').'0000';	// Set $hourminsec to '100000' to auto set hour to 10:00 at creation
 
 	$urltocreateaction = DOL_URL_ROOT.'/comm/action/card.php?action=create';
 	$urltocreateaction .= '&apyear='.$tmpforcreatebutton['year'].'&apmonth='.$tmpforcreatebutton['mon'].'&apday='.$tmpforcreatebutton['mday'].'&aphour='.$tmpforcreatebutton['hours'].'&apmin='.$tmpforcreatebutton['minutes'];
diff --git a/htdocs/comm/action/list.php b/htdocs/comm/action/list.php
index 475c580400ffb..71a8884e0d2da 100644
--- a/htdocs/comm/action/list.php
+++ b/htdocs/comm/action/list.php
@@ -736,13 +736,13 @@
 
 $viewmode .= '<span class="marginrightonly"></span>';
 
-
-$tmpforcreatebutton = dol_getdate(dol_now(), true);
+$tmpforcreatebutton = dol_getdate(dol_now('tzuserrel'), true);
 
 $newparam = '&month='.str_pad((string) $month, 2, "0", STR_PAD_LEFT).'&year='.$tmpforcreatebutton['year'];
 
 $url = DOL_URL_ROOT.'/comm/action/card.php?action=create';
-$url .= '&apyear='.$tmpforcreatebutton['year'].'&apmonth='.$tmpforcreatebutton['mon'].'&apday='.$tmpforcreatebutton['mday'].'&aphour='.$tmpforcreatebutton['hours'].'&apmin='.$tmpforcreatebutton['minutes'];
+$url .= '&apyear='.$tmpforcreatebutton['year'].'&apmonth='.$tmpforcreatebutton['mon'].'&apday='.$tmpforcreatebutton['mday'];
+$url .= '&aphour='.$tmpforcreatebutton['hours'].'&apmin='.$tmpforcreatebutton['minutes'];
 $url .= '&backtopage='.urlencode($_SERVER["PHP_SELF"].($newparam ? '?'.$newparam : ''));
 
 $newcardbutton = dolGetButtonTitle($langs->trans('AddAction'), '', 'fa fa-plus-circle', $url, '', (int) ($user->hasRight('agenda', 'myactions', 'create') || $user->hasRight('agenda', 'allactions', 'create')));
diff --git a/htdocs/comm/action/pertype.php b/htdocs/comm/action/pertype.php
index e4b43bbddc89c..4d9b4155d4632 100644
--- a/htdocs/comm/action/pertype.php
+++ b/htdocs/comm/action/pertype.php
@@ -487,7 +487,7 @@
 $newparam = '';
 $newcardbutton = '';
 if ($user->hasRight('agenda', 'myactions', 'create') || $user->hasRight('agenda', 'allactions', 'create')) {
-	$tmpforcreatebutton = dol_getdate(dol_now(), true);
+	$tmpforcreatebutton = dol_getdate(dol_now('tzuserrel'), true);
 
 	$newparam .= '&month='.str_pad($month, 2, "0", STR_PAD_LEFT).'&year='.$tmpforcreatebutton['year'];
 
diff --git a/htdocs/comm/action/peruser.php b/htdocs/comm/action/peruser.php
index cc2a932447850..bab2ff5916ccb 100644
--- a/htdocs/comm/action/peruser.php
+++ b/htdocs/comm/action/peruser.php
@@ -492,7 +492,7 @@
 $newparam = '';
 $newcardbutton = '';
 if ($user->hasRight('agenda', 'myactions', 'create') || $user->hasRight('agenda', 'allactions', 'create')) {
-	$tmpforcreatebutton = dol_getdate(dol_now(), true);
+	$tmpforcreatebutton = dol_getdate(dol_now('tzuserrel'), true);
 
 	$newparam .= '&month='.urlencode(str_pad((string) $month, 2, "0", STR_PAD_LEFT)).'&year='.((int) $tmpforcreatebutton['year']);
 	if ($begin_h !== '') {
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index 94468009dd16c..9e54b19db1ce6 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -2494,8 +2494,8 @@ public function select_dolusers_forevent($action = '', $htmlname = 'userid', $sh
 					if (!$canremoveowner) {
 						$canremoveassignee = 0;
 					}
-					if ($userstatic->id == $user->id && !$user->hasRight('agenda', 'allactions', 'create')) {
-						$canremoveassignee = 0;		// Can't remove myself if i am the owner
+					if (!$user->hasRight('agenda', 'allactions', 'create')) {
+						$canremoveassignee = 0;		// Can't remove the owner
 					}
 				} else {
 					// We are not on the owner of the event but on a secondary assignee

From 289b69bb2419eb84dfdb7122c4089744bf9c6b1e Mon Sep 17 00:00:00 2001
From: "Laurent Destailleur (aka Eldy)" <eldy@destailleur.fr>
Date: Thu, 19 Dec 2024 01:05:39 +0100
Subject: [PATCH 10/10] Debug v21 - Fix set of focus on description after
 slection of type of line

---
 htdocs/core/class/html.form.class.php     |  24 +-
 htdocs/core/js/lib_head.js.php            |   6 +-
 htdocs/core/tpl/objectline_create.tpl.php | 981 +++++++++++-----------
 htdocs/langs/en_US/main.lang              |   2 +-
 htdocs/theme/eldy/global.inc.php          |   5 +
 htdocs/theme/md/style.css.php             |  10 +-
 6 files changed, 538 insertions(+), 490 deletions(-)

diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index 9e54b19db1ce6..bb482bbf43313 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -1149,15 +1149,16 @@ public function select_incoterms($selected = '', $location_incoterms = '', $page
 	 * Return list of types of lines (product or service)
 	 * Example: 0=product, 1=service, 9=other (for external module)
 	 *
-	 * @param 	string 				$selected 	Preselected type
-	 * @param 	string 				$htmlname 	Name of field in html form
-	 * @param 	int<0,1>|string 	$showempty 	Add an empty field
-	 * @param 	int 				$hidetext 	Do not show label 'Type' before combo box (used only if there is at least 2 choices to select)
-	 * @param 	integer 			$forceall 	1=Force to show products and services in combo list, whatever are activated modules, 0=No force, 2=Force to show only Products, 3=Force to show only services, -1=Force none (and set hidden field to 'service')
-	 * @param	string				$morecss	More css
+	 * @param 	string 				$selected 		Preselected type
+	 * @param 	string 				$htmlname 		Name of field in html form
+	 * @param 	int<0,1>|string 	$showempty 		Add an empty field
+	 * @param 	int 				$hidetext 		Do not show label 'Type' before combo box (used only if there is at least 2 choices to select)
+	 * @param 	integer 			$forceall 		1=Force to show products and services in combo list, whatever are activated modules, 0=No force, 2=Force to show only Products, 3=Force to show only services, -1=Force none (and set hidden field to 'service')
+	 * @param	string				$morecss		More css
+	 * @param	int					$useajaxcombo	1=Use ajaxcombo
 	 * @return  void
 	 */
-	public function select_type_of_lines($selected = '', $htmlname = 'type', $showempty = 0, $hidetext = 0, $forceall = 0, $morecss = "")
+	public function select_type_of_lines($selected = '', $htmlname = 'type', $showempty = 0, $hidetext = 0, $forceall = 0, $morecss = "", $useajaxcombo = 1)
 	{
 		// phpcs:enable
 		global $langs;
@@ -1166,11 +1167,11 @@ public function select_type_of_lines($selected = '', $htmlname = 'type', $showem
 		if ($forceall == 1 || (empty($forceall) && isModEnabled("product") && isModEnabled("service"))
 			|| (empty($forceall) && !isModEnabled('product') && !isModEnabled('service'))) {
 			if (empty($hidetext)) {
-				print $langs->trans("Type") . ': ';
+				print $langs->trans("Type").'...';
 			}
 			print '<select class="flat'.($morecss ? ' '.$morecss : '').'" id="select_' . $htmlname . '" name="' . $htmlname . '">';
 			if ($showempty) {
-				print '<option value="-1"';
+				print '<option value="-1" class="opacitymedium"'.($useajaxcombo ? '' : ' disabled="disabled"');
 				if ($selected == -1) {
 					print ' selected';
 				}
@@ -1196,7 +1197,10 @@ public function select_type_of_lines($selected = '', $htmlname = 'type', $showem
 			print '>' . $langs->trans("Service");
 
 			print '</select>';
-			print ajax_combobox('select_' . $htmlname);
+
+			if ($useajaxcombo) {
+				print ajax_combobox('select_' . $htmlname);
+			}
 			//if ($user->admin) print info_admin($langs->trans("YouCanChangeValuesForThisListFromDictionarySetup"),1);
 		}
 		if ((empty($forceall) && !isModEnabled('product') && isModEnabled("service")) || $forceall == 3) {
diff --git a/htdocs/core/js/lib_head.js.php b/htdocs/core/js/lib_head.js.php
index 44cb68bd6971e..b6809a296a586 100644
--- a/htdocs/core/js/lib_head.js.php
+++ b/htdocs/core/js/lib_head.js.php
@@ -1557,11 +1557,13 @@ function price2numjs(amount) {
  * TODO: Recheck with the select2 GH issue and remove once this is fixed on their side
  */
 $(document).on('select2:open', (e) => {
-	console.log("Execute the focus (click on combo or use space when on component");
+	console.log("Execute the focus (click on combo or use space when on component)");
 	const target = $(e.target);
 	if (target && target.length) {
 		let id = target[0].id || target[0].name;
-		if (id.substr(-2) == "[]") id = id.substr(0,id.length-2);
+		if (id.substr(-2) == "[]") {
+			id = id.substr(0,id.length-2);
+		}
 		document.querySelector('input[aria-controls*='+id+']').focus();
 	}
 });
diff --git a/htdocs/core/tpl/objectline_create.tpl.php b/htdocs/core/tpl/objectline_create.tpl.php
index be49279b2ef08..4cf2258fded39 100644
--- a/htdocs/core/tpl/objectline_create.tpl.php
+++ b/htdocs/core/tpl/objectline_create.tpl.php
@@ -204,7 +204,7 @@
 				}
 			}
 
-			// Free line
+			// Select type of free line
 			$labelforempty = 1;
 			print '<span class="prod_entry_mode_free nowraponall">';
 			// Show radio for the non predefined product
@@ -215,10 +215,8 @@
 				print((GETPOST('prod_entry_mode', 'alpha') == 'free' || getDolGlobalString('MAIN_FREE_PRODUCT_CHECKED_BY_DEFAULT')) ? ' checked' : '');
 				print '> ';
 				// Show type selector
-				//print '<span class="textradioforitem">'.$langs->trans("FreeLineOfType").'</span>';
-				$labelforempty = $langs->trans("FreeLineOfType");
+				$labelforempty = $langs->trans("FreeLineOfType").'...';
 				print '</label>';
-				//print ' ';
 			} else {
 				echo '<input type="hidden" id="prod_entry_mode_free" name="prod_entry_mode" value="free">';
 				// Show type selector
@@ -228,11 +226,10 @@
 					} else {
 						$labelforempty = $langs->trans("FreeLineOfType");
 					}
-					//print ' ';
 				}
 			}
 
-			$form->select_type_of_lines(GETPOSTISSET("type") ? GETPOST("type", 'alpha', 2) : -1, 'type', $labelforempty, 1, $forceall, 'minwidth200');
+			$form->select_type_of_lines(GETPOSTISSET("type") ? GETPOST("type", 'alpha', 2) : -1, 'type', $labelforempty, 1, $forceall, 'minwidth200', 0);
 			print '</span>';
 		}
 		// Predefined product/service
@@ -281,10 +278,10 @@
 				if (getDolGlobalString('MAIN_AUTO_OPEN_SELECT2_ON_FOCUS_FOR_CUSTOMER_PRODUCTS')) {
 					?>
 				<script>
-					$(document).ready(function(){
+					$(document).ready(function() {
 						// On first focus on a select2 combo, auto open the menu (this allow to use the keyboard only)
 						$(document).on('focus', '.select2-selection.select2-selection--single', function (e) {
-							console.log('focus on a select2');
+							console.log("focus on a select2 because of MAIN_AUTO_OPEN_SELECT2_ON_FOCUS_FOR_CUSTOMER_PRODUCTS");
 							if ($(this).attr('aria-labelledby') == 'select2-idprod-container')
 							{
 								console.log('open combo');
@@ -321,7 +318,7 @@
 					$(document).ready(function(){
 						// On first focus on a select2 combo, auto open the menu (this allow to use the keyboard only)
 						$(document).on('focus', '.select2-selection.select2-selection--single', function (e) {
-							//console.log('focus on a select2');
+							//console.log('focus on a select2 because of MAIN_AUTO_OPEN_SELECT2_ON_FOCUS_FOR_SUPPLIER_PRODUCTS');
 							if ($(this).attr('aria-labelledby') == 'select2-idprodfournprice-container')
 							{
 								$('#idprodfournprice').select2('open');
@@ -638,6 +635,7 @@ function prefill_service_dates()
 
 
 print "<script>\n";
+
 if (!empty($usemargins) && $user->hasRight('margins', 'creer')) {
 	?>
 	/* Some js test when we click on button "Add" */
@@ -645,12 +643,14 @@ function prefill_service_dates()
 	<?php
 	if (getDolGlobalString('DISPLAY_MARGIN_RATES')) { ?>
 		$("input[name='np_marginRate']:first").blur(function(e) {
+			console.log("np_marginRate blur");
 			return checkFreeLine(e, "np_marginRate");
 		});
 		<?php
 	}
 	if (getDolGlobalString('DISPLAY_MARK_RATES')) { ?>
 		$("input[name='np_markRate']:first").blur(function(e) {
+			console.log("np_markRate blur");
 			return checkFreeLine(e, "np_markRate");
 		});
 		<?php
@@ -707,574 +707,597 @@ function checkFreeLine(e, npRate)
 }
 ?>
 
+	/* Function to set focus on description */
+	function setFocusOnDescription() {
+		console.log("Set focus on description field");
+		/* this focus code works on a standard textarea but not if field was replaced with CKEDITOR */
+		jQuery('#dp_desc').focus();
+		/* this focus code works for CKEDITOR */
+		if (typeof CKEDITOR == "object" && typeof CKEDITOR.instances != "undefined") {
+			var editor = CKEDITOR.instances['dp_desc'];
+			if (editor) {
+				editor.focus();
+			}
+		}
+	}
+
+
 	/* JQuery for product free or predefined select */
 	jQuery(document).ready(function() {
 		jQuery("#price_ht").keyup(function(event) {
 			// console.log(event.which);		// discard event tag and arrows
 			if (event.which != 9 && (event.which < 37 ||event.which > 40) && jQuery("#price_ht").val() != '') {
-			jQuery("#price_ttc").val('');
-			jQuery("#multicurrency_subprice").val('');
-			jQuery("#multicurrency_price_ht").val('');
-		}
-	});
-	jQuery("#price_ttc").keyup(function(event) {
-		// console.log(event.which);		// discard event tag and arrows
-		if (event.which != 9 && (event.which < 37 || event.which > 40) && jQuery("#price_ttc").val() != '') {
-			jQuery("#price_ht").val('');
-			jQuery("#multicurrency_subprice").val('');
-			jQuery("#multicurrency_price_ht").val('');
-		}
-	});
-	jQuery("#multicurrency_subprice").keyup(function(event) {
-		// console.log(event.which);		// discard event tag and arrows
-		if (event.which != 9 && (event.which < 37 || event.which > 40) && jQuery("#multicurrency_subprice").val() != '') {
-			jQuery("#price_ht").val('');
-			jQuery("#price_ttc").val('');
-		}
-	});
-	jQuery("#multicurrency_price_ht").keyup(function(event) {
-		// console.log(event.which);		// discard event tag and arrows
-		if (event.which != 9 && (event.which < 37 || event.which > 40) && jQuery("#multicurrency_price_ht").val() != '') {
-			jQuery("#price_ht").val('');
-			jQuery("#price_ttc").val('');
-		}
-	});
+				jQuery("#price_ttc").val('');
+				jQuery("#multicurrency_subprice").val('');
+				jQuery("#multicurrency_price_ht").val('');
+			}
+		});
 
-	$("#prod_entry_mode_free").on( "click", function() {
-		setforfree();
-	});
-	$("#select_type").change(function()
-	{
-		setforfree();
-
-		if (jQuery('#select_type').val() >= 0) {
-			console.log("Set focus on description field");
-			/* this focus code works on a standard textarea but not if field was replaced with CKEDITOR */
-			jQuery('#dp_desc').focus();
-			/* this focus code works for CKEDITOR */
-			if (typeof CKEDITOR == "object" && typeof CKEDITOR.instances != "undefined") {
-				var editor = CKEDITOR.instances['dp_desc'];
-				if (editor) {
-					editor.focus();
-				}
+		jQuery("#price_ttc").keyup(function(event) {
+			// console.log(event.which);		// discard event tag and arrows
+			if (event.which != 9 && (event.which < 37 || event.which > 40) && jQuery("#price_ttc").val() != '') {
+				jQuery("#price_ht").val('');
+				jQuery("#multicurrency_subprice").val('');
+				jQuery("#multicurrency_price_ht").val('');
 			}
-		}
+		});
+		jQuery("#multicurrency_subprice").keyup(function(event) {
+			// console.log(event.which);		// discard event tag and arrows
+			if (event.which != 9 && (event.which < 37 || event.which > 40) && jQuery("#multicurrency_subprice").val() != '') {
+				jQuery("#price_ht").val('');
+				jQuery("#price_ttc").val('');
+			}
+		});
+		jQuery("#multicurrency_price_ht").keyup(function(event) {
+			// console.log(event.which);		// discard event tag and arrows
+			if (event.which != 9 && (event.which < 37 || event.which > 40) && jQuery("#multicurrency_price_ht").val() != '') {
+				jQuery("#price_ht").val('');
+				jQuery("#price_ttc").val('');
+			}
+		});
 
-		console.log("Hide/show date according to product type");
-		if (jQuery('#select_type').val() == '0')
+		$("#select_type").change(function()
 		{
-			jQuery('#trlinefordates').hide();
-			jQuery('.divlinefordates').hide();
-		}
-		else
-		{
-			jQuery('#trlinefordates').show();
-			jQuery('.divlinefordates').show();
-		}
-	});
+			setforfree();
 
-	$("#prod_entry_mode_predef").on( "click", function() {
-		console.log("click prod_entry_mode_predef");
-		setforpredef();
-		jQuery('#trlinefordates').show();
-	});
+			console.log("Hide/show date according to product type select_type="+jQuery('#select_type').val());
+			if (jQuery('#select_type').val() == '0')
+			{
+				jQuery('#trlinefordates').hide();
+				jQuery('.divlinefordates').hide();
+			}
+			else
+			{
+				jQuery('#trlinefordates').show();
+				jQuery('.divlinefordates').show();
+			}
+
+			if (jQuery("#select_type").val() != '-1') {
+				console.log("we remove class");
+				jQuery("#select_type").removeClass("placeholder");
+				setFocusOnDescription();
+			} else {
+				console.log("we add class");
+				jQuery("#select_type").addClass("placeholder");
+			}
+		});
+
+		$("#prod_entry_mode_free").on( "click", function() {
+			setforfree();
+		});
+
+		$("#prod_entry_mode_predef").on( "click", function() {
+			console.log("click prod_entry_mode_predef");
+			jQuery("#select_type").addClass("placeholder");
+			setforpredef();
+			jQuery('#trlinefordates').show();
+		});
 
-	<?php
-	if (!$freelines) { ?>
-		$("#prod_entry_mode_predef").click();
 		<?php
-	}
+		if (!$freelines) { ?>
+			jQuery("#prod_entry_mode_predef").click();
+			<?php
+		} else { ?>
+			jQuery("#select_type").addClass("placeholder");
+			<?php
+		}
 
-	if (in_array($this->table_element_line, array('propaldet', 'commandedet', 'facturedet'))) { ?>
-	$("#date_start, #date_end").focusout(function() {
-		let type = $(this).attr('type');
-		let mandatoryP = $(this).attr('mandatoryperiod');
-		if (type == 1 && mandatoryP == 1) {
-			if ($(this).val() == ''  && !$(this).hasClass('inputmandatory')) {
-				$(this).addClass('inputmandatory');
-			}else{
-				$(this).removeClass('inputmandatory');
+		if (in_array($this->table_element_line, array('propaldet', 'commandedet', 'facturedet'))) { ?>
+		$("#date_start, #date_end").focusout(function() {
+			console.log("focusout of date");
+			let type = $(this).attr('type');
+			let mandatoryP = $(this).attr('mandatoryperiod');
+			if (type == 1 && mandatoryP == 1) {
+				if ($(this).val() == ''  && !$(this).hasClass('inputmandatory')) {
+					$(this).addClass('inputmandatory');
+				}else{
+					$(this).removeClass('inputmandatory');
+				}
 			}
-		}
-	});
+		});
 			<?php
-	} ?>
-	/* When changing predefined product, we reload list of supplier prices required for margin combo */
-	$("#idprod, #idprodfournprice").change(function()
-	{
-		console.log("objectline_create.tpl Call method change() after change on #idprod or #idprodfournprice (senderissupplier=<?php echo $senderissupplier; ?>). this.val = "+$(this).val());
+		} ?>
 
-		setforpredef();		// TODO Keep vat combo visible and set it to first entry into list that match result of get_default_tva(product)
+		/* When changing predefined product, we reload list of supplier prices required for margin combo */
+		$("#idprod, #idprodfournprice").change(function()
+		{
+			console.log("objectline_create.tpl Call method change() after change on #idprod or #idprodfournprice (senderissupplier=<?php echo $senderissupplier; ?>). this.val = "+$(this).val());
 
-		jQuery('#trlinefordates').show();
+			setforpredef();		// TODO Keep vat combo visible and set it to first entry into list that match result of get_default_tva(product)
 
-		<?php
-		if (!getDolGlobalString('MAIN_DISABLE_EDIT_PREDEF_PRICEHT') && empty($senderissupplier)) {
-			?>
-			var pbq = parseInt($('option:selected', this).attr('data-pbq'));	/* If product was selected with a HTML select */
-			if (isNaN(pbq)) { pbq = jQuery('#idprod').attr('data-pbq'); } 		/* If product was selected with a HTML input with autocomplete */
+			jQuery('#trlinefordates').show();
 
-			if ((jQuery('#idprod').val() > 0 || jQuery('#idprodfournprice').val()) && ! isNaN(pbq) && pbq > 0)
-			{
-				console.log("objectline_create.tpl We are in a price per qty context, we do not call ajax/product, init of fields is done few lines later");
-			} else {
-				<?php if (getDolGlobalString('PRODUIT_CUSTOMER_PRICES_BY_QTY') || getDolGlobalString('PRODUIT_CUSTOMER_PRICES_BY_QTY_MULTIPRICES')) { ?>
-					if (isNaN(pbq)) { console.log("We use experimental option PRODUIT_CUSTOMER_PRICES_BY_QTY or PRODUIT_CUSTOMER_PRICES_BY_QTY but we could not get the id of pbq from product combo list, so load of price may be 0 if product has different prices"); }
-				<?php } ?>
-				// Get the price for the product and display it
-				console.log("Load unit price and set it into #price_ht or #price_ttc for product id="+$(this).val()+" socid=<?php print $object->socid; ?>");
-				$.post('<?php echo DOL_URL_ROOT; ?>/product/ajax/products.php?action=fetch',
-					{ 'id': $(this).val(), 'socid': <?php print $object->socid; ?>, 'token': '<?php print currentToken(); ?>', 'addalsovatforthirdpartyid': 1 },
-					function(data) {
-						console.log("objectline_create.tpl Load unit price ends, we got value ht="+data.price_ht+" ttc="+data.price_ttc+" pricebasetype="+data.pricebasetype);
-
-						$('#date_start').removeAttr('type');
-						$('#date_end').removeAttr('type');
-						$('#date_start').attr('type', data.type);
-						$('#date_end').attr('type', data.type);
-
-						$('#date_start').removeAttr('mandatoryperiod');
-						$('#date_end').removeAttr('mandatoryperiod');
-						$('#date_start').attr('mandatoryperiod', data.mandatory_period);
-						$('#date_end').attr('mandatoryperiod', data.mandatory_period);
-
-						// service and we set mandatory_period to true
-						if (data.mandatory_period == 1 && data.type == 1) {
-							jQuery('#date_start').addClass('inputmandatory');
-							jQuery('#date_end').addClass('inputmandatory');
-						} else {
-							jQuery('#date_start').removeClass('inputmandatory');
-							jQuery('#date_end').removeClass('inputmandatory');
-						}
+			<?php
+			if (!getDolGlobalString('MAIN_DISABLE_EDIT_PREDEF_PRICEHT') && empty($senderissupplier)) {
+				?>
+				var pbq = parseInt($('option:selected', this).attr('data-pbq'));	/* If product was selected with a HTML select */
+				if (isNaN(pbq)) { pbq = jQuery('#idprod').attr('data-pbq'); } 		/* If product was selected with a HTML input with autocomplete */
 
-						if (<?php echo (int) $inputalsopricewithtax; ?> == 1 && data.pricebasetype == 'TTC' && <?php print getDolGlobalInt('MAIN_NO_INPUT_PRICE_WITH_TAX') ? 'false' : 'true'; ?>) {
-							console.log("objectline_create.tpl set content of price_ttc");
-							jQuery("#price_ttc").val(data.price_ttc);
-						} else {
-							console.log("objectline_create.tpl set content of price_ht");
-							jQuery("#price_ht").val(data.price_ht);
-						}
+				if ((jQuery('#idprod').val() > 0 || jQuery('#idprodfournprice').val()) && ! isNaN(pbq) && pbq > 0)
+				{
+					console.log("objectline_create.tpl We are in a price per qty context, we do not call ajax/product, init of fields is done few lines later");
+				} else {
+					<?php if (getDolGlobalString('PRODUIT_CUSTOMER_PRICES_BY_QTY') || getDolGlobalString('PRODUIT_CUSTOMER_PRICES_BY_QTY_MULTIPRICES')) { ?>
+						if (isNaN(pbq)) { console.log("We use experimental option PRODUIT_CUSTOMER_PRICES_BY_QTY or PRODUIT_CUSTOMER_PRICES_BY_QTY but we could not get the id of pbq from product combo list, so load of price may be 0 if product has different prices"); }
+					<?php } ?>
+					// Get the price for the product and display it
+					console.log("Load unit price and set it into #price_ht or #price_ttc for product id="+$(this).val()+" socid=<?php print $object->socid; ?>");
+					$.post('<?php echo DOL_URL_ROOT; ?>/product/ajax/products.php?action=fetch',
+						{ 'id': $(this).val(), 'socid': <?php print $object->socid; ?>, 'token': '<?php print currentToken(); ?>', 'addalsovatforthirdpartyid': 1 },
+						function(data) {
+							console.log("objectline_create.tpl Load unit price ends, we got value ht="+data.price_ht+" ttc="+data.price_ttc+" pricebasetype="+data.pricebasetype);
+
+							$('#date_start').removeAttr('type');
+							$('#date_end').removeAttr('type');
+							$('#date_start').attr('type', data.type);
+							$('#date_end').attr('type', data.type);
+
+							$('#date_start').removeAttr('mandatoryperiod');
+							$('#date_end').removeAttr('mandatoryperiod');
+							$('#date_start').attr('mandatoryperiod', data.mandatory_period);
+							$('#date_end').attr('mandatoryperiod', data.mandatory_period);
+
+							// service and we set mandatory_period to true
+							if (data.mandatory_period == 1 && data.type == 1) {
+								jQuery('#date_start').addClass('inputmandatory');
+								jQuery('#date_end').addClass('inputmandatory');
+							} else {
+								jQuery('#date_start').removeClass('inputmandatory');
+								jQuery('#date_end').removeClass('inputmandatory');
+							}
+
+							if (<?php echo (int) $inputalsopricewithtax; ?> == 1 && data.pricebasetype == 'TTC' && <?php print getDolGlobalInt('MAIN_NO_INPUT_PRICE_WITH_TAX') ? 'false' : 'true'; ?>) {
+								console.log("objectline_create.tpl set content of price_ttc");
+								jQuery("#price_ttc").val(data.price_ttc);
+							} else {
+								console.log("objectline_create.tpl set content of price_ht");
+								jQuery("#price_ht").val(data.price_ht);
+							}
 
-						// Set values for any fields in the form options_SOMETHING
-						for (var key in data.array_options) {
-							if (data.array_options.hasOwnProperty(key)) {
-								var field = jQuery("#" + key);
-								if(field.length > 0){
-									console.log("objectline_create.tpl set content of options_" + key);
-									field.val(data.array_options[key]);
+							// Set values for any fields in the form options_SOMETHING
+							for (var key in data.array_options) {
+								if (data.array_options.hasOwnProperty(key)) {
+									var field = jQuery("#" + key);
+									if(field.length > 0){
+										console.log("objectline_create.tpl set content of options_" + key);
+										field.val(data.array_options[key]);
+									}
 								}
 							}
-						}
 
-						var tva_tx = data.tva_tx;
-						var default_vat_code = data.default_vat_code;
-
-						// Now set the VAT
-						var stringforvatrateselection = tva_tx;
-						if (typeof default_vat_code != 'undefined' && default_vat_code != null && default_vat_code != '') {
-							stringforvatrateselection = stringforvatrateselection+' ('+default_vat_code+')';
-							<?php
-							// Special case for India
-							if (getDolGlobalString('MAIN_SALETAX_AUTOSWITCH_I_CS_FOR_INDIA')) {
-								?>
-								console.log("MAIN_SALETAX_AUTOSWITCH_I_CS_FOR_INDIA is on so we check if we need to autoswith the vat code");
-								console.log("mysoc->country_code=<?php echo $mysoc->country_code; ?> thirdparty->country_code=<?php echo $object->thirdparty->country_code; ?>");
-								new_default_vat_code = default_vat_code;
+							var tva_tx = data.tva_tx;
+							var default_vat_code = data.default_vat_code;
+
+							// Now set the VAT
+							var stringforvatrateselection = tva_tx;
+							if (typeof default_vat_code != 'undefined' && default_vat_code != null && default_vat_code != '') {
+								stringforvatrateselection = stringforvatrateselection+' ('+default_vat_code+')';
 								<?php
-								if ($mysoc->country_code == 'IN' && !empty($object->thirdparty) && $object->thirdparty->country_code == 'IN' && $mysoc->state_code == $object->thirdparty->state_code) {
-									// We are in India and states are same, we revert the vat code "I-x" into "CS-x"
+								// Special case for India
+								if (getDolGlobalString('MAIN_SALETAX_AUTOSWITCH_I_CS_FOR_INDIA')) {
 									?>
-									console.log("Countries are both IN and states are same, so we revert I into CS in default_vat_code="+default_vat_code);
-									new_default_vat_code = default_vat_code.replace(/^I\-/, 'C+S-');
+									console.log("MAIN_SALETAX_AUTOSWITCH_I_CS_FOR_INDIA is on so we check if we need to autoswith the vat code");
+									console.log("mysoc->country_code=<?php echo $mysoc->country_code; ?> thirdparty->country_code=<?php echo $object->thirdparty->country_code; ?>");
+									new_default_vat_code = default_vat_code;
 									<?php
-								} elseif ($mysoc->country_code == 'IN' && !empty($object->thirdparty) && $object->thirdparty->country_code == 'IN' && $mysoc->state_code != $object->thirdparty->state_code) {
-									// We are in India and states differs, we revert the vat code "CS-x" into "I-x"
-									?>
-									console.log("Countries are both IN and states differs, so we revert CS into I in default_vat_code="+default_vat_code);
-									new_default_vat_code = default_vat_code.replace(/^C\+S\-/, 'I-');
+									if ($mysoc->country_code == 'IN' && !empty($object->thirdparty) && $object->thirdparty->country_code == 'IN' && $mysoc->state_code == $object->thirdparty->state_code) {
+										// We are in India and states are same, we revert the vat code "I-x" into "CS-x"
+										?>
+										console.log("Countries are both IN and states are same, so we revert I into CS in default_vat_code="+default_vat_code);
+										new_default_vat_code = default_vat_code.replace(/^I\-/, 'C+S-');
+										<?php
+									} elseif ($mysoc->country_code == 'IN' && !empty($object->thirdparty) && $object->thirdparty->country_code == 'IN' && $mysoc->state_code != $object->thirdparty->state_code) {
+										// We are in India and states differs, we revert the vat code "CS-x" into "I-x"
+										?>
+										console.log("Countries are both IN and states differs, so we revert CS into I in default_vat_code="+default_vat_code);
+										new_default_vat_code = default_vat_code.replace(/^C\+S\-/, 'I-');
+										<?php
+									} ?>
+									if (new_default_vat_code != default_vat_code && jQuery('#tva_tx option:contains("'+new_default_vat_code+'")').val()) {
+										console.log("We found en entry into VAT with new default_vat_code, we will use it");
+										stringforvatrateselection = jQuery('#tva_tx option:contains("'+new_default_vat_code+'")').val();
+									}
 									<?php
 								} ?>
-								if (new_default_vat_code != default_vat_code && jQuery('#tva_tx option:contains("'+new_default_vat_code+'")').val()) {
-									console.log("We found en entry into VAT with new default_vat_code, we will use it");
-									stringforvatrateselection = jQuery('#tva_tx option:contains("'+new_default_vat_code+'")').val();
-								}
+							}
+							// Set vat rate if field is an input box
+							$('#tva_tx').val(tva_tx);
+							// Set vat rate by selecting the combo
+							//$('#tva_tx option').val(tva_tx);	// This is bugged, it replaces the vat key of all options
+							$('#tva_tx option').removeAttr('selected');
+							console.log("stringforvatrateselection="+stringforvatrateselection+" -> value of option label for this key="+$('#tva_tx option[value="'+stringforvatrateselection+'"]').val());
+							$('#tva_tx option[value="'+stringforvatrateselection+'"]').prop('selected', true);
+
 								<?php
-							} ?>
-						}
-						// Set vat rate if field is an input box
-						$('#tva_tx').val(tva_tx);
-						// Set vat rate by selecting the combo
-						//$('#tva_tx option').val(tva_tx);	// This is bugged, it replaces the vat key of all options
-						$('#tva_tx option').removeAttr('selected');
-						console.log("stringforvatrateselection="+stringforvatrateselection+" -> value of option label for this key="+$('#tva_tx option[value="'+stringforvatrateselection+'"]').val());
-						$('#tva_tx option[value="'+stringforvatrateselection+'"]').prop('selected', true);
-
-							<?php
-							if (getDolGlobalInt('PRODUIT_AUTOFILL_DESC') == 1) {
-								if (getDolGlobalInt('MAIN_MULTILANGS') && getDolGlobalString('PRODUIT_TEXTS_IN_THIRDPARTY_LANGUAGE')) { ?>
-						var proddesc = data.desc_trans;
+								if (getDolGlobalInt('PRODUIT_AUTOFILL_DESC') == 1) {
+									if (getDolGlobalInt('MAIN_MULTILANGS') && getDolGlobalString('PRODUIT_TEXTS_IN_THIRDPARTY_LANGUAGE')) { ?>
+							var proddesc = data.desc_trans;
+										<?php
+									} else { ?>
+							var proddesc = data.desc;
+										<?php
+									} ?>
+							console.log("objectline_create.tpl Load description into text area : "+proddesc);
 									<?php
-								} else { ?>
-						var proddesc = data.desc;
+									if (getDolGlobalString('FCKEDITOR_ENABLE_DETAILS')) { ?>
+							if (typeof CKEDITOR == "object" && typeof CKEDITOR.instances != "undefined")
+							{
+								var editor = CKEDITOR.instances['dp_desc'];
+								if (editor) {
+									editor.setData(proddesc);
+								}
+							}
+										<?php
+									} else { ?>
+							jQuery('#dp_desc').text(proddesc);
+										<?php
+									} ?>
 									<?php
 								} ?>
-						console.log("objectline_create.tpl Load description into text area : "+proddesc);
 								<?php
-								if (getDolGlobalString('FCKEDITOR_ENABLE_DETAILS')) { ?>
-						if (typeof CKEDITOR == "object" && typeof CKEDITOR.instances != "undefined")
-						{
-							var editor = CKEDITOR.instances['dp_desc'];
-							if (editor) {
-								editor.setData(proddesc);
-							}
-						}
-									<?php
-								} else { ?>
-						jQuery('#dp_desc').text(proddesc);
+								if (getDolGlobalString('PRODUCT_LOAD_EXTRAFIELD_INTO_OBJECTLINES')) { ?>
+								jQuery.each(data.array_options, function( key, value ) {
+									jQuery('div[class*="det'+key.replace('options_','_extras_')+'"] > #'+key).val(value);
+								});
 									<?php
 								} ?>
-								<?php
-							} ?>
-							<?php
-							if (getDolGlobalString('PRODUCT_LOAD_EXTRAFIELD_INTO_OBJECTLINES')) { ?>
-							jQuery.each(data.array_options, function( key, value ) {
-								jQuery('div[class*="det'+key.replace('options_','_extras_')+'"] > #'+key).val(value);
-							});
-								<?php
-							} ?>
-					},
-					'json'
-				);
+						},
+						'json'
+					);
+				}
+					<?php
 			}
-				<?php
-		}
 
-		if (!empty($usemargins) && $user->hasRight('margins', 'creer')) {
-			$langs->load('stocks'); ?>
+			if (!empty($usemargins) && $user->hasRight('margins', 'creer')) {
+				$langs->load('stocks'); ?>
 
-			/* Code for margin */
-			$("#fournprice_predef").find("option").remove();
-			$("#fournprice_predef").hide();
-			$("#buying_price").val("").show();
+				/* Code for margin */
+				$("#fournprice_predef").find("option").remove();
+				$("#fournprice_predef").hide();
+				$("#buying_price").val("").show();
 
-			/* Call post to load content of combo list fournprice_predef */
-			var token = '<?php echo currentToken(); ?>';		// For AJAX Call we use old 'token' and not 'newtoken'
-			$.post('<?php echo DOL_URL_ROOT; ?>/fourn/ajax/getSupplierPrices.php?bestpricefirst=1', { 'idprod': $(this).val(), 'token': token }, function(data) {
-				if (data && data.length > 0)
-				{
-					var options = ''; var defaultkey = ''; var defaultprice = ''; var bestpricefound = 0;
+				/* Call post to load content of combo list fournprice_predef */
+				var token = '<?php echo currentToken(); ?>';		// For AJAX Call we use old 'token' and not 'newtoken'
+				$.post('<?php echo DOL_URL_ROOT; ?>/fourn/ajax/getSupplierPrices.php?bestpricefirst=1', { 'idprod': $(this).val(), 'token': token }, function(data) {
+					if (data && data.length > 0)
+					{
+						var options = ''; var defaultkey = ''; var defaultprice = ''; var bestpricefound = 0;
 
-					var bestpriceid = 0; var bestpricevalue = 0;
-					var pmppriceid = 0; var pmppricevalue = 0;
-					var costpriceid = 0; var costpricevalue = 0;
+						var bestpriceid = 0; var bestpricevalue = 0;
+						var pmppriceid = 0; var pmppricevalue = 0;
+						var costpriceid = 0; var costpricevalue = 0;
 
-					/* setup of margin calculation */
-					var defaultbuyprice = '<?php
-					if (isset($conf->global->MARGIN_TYPE)) {
-						if (getDolGlobalString('MARGIN_TYPE') == '1') {
-							print 'bestsupplierprice';
-						}
-						if (getDolGlobalString('MARGIN_TYPE') == 'pmp') {
-							print 'pmp';
-						}
-						if (getDolGlobalString('MARGIN_TYPE') == 'costprice') {
-							print 'costprice';
-						}
-					} ?>';
-					console.log("objectline_create.tpl we will set the field for margin. defaultbuyprice="+defaultbuyprice);
+						/* setup of margin calculation */
+						var defaultbuyprice = '<?php
+						if (isset($conf->global->MARGIN_TYPE)) {
+							if (getDolGlobalString('MARGIN_TYPE') == '1') {
+								print 'bestsupplierprice';
+							}
+							if (getDolGlobalString('MARGIN_TYPE') == 'pmp') {
+								print 'pmp';
+							}
+							if (getDolGlobalString('MARGIN_TYPE') == 'costprice') {
+								print 'costprice';
+							}
+						} ?>';
+						console.log("objectline_create.tpl we will set the field for margin. defaultbuyprice="+defaultbuyprice);
 
-					var i = 0;
-					$(data).each(function() {
-						/* Warning: Lines must be processed in order: best supplier price, then pmpprice line then costprice */
-						if (this.id != 'pmpprice' && this.id != 'costprice')
-						{
-							i++;
-							this.price = parseFloat(this.price); // to fix when this.price >0
-							// If margin is calculated on best supplier price, we set it by default (but only if value is not 0)
-							//console.log("id="+this.id+"-price="+this.price+"-"+(this.price > 0));
-							if (bestpricefound == 0 && this.price > 0) { defaultkey = this.id; defaultprice = this.price; bestpriceid = this.id; bestpricevalue = this.price; bestpricefound=1; }	// bestpricefound is used to take the first price > 0
-						}
-						if (this.id == 'pmpprice')
-						{
-							// If margin is calculated on PMP, we set it by default (but only if value is not 0)
-							console.log("id="+this.id+"-price="+this.price);
-							if ('pmp' == defaultbuyprice || 'costprice' == defaultbuyprice)
+						var i = 0;
+						$(data).each(function() {
+							/* Warning: Lines must be processed in order: best supplier price, then pmpprice line then costprice */
+							if (this.id != 'pmpprice' && this.id != 'costprice')
 							{
-								if (this.price > 0) {
-									defaultkey = this.id; defaultprice = this.price; pmppriceid = this.id; pmppricevalue = this.price;
-									//console.log("pmppricevalue="+pmppricevalue);
+								i++;
+								this.price = parseFloat(this.price); // to fix when this.price >0
+								// If margin is calculated on best supplier price, we set it by default (but only if value is not 0)
+								//console.log("id="+this.id+"-price="+this.price+"-"+(this.price > 0));
+								if (bestpricefound == 0 && this.price > 0) { defaultkey = this.id; defaultprice = this.price; bestpriceid = this.id; bestpricevalue = this.price; bestpricefound=1; }	// bestpricefound is used to take the first price > 0
+							}
+							if (this.id == 'pmpprice')
+							{
+								// If margin is calculated on PMP, we set it by default (but only if value is not 0)
+								console.log("id="+this.id+"-price="+this.price);
+								if ('pmp' == defaultbuyprice || 'costprice' == defaultbuyprice)
+								{
+									if (this.price > 0) {
+										defaultkey = this.id; defaultprice = this.price; pmppriceid = this.id; pmppricevalue = this.price;
+										//console.log("pmppricevalue="+pmppricevalue);
+									}
 								}
 							}
-						}
-						if (this.id == 'costprice')
-						{
-							// If margin is calculated on Cost price, we set it by default (but only if value is not 0)
-							console.log("id="+this.id+"-price="+this.price+"-pmppricevalue="+pmppricevalue);
-							if ('costprice' == defaultbuyprice)
+							if (this.id == 'costprice')
 							{
-								if (this.price > 0) { defaultkey = this.id; defaultprice = this.price; costpriceid = this.id; costpricevalue = this.price; }
-								else if (pmppricevalue > 0) { defaultkey = 'pmpprice'; defaultprice = pmppricevalue; }
+								// If margin is calculated on Cost price, we set it by default (but only if value is not 0)
+								console.log("id="+this.id+"-price="+this.price+"-pmppricevalue="+pmppricevalue);
+								if ('costprice' == defaultbuyprice)
+								{
+									if (this.price > 0) { defaultkey = this.id; defaultprice = this.price; costpriceid = this.id; costpricevalue = this.price; }
+									else if (pmppricevalue > 0) { defaultkey = 'pmpprice'; defaultprice = pmppricevalue; }
+								}
 							}
-						}
-						options += '<option value="'+this.id+'" price="'+this.price+'">'+this.label+'</option>';
-					});
-					options += '<option value="inputprice" price="'+defaultprice+'"><?php echo dol_escape_js($langs->trans("InputPrice").'...'); ?></option>';
-
-					console.log("finally selected defaultkey="+defaultkey+" defaultprice for buying price="+defaultprice);
+							options += '<option value="'+this.id+'" price="'+this.price+'">'+this.label+'</option>';
+						});
+						options += '<option value="inputprice" price="'+defaultprice+'"><?php echo dol_escape_js($langs->trans("InputPrice").'...'); ?></option>';
 
-					$("#fournprice_predef").html(options).show();
-					if (defaultkey != '')
-					{
-						$("#fournprice_predef").val(defaultkey);
-					}
+						console.log("finally selected defaultkey="+defaultkey+" defaultprice for buying price="+defaultprice);
 
-					/* At loading, no product are yet selected, so we hide field of buying_price */
-					$("#buying_price").hide();
+						$("#fournprice_predef").html(options).show();
+						if (defaultkey != '')
+						{
+							$("#fournprice_predef").val(defaultkey);
+						}
 
-					/* Define default price at loading */
-					var defaultprice = $("#fournprice_predef").find('option:selected').attr("price");
-					$("#buying_price").val(defaultprice);
+						/* At loading, no product are yet selected, so we hide field of buying_price */
+						$("#buying_price").hide();
 
-					$("#fournprice_predef").change(function() {
-						console.log("change on fournprice_predef");
-						/* Hide field buying_price according to choice into list (if 'inputprice' or not) */
-						var linevalue=$(this).find('option:selected').val();
-						var pricevalue = $(this).find('option:selected').attr("price");
-						if (linevalue != 'inputprice' && linevalue != 'pmpprice') {
-							$("#buying_price").val(pricevalue).hide();	/* We set value then hide field */
-						}
-						if (linevalue == 'inputprice') {
-							$('#buying_price').show();
-						}
-						if (linevalue == 'pmpprice') {
-							$("#buying_price").val(pricevalue);
-							$('#buying_price').hide();
-						}
-					});
-				}
-			},
-			'json');
+						/* Define default price at loading */
+						var defaultprice = $("#fournprice_predef").find('option:selected').attr("price");
+						$("#buying_price").val(defaultprice);
 
-					<?php
-		}
-		?>
+						$("#fournprice_predef").change(function() {
+							console.log("change on fournprice_predef");
+							/* Hide field buying_price according to choice into list (if 'inputprice' or not) */
+							var linevalue=$(this).find('option:selected').val();
+							var pricevalue = $(this).find('option:selected').attr("price");
+							if (linevalue != 'inputprice' && linevalue != 'pmpprice') {
+								$("#buying_price").val(pricevalue).hide();	/* We set value then hide field */
+							}
+							if (linevalue == 'inputprice') {
+								$('#buying_price').show();
+							}
+							if (linevalue == 'pmpprice') {
+								$("#buying_price").val(pricevalue);
+								$('#buying_price').hide();
+							}
+						});
+					}
+				},
+				'json');
 
-		<?php
-		if (getDolGlobalString('PRODUIT_CUSTOMER_PRICES_BY_QTY') || getDolGlobalString('PRODUIT_CUSTOMER_PRICES_BY_QTY_MULTIPRICES')) {
+						<?php
+			}
 			?>
-			/* To process customer price per quantity (PRODUIT_CUSTOMER_PRICES_BY_QTY works only if combo product is not an ajax after x key pressed) */
-			var pbq = parseInt($('option:selected', this).attr('data-pbq'));				// When select is done from HTML select
-			if (isNaN(pbq)) { pbq = jQuery('#idprod').attr('data-pbq');	}					// When select is done from HTML input with autocomplete
-			var pbqup = parseFloat($('option:selected', this).attr('data-pbqup'));
-			if (isNaN(pbqup)) { pbqup = jQuery('#idprod').attr('data-pbqup');	}
-			var pbqbase = $('option:selected', this).attr('data-pbqbase');
-			if (isNaN(pbqbase)) { pbqbase = jQuery('#idprod').attr('data-pbqbase');	}
-			var pbqqty = parseFloat($('option:selected', this).attr('data-pbqqty'));
-			if (isNaN(pbqqty)) { pbqqty = jQuery('#idprod').attr('data-pbqqty');	}
-			var pbqpercent = parseFloat($('option:selected', this).attr('data-pbqpercent'));
-			if (isNaN(pbqpercent)) { pbqpercent = jQuery('#idprod').attr('data-pbqpercent');	}
-
-			if ((jQuery('#idprod').val() > 0) && ! isNaN(pbq) && pbq > 0)
-			{
-				var pbqupht = pbqup;	/* TODO support of price per qty TTC not yet available */
 
-				console.log("We choose a price by quanty price_by_qty id = "+pbq+" price_by_qty upht = "+pbqupht+" price_by_qty qty = "+pbqqty+" price_by_qty percent = "+pbqpercent);
-				jQuery("#pbq").val(pbq);
-				jQuery("#price_ht").val(pbqupht);
-				if (jQuery("#qty").val() < pbqqty)
-				{
-					jQuery("#qty").val(pbqqty);
-				}
-				if (jQuery("#remise_percent").val() < pbqpercent)
-				{
-					jQuery("#remise_percent").val(pbqpercent);
-				}
-			} else { jQuery("#pbq").val(''); }
 			<?php
-		}
-		?>
+			if (getDolGlobalString('PRODUIT_CUSTOMER_PRICES_BY_QTY') || getDolGlobalString('PRODUIT_CUSTOMER_PRICES_BY_QTY_MULTIPRICES')) {
+				?>
+				/* To process customer price per quantity (PRODUIT_CUSTOMER_PRICES_BY_QTY works only if combo product is not an ajax after x key pressed) */
+				var pbq = parseInt($('option:selected', this).attr('data-pbq'));				// When select is done from HTML select
+				if (isNaN(pbq)) { pbq = jQuery('#idprod').attr('data-pbq');	}					// When select is done from HTML input with autocomplete
+				var pbqup = parseFloat($('option:selected', this).attr('data-pbqup'));
+				if (isNaN(pbqup)) { pbqup = jQuery('#idprod').attr('data-pbqup');	}
+				var pbqbase = $('option:selected', this).attr('data-pbqbase');
+				if (isNaN(pbqbase)) { pbqbase = jQuery('#idprod').attr('data-pbqbase');	}
+				var pbqqty = parseFloat($('option:selected', this).attr('data-pbqqty'));
+				if (isNaN(pbqqty)) { pbqqty = jQuery('#idprod').attr('data-pbqqty');	}
+				var pbqpercent = parseFloat($('option:selected', this).attr('data-pbqpercent'));
+				if (isNaN(pbqpercent)) { pbqpercent = jQuery('#idprod').attr('data-pbqpercent');	}
+
+				if ((jQuery('#idprod').val() > 0) && ! isNaN(pbq) && pbq > 0)
+				{
+					var pbqupht = pbqup;	/* TODO support of price per qty TTC not yet available */
+
+					console.log("We choose a price by quanty price_by_qty id = "+pbq+" price_by_qty upht = "+pbqupht+" price_by_qty qty = "+pbqqty+" price_by_qty percent = "+pbqpercent);
+					jQuery("#pbq").val(pbq);
+					jQuery("#price_ht").val(pbqupht);
+					if (jQuery("#qty").val() < pbqqty)
+					{
+						jQuery("#qty").val(pbqqty);
+					}
+					if (jQuery("#remise_percent").val() < pbqpercent)
+					{
+						jQuery("#remise_percent").val(pbqpercent);
+					}
+				} else { jQuery("#pbq").val(''); }
+				<?php
+			}
+			?>
 
 
-		// Deal with supplier ref price (idprodfournprice = int)
-		if (jQuery('#idprodfournprice').val() > 0)
-		{
-			console.log("objectline_create.tpl #idprodfournprice is an ID > 0, so we set some properties into page");
+			// Deal with supplier ref price (idprodfournprice = int)
+			if (jQuery('#idprodfournprice').val() > 0)
+			{
+				console.log("objectline_create.tpl #idprodfournprice is an ID > 0, so we set some properties into page");
+
+				var up = parseFloat($('option:selected', this).attr('data-up')); 							// When select is done from HTML select
+				if (isNaN(up)) { up = parseFloat(jQuery('#idprodfournprice').attr('data-up'));}				// When select is done from HTML input with ajax autocomplete
 
-			var up = parseFloat($('option:selected', this).attr('data-up')); 							// When select is done from HTML select
-			if (isNaN(up)) { up = parseFloat(jQuery('#idprodfournprice').attr('data-up'));}				// When select is done from HTML input with ajax autocomplete
+				var up_locale = $('option:selected', this).attr('data-up-locale');							// When select is done from HTML select
+				if (typeof up_locale === 'undefined') { up_locale = jQuery('#idprodfournprice').attr('data-up-locale');}	// When select is done from HTML input with ajax autocomplete
 
-			var up_locale = $('option:selected', this).attr('data-up-locale');							// When select is done from HTML select
-			if (typeof up_locale === 'undefined') { up_locale = jQuery('#idprodfournprice').attr('data-up-locale');}	// When select is done from HTML input with ajax autocomplete
+				var qty = parseFloat($('option:selected', this).attr('data-qty'));
+				if (isNaN(qty)) { qty = parseFloat(jQuery('#idprodfournprice').attr('data-qty'));}
 
-			var qty = parseFloat($('option:selected', this).attr('data-qty'));
-			if (isNaN(qty)) { qty = parseFloat(jQuery('#idprodfournprice').attr('data-qty'));}
+				var discount = parseFloat($('option:selected', this).attr('data-discount'));
+				if (isNaN(discount)) { discount = parseFloat(jQuery('#idprodfournprice').attr('data-discount'));}
 
-			var discount = parseFloat($('option:selected', this).attr('data-discount'));
-			if (isNaN(discount)) { discount = parseFloat(jQuery('#idprodfournprice').attr('data-discount'));}
+				var tva_tx = parseFloat($('option:selected', this).attr('data-tvatx')); 					// When select is done from HTML select
+				if (isNaN(tva_tx)) { tva_tx = parseFloat(jQuery('#idprodfournprice').attr('data-tvatx'));}	// When select is done from HTML input with ajax autocomplete
 
-			var tva_tx = parseFloat($('option:selected', this).attr('data-tvatx')); 					// When select is done from HTML select
-			if (isNaN(tva_tx)) { tva_tx = parseFloat(jQuery('#idprodfournprice').attr('data-tvatx'));}	// When select is done from HTML input with ajax autocomplete
+				var default_vat_code = $('option:selected', this).attr('data-default-vat-code');							 					// When select is done from HTML select
+				if (typeof default_vat_code === 'undefined') { default_vat_code = jQuery('#idprodfournprice').attr('data-default-vat-code');}	// When select is done from HTML input with ajax autocomplete
 
-			var default_vat_code = $('option:selected', this).attr('data-default-vat-code');							 					// When select is done from HTML select
-			if (typeof default_vat_code === 'undefined') { default_vat_code = jQuery('#idprodfournprice').attr('data-default-vat-code');}	// When select is done from HTML input with ajax autocomplete
+				var supplier_ref = $('option:selected', this).attr('data-supplier-ref');											// When select is done from HTML select
+				if (typeof supplier_ref === 'undefined') { supplier_ref = jQuery('#idprodfournprice').attr('data-supplier-ref'); }	// When select is done from HTML input with ajax autocomplete
 
-			var supplier_ref = $('option:selected', this).attr('data-supplier-ref');											// When select is done from HTML select
-			if (typeof supplier_ref === 'undefined') { supplier_ref = jQuery('#idprodfournprice').attr('data-supplier-ref'); }	// When select is done from HTML input with ajax autocomplete
+				<?php if (($object->element == 'supplier_proposal' || $object->element == 'order_supplier' || $object->element == 'invoice_supplier' || $object->element == 'invoice_supplier_rec') && !$seller->tva_assuj) { ?>
+					if (tva_tx != .0) {
+						tva_tx = .0;
+						default_vat_code = null;
+					}
+				<?php } ?>
 
-			<?php if (($object->element == 'supplier_proposal' || $object->element == 'order_supplier' || $object->element == 'invoice_supplier' || $object->element == 'invoice_supplier_rec') && !$seller->tva_assuj) { ?>
-				if (tva_tx != .0) {
-					tva_tx = .0;
-					default_vat_code = null;
+				var stringforvatrateselection = tva_tx;
+				if (typeof default_vat_code != 'undefined' && default_vat_code != null && default_vat_code != '') {
+					stringforvatrateselection = stringforvatrateselection+' ('+default_vat_code+')';
 				}
-			<?php } ?>
 
-			var stringforvatrateselection = tva_tx;
-			if (typeof default_vat_code != 'undefined' && default_vat_code != null && default_vat_code != '') {
-				stringforvatrateselection = stringforvatrateselection+' ('+default_vat_code+')';
-			}
+				var has_multicurrency_up = false;
+				<?php
+				if (isModEnabled('multicurrency') && $object->multicurrency_code != $conf->currency) {
+					?>
+					var object_multicurrency_code = '<?php print dol_escape_js($object->multicurrency_code); ?>';
 
-			var has_multicurrency_up = false;
-			<?php
-			if (isModEnabled('multicurrency') && $object->multicurrency_code != $conf->currency) {
-				?>
-				var object_multicurrency_code = '<?php print dol_escape_js($object->multicurrency_code); ?>';
+					var multicurrency_code = $('option:selected', this).attr('data-multicurrency-code');                                			// When select is done from HTML select
+					if (multicurrency_code == undefined) { multicurrency_code = jQuery('#idprodfournprice').attr('data-multicurrency-code'); }  	// When select is done from HTML input with ajax autocomplete
 
-				var multicurrency_code = $('option:selected', this).attr('data-multicurrency-code');                                			// When select is done from HTML select
-				if (multicurrency_code == undefined) { multicurrency_code = jQuery('#idprodfournprice').attr('data-multicurrency-code'); }  	// When select is done from HTML input with ajax autocomplete
+					var multicurrency_up = parseFloat($('option:selected', this).attr('data-multicurrency-unitprice'));                                	// When select is done from HTML select
+					if (isNaN(multicurrency_up)) { multicurrency_up = parseFloat(jQuery('#idprodfournprice').attr('data-multicurrency-unitprice')); }   // When select is done from HTML input with ajax autocomplete
 
-				var multicurrency_up = parseFloat($('option:selected', this).attr('data-multicurrency-unitprice'));                                	// When select is done from HTML select
-				if (isNaN(multicurrency_up)) { multicurrency_up = parseFloat(jQuery('#idprodfournprice').attr('data-multicurrency-unitprice')); }   // When select is done from HTML input with ajax autocomplete
+					if (multicurrency_code == object_multicurrency_code) {
+						has_multicurrency_up = true;
+						jQuery("#multicurrency_price_ht").val(multicurrency_up);
+					}
 
-				if (multicurrency_code == object_multicurrency_code) {
-					has_multicurrency_up = true;
-					jQuery("#multicurrency_price_ht").val(multicurrency_up);
+					console.log("objectline_create.tpl Multicurrency values : object_multicurrency_code = "+object_multicurrency_code+", multicurrency_code = "+multicurrency_code+", multicurrency_up = "+multicurrency_up);
+					<?php
 				}
+				?>
 
-				console.log("objectline_create.tpl Multicurrency values : object_multicurrency_code = "+object_multicurrency_code+", multicurrency_code = "+multicurrency_code+", multicurrency_up = "+multicurrency_up);
-				<?php
-			}
-			?>
-
-			console.log("objectline_create.tpl We find supplier price : up = "+up+", up_locale = "+up_locale+", has_multicurrency_up = "+has_multicurrency_up+", supplier_ref = "+supplier_ref+" qty = "+qty+", tva_tx = "+tva_tx+", default_vat_code = "+default_vat_code+", stringforvatrateselection="+stringforvatrateselection+", discount = "+discount+" for product supplier ref id = "+jQuery('#idprodfournprice').val());
+				console.log("objectline_create.tpl We find supplier price : up = "+up+", up_locale = "+up_locale+", has_multicurrency_up = "+has_multicurrency_up+", supplier_ref = "+supplier_ref+" qty = "+qty+", tva_tx = "+tva_tx+", default_vat_code = "+default_vat_code+", stringforvatrateselection="+stringforvatrateselection+", discount = "+discount+" for product supplier ref id = "+jQuery('#idprodfournprice').val());
 
-			if (has_multicurrency_up === false) {
-				if (typeof up_locale === 'undefined') {
-					jQuery("#price_ht").val(up);
-				} else {
-					jQuery("#price_ht").val(up_locale);
+				if (has_multicurrency_up === false) {
+					if (typeof up_locale === 'undefined') {
+						jQuery("#price_ht").val(up);
+					} else {
+						jQuery("#price_ht").val(up_locale);
+					}
 				}
-			}
 
-			// Set supplier_ref
-			$('#fourn_ref').val(supplier_ref);
-			// Set vat rate if field is an input box
-			$('#tva_tx').val(tva_tx);
-			// Set vat rate by selecting the combo
-			//$('#tva_tx option').val(tva_tx);	// This is bugged, it replaces the vat key of all options
-			$('#tva_tx option').removeAttr('selected');
-			console.log("stringforvatrateselection="+stringforvatrateselection+" -> value of option label for this key="+$('#tva_tx option[value="'+stringforvatrateselection+'"]').val());
-			$('#tva_tx option[value="'+stringforvatrateselection+'"]').prop('selected', true);
-
-			if (jQuery("#qty").val() < qty)	{
-				jQuery("#qty").val(qty);
-			}
-			if (jQuery("#remise_percent").val() < discount) {
-				jQuery("#remise_percent").val(discount);
-			}
-
-			<?php
-			if (getDolGlobalInt('PRODUIT_AUTOFILL_DESC') == 1) {
-				?>
-			var description = $('option:selected', this).attr('data-description');
-			if (typeof description == 'undefined') { description = jQuery('#idprodfournprice').attr('data-description');	}
+				// Set supplier_ref
+				$('#fourn_ref').val(supplier_ref);
+				// Set vat rate if field is an input box
+				$('#tva_tx').val(tva_tx);
+				// Set vat rate by selecting the combo
+				//$('#tva_tx option').val(tva_tx);	// This is bugged, it replaces the vat key of all options
+				$('#tva_tx option').removeAttr('selected');
+				console.log("stringforvatrateselection="+stringforvatrateselection+" -> value of option label for this key="+$('#tva_tx option[value="'+stringforvatrateselection+'"]').val());
+				$('#tva_tx option[value="'+stringforvatrateselection+'"]').prop('selected', true);
+
+				if (jQuery("#qty").val() < qty)	{
+					jQuery("#qty").val(qty);
+				}
+				if (jQuery("#remise_percent").val() < discount) {
+					jQuery("#remise_percent").val(discount);
+				}
 
-			console.log("Load description into text area : "+description);
 				<?php
-				if (getDolGlobalString('FCKEDITOR_ENABLE_DETAILS')) {
+				if (getDolGlobalInt('PRODUIT_AUTOFILL_DESC') == 1) {
 					?>
-			if (typeof CKEDITOR == "object" && typeof CKEDITOR.instances != "undefined")
-			{
-				var editor = CKEDITOR.instances['dp_desc'];
-				if (editor) {
-					editor.setData(description);
-				}
-			}
-					<?php
-				} else {
-					?>
-			jQuery('#dp_desc').text(description);
+				var description = $('option:selected', this).attr('data-description');
+				if (typeof description == 'undefined') { description = jQuery('#idprodfournprice').attr('data-description');	}
+
+				console.log("Load description into text area : "+description);
 					<?php
+					if (getDolGlobalString('FCKEDITOR_ENABLE_DETAILS')) {
+						?>
+				if (typeof CKEDITOR == "object" && typeof CKEDITOR.instances != "undefined")
+				{
+					var editor = CKEDITOR.instances['dp_desc'];
+					if (editor) {
+						editor.setData(description);
+					}
 				}
-			}
-			?>
-		} else if (jQuery('#idprodfournprice').length > 0) {
-			console.log("objectline_create.tpl #idprodfournprice is not an int but is a string so we set only few properties into page");
+						<?php
+					} else {
+						?>
+				jQuery('#dp_desc').text(description);
+						<?php
+					}
+				}
+				?>
+			} else if (jQuery('#idprodfournprice').length > 0) {
+				console.log("objectline_create.tpl #idprodfournprice is not an int but is a string so we set only few properties into page");
 
-			var tva_tx = parseFloat($('option:selected', this).attr('data-tvatx')); 					// When select is done from HTML select
-			if (isNaN(tva_tx)) { tva_tx = parseFloat(jQuery('#idprodfournprice').attr('data-tvatx'));}	// When select is done from HTML input with ajax autocomplete
+				var tva_tx = parseFloat($('option:selected', this).attr('data-tvatx')); 					// When select is done from HTML select
+				if (isNaN(tva_tx)) { tva_tx = parseFloat(jQuery('#idprodfournprice').attr('data-tvatx'));}	// When select is done from HTML input with ajax autocomplete
 
-			var default_vat_code = $('option:selected', this).attr('data-default-vat-code');							 					// When select is done from HTML select
-			if (typeof default_vat_code === 'undefined') { default_vat_code = jQuery('#idprodfournprice').attr('data-default-vat-code');}	// When select is done from HTML input with ajax autocomplete
+				var default_vat_code = $('option:selected', this).attr('data-default-vat-code');							 					// When select is done from HTML select
+				if (typeof default_vat_code === 'undefined') { default_vat_code = jQuery('#idprodfournprice').attr('data-default-vat-code');}	// When select is done from HTML input with ajax autocomplete
 
-			var supplier_ref = $('option:selected', this).attr('data-supplier-ref');											// When select is done from HTML select
-			if (typeof supplier_ref === 'undefined') { supplier_ref = jQuery('#idprodfournprice').attr('data-supplier-ref'); }	// When select is done from HTML input with ajax autocomplete
+				var supplier_ref = $('option:selected', this).attr('data-supplier-ref');											// When select is done from HTML select
+				if (typeof supplier_ref === 'undefined') { supplier_ref = jQuery('#idprodfournprice').attr('data-supplier-ref'); }	// When select is done from HTML input with ajax autocomplete
 
-			var stringforvatrateselection = tva_tx;
-			if (typeof default_vat_code != 'undefined' && default_vat_code != null && default_vat_code != '') {
-				stringforvatrateselection = stringforvatrateselection+' ('+default_vat_code+')';
-			}
+				var stringforvatrateselection = tva_tx;
+				if (typeof default_vat_code != 'undefined' && default_vat_code != null && default_vat_code != '') {
+					stringforvatrateselection = stringforvatrateselection+' ('+default_vat_code+')';
+				}
 
 
-			console.log("objectline_create.tpl We find data for price : tva_tx = "+tva_tx+", default_vat_code = "+default_vat_code+", supplier_ref = "+supplier_ref+", stringforvatrateselection="+stringforvatrateselection+" for product id = "+jQuery('#idprodfournprice').val());
+				console.log("objectline_create.tpl We find data for price : tva_tx = "+tva_tx+", default_vat_code = "+default_vat_code+", supplier_ref = "+supplier_ref+", stringforvatrateselection="+stringforvatrateselection+" for product id = "+jQuery('#idprodfournprice').val());
 
-			// Set supplier_ref
-			$('#fourn_ref').val(supplier_ref);
-			// Set vat rate if field is an input box
-			$('#tva_tx').val(tva_tx);
-			// Set vat rate by selecting the combo
-			//$('#tva_tx option').val(tva_tx);	// This is bugged, it replaces the vat key of all options
-			$('#tva_tx option').removeAttr('selected');
-			console.log("stringforvatrateselection="+stringforvatrateselection+" -> value of option label for this key="+$('#tva_tx option[value="'+stringforvatrateselection+'"]').val());
-			$('#tva_tx option[value="'+stringforvatrateselection+'"]').prop('selected', true);
-			<?php
-			if (getDolGlobalInt('PRODUIT_AUTOFILL_DESC') == 1) {
-				if (getDolGlobalString('FCKEDITOR_ENABLE_DETAILS')) {
-					?>
-			if (typeof CKEDITOR == "object" && typeof CKEDITOR.instances != "undefined")
-			{
-				var editor = CKEDITOR.instances['dp_desc'];
-				if (editor) {
-					editor.setData('');
+				// Set supplier_ref
+				$('#fourn_ref').val(supplier_ref);
+				// Set vat rate if field is an input box
+				$('#tva_tx').val(tva_tx);
+				// Set vat rate by selecting the combo
+				//$('#tva_tx option').val(tva_tx);	// This is bugged, it replaces the vat key of all options
+				$('#tva_tx option').removeAttr('selected');
+				console.log("stringforvatrateselection="+stringforvatrateselection+" -> value of option label for this key="+$('#tva_tx option[value="'+stringforvatrateselection+'"]').val());
+				$('#tva_tx option[value="'+stringforvatrateselection+'"]').prop('selected', true);
+				<?php
+				if (getDolGlobalInt('PRODUIT_AUTOFILL_DESC') == 1) {
+					if (getDolGlobalString('FCKEDITOR_ENABLE_DETAILS')) {
+						?>
+				if (typeof CKEDITOR == "object" && typeof CKEDITOR.instances != "undefined")
+				{
+					var editor = CKEDITOR.instances['dp_desc'];
+					if (editor) {
+						editor.setData('');
+					}
 				}
-			}
-					<?php
-				} else {
-					?>
-			jQuery('#dp_desc').text('');
-					<?php
+						<?php
+					} else {
+						?>
+				jQuery('#dp_desc').text('');
+						<?php
+					}
 				}
+				?>
 			}
-			?>
-		}
 
 
-		/* To set focus */
-		if (jQuery('#idprod').val() > 0 || jQuery('#idprodfournprice').val() > 0)
-		{
-			/* focus work on a standard textarea but not if field was replaced with CKEDITOR */
-			jQuery('#dp_desc').focus();
-			/* focus if CKEDITOR */
-			if (typeof CKEDITOR == "object" && typeof CKEDITOR.instances != "undefined")
+			/* To set focus */
+			if (jQuery('#idprod').val() > 0 || jQuery('#idprodfournprice').val() > 0)
 			{
-				var editor = CKEDITOR.instances['dp_desc'];
-				if (editor) { editor.focus(); }
+				console.log("Try to set focus on desc");
+				/* this focus code works on a standard textarea but not if field was replaced with CKEDITOR */
+				jQuery('#dp_desc').focus();
+				/* this focus code works for CKEDITOR */
+				if (typeof CKEDITOR == "object" && typeof CKEDITOR.instances != "undefined")
+				{
+					var editor = CKEDITOR.instances['dp_desc'];
+					if (editor) {
+						editor.focus();
+					}
+				}
 			}
-		}
-	});
+		});
 
 		<?php if (GETPOST('prod_entry_mode') == 'predef') { // When we submit with a predef product and it fails we must start with predef?>
 		setforpredef();
 		<?php } ?>
+
 	});
 
 	/* Function to set fields visibility after selecting a free product */
@@ -1291,7 +1314,11 @@ function setforfree() {
 
 	function setforpredef() {
 		console.log("objectline_create.tpl::setforpredef We hide some fields, show dates");
+
 		jQuery("#select_type").val(-1);
+		jQuery("#select_type").addClass("placeholder");
+		jQuery("#select_type").trigger("change");
+
 		jQuery("#prod_entry_mode_free").prop('checked',false).change();
 		jQuery("#prod_entry_mode_predef").prop('checked',true).change();
 		<?php if (!getDolGlobalString('MAIN_DISABLE_EDIT_PREDEF_PRICEHT')) { ?>
@@ -1329,4 +1356,6 @@ function setforpredef() {
 
 print '</script>';
 
+//print '<span onclick="setFocusOnDescription();">Click</span>';
+
 print "<!-- END PHP TEMPLATE objectline_create.tpl.php -->\n";
diff --git a/htdocs/langs/en_US/main.lang b/htdocs/langs/en_US/main.lang
index 16db52a977034..4099d76274578 100644
--- a/htdocs/langs/en_US/main.lang
+++ b/htdocs/langs/en_US/main.lang
@@ -798,7 +798,7 @@ Notes=Notes
 AddNewLine=Add new line
 AddFile=Add file
 FreeZone=Free-text product
-FreeLineOfType=Free-text item, type:
+FreeLineOfType=Free-text item, type
 CloneMainAttributes=Clone object with its main attributes
 ReGeneratePDF=Re-generate PDF
 PDFMerge=PDF Merge
diff --git a/htdocs/theme/eldy/global.inc.php b/htdocs/theme/eldy/global.inc.php
index 5db98f3af5cbb..e6b4e156a26e7 100644
--- a/htdocs/theme/eldy/global.inc.php
+++ b/htdocs/theme/eldy/global.inc.php
@@ -748,8 +748,12 @@
 
 /* CSS for placeholder */
 .placeholder { color: #ccc; }
+select.placeholder { color: #ccc; }
 ::-webkit-input-placeholder { color: #ccc; }
 input:-moz-placeholder { color: #ccc; }
+select.placeholder option:not(.opacitymediumbycolor):not(.opacitymedium) {
+	color: var(--colortext);
+}
 
 input[name=price], input[name=weight], input[name=volume], input[name=surface], input[name=sizeheight], input[name=net_measure], select[name=incoterm_id] { margin-right: 6px; }
 fieldset {
@@ -766,6 +770,7 @@
 	opacity: 0.7;
 }
 
+
 .formconsumeproduce {
 	background: #f3f3f3;
 	padding: 20px 0px 0px 0px;
diff --git a/htdocs/theme/md/style.css.php b/htdocs/theme/md/style.css.php
index 5d31a78fe2236..b333f13f1cad1 100644
--- a/htdocs/theme/md/style.css.php
+++ b/htdocs/theme/md/style.css.php
@@ -933,11 +933,15 @@
 
 /* CSS for placeholder */
 .placeholder { color: #ccc; }
+select.placeholder { color: #ccc; }
 ::-webkit-input-placeholder { color:#ccc; }
 :-moz-placeholder { color:#bbb; } 			/* firefox 18- */
 ::-moz-placeholder { color:#bbb; } 			/* firefox 19+ */
 :-ms-input-placeholder { color:#ccc; } 		/* ie */
 input:-moz-placeholder { color:#ccc; }
+select.placeholder option:not(.opacitymediumbycolor):not(.opacitymedium) {
+	color: var(--colortext);
+}
 
 input[name=price], input[name=weight], input[name=volume], input[name=surface], input[name=sizeheight], input[name=net_measure], select[name=incoterm_id] { margin-right: 6px; }
 fieldset {
@@ -4490,7 +4494,7 @@
 	padding-top: 4px;
 	padding-bottom: 3px;
 }
-.liste_titre_create td, .liste_titre_create th, .liste_titre_create .tagtd
+.liste_titre_create td:not(.linecoldescription), .liste_titre_create th, .liste_titre_create .tagtd
 {
 	border-top-width: 1px;
 	border-top-color: var(--colortopbordertitle1);
@@ -4512,6 +4516,10 @@
 	border-top-style: solid;
 }
 
+td.linecoldescription {
+	padding: 6px 10px 6px 12px !important;			/* t r b l */
+}
+
 table.liste th, table.noborder th, table.noborder tr.liste_titre td, table.noborder tr.box_titre td {
 	padding: 8px 8px 8px 10px;			/* t r b l */
 }