diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index f113a8a7a36..fb05f408e57 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -28,7 +28,7 @@ jobs:
       # This is faster for a big repo.
       - name: Get all changed php files (if PR)
         id: changed-php
-        uses: tj-actions/changed-files@v43
+        uses: tj-actions/changed-files@v44
         if: env.gh_event == 'pull_request'
         with:
           files: |
@@ -66,7 +66,7 @@ jobs:
       # The next uses git, which is slow for a bit repo.
       # - name: Get all changed php files (if PR)
       #   id: changed-php
-      #   uses: tj-actions/changed-files@v43
+      #   uses: tj-actions/changed-files@v44
       #   if: env.gh_event == 'pull_request'
       #   with:
       #     files: |
@@ -115,7 +115,7 @@ jobs:
           ls -l ~/.cache/pre-commit/
 
       - name: Convert Raw Log to Annotations
-        uses: mdeweerd/logToCheckStyle@v2024.3.4
+        uses: mdeweerd/logToCheckStyle@v2024.3.5
         if: ${{ failure() }}
         with:
           in: ${{ env.RAW_LOG }}
diff --git a/.github/workflows/windows-ci.yml b/.github/workflows/windows-ci.yml
index f85ad2535be..7f550037416 100644
--- a/.github/workflows/windows-ci.yml
+++ b/.github/workflows/windows-ci.yml
@@ -157,7 +157,7 @@ jobs:
           for /f "tokens=2 delims==" %%A in ('doskey /m:err') do EXIT /B %%A
 
       - name: Convert Raw Log to Annotations
-        uses: mdeweerd/logToCheckStyle@v2024.3.4
+        uses: mdeweerd/logToCheckStyle@v2024.3.5
         if: ${{ failure() }}
         with:
           in: ${{ env.PHPUNIT_LOG }}
diff --git a/dev/examples/mail/source_email_ticket_2_answer_from_ticket.txt b/dev/examples/mail/source_email_ticket_2_answer_from_ticket.txt
index 350b9a93cad..969d4eec95a 100644
--- a/dev/examples/mail/source_email_ticket_2_answer_from_ticket.txt
+++ b/dev/examples/mail/source_email_ticket_2_answer_from_ticket.txt
@@ -10,7 +10,8 @@ To: customer@customercompany.fr
 Subject: [MyBigCompany - Ticket #TS2008-0040] Nouveau message
 Date: Thu, 20 Aug 2020 18:31:37 +0200
 Message-ID: <1597941097.SMTPs-dolibarr-tic58@83b5bc91f83a56e458db71e0adac2b62>
-References: <1597941097.SMTPs-dolibarr-tic58@83b5bc91f83a56e458db71e0adac2b62>
+References: <CALeEO_kij-ogXKzrjV_pTgqVbUB9j=287VkX34iVSWgDHFA8eg@mail.gmail.com>
+In-Reply-To: <CALeEO_kij-ogXKzrjV_pTgqVbUB9j=287VkX34iVSWgDHFA8eg@mail.gmail.com>
 X-Dolibarr-TRACKID: tic58@83b5bc91f83a56e458db71e0adac2b62
 X-RemoteAddr: 127.0.0.1
 X-Mailer: Dolibarr version 13.0.0-alpha (using SMTPs Mailer)
@@ -25,17 +26,17 @@ Content-Type: multipart/alternative; boundary="mul_872cdd6a64216735955664484832b
 --mul_872cdd6a64216735955664484832b075
 Content-Type: text/plain; charset=UTF-8
 
-Bonjour 
+Bonjour
+
 
- 
 Une nouvelle réponse a été ajoutée à un ticket que vous suivez. Voici
-le message :PredefinedMailContentTicket_send 
- 
- 
+le message :PredefinedMailContentTicket_send
+
+
 Vous pouvez voir la progression du ticket en cliquant sur le lien
-ci-dessus. : fr5uw2yospypn2rz 
- Cordialement, 
- 
+ci-dessus. : fr5uw2yospypn2rz
+ Cordialement,
+
 --
 --mul_872cdd6a64216735955664484832b075
 Content-Type: text/html; charset=UTF-8
diff --git a/dev/translation/dynamic_translation_keys.lst b/dev/translation/dynamic_translation_keys.lst
index 41220044fe9..00a01c617ca 100644
--- a/dev/translation/dynamic_translation_keys.lst
+++ b/dev/translation/dynamic_translation_keys.lst
@@ -437,6 +437,7 @@ CardContent
 CardProduct0
 CardProduct1
 Cards
+Cart
 CashAccounts
 CashDeskBankCB
 CashDeskBankCash
@@ -2028,6 +2029,7 @@ Notify_MEMBER_MODIFY
 Notify_MEMBER_RESILIATE
 Notify_MEMBER_SUBSCRIPTION
 Notify_MEMBER_VALIDATE
+Notify_ORDER_CANCEL
 Notify_ORDER_CLOSE
 Notify_ORDER_SENTBYMAIL
 Notify_ORDER_SUPPLIER_APPROVE
diff --git a/htdocs/adherents/card.php b/htdocs/adherents/card.php
index 3f414262a72..0f153f57e01 100644
--- a/htdocs/adherents/card.php
+++ b/htdocs/adherents/card.php
@@ -1122,8 +1122,8 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action)) {
 		// Categories
 		if (isModEnabled('category') && $user->hasRight('categorie', 'lire')) {
 			print '<tr><td>'.$form->editfieldkey("Categories", 'memcats', '', $object, 0).'</td><td>';
-			$cate_arbo = $form->select_all_categories(Categorie::TYPE_MEMBER, null, 'parent', null, null, 1);
-			print img_picto('', 'category').$form->multiselectarray('memcats', $cate_arbo, GETPOST('memcats', 'array'), null, null, 'quatrevingtpercent widthcentpercentminusx', 0, 0);
+			$cate_arbo = $form->select_all_categories(Categorie::TYPE_MEMBER, 0, 'parent', 0, 0, 1);
+			print img_picto('', 'category').$form->multiselectarray('memcats', $cate_arbo, GETPOST('memcats', 'array'), 0, 0, 'quatrevingtpercent widthcentpercentminusx', 0, 0);
 			print "</td></tr>";
 		}
 
diff --git a/htdocs/adherents/class/api_members.class.php b/htdocs/adherents/class/api_members.class.php
index 941a685d326..a0586546b48 100644
--- a/htdocs/adherents/class/api_members.class.php
+++ b/htdocs/adherents/class/api_members.class.php
@@ -81,7 +81,7 @@ class Members extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('adherent', $member->id) && $id > 0) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($member);
@@ -114,7 +114,7 @@ class Members extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('adherent', $member->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($member);
@@ -153,7 +153,7 @@ class Members extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('adherent', $member->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($member);
@@ -192,7 +192,7 @@ class Members extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('adherent', $member->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($member);
@@ -301,11 +301,11 @@ class Members extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$member->context['caller'] = $request_data['caller'];
+				$member->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$member->$field = $value;
+			$member->$field = $this->_checkValForAPI($field, $value, $member);
 		}
 		if ($member->create(DolibarrApiAccess::$user) < 0) {
 			throw new RestException(500, 'Error creating member', array_merge(array($member->error), $member->errors));
@@ -337,7 +337,7 @@ class Members extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('member', $member->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($request_data as $field => $value) {
@@ -346,10 +346,15 @@ class Members extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$member->context['caller'] = $request_data['caller'];
+				$member->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
+				continue;
+			}
+			if ($field == 'array_options' && is_array($value)) {
+				foreach ($value as $index => $val) {
+					$member->array_options[$index] = $val;
+				}
 				continue;
 			}
-
 			// Process the status separately because it must be updated using
 			// the validate(), resiliate() and exclude() methods of the class Adherent.
 			if ($field == 'statut') {
@@ -370,7 +375,7 @@ class Members extends DolibarrApi
 					}
 				}
 			} else {
-				$member->$field = $value;
+				$member->$field = $this->_checkValForAPI($field, $value, $member);
 			}
 		}
 
@@ -405,7 +410,7 @@ class Members extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('member', $member->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 
@@ -646,7 +651,7 @@ class Members extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('member', $membertype->id, 'adherent_type')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($membertype);
@@ -745,11 +750,11 @@ class Members extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$membertype->context['caller'] = $request_data['caller'];
+				$membertype->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$membertype->$field = $value;
+			$membertype->$field = $this->_checkValForAPI($field, $value, $membertype);
 		}
 		if ($membertype->create(DolibarrApiAccess::$user) < 0) {
 			throw new RestException(500, 'Error creating member type', array_merge(array($membertype->error), $membertype->errors));
@@ -783,7 +788,7 @@ class Members extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('member', $membertype->id, 'adherent_type')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($request_data as $field => $value) {
@@ -792,13 +797,13 @@ class Members extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$membertype->context['caller'] = $request_data['caller'];
+				$membertype->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
 			// Process the status separately because it must be updated using
 			// the validate(), resiliate() and exclude() methods of the class AdherentType.
-			$membertype->$field = $value;
+			$membertype->$field = $this->_checkValForAPI($field, $value, $membertype);
 		}
 
 		// If there is no error, update() returns the number of affected rows
@@ -834,7 +839,7 @@ class Members extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('member', $membertype->id, 'adherent_type')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$res = $membertype->delete(DolibarrApiAccess::$user);
diff --git a/htdocs/adherents/class/api_subscriptions.class.php b/htdocs/adherents/class/api_subscriptions.class.php
index a5f27263cbd..56eb2f0f0af 100644
--- a/htdocs/adherents/class/api_subscriptions.class.php
+++ b/htdocs/adherents/class/api_subscriptions.class.php
@@ -161,11 +161,11 @@ class Subscriptions extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$subscription->context['caller'] = $request_data['caller'];
+				$subscription->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$subscription->$field = $value;
+			$subscription->$field = $this->_checkValForAPI($field, $value, $subscription);
 		}
 		if ($subscription->create(DolibarrApiAccess::$user) < 0) {
 			throw new RestException(500, 'Error when creating subscription', array_merge(array($subscription->error), $subscription->errors));
@@ -202,11 +202,11 @@ class Subscriptions extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$subscription->context['caller'] = $request_data['caller'];
+				$subscription->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$subscription->$field = $value;
+			$subscription->$field = $this->_checkValForAPI($field, $value, $subscription);
 		}
 
 		if ($subscription->update(DolibarrApiAccess::$user) > 0) {
diff --git a/htdocs/admin/external_rss.php b/htdocs/admin/external_rss.php
index 5d3228ae23a..5781b810489 100644
--- a/htdocs/admin/external_rss.php
+++ b/htdocs/admin/external_rss.php
@@ -7,6 +7,7 @@
  * Copyright (C) 2005-2011 Regis Houssin        <regis.houssin@inodbox.com>
  * Copyright (C) 2011 	   Juanjo Menent		<jmenent@2byte.es>
  * Copyright (C) 2020		Tobias Sekan		<tobias.sekan@startmail.com>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -280,7 +281,7 @@ if ($resql) {
 		print '<tr class="oddeven">';
 		print "<td>".$langs->trans("Status")."</td>";
 		print "<td>";
-		if ($result > 0 && empty($rss->error)) {
+		if ($result > 0 && empty($rssparser->error)) {
 			print '<span class="ok">'.$langs->trans("Online").'</div>';
 		} else {
 			print '<span class="error">'.$langs->trans("Offline");
diff --git a/htdocs/admin/notification.php b/htdocs/admin/notification.php
index 43e29dfb535..d7bb4315638 100644
--- a/htdocs/admin/notification.php
+++ b/htdocs/admin/notification.php
@@ -189,35 +189,25 @@ print '<form method="post" action="'.$_SERVER["PHP_SELF"].'">';
 print '<input type="hidden" name="token" value="'.newToken().'">';
 print '<input type="hidden" name="action" value="setvalue">';
 
-print '<div class="div-table-responsive">';
+print '<div class="div-table-responsive-no-min">';
 print '<table class="noborder centpercent">';
 print '<tr class="liste_titre">';
 print '<td>'.$langs->trans("Parameter").'</td>';
 print '<td>'.$langs->trans("Value").'</td>';
 print "</tr>\n";
 
+
 print '<tr class="oddeven"><td>';
 print $langs->trans("NotificationEMailFrom").'</td>';
 print '<td>';
 print img_picto('', 'email', 'class="pictofixedwidth"');
 print '<input class="width150 quatrevingtpercentminusx" type="email" name="email_from" value="'.getDolGlobalString('NOTIFICATION_EMAIL_FROM').'">';
-if (getDolGlobalString('NOTIFICATION_EMAIL_FROM') && !isValidEmail($conf->global->NOTIFICATION_EMAIL_FROM)) {
+if (getDolGlobalString('NOTIFICATION_EMAIL_FROM') && !isValidEmail(getDolGlobalString('NOTIFICATION_EMAIL_FROM'))) {
 	print ' '.img_warning($langs->trans("ErrorBadEMail"));
 }
 print '</td>';
 print '</tr>';
 
-print '<tr class="oddeven"><td>';
-print $langs->trans("NotificationDisableConfirmMessageContact").'</td>';
-print '<td>';
-if ($conf->use_javascript_ajax) {
-	print ajax_constantonoff('NOTIFICATION_EMAIL_DISABLE_CONFIRM_MESSAGE_CONTACT');
-} else {
-	$arrval = array('0' => $langs->trans("No"), '1' => $langs->trans("Yes"));
-	print $form->selectarray("NOTIFICATION_EMAIL_DISABLE_CONFIRM_MESSAGE_CONTACT", $arrval, getDolGlobalString('NOTIFICATION_EMAIL_DISABLE_CONFIRM_MESSAGE_CONTACT'));
-}
-print '</td>';
-print '</tr>';
 
 print '<tr class="oddeven"><td>';
 print $langs->trans("NotificationDisableConfirmMessageUser").'</td>';
@@ -231,6 +221,20 @@ if ($conf->use_javascript_ajax) {
 print '</td>';
 print '</tr>';
 
+
+print '<tr class="oddeven"><td>';
+print $langs->trans("NotificationDisableConfirmMessageContact").'</td>';
+print '<td>';
+if ($conf->use_javascript_ajax) {
+	print ajax_constantonoff('NOTIFICATION_EMAIL_DISABLE_CONFIRM_MESSAGE_CONTACT');
+} else {
+	$arrval = array('0' => $langs->trans("No"), '1' => $langs->trans("Yes"));
+	print $form->selectarray("NOTIFICATION_EMAIL_DISABLE_CONFIRM_MESSAGE_CONTACT", $arrval, getDolGlobalString('NOTIFICATION_EMAIL_DISABLE_CONFIRM_MESSAGE_CONTACT'));
+}
+print '</td>';
+print '</tr>';
+
+
 print '<tr class="oddeven"><td>';
 print $langs->trans("NotificationDisableConfirmMessageFix").'</td>';
 print '<td>';
@@ -242,6 +246,8 @@ if ($conf->use_javascript_ajax) {
 }
 print '</td>';
 print '</tr>';
+
+
 print '</table>';
 print '</div>';
 
diff --git a/htdocs/admin/security_file.php b/htdocs/admin/security_file.php
index 0c191d9ae7b..ba2d0be6054 100644
--- a/htdocs/admin/security_file.php
+++ b/htdocs/admin/security_file.php
@@ -2,6 +2,7 @@
 /* Copyright (C) 2004-2017	Laurent Destailleur	<eldy@users.sourceforge.net>
  * Copyright (C) 2005-2017	Regis Houssin		<regis.houssin@inodbox.com>
  * Copyright (C) 2013		Juanjo Menent		<jmenent@2byte.es>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -86,7 +87,7 @@ if ($action == 'updateform') {
 		if (!preg_match('/^0/', $tmpumask)) {
 			$tmpumask = '0'.$tmpumask;
 		}
-		if (empty($tmpumask) || $tmpumask === '0') {
+		if (empty($tmpumask)) {  // Also matches '0'
 			$tmpumask = '0664';
 		}
 
diff --git a/htdocs/api/admin/index.php b/htdocs/api/admin/index.php
index 4a9abc9f307..8ac6eed0201 100644
--- a/htdocs/api/admin/index.php
+++ b/htdocs/api/admin/index.php
@@ -150,7 +150,7 @@ print ' '.$langs->trans("Example").': '.$langs->trans("IPListExample");
 print '</td>';
 print '<td><input type="text" name="API_RESTRICT_ON_IP" value="'.dol_escape_htmltag(getDolGlobalString('API_RESTRICT_ON_IP')).'"></td>';
 print '<td>';
-print '<input type="submit" class="button button-save" name="save" value="'.dol_escape_htmltag($langs->trans("Save")).'"></td>';
+print '<input type="submit" class="button button-save small" name="save" value="'.dol_escape_htmltag($langs->trans("Save")).'"></td>';
 print '</td>';
 print '</tr>';
 
diff --git a/htdocs/api/class/api.class.php b/htdocs/api/class/api.class.php
index 63d504b14cb..1436eabd4b6 100644
--- a/htdocs/api/class/api.class.php
+++ b/htdocs/api/class/api.class.php
@@ -2,6 +2,7 @@
 /* Copyright (C) 2015   Jean-François Ferry     <jfefe@aternatik.fr>
  * Copyright (C) 2016	Laurent Destailleur		<eldy@users.sourceforge.net>
  * Copyright (C) 2020		Frédéric France		<frederic.france@netlogic.fr>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -73,8 +74,6 @@ class DolibarrApi
 	/**
 	 * Check and convert a string depending on its type/name.
 	 *
-	 * Display a short message an return a http code 200
-	 *
 	 * @param	string			$field		Field name
 	 * @param	string|array	$value		Value to check/clean
 	 * @param	Object			$object		Object
@@ -84,16 +83,45 @@ class DolibarrApi
 	{
 		// phpcs:enable
 		if (!is_array($value)) {
-			// TODO Use type detected in $object->fields if $object known and we can
+			// Sanitize the value using its type declared into ->fields of $object
+			if (!empty($object->fields) && !empty($object->fields[$field]) && !empty($object->fields[$field]['type'])) {
+				if (strpos($object->fields[$field]['type'], 'int') || strpos($object->fields[$field]['type'], 'double') || in_array($object->fields[$field]['type'], array('real', 'price', 'stock'))) {
+					return sanitizeVal($value, 'int');
+				}
+				if ($object->fields[$field]['type'] == 'html') {
+					return sanitizeVal($value, 'restricthtml');
+				}
+				if ($object->fields[$field]['type'] == 'select') {
+					// Check values are in the list of possible 'options'
+					// TODO
+				}
+				if ($object->fields[$field]['type'] == 'sellist' || $object->fields[$field]['type'] == 'checkbox') {
+					// TODO
+				}
+				if ($object->fields[$field]['type'] == 'boolean' || $object->fields[$field]['type'] == 'radio') {
+					// TODO
+				}
+				if ($object->fields[$field]['type'] == 'email') {
+					return sanitizeVal($value, 'email');
+				}
+				if ($object->fields[$field]['type'] == 'password') {
+					return sanitizeVal($value, 'none');
+				}
+				// Others will use 'alphanohtml'
+			}
+
 			if (in_array($field, array('note', 'note_private', 'note_public', 'desc', 'description'))) {
 				return sanitizeVal($value, 'restricthtml');
 			} else {
 				return sanitizeVal($value, 'alphanohtml');
 			}
-		} else {
-			// TODO Recall _checkValForAPI for each element of array
+		} else {	// Example when $field = 'extrafields' and $value = content of $object->array_options
+			$newarrayvalue = array();
+			foreach ($value as $tmpkey => $tmpvalue) {
+				$newarrayvalue[$tmpkey] = $this->_checkValForAPI($tmpkey, $tmpvalue, $object);
+			}
 
-			return $value;
+			return $newarrayvalue;
 		}
 	}
 
@@ -107,16 +135,41 @@ class DolibarrApi
 	 */
 	protected function _filterObjectProperties($object, $properties)
 	{
+		// phpcs:enable
 		// If properties is empty, we return all properties
 		if (empty($properties)) {
 			return $object;
 		}
-		// Else we filter properties
+
+		// Copy of exploded array for efficiency
+		$arr_properties = explode(',', $properties);
+		$magic_properties = array();
+		$real_properties = get_object_vars($object);
+
+		// Unsetting real properties may unset magic properties.
+		// We keep a copy of the requested magic properties
+		foreach ($arr_properties as $key) {
+			if (!array_key_exists($key, $real_properties)) {
+				// Not a real property,
+				// check if $key is a magic property (we want to keep '$obj->$key')
+				if (property_exists($object, $key) && isset($object->$key)) {
+					$magic_properties[$key] = $object->$key;
+				}
+			}
+		}
+
+		// Filter real properties (may indirectly unset magic properties)
 		foreach (get_object_vars($object) as $key => $value) {
-			if (!in_array($key, explode(',', $properties))) {
+			if (!in_array($key, $arr_properties)) {
 				unset($object->$key);
 			}
 		}
+
+		// Restore the magic properties
+		foreach ($magic_properties as $key => $value) {
+			$object->$key = $value;
+		}
+
 		return $object;
 	}
 
diff --git a/htdocs/api/index.php b/htdocs/api/index.php
index 4b3385fe5ee..31e8dcf47c7 100644
--- a/htdocs/api/index.php
+++ b/htdocs/api/index.php
@@ -167,6 +167,7 @@ if (!empty($reg[1]) && $reg[1] == 'explorer' && ($reg[2] == '/swagger.json' || $
 	$refreshcache = true;
 	if (!is_writable($conf->api->dir_temp)) {
 		print 'Erreur temp dir api/temp not writable';
+		header('HTTP/1.1 500 temp dir api/temp not writable');
 		exit(0);
 	}
 }
diff --git a/htdocs/asset/class/asset.class.php b/htdocs/asset/class/asset.class.php
index 4c016282171..51b28f18427 100644
--- a/htdocs/asset/class/asset.class.php
+++ b/htdocs/asset/class/asset.class.php
@@ -158,7 +158,7 @@ class Asset extends CommonObject
 	public $status;
 
 	/**
-	 * @var Asset object oldcopy
+	 * @var static object oldcopy
 	 */
 	public $oldcopy;
 
diff --git a/htdocs/bom/class/api_boms.class.php b/htdocs/bom/class/api_boms.class.php
index f551600797a..3f9fe328199 100644
--- a/htdocs/bom/class/api_boms.class.php
+++ b/htdocs/bom/class/api_boms.class.php
@@ -196,11 +196,11 @@ class Boms extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->bom->context['caller'] = $request_data['caller'];
+				$this->bom->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->bom->$field = $value;
+			$this->bom->$field = $this->_checkValForAPI($field, $value, $this->bom);
 		}
 
 		$this->checkRefNumbering();
@@ -243,11 +243,18 @@ class Boms extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->bom->context['caller'] = $request_data['caller'];
+				$this->bom->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->bom->$field = $value;
+			if ($field == 'array_options' && is_array($value)) {
+				foreach ($value as $index => $val) {
+					$this->bom->array_options[$index] = $this->_checkValForAPI('extrafields', $val, $this->bom);
+				}
+				continue;
+			}
+
+			$this->bom->$field = $this->_checkValForAPI($field, $value, $this->bom);
 		}
 
 		$this->checkRefNumbering();
@@ -280,7 +287,7 @@ class Boms extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('bom', $this->bom->id, 'bom_bom')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->bom->delete(DolibarrApiAccess::$user)) {
@@ -531,6 +538,14 @@ class Boms extends DolibarrApi
 		unset($object->fk_incoterms);
 		unset($object->label_incoterms);
 		unset($object->location_incoterms);
+		unset($object->multicurrency_code);
+		unset($object->multicurrency_tx);
+		unset($object->multicurrency_total_ht);
+		unset($object->multicurrency_total_ttc);
+		unset($object->multicurrency_total_tva);
+		unset($object->multicurrency_total_localtax1);
+		unset($object->multicurrency_total_localtax2);
+
 
 		// If object has lines, remove $db property
 		if (isset($object->lines) && is_array($object->lines) && count($object->lines) > 0) {
diff --git a/htdocs/categories/class/api_categories.class.php b/htdocs/categories/class/api_categories.class.php
index 79b5007a241..f3b8c011f11 100644
--- a/htdocs/categories/class/api_categories.class.php
+++ b/htdocs/categories/class/api_categories.class.php
@@ -99,7 +99,7 @@ class Categories extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('categorie', $this->category->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if ($include_childs) {
@@ -203,11 +203,11 @@ class Categories extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->category->context['caller'] = $request_data['caller'];
+				$this->category->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->category->$field = $value;
+			$this->category->$field = $this->_checkValForAPI($field, $value, $this->category);
 		}
 		if ($this->category->create(DolibarrApiAccess::$user) < 0) {
 			throw new RestException(500, 'Error when creating category', array_merge(array($this->category->error), $this->category->errors));
@@ -234,7 +234,7 @@ class Categories extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('categorie', $this->category->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($request_data as $field => $value) {
@@ -243,11 +243,11 @@ class Categories extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->category->context['caller'] = $request_data['caller'];
+				$this->category->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->category->$field = $value;
+			$this->category->$field = $this->_checkValForAPI($field, $value, $this->category);
 		}
 
 		if ($this->category->update(DolibarrApiAccess::$user) > 0) {
@@ -274,7 +274,7 @@ class Categories extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('categorie', $this->category->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->category->delete(DolibarrApiAccess::$user)) {
@@ -767,7 +767,7 @@ class Categories extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('categorie', $this->category->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->category->getObjectsInCateg($type, $onlyids);
diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php
index 09e73b188f8..13066e7d6cf 100644
--- a/htdocs/comm/action/class/actioncomm.class.php
+++ b/htdocs/comm/action/class/actioncomm.class.php
@@ -60,14 +60,14 @@ class ActionComm extends CommonObject
 	public $picto = 'action';
 
 	/**
-	 * @var int 0=No test on entity, 1=Test with field entity, 2=Test with link by societe
+	 * @var int<0,2>	0=No test on entity, 1=Test with field entity, 2=Test with link by societe
 	 */
 	public $ismultientitymanaged = 1;
 
 	/**
-	 * @var integer 0=Default
-	 *              1=View may be restricted to sales representative only if no permission to see all or to company of external user if external user
-	 *              2=Same than 1 but accept record if fksoc is empty
+	 * @var int<0,2> 0=Default
+	 *               1=View may be restricted to sales representative only if no permission to see all or to company of external user if external user
+	 *               2=Same than 1 but accept record if fksoc is empty
 	 */
 	public $restrictiononfksoc = 2;
 
@@ -129,7 +129,7 @@ class ActionComm extends CommonObject
 	 * @var string Agenda event label
 	 * @deprecated Use $label
 	 */
-	public $libelle;
+	private $libelle;
 
 	/**
 	 * @var integer Date creation record (datec)
@@ -197,7 +197,7 @@ class ActionComm extends CommonObject
 
 	/**
 	 * @var int -1=Unknown duration
-	 * @deprecated
+	 * @deprecated Use ($datef - $datep)
 	 */
 	public $durationp = -1;
 
@@ -212,7 +212,7 @@ class ActionComm extends CommonObject
 	public $ponctuel;
 
 	/**
-	 * @var integer Percentage
+	 * @var int<0,100> Percentage
 	 */
 	public $percentage;
 
@@ -232,7 +232,7 @@ class ActionComm extends CommonObject
 	public $priority;
 
 	/**
-	 * @var array<int,array{id:int,transparency:int}> 	Array of users
+	 * @var array<int,array{id:int,transparency:int<0,1>}> 	Array of users
 	 */
 	public $userassigned = array();
 
@@ -242,7 +242,7 @@ class ActionComm extends CommonObject
 	public $userownerid;
 
 	/**
-	 * @var int[] Array of contact ids
+	 * @var array<int,array{id:int,mandatory:int<0,1>,answer_status:int,transparency:int<0,1>}> Array of contact ids
 	 */
 	public $socpeopleassigned = array();
 
@@ -252,7 +252,7 @@ class ActionComm extends CommonObject
 	public $otherassigned = array();
 
 	/**
-	 * @var array	Array of reminders
+	 * @var array<int,ActionCommReminder>	Array of reminders
 	 */
 	public $reminders = array();
 
@@ -268,14 +268,14 @@ class ActionComm extends CommonObject
 
 
 	/**
-	 * @var Societe|null Company linked to action (optional)
+	 * @var ?Societe Company linked to action (optional)
 	 * @deprecated
 	 * @see $socid
 	 */
 	public $societe;
 
 	/**
-	 * @var Contact|null Contact linked to action (optional)
+	 * @var ?Contact Contact linked to action (optional)
 	 * @deprecated
 	 * @see $contact_id
 	 */
@@ -318,7 +318,7 @@ class ActionComm extends CommonObject
 	public $extraparams;
 
 	/**
-	 * @var array Actions
+	 * @var array<int,array{id:int,type:string,actionparam:string,status:int}> Actions
 	 */
 	public $actions = array();
 
@@ -377,12 +377,21 @@ class ActionComm extends CommonObject
 	public $status;
 
 	/**
+	 * @var string IP address
+	 */
+	public $ip;
+
+	/*
 	 * Properties to manage the recurring events
 	 */
-	public $recurid;		/* A string YYYYMMDDHHMMSS shared by allevent of same series */
-	public $recurrule;		/* Rule of recurring */
-	public $recurdateend;	/* Repeat until this date */
+	/** @var string	A string YYYYMMDDHHMMSS shared by allevent of same series */
+	public $recurid;
+	/** @var string Rule of recurring */
+	public $recurrule;
+	/** @var string Repeat until this date */
+	public $recurdateend;
 
+	/** @var int Duration of phone call when the event is a phone call */
 	public $calling_duration;
 
 
@@ -405,6 +414,19 @@ class ActionComm extends CommonObject
 	public $fields = array();
 
 
+	/**
+	 * Provide list of deprecated properties and replacements
+	 *
+	 * @return array<string,string>  Old property to new property mapping
+	 */
+	protected function deprecatedProperties()
+	{
+		return array(
+			'libelle' => 'label',
+		) + parent::deprecatedProperties();
+	}
+
+
 	/**
 	 *      Constructor
 	 *
@@ -419,9 +441,9 @@ class ActionComm extends CommonObject
 	 *    Add an action/event into database.
 	 *    $this->type_id OR $this->type_code must be set.
 	 *
-	 *    @param	User	$user      		Object user making action
-	 *    @param    int		$notrigger		1 = disable triggers, 0 = enable triggers
-	 *    @return   int 		        	Id of created event, < 0 if KO
+	 *    @param	User		$user      		Object user making action
+	 *    @param    int<0,1>	$notrigger		1 = disable triggers, 0 = enable triggers
+	 *    @return   int 			        	Id of created event, < 0 if KO
 	 */
 	public function create(User $user, $notrigger = 0)
 	{
@@ -775,12 +797,12 @@ class ActionComm extends CommonObject
 	/**
 	 *  Load object from database
 	 *
-	 *  @param  int		$id     			Id of action to get
-	 *  @param  string	$ref    			Ref of action to get
-	 *  @param  string	$ref_ext			Ref ext to get
-	 *  @param	string	$email_msgid		Email msgid
-	 *  @param	int		$loadresources		1=Load also resources
-	 *  @return	int							Return integer <0 if KO, >0 if OK
+	 *  @param  int			$id     			Id of action to get
+	 *  @param  string		$ref    			Ref of action to get
+	 *  @param  string		$ref_ext			Ref ext to get
+	 *  @param	string		$email_msgid		Email msgid
+	 *  @param	int<0,1>	$loadresources		1=Load also resources
+	 *  @return	int<-1,1>						Return integer <0 if KO, >0 if OK
 	 */
 	public function fetch($id, $ref = '', $ref_ext = '', $email_msgid = '', $loadresources = 1)
 	{
@@ -926,7 +948,7 @@ class ActionComm extends CommonObject
 	/**
 	 *    Initialize $this->userassigned & this->socpeopleassigned array with list of id of user and contact assigned to event
 	 *
-	 *    @return   int				Return integer <0 if KO, >0 if OK
+	 *    @return   int<-1,1>			Return integer <0 if KO, >0 if OK
 	 */
 	public function fetchResources()
 	{
@@ -972,7 +994,7 @@ class ActionComm extends CommonObject
 	 *    Initialize this->userassigned array with list of id of user assigned to event
 	 *
 	 *    @param    bool    $override   Override $this->userownerid when empty. TODO This should be false by default. True is here to fix corrupted data.
-	 *    @return   int                 Return integer <0 if KO, >0 if OK
+	 *    @return   int<-1,1>           Return integer <0 if KO, >0 if OK
 	 */
 	public function fetch_userassigned($override = true)
 	{
@@ -1017,9 +1039,9 @@ class ActionComm extends CommonObject
 	/**
 	 *    Delete event from database
 	 *
-	 *    @param	User	$user			User making the delete
-	 *    @param    int		$notrigger		1 = disable triggers, 0 = enable triggers
-	 *    @return   int 					Return integer <0 if KO, >0 if OK
+	 *    @param	User		$user			User making the delete
+	 *    @param    int<0,1>	$notrigger		1 = disable triggers, 0 = enable triggers
+	 *    @return   int<-1,1> 					Return integer <0 if KO, >0 if OK
 	 */
 	public function delete($user, $notrigger = 0)
 	{
@@ -1113,9 +1135,9 @@ class ActionComm extends CommonObject
 	 *    Update action into database
 	 *	  If percentage = 100, on met a jour date 100%
 	 *
-	 *    @param    User	$user			Object user making change
-	 *    @param    int		$notrigger		1 = disable triggers, 0 = enable triggers
-	 *    @return   int     				Return integer <0 if KO, >0 if OK
+	 *    @param    User		$user			Object user making change
+	 *    @param    int<0,1>	$notrigger		1 = disable triggers, 0 = enable triggers
+	 *    @return   int<-1,1>   				Return integer <0 if KO, >0 if OK
 	 */
 	public function update(User $user, $notrigger = 0)
 	{
@@ -1436,6 +1458,7 @@ class ActionComm extends CommonObject
 
 		$resql = $this->db->query($sql);
 		if ($resql) {
+			$response = null;  // Ensure the variable is defined
 			if (empty($load_state_board)) {
 				$agenda_static = new ActionComm($this->db);
 				$response = new WorkboardResponse();
@@ -1451,6 +1474,8 @@ class ActionComm extends CommonObject
 			// This assignment in condition is not a bug. It allows walking the results.
 			while ($obj = $this->db->fetch_object($resql)) {
 				if (empty($load_state_board)) {
+					'@phan-var-force WorkboardResponse $response
+					 @phan-var-force ActionComm $agenda_static';
 					$response->nbtodo++;
 					$agenda_static->datep = $this->db->jdate($obj->dp);
 					if ($agenda_static->hasDelay()) {
@@ -1515,8 +1540,8 @@ class ActionComm extends CommonObject
 	/**
 	 *  Return the label of the status
 	 *
-	 *  @param  int		$mode           0=Long label, 1=Short label, 2=Picto+Short label, 3=Picto, 4=Picto+Short label, 5=Short label+Picto, 6=Picto+Long label, 7=Very short label+Picto
-	 *  @param  int		$hidenastatus   1=Show nothing if status is "Not applicable"
+	 *  @param  int<0,7>	$mode           0=Long label, 1=Short label, 2=Picto+Short label, 3=Picto, 4=Picto+Short label, 5=Short label+Picto, 6=Picto+Long label, 7=Very short label+Picto
+	 *  @param  int<0,1>	$hidenastatus   1=Show nothing if status is "Not applicable"
 	 *  @return string          		String with status
 	 */
 	public function getLibStatut($mode, $hidenastatus = 0)
@@ -1528,11 +1553,11 @@ class ActionComm extends CommonObject
 	/**
 	 *  Return label of action status
 	 *
-	 *  @param  int     $percent        Percent
-	 *  @param  int		$mode           0=Long label, 1=Short label, 2=Picto+Short label, 3=Picto, 4=Picto+Short label, 5=Short label+Picto, 6=Picto+Long label, 7=Very short label+Picto
-	 *  @param  int		$hidenastatus   1=Show nothing if status is "Not applicable"
-	 *  @param  int|string     $datestart      Date start of event
-	 *  @return string		    		Label
+	 *  @param  int<0,100>	$percent        Percent
+	 *  @param  int<0,7>	$mode           0=Long label, 1=Short label, 2=Picto+Short label, 3=Picto, 4=Picto+Short label, 5=Short label+Picto, 6=Picto+Long label, 7=Very short label+Picto
+	 *  @param  int<0,1>	$hidenastatus   1=Show nothing if status is "Not applicable"
+	 *  @param  int|string	$datestart      Date start of event
+	 *  @return string			    		Label
 	 */
 	public function LibStatut($percent, $mode, $hidenastatus = 0, $datestart = '')
 	{
@@ -1580,9 +1605,9 @@ class ActionComm extends CommonObject
 
 	/**
 	 * getTooltipContentArray
-	 * @param array $params params to construct tooltip data
+	 * @param array<string,mixed> $params params to construct tooltip data
 	 * @since v18
-	 * @return array
+	 * @return array{picto:string,ref?:string,title?:string,labeltype?:string,location?:string,transparency?:string,space?:string,mailtopic?:string,mailfrom?:string,mailto?:string,mailcc?:string,description?:string,note?:string,categories?:string}
 	 */
 	public function getTooltipContentArray($params)
 	{
@@ -1603,7 +1628,6 @@ class ActionComm extends CommonObject
 				$labeltype = $langs->trans('ActionAC_MANUAL');
 			}
 		}
-
 		$datas['picto'] = img_picto('', $this->picto).' <u>'.$langs->trans('Action').'</u>';
 		if (!empty($this->ref)) {
 			$datas['ref'] = '<br><b>'.$langs->trans('Ref').':</b> '.dol_escape_htmltag($this->ref);
@@ -1658,13 +1682,13 @@ class ActionComm extends CommonObject
 	 *  Return URL of event
 	 *  Use $this->id, $this->type_code, $this->label and $this->type_label
 	 *
-	 *  @param	int		$withpicto				0 = No picto, 1 = Include picto into link, 2 = Only picto
-	 *  @param	int		$maxlength				Max number of characters into label. If negative, use the ref as label.
-	 *  @param	string	$classname				Force style class on a link
-	 *  @param	string	$option					'' = Link to action, 'birthday'= Link to contact, 'holiday' = Link to leave
-	 *  @param	int		$overwritepicto			1 = Overwrite picto with this one
-	 *  @param	int   	$notooltip		    	1 = Disable tooltip
-	 *  @param  int     $save_lastsearch_value  -1 = Auto, 0 = No save of lastsearch_values when clicking, 1 = Save lastsearch_values whenclicking
+	 *  @param	int<0,2>	$withpicto				0 = No picto, 1 = Include picto into link, 2 = Only picto
+	 *  @param	int			$maxlength				Max number of characters into label. If negative, use the ref as label.
+	 *  @param	string		$classname				Force style class on a link
+	 *  @param	string		$option					'' = Link to action, 'birthday'= Link to contact, 'holiday' = Link to leave
+	 *  @param	int<0,1>	$overwritepicto			1 = Overwrite picto with this one
+	 *  @param	int<0,1>	$notooltip		    	1 = Disable tooltip
+	 *  @param  int<-1,1>	$save_lastsearch_value  -1 = Auto, 0 = No save of lastsearch_values when clicking, 1 = Save lastsearch_values whenclicking
 	 *  @return	string							Chaine avec URL
 	 */
 	public function getNomUrl($withpicto = 0, $maxlength = 0, $classname = '', $option = '', $overwritepicto = 0, $notooltip = 0, $save_lastsearch_value = -1)
@@ -1690,9 +1714,6 @@ class ActionComm extends CommonObject
 		}
 
 		$label = $this->label;
-		if (empty($label)) {
-			$label = $this->libelle; // For backward compatibility
-		}
 
 		$result = '';
 
@@ -1903,7 +1924,7 @@ class ActionComm extends CommonObject
 	 * Existing categories are left untouch.
 	 *
 	 * @param  int[]|int 	$categories 	Category or categories IDs
-	 * @return int							Return integer <0 if KO, >0 if OK
+	 * @return int<-1,1>					Return integer <0 if KO, >0 if OK
 	 */
 	public function setCategories($categories)
 	{
@@ -1948,9 +1969,9 @@ class ActionComm extends CommonObject
 	 * @param string    $type           The type of the export 'event' or 'journal'
 	 * @param integer   $cachedelay     Do not rebuild file if date older than cachedelay seconds
 	 * @param string    $filename       The name for the exported file.
-	 * @param array     $filters        Array of filters. Example array('notolderthan'=>99, 'year'=>..., 'idfrom'=>..., 'notactiontype'=>'systemauto', 'project'=>123, ...)
-	 * @param integer   $exportholiday  0 = don't integrate holidays into the export, 1 = integrate holidays into the export
-	 * @return integer                  -1 = error on build export file, 0 = export okay
+	 * @param array<string,int|string>	$filters	Array of filters. Example array('notolderthan'=>99, 'year'=>..., 'idfrom'=>..., 'notactiontype'=>'systemauto', 'project'=>123, ...)
+	 * @param int<0,1>  $exportholiday  0 = don't integrate holidays into the export, 1 = integrate holidays into the export
+	 * @return int<-1,1>                -1 = error on build export file, 0 = export okay
 	 */
 	public function build_exportfile($format, $type, $cachedelay, $filename, $filters, $exportholiday = 0)
 	{
@@ -2124,7 +2145,7 @@ class ActionComm extends CommonObject
 							$condition = '<>';
 						}
 						$userforfilter = new User($this->db);
-						$result = $userforfilter->fetch('', $logina);
+						$result = $userforfilter->fetch(0, $logina);
 						if ($result > 0) {
 							$sql .= " AND a.fk_user_author ".$condition." ".$userforfilter->id;
 						} elseif ($result < 0 || $condition == '=') {
@@ -2139,7 +2160,7 @@ class ActionComm extends CommonObject
 							$condition = '<>';
 						}
 						$userforfilter = new User($this->db);
-						$result = $userforfilter->fetch('', $logint);
+						$result = $userforfilter->fetch(0, $logint);
 						if ($result > 0) {
 							$sql .= " AND ar.fk_element = ".((int) $userforfilter->id);
 						} elseif ($result < 0 || $condition == '=') {
@@ -2288,8 +2309,8 @@ class ActionComm extends CommonObject
 						}
 
 						if (getDolGlobalString('AGENDA_EXPORT_FIX_TZ')) {
-							$timestampStart = $timestampStart - ($conf->global->AGENDA_EXPORT_FIX_TZ * 3600);
-							$timestampEnd   = $timestampEnd - ($conf->global->AGENDA_EXPORT_FIX_TZ * 3600);
+							$timestampStart -= ($conf->global->AGENDA_EXPORT_FIX_TZ * 3600);
+							$timestampEnd   -= ($conf->global->AGENDA_EXPORT_FIX_TZ * 3600);
 						}
 
 						$urlwithouturlroot = preg_replace('/'.preg_quote(DOL_URL_ROOT, '/').'$/i', '', trim($dolibarr_main_url_root));
@@ -2395,7 +2416,7 @@ class ActionComm extends CommonObject
 	 *  Used to build previews or test instances.
 	 *  id must be 0 if object instance is a specimen.
 	 *
-	 *  @return	int >0 if ok
+	 *  @return	int<1,1>	 >0 if ok
 	 */
 	public function initAsSpecimen()
 	{
@@ -2486,7 +2507,7 @@ class ActionComm extends CommonObject
 	 *  @param	string	$type		Type of reminder 'browser' or 'email'
 	 *  @param	int		$fk_user	Id of user
 	 *  @param	bool	$onlypast	true = get only past reminder, false = get all reminders linked to this
-	 *  @return int         		0 if OK, <>0 if KO (this function is used also by cron so only 0 is OK)
+	 *  @return int<-1,max>    		< if OK, else count of number of reminders
 	 */
 	public function loadReminders($type = '', $fk_user = 0, $onlypast = true)
 	{
@@ -2547,7 +2568,7 @@ class ActionComm extends CommonObject
 	 *  Send reminders by emails
 	 *  CAN BE A CRON TASK
 	 *
-	 *  @return int         0 if OK, <>0 if KO (this function is used also by cron so only 0 is OK)
+	 *  @return int<-1,1>|string     0 if OK, <>0 if KO (this function is used also by cron so only 0 is OK)
 	 */
 	public function sendEmailsReminder()
 	{
@@ -2589,6 +2610,7 @@ class ActionComm extends CommonObject
 		if ($resql) {
 			require_once DOL_DOCUMENT_ROOT.'/core/class/html.formmail.class.php';
 			$formmail = new FormMail($this->db);
+			$to = null;  // Ensure 'to' is defined for static analysis
 
 			while ($obj = $this->db->fetch_object($resql)) {
 				$res = $actionCommReminder->fetch($obj->id);
@@ -2721,10 +2743,10 @@ class ActionComm extends CommonObject
 	/**
 	 * Update the percent value of a event with the given id
 	 *
-	 * @param int		$id			The id of the event
-	 * @param int		$percent	The new percent value for the event
-	 * @param int		$usermodid	The user who modified the percent
-	 * @return int					1 when update of the event was suscessfull, otherwise -1
+	 * @param int			$id			The id of the event
+	 * @param int<0,100>	$percent	The new percent value for the event
+	 * @param int			$usermodid	The user who modified the percent
+	 * @return int<-1,1>				1 when update of the event was successful, otherwise -1
 	 */
 	public function updatePercent($id, $percent, $usermodid = 0)
 	{
diff --git a/htdocs/comm/action/class/api_agendaevents.class.php b/htdocs/comm/action/class/api_agendaevents.class.php
index 6aa5bd090d8..4f1e49d5166 100644
--- a/htdocs/comm/action/class/api_agendaevents.class.php
+++ b/htdocs/comm/action/class/api_agendaevents.class.php
@@ -84,7 +84,7 @@ class AgendaEvents extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('agenda', $this->actioncomm->id, 'actioncomm', '', 'fk_soc', 'id')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		return $this->_cleanObjectDatas($this->actioncomm);
 	}
@@ -204,7 +204,7 @@ class AgendaEvents extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->actioncomm->context['caller'] = $request_data['caller'];
+				$this->actioncomm->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -253,7 +253,7 @@ class AgendaEvents extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('actioncomm', $this->actioncomm->id, 'actioncomm', '', 'fk_soc', 'id')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		foreach ($request_data as $field => $value) {
 			if ($field == 'id') {
@@ -261,7 +261,7 @@ class AgendaEvents extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->actioncomm->context['caller'] = $request_data['caller'];
+				$this->actioncomm->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -304,7 +304,7 @@ class AgendaEvents extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('actioncomm', $this->actioncomm->id, 'actioncomm', '', 'fk_soc', 'id')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->actioncomm->delete(DolibarrApiAccess::$user)) {
diff --git a/htdocs/comm/action/index.php b/htdocs/comm/action/index.php
index 37d2c7054c1..d1bd15fdc55 100644
--- a/htdocs/comm/action/index.php
+++ b/htdocs/comm/action/index.php
@@ -916,7 +916,6 @@ if ($resql) {
 		$event->type = $obj->type_type;
 		$event->type_picto = $obj->type_picto;
 
-		$event->libelle = $obj->label; // deprecated
 		$event->label = $obj->label;
 		$event->percentage = $obj->percent;
 
@@ -2166,17 +2165,15 @@ function show_day_events($db, $day, $month, $year, $monthshown, $style, &$eventa
 
 							// Show title
 							$titletoshow = $daterange;
-							$titletoshow .= ($titletoshow ? ' ' : '').dol_escape_htmltag($event->label ? $event->label : $event->libelle);
+							$titletoshow .= ($titletoshow ? ' ' : '').dol_escape_htmltag($event->label);
 
 							if ($event->type_code != 'ICALEVENT') {
-								$savlabel = $event->label ? $event->label : $event->libelle;
+								$savlabel = $event->label;
 								$event->label = $titletoshow;
-								$event->libelle = $titletoshow;		// deprecatd
 								// Note: List of users are inside $event->userassigned. Link may be clickable depending on permissions of user.
 								$titletoshow = (($event->type_picto || $event->type_code) ? $event->getTypePicto() : '');
 								$titletoshow .= $event->getNomUrl(0, $maxnbofchar, 'cal_event cal_event_title valignmiddle', '', 0, 0);	// do not add 'inline-block' in css here: it makes the title transformed completely into '...'
 								$event->label = $savlabel;
-								$event->libelle = $savlabel;
 							}
 
 							// Loop on each assigned user
diff --git a/htdocs/comm/index.php b/htdocs/comm/index.php
index 77f0c7ea647..4b7aa0ca172 100644
--- a/htdocs/comm/index.php
+++ b/htdocs/comm/index.php
@@ -422,6 +422,8 @@ if (isModEnabled('order') && $user->hasRight('commande', 'lire')) {
  */
 
 if ((isModEnabled("fournisseur") && !getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD') && $user->hasRight("fournisseur", "commande", "lire")) || (isModEnabled("supplier_order") && $user->hasRight("supplier_order", "lire"))) {
+	$supplierorderstatic = new CommandeFournisseur($db);
+
 	$sql = "SELECT cf.rowid, cf.ref, cf.ref_supplier, cf.total_ht, cf.total_tva, cf.total_ttc, cf.fk_statut as status";
 	$sql .= ", s.rowid as socid, s.nom as name, s.name_alias";
 	$sql .= ", s.code_client, s.code_compta, s.client";
@@ -639,7 +641,7 @@ if (isModEnabled("societe") && $user->hasRight('societe', 'lire')) {
 		}
 
 		$num = $db->num_rows($resql);
-		startSimpleTable($langs->trans($header, min($max, $num)), "societe/list.php", "type=p,c", 1);
+		startSimpleTable($langs->trans($header, min($max, $num)), "societe/list.php", "type=p,c&sortfield=s.tms&sortorder=DESC", 1, -1, 'company');
 
 		if ($num) {
 			$i = 0;
diff --git a/htdocs/comm/propal/class/api_proposals.class.php b/htdocs/comm/propal/class/api_proposals.class.php
index 33cc0957c47..94a8647974f 100644
--- a/htdocs/comm/propal/class/api_proposals.class.php
+++ b/htdocs/comm/propal/class/api_proposals.class.php
@@ -132,7 +132,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		// Add external contacts ids.
@@ -255,11 +255,11 @@ class Proposals extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->propal->context['caller'] = $request_data['caller'];
+				$this->propal->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->propal->$field = $value;
+			$this->propal->$field = $this->_checkValForAPI($field, $value, $this->propal);
 		}
 		/*if (isset($request_data["lines"])) {
 		  $lines = array();
@@ -297,7 +297,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$sql = '';
@@ -339,7 +339,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -405,7 +405,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$errors = [];
@@ -486,7 +486,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -564,7 +564,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$updateRes = $this->propal->deleteLine($lineid, $id);
@@ -605,7 +605,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->propal->add_contact($contactid, $type, 'external');
@@ -649,7 +649,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$contacts = $this->propal->liste_contact();
@@ -686,7 +686,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		foreach ($request_data as $field => $value) {
 			if ($field == 'id') {
@@ -694,11 +694,17 @@ class Proposals extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->propal->context['caller'] = $request_data['caller'];
+				$this->propal->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
+				continue;
+			}
+			if ($field == 'array_options' && is_array($value)) {
+				foreach ($value as $index => $val) {
+					$this->propal->array_options[$index] = $this->_checkValForAPI($field, $val, $this->propal);
+				}
 				continue;
 			}
 
-			$this->propal->$field = $value;
+			$this->propal->$field = $this->_checkValForAPI($field, $value, $this->propal);
 		}
 
 		// update end of validity date
@@ -735,7 +741,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->propal->delete(DolibarrApiAccess::$user)) {
@@ -769,7 +775,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->propal->setDraft(DolibarrApiAccess::$user);
@@ -786,7 +792,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->propal->fetchObjectLinked();
@@ -825,7 +831,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->propal->valid(DolibarrApiAccess::$user, $notrigger);
@@ -842,7 +848,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->propal->fetchObjectLinked();
@@ -872,7 +878,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->propal->closeProposal(DolibarrApiAccess::$user, $status, $note_private, $notrigger);
@@ -889,7 +895,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->propal->fetchObjectLinked();
@@ -916,7 +922,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->propal->classifyBilled(DolibarrApiAccess::$user);
@@ -930,7 +936,7 @@ class Proposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('propal', $this->propal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->propal->fetchObjectLinked();
diff --git a/htdocs/comm/propal/class/propal.class.php b/htdocs/comm/propal/class/propal.class.php
index 499ab5088af..8e875f598ac 100644
--- a/htdocs/comm/propal/class/propal.class.php
+++ b/htdocs/comm/propal/class/propal.class.php
@@ -130,7 +130,7 @@ class Propal extends CommonObject
 	public $ref_customer;
 
 	/**
-	 * @var Propal oldcopy with propal properties
+	 * @var static oldcopy with propal properties
 	 */
 	public $oldcopy;
 
diff --git a/htdocs/commande/class/api_orders.class.php b/htdocs/commande/class/api_orders.class.php
index d70dab85cb7..7256ee8e790 100644
--- a/htdocs/commande/class/api_orders.class.php
+++ b/htdocs/commande/class/api_orders.class.php
@@ -128,7 +128,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		// Add external contacts ids
@@ -273,11 +273,11 @@ class Orders extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->commande->context['caller'] = $request_data['caller'];
+				$this->commande->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->commande->$field = $value;
+			$this->commande->$field = $this->_checkValForAPI($field, $value, $this->commande);
 		}
 		/*if (isset($request_data["lines"])) {
 		  $lines = array();
@@ -315,7 +315,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$this->commande->getLinesArray();
 		$result = array();
@@ -347,7 +347,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -414,7 +414,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -482,7 +482,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$updateRes = $this->commande->deleteLine(DolibarrApiAccess::$user, $lineid, $id);
@@ -518,7 +518,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$contacts = $this->commande->liste_contact(-1, 'external', 0, $type);
@@ -551,7 +551,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->commande->add_contact($contactid, $type, 'external');
@@ -599,7 +599,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$contacts = $this->commande->liste_contact();
@@ -641,7 +641,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		foreach ($request_data as $field => $value) {
 			if ($field == 'id') {
@@ -649,11 +649,17 @@ class Orders extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->commande->context['caller'] = $request_data['caller'];
+				$this->commande->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
+				continue;
+			}
+			if ($field == 'array_options' && is_array($value)) {
+				foreach ($value as $index => $val) {
+					$this->commande->array_options[$index] = $this->_checkValForAPI($field, $val, $this->commande);
+				}
 				continue;
 			}
 
-			$this->commande->$field = $value;
+			$this->commande->$field = $this->_checkValForAPI($field, $value, $this->commande);
 		}
 
 		// Update availability
@@ -687,7 +693,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->commande->delete(DolibarrApiAccess::$user)) {
@@ -737,7 +743,7 @@ class Orders extends DolibarrApi
 		$result = $this->commande->fetch_thirdparty(); // do not check result, as failure is not fatal (used only for mail notification substitutes)
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->commande->valid(DolibarrApiAccess::$user, $idwarehouse, $notrigger);
@@ -835,7 +841,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->commande->fetchObjectLinked();
@@ -863,7 +869,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->commande->cloture(DolibarrApiAccess::$user, $notrigger);
@@ -880,7 +886,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->commande->fetchObjectLinked();
@@ -908,7 +914,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->commande->setDraft(DolibarrApiAccess::$user, $idwarehouse);
@@ -925,7 +931,7 @@ class Orders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->commande->fetchObjectLinked();
diff --git a/htdocs/commande/list.php b/htdocs/commande/list.php
index 1ca44dac3c1..05e3e590183 100644
--- a/htdocs/commande/list.php
+++ b/htdocs/commande/list.php
@@ -496,6 +496,7 @@ if (empty($reshook)) {
 							$rang = ($nbOrders > 1) ? -1 : $lines[$i]->rang;
 							//there may already be rows from previous orders
 							if (!empty($createbills_onebythird)) {
+								$TFactThirdNbLines[$cmd->socid]++;
 								$rang = $TFactThirdNbLines[$cmd->socid];
 							}
 
@@ -531,9 +532,6 @@ if (empty($reshook)) {
 							);
 							if ($result > 0) {
 								$lineid = $result;
-								if (!empty($createbills_onebythird)) { //increment rang to keep order
-									$TFactThirdNbLines[$cmd->socid]++;
-								}
 							} else {
 								$lineid = 0;
 								$error++;
@@ -1734,14 +1732,6 @@ if (!empty($arrayfields['total_mark_rate']['checked'])) {
 	print '</td>';
 }
 
-// Extra fields
-include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_input.tpl.php';
-
-// Fields from hook
-$parameters = array('arrayfields' => $arrayfields);
-$reshook = $hookmanager->executeHooks('printFieldListOption', $parameters, $object, $action); // Note that $action and $object may have been modified by hook
-print $hookmanager->resPrint;
-
 // Date creation
 if (!empty($arrayfields['c.datec']['checked'])) {
 	print '<td class="liste_titre">';
@@ -1785,17 +1775,28 @@ if (!empty($arrayfields['shippable']['checked'])) {
 	}
 	print '</td>';
 }
+
+// Extra fields
+include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_input.tpl.php';
+
+// Fields from hook
+$parameters = array('arrayfields' => $arrayfields);
+$reshook = $hookmanager->executeHooks('printFieldListOption', $parameters, $object, $action); // Note that $action and $object may have been modified by hook
+print $hookmanager->resPrint;
+
 // Status billed
 if (!empty($arrayfields['c.facture']['checked'])) {
 	print '<td class="liste_titre maxwidthonsmartphone center">';
 	print $form->selectyesno('search_billed', $search_billed, 1, 0, 1, 1);
 	print '</td>';
 }
+
 // Import key
 if (!empty($arrayfields['c.import_key']['checked'])) {
 	print '<td class="liste_titre maxwidthonsmartphone center">';
 	print '</td>';
 }
+
 // Status
 if (!empty($arrayfields['c.fk_statut']['checked'])) {
 	print '<td class="liste_titre center parentonrightofpage">';
@@ -1970,13 +1971,6 @@ if (!empty($arrayfields['total_mark_rate']['checked'])) {
 	$totalarray['nbfield']++;
 }
 
-// Extra fields
-include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_title.tpl.php';
-
-// Hook fields
-$parameters = array('arrayfields' => $arrayfields, 'param' => $param, 'sortfield' => $sortfield, 'sortorder' => $sortorder, 'totalarray' => &$totalarray);
-$reshook = $hookmanager->executeHooks('printFieldListTitle', $parameters, $object, $action); // Note that $action and $object may have been modified by hook
-print $hookmanager->resPrint;
 if (!empty($arrayfields['c.datec']['checked'])) {
 	print_liste_field_titre($arrayfields['c.datec']['label'], $_SERVER["PHP_SELF"], "c.date_creation", "", $param, '', $sortfield, $sortorder, 'center nowrap ');
 	$totalarray['nbfield']++;
@@ -2001,6 +1995,14 @@ if (!empty($arrayfields['shippable']['checked'])) {
 	print_liste_field_titre($arrayfields['shippable']['label'], $_SERVER["PHP_SELF"], '', '', $param, '', $sortfield, $sortorder, 'center ');
 	$totalarray['nbfield']++;
 }
+// Extra fields
+include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_title.tpl.php';
+
+// Hook fields
+$parameters = array('arrayfields' => $arrayfields, 'param' => $param, 'sortfield' => $sortfield, 'sortorder' => $sortorder, 'totalarray' => &$totalarray);
+$reshook = $hookmanager->executeHooks('printFieldListTitle', $parameters, $object, $action); // Note that $action and $object may have been modified by hook
+print $hookmanager->resPrint;
+
 if (!empty($arrayfields['c.facture']['checked'])) {
 	print_liste_field_titre($arrayfields['c.facture']['label'], $_SERVER["PHP_SELF"], 'c.facture', '', $param, '', $sortfield, $sortorder, 'center ');
 	$totalarray['nbfield']++;
@@ -2577,13 +2579,6 @@ while ($i < $imaxinloop) {
 			}
 		}
 
-		// Extra fields
-		include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_print_fields.tpl.php';
-		// Fields from hook
-		$parameters = array('arrayfields' => $arrayfields, 'obj' => $obj, 'i' => $i, 'totalarray' => &$totalarray);
-		$reshook = $hookmanager->executeHooks('printFieldListValue', $parameters, $object, $action); // Note that $action and $object may have been modified by hook
-		print $hookmanager->resPrint;
-
 		// Date creation
 		if (!empty($arrayfields['c.datec']['checked'])) {
 			print '<td align="center" class="nowrap">';
@@ -2740,6 +2735,13 @@ while ($i < $imaxinloop) {
 			}
 		}
 
+		// Extra fields
+		include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_print_fields.tpl.php';
+		// Fields from hook
+		$parameters = array('arrayfields' => $arrayfields, 'obj' => $obj, 'i' => $i, 'totalarray' => &$totalarray);
+		$reshook = $hookmanager->executeHooks('printFieldListValue', $parameters, $object, $action); // Note that $action and $object may have been modified by hook
+		print $hookmanager->resPrint;
+
 		// Billed
 		if (!empty($arrayfields['c.facture']['checked'])) {
 			print '<td class="center">';
diff --git a/htdocs/compta/bank/class/api_bankaccounts.class.php b/htdocs/compta/bank/class/api_bankaccounts.class.php
index a05b8dfd965..94576ab0ebc 100644
--- a/htdocs/compta/bank/class/api_bankaccounts.class.php
+++ b/htdocs/compta/bank/class/api_bankaccounts.class.php
@@ -161,7 +161,7 @@ class BankAccounts extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$account->context['caller'] = $request_data['caller'];
+				$account->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -343,7 +343,7 @@ class BankAccounts extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$account->context['caller'] = $request_data['caller'];
+				$account->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
diff --git a/htdocs/compta/facture/class/api_invoices.class.php b/htdocs/compta/facture/class/api_invoices.class.php
index 40abcfbca07..80126d347b6 100644
--- a/htdocs/compta/facture/class/api_invoices.class.php
+++ b/htdocs/compta/facture/class/api_invoices.class.php
@@ -146,7 +146,7 @@ class Invoices extends DolibarrApi
 		$this->invoice->remaintopay = price2num($this->invoice->total_ttc - $this->invoice->totalpaid - $this->invoice->totalcreditnotes - $this->invoice->totaldeposits, 'MT');
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		// Add external contacts ids
@@ -300,11 +300,11 @@ class Invoices extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->invoice->context['caller'] = $request_data['caller'];
+				$this->invoice->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->invoice->$field = $value;
+			$this->invoice->$field = $this->_checkValForAPI($field, $value, $this->invoice);
 		}
 		if (!array_key_exists('date', $request_data)) {
 			$this->invoice->date = dol_now();
@@ -426,7 +426,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$this->invoice->getLinesArray();
 		$result = array();
@@ -462,7 +462,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -538,7 +538,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('invoice', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->invoice->add_contact($contactid, $type, 'external');
@@ -582,7 +582,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('invoice', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$contacts = $this->invoice->liste_contact();
@@ -624,7 +624,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->invoice->fetch($id);
@@ -659,7 +659,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($request_data as $field => $value) {
@@ -668,11 +668,17 @@ class Invoices extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->invoice->context['caller'] = $request_data['caller'];
+				$this->invoice->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
+				continue;
+			}
+			if ($field == 'array_options' && is_array($value)) {
+				foreach ($value as $index => $val) {
+					$this->invoice->array_options[$index] = $this->_checkValForAPI($field, $val, $this->invoice);
+				}
 				continue;
 			}
 
-			$this->invoice->$field = $value;
+			$this->invoice->$field = $this->_checkValForAPI($field, $value, $this->invoice);
 
 			// If cond reglement => update date lim reglement
 			if ($field == 'cond_reglement_id') {
@@ -711,7 +717,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->invoice->delete(DolibarrApiAccess::$user);
@@ -764,7 +770,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -851,7 +857,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->invoice->add_contact($fk_socpeople, $type_contact, $source, $notrigger);
@@ -865,7 +871,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($this->invoice);
@@ -899,7 +905,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->invoice->setDraft(DolibarrApiAccess::$user, $idwarehouse);
@@ -916,7 +922,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($this->invoice);
@@ -951,7 +957,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->invoice->validate(DolibarrApiAccess::$user, $force_number, $idwarehouse, $notrigger);
@@ -968,7 +974,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		// copy from order
@@ -1004,7 +1010,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->invoice->setPaid(DolibarrApiAccess::$user, $close_code, $close_note);
@@ -1022,7 +1028,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($this->invoice);
@@ -1053,7 +1059,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->invoice->setUnpaid(DolibarrApiAccess::$user);
@@ -1071,7 +1077,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($this->invoice);
@@ -1099,7 +1105,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$discountcheck = new DiscountAbsolute($this->db);
@@ -1142,7 +1148,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $this->invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if ($this->invoice->paye) {
@@ -1313,7 +1319,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->invoice->fetch($id);
@@ -1360,7 +1366,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$discount = new DiscountAbsolute($this->db);
 		$result = $discount->fetch($discountid);
@@ -1399,7 +1405,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facture', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->invoice->fetch($id);
@@ -1811,7 +1817,7 @@ class Invoices extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('facturerec', $this->template_invoice->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		// Add external contacts ids
diff --git a/htdocs/compta/facture/class/facture.class.php b/htdocs/compta/facture/class/facture.class.php
index 710cf3edaab..9f3f554e229 100644
--- a/htdocs/compta/facture/class/facture.class.php
+++ b/htdocs/compta/facture/class/facture.class.php
@@ -221,7 +221,7 @@ class Facture extends CommonInvoice
 	public $tab_next_situation_invoice = array();
 
 	/**
-	 * @var Facture object oldcopy
+	 * @var static object oldcopy
 	 */
 	public $oldcopy;
 
diff --git a/htdocs/compta/facture/prelevement.php b/htdocs/compta/facture/prelevement.php
index 2371f6ff59a..0b0b394ace7 100644
--- a/htdocs/compta/facture/prelevement.php
+++ b/htdocs/compta/facture/prelevement.php
@@ -6,6 +6,7 @@
  * Copyright (C) 2010-2014  Juanjo Menent			<jmenent@2byte.es>
  * Copyright (C) 2017       Ferran Marcet			<fmarcet@2byte.es>
  * Copyright (C) 2018-2024  Frédéric France         <frederic.france@free.fr>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -64,7 +65,7 @@ if ($type == 'bank-transfer') {
 // Load object
 if ($id > 0 || !empty($ref)) {
 	$ret = $object->fetch($id, $ref);
-	$isdraft = (($object->statut == FactureFournisseur::STATUS_DRAFT) ? 1 : 0);
+	$isdraft = (($object->status == FactureFournisseur::STATUS_DRAFT) ? 1 : 0);
 	if ($ret > 0) {
 		$object->fetch_thirdparty();
 	}
@@ -146,7 +147,7 @@ if (empty($reshook)) {
 		} else {
 			// We refresh object data
 			$ret = $object->fetch($id, $ref);
-			$isdraft = (($object->statut == Facture::STATUS_DRAFT) ? 1 : 0);
+			$isdraft = (($object->status == Facture::STATUS_DRAFT) ? 1 : 0);
 			if ($ret > 0) {
 				$object->fetch_thirdparty();
 			}
@@ -161,7 +162,7 @@ if (empty($reshook)) {
 		} else {
 			// We refresh object data
 			$ret = $object->fetch($id, $ref);
-			$isdraft = (($object->statut == FactureFournisseur::STATUS_DRAFT) ? 1 : 0);
+			$isdraft = (($object->status == FactureFournisseur::STATUS_DRAFT) ? 1 : 0);
 			if ($ret > 0) {
 				$object->fetch_thirdparty();
 			}
@@ -280,7 +281,7 @@ if ($object->id > 0) {
 	//$resteapayer=bcadd($resteapayer,$totalavoir,$conf->global->MAIN_MAX_DECIMALS_TOT);
 	$resteapayer = price2num($object->total_ttc - $totalpaid - $totalcreditnotes - $totaldeposits, 'MT');
 
-	if ($object->paye) {
+	if ($object->paid) {
 		$resteapayer = 0;
 	}
 	$resteapayeraffiche = $resteapayer;
@@ -755,7 +756,7 @@ if ($object->id > 0) {
 	}
 
 	// Add a transfer request
-	if ($object->statut > $object::STATUS_DRAFT && $object->paye == 0 && $num == 0) {
+	if ($object->status > $object::STATUS_DRAFT && $object->paid == 0 && $num == 0) {
 		if ($resteapayer > 0) {
 			if ($user_perms) {
 				$remaintopaylesspendingdebit = $resteapayer - $pending;
@@ -794,7 +795,7 @@ if ($object->id > 0) {
 		}
 	} else {
 		if ($num == 0) {
-			if ($object->statut > $object::STATUS_DRAFT) {
+			if ($object->status > $object::STATUS_DRAFT) {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("AlreadyPaid")).'">'.$buttonlabel.'</a>';
 			} else {
 				print '<a class="butActionRefused classfortooltip" href="#" title="'.dol_escape_htmltag($langs->trans("Draft")).'">'.$buttonlabel.'</a>';
diff --git a/htdocs/compta/index.php b/htdocs/compta/index.php
index 59fae4217d6..0d20375bcb5 100644
--- a/htdocs/compta/index.php
+++ b/htdocs/compta/index.php
@@ -11,6 +11,7 @@
  * Copyright (C) 2020      Josep Lluís Amador   <joseplluis@lliuretic.cat>
  * Copyright (C) 2021-2024 Frédéric France		<frederic.france@free.fr>
  * Copyright (C) 2024      Rafael San José      <rsanjose@alxarafe.com>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -339,7 +340,9 @@ if ((isModEnabled('fournisseur') && !getDolGlobalString('MAIN_USE_NEW_SUPPLIERMO
 				$facstatic->total_tva = $obj->total_tva;
 				$facstatic->total_ttc = $obj->total_ttc;
 				$facstatic->statut = $obj->status;
+				$facstatic->status = $obj->status;
 				$facstatic->paye = $obj->paye;
+				$facstatic->paid = $obj->paye;
 				$facstatic->type = $obj->type;
 				$facstatic->ref_supplier = $obj->ref_supplier;
 
diff --git a/htdocs/compta/paymentbybanktransfer/index.php b/htdocs/compta/paymentbybanktransfer/index.php
index 9b42490727d..1135ff97b42 100644
--- a/htdocs/compta/paymentbybanktransfer/index.php
+++ b/htdocs/compta/paymentbybanktransfer/index.php
@@ -4,6 +4,7 @@
  * Copyright (C) 2005-2009 Regis Houssin        <regis.houssin@inodbox.com>
  * Copyright (C) 2011      Juanjo Menent		<jmenent@2byte.es>
  * Copyright (C) 2013      Florian Henry		<florian.henry@open-concept.pro>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -159,6 +160,7 @@ if (isModEnabled('supplier_invoice')) {
 				$invoicestatic->status = $obj->fk_statut;
 				$invoicestatic->statut = $obj->fk_statut;	// For backward compatibility
 				$invoicestatic->paye = $obj->paye;
+				$invoicestatic->paid = $obj->paye;
 				$invoicestatic->type = $obj->type;
 				$invoicestatic->date = $db->jdate($obj->datef);
 				$invoicestatic->date_echeance = $db->jdate($obj->date_lim_reglement);
diff --git a/htdocs/contact/agenda.php b/htdocs/contact/agenda.php
index 2c1a0d2ab99..5ef2652268c 100644
--- a/htdocs/contact/agenda.php
+++ b/htdocs/contact/agenda.php
@@ -144,7 +144,7 @@ if (empty($reshook)) {
 
 $form = new Form($db);
 
-$title = (getDolGlobalString('SOCIETE_ADDRESSES_MANAGEMENT') ? $langs->trans("Contacts") : $langs->trans("ContactsAddresses"));
+$title = $langs->trans("ContactEvents");
 if (getDolGlobalString('MAIN_HTML_TITLE') && preg_match('/contactnameonly/', getDolGlobalString('MAIN_HTML_TITLE')) && $object->lastname) {
 	$title = $object->lastname;
 }
diff --git a/htdocs/contact/card.php b/htdocs/contact/card.php
index 16087378bf2..1e0e14dbbc4 100644
--- a/htdocs/contact/card.php
+++ b/htdocs/contact/card.php
@@ -574,7 +574,6 @@ if (getDolGlobalString('MAIN_HTML_TITLE') && preg_match('/contactnameonly/', get
 	$title = $object->lastname;
 }
 $help_url = 'EN:Module_Third_Parties|FR:Module_Tiers|ES:Empresas';
-$title = (getDolGlobalString('SOCIETE_ADDRESSES_MANAGEMENT') ? $langs->trans("NewContact") : $langs->trans("NewContactAddress"));
 
 llxHeader('', $title, $help_url);
 
diff --git a/htdocs/contact/class/contact.class.php b/htdocs/contact/class/contact.class.php
index ac7c96194cb..833919df82d 100644
--- a/htdocs/contact/class/contact.class.php
+++ b/htdocs/contact/class/contact.class.php
@@ -337,7 +337,7 @@ class Contact extends CommonObject
 
 	/**
 	 * Old copy
-	 * @var Contact
+	 * @var static
 	 */
 	public $oldcopy; // To contains a clone of this when we need to save old properties of object
 
diff --git a/htdocs/contact/consumption.php b/htdocs/contact/consumption.php
index 66067b00e6e..158229e620a 100644
--- a/htdocs/contact/consumption.php
+++ b/htdocs/contact/consumption.php
@@ -111,7 +111,7 @@ $formother = new FormOther($db);
 $productstatic = new Product($db);
 $objsoc = new Societe($db);
 
-$title = (getDolGlobalString('SOCIETE_ADDRESSES_MANAGEMENT') ? $langs->trans("Contacts") : $langs->trans("ContactsAddresses"));
+$title = $langs->trans("ContactRelatedItems");
 $help_url = 'EN:Module_Third_Parties|FR:Module_Tiers|ES:Empresas';
 llxHeader('', $title, $help_url);
 
diff --git a/htdocs/contact/document.php b/htdocs/contact/document.php
index c4b216d2679..efc55ac0e5b 100644
--- a/htdocs/contact/document.php
+++ b/htdocs/contact/document.php
@@ -110,7 +110,7 @@ include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php';
 
 $form = new Form($db);
 
-$title = (getDolGlobalString('SOCIETE_ADDRESSES_MANAGEMENT') ? $langs->trans("Contacts") : $langs->trans("ContactsAddresses"));
+$title = $langs->trans("ContactLinkedFiles");
 if (getDolGlobalString('MAIN_HTML_TITLE') && preg_match('/contactnameonly/', getDolGlobalString('MAIN_HTML_TITLE')) && $object->lastname) {
 	$title = $object->lastname;
 }
diff --git a/htdocs/contact/note.php b/htdocs/contact/note.php
index 1f7a328e614..1f956e94821 100644
--- a/htdocs/contact/note.php
+++ b/htdocs/contact/note.php
@@ -78,7 +78,7 @@ if (empty($reshook)) {
 
 $now = dol_now();
 
-$title = (getDolGlobalString('SOCIETE_ADDRESSES_MANAGEMENT') ? $langs->trans("Contacts") : $langs->trans("ContactsAddresses"));
+$title = $langs->trans("ContactNotes");
 
 $form = new Form($db);
 
diff --git a/htdocs/contact/perso.php b/htdocs/contact/perso.php
index 90028857f99..0661a80b685 100644
--- a/htdocs/contact/perso.php
+++ b/htdocs/contact/perso.php
@@ -3,6 +3,7 @@
  * Copyright (C) 2004-2011  Laurent Destailleur     <eldy@users.sourceforge.net>
  * Copyright (C) 2005-2012  Regis Houssin           <regis.houssin@inodbox.com>
  * Copyright (C) 2018-2021  Frédéric France         <frederic.france@netlogic.fr>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -119,7 +120,7 @@ if ($action == 'update' && !GETPOST("cancel") && $user->hasRight('societe', 'con
 
 $now = dol_now();
 
-$title = (getDolGlobalString('SOCIETE_ADDRESSES_MANAGEMENT') ? $langs->trans("Contacts") : $langs->trans("ContactsAddresses"));
+$title = $langs->trans("ContactPersonalData");
 if (getDolGlobalString('MAIN_HTML_TITLE') && preg_match('/contactnameonly/', getDolGlobalString('MAIN_HTML_TITLE')) && $object->lastname) {
 	$title = $object->lastname;
 }
@@ -294,8 +295,8 @@ if ($action == 'edit') {
 
 		print ' &nbsp; ';
 		//var_dump($birthdatearray);
-		$ageyear = convertSecondToTime($now - $object->birthday, 'year') - 1970;
-		$agemonth = convertSecondToTime($now - $object->birthday, 'month') - 1;
+		$ageyear = (int) convertSecondToTime($now - $object->birthday, 'year') - 1970;
+		$agemonth = (int) convertSecondToTime($now - $object->birthday, 'month') - 1;
 		if ($ageyear >= 2) {
 			print '('.$ageyear.' '.$langs->trans("DurationYears").')';
 		} elseif ($agemonth >= 2) {
diff --git a/htdocs/contrat/class/api_contracts.class.php b/htdocs/contrat/class/api_contracts.class.php
index cee27733140..c599ad6d82e 100644
--- a/htdocs/contrat/class/api_contracts.class.php
+++ b/htdocs/contrat/class/api_contracts.class.php
@@ -75,7 +75,7 @@ class Contracts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contrat', $this->contract->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->contract->fetchObjectLinked();
@@ -192,11 +192,11 @@ class Contracts extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->contract->context['caller'] = $request_data['caller'];
+				$this->contract->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->contract->$field = $value;
+			$this->contract->$field = $this->_checkValForAPI($field, $value, $this->contract);
 		}
 		/*if (isset($request_data["lines"])) {
 		  $lines = array();
@@ -233,7 +233,7 @@ class Contracts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contrat', $this->contract->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$this->contract->getLinesArray();
 		$result = array();
@@ -265,7 +265,7 @@ class Contracts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contrat', $this->contract->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -323,7 +323,7 @@ class Contracts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contrat', $this->contract->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -386,7 +386,7 @@ class Contracts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contrat', $this->contract->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$updateRes = $this->contract->active_line(DolibarrApiAccess::$user, $lineid, $datestart, $dateend, $comment);
@@ -424,7 +424,7 @@ class Contracts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contrat', $this->contract->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$updateRes = $this->contract->close_line(DolibarrApiAccess::$user, $lineid, $datestart, $comment);
@@ -464,7 +464,7 @@ class Contracts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contrat', $this->contract->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		// TODO Check the lineid $lineid is a line of object
@@ -496,7 +496,7 @@ class Contracts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contrat', $this->contract->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		foreach ($request_data as $field => $value) {
 			if ($field == 'id') {
@@ -504,11 +504,17 @@ class Contracts extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->contract->context['caller'] = $request_data['caller'];
+				$this->contract->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
+				continue;
+			}
+			if ($field == 'array_options' && is_array($value)) {
+				foreach ($value as $index => $val) {
+					$this->contract->array_options[$index] = $this->_checkValForAPI($field, $val, $this->contract);;
+				}
 				continue;
 			}
 
-			$this->contract->$field = $value;
+			$this->contract->$field = $this->_checkValForAPI($field, $value, $this->contract);
 		}
 
 		if ($this->contract->update(DolibarrApiAccess::$user) > 0) {
@@ -624,7 +630,7 @@ class Contracts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contrat', $this->contract->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->contract->closeAll(DolibarrApiAccess::$user, $notrigger);
diff --git a/htdocs/core/boxes/box_factures_fourn_imp.php b/htdocs/core/boxes/box_factures_fourn_imp.php
index 777cea5a2ed..7806477433a 100644
--- a/htdocs/core/boxes/box_factures_fourn_imp.php
+++ b/htdocs/core/boxes/box_factures_fourn_imp.php
@@ -138,6 +138,7 @@ class box_factures_fourn_imp extends ModeleBoxes
 					//$alreadypaid = $facturestatic->getSommePaiement();
 
 					$facturestatic->paye = $objp->paye;
+					$facturestatic->paid = $objp->paye;
 					$facturestatic->alreadypaid = $objp->am;
 
 					$thirdpartystatic->id = $objp->socid;
diff --git a/htdocs/core/class/CMailFile.class.php b/htdocs/core/class/CMailFile.class.php
index 9d73998e151..323b544c9ba 100644
--- a/htdocs/core/class/CMailFile.class.php
+++ b/htdocs/core/class/CMailFile.class.php
@@ -52,7 +52,7 @@ class CMailFile
 	public $subject;
 	public $addr_from; // From:		Label and EMail of sender (must include '<>'). For example '<myemail@example.com>' or 'John Doe <myemail@example.com>' or '<myemail+trackingid@example.com>'). Note that with gmail smtps, value here is forced by google to account (but not the reply-to).
 	// Sender:      Who send the email ("Sender" has sent emails on behalf of "From").
-	//              Use it when the "From" is an email of a domain that is a SPF protected domain, and sending smtp server is not this domain. In such case, add Sender field with an email of the protected domain.
+	//              Use it when the "From" is an email of a domain that is a SPF protected domain, and the sending smtp server is not this domain. In such case, add Sender field with an email of the protected domain.
 	// Return-Path: Email where to send bounds.
 	public $reply_to; // Reply-To:	Email where to send replies from mailer software (mailer use From if reply-to not defined, Gmail use gmail account if reply-to not defined)
 	public $errors_to; // Errors-To:	Email where to send errors.
@@ -114,7 +114,19 @@ class CMailFile
 	 * @var string	Message-ID of the email to send (generated)
 	 */
 	public $msgid;
+
+	/**
+	 * @var string	Value to use in In-reply-to when email is set as an answer of another email (The Msg-Id of received email)
+	 */
+	public $in_reply_to;
+
+	/**
+	 * @var string	References to add to the email to send (generated from the email we answer)
+	 */
+	public $references;
+
 	public $headers;
+
 	public $message;
 
 	/**
@@ -172,10 +184,12 @@ class CMailFile
 	 *	@param	string	$trackid             Tracking string (contains type and id of related element)
 	 *  @param  string  $moreinheader        More in header. $moreinheader must contains the "\r\n" at end of each line
 	 *  @param  string  $sendcontext      	 'standard', 'emailing', 'ticket', 'password', ... (used to define which sending mode and parameters to use)
-	 *  @param	string	$replyto			 Reply-to email (will be set to same value than From by default if not provided)
+	 *  @param	string	$replyto			 Reply-to email (will be set to the same value than From by default if not provided)
 	 *  @param	string	$upload_dir_tmp		 Temporary directory (used to convert images embedded as img src=data:image)
+	 *  @param	string	$in_reply_to		 Message-ID of the message we reply Token
+	 *  @param	string	$references			 String with list of Message-ID of the thread ('<123> <456> ...')
 	 */
-	public function __construct($subject, $to, $from, $msg, $filename_list = array(), $mimetype_list = array(), $mimefilename_list = array(), $addr_cc = "", $addr_bcc = "", $deliveryreceipt = 0, $msgishtml = 0, $errors_to = '', $css = '', $trackid = '', $moreinheader = '', $sendcontext = 'standard', $replyto = '', $upload_dir_tmp = '')
+	public function __construct($subject, $to, $from, $msg, $filename_list = array(), $mimetype_list = array(), $mimefilename_list = array(), $addr_cc = "", $addr_bcc = "", $deliveryreceipt = 0, $msgishtml = 0, $errors_to = '', $css = '', $trackid = '', $moreinheader = '', $sendcontext = 'standard', $replyto = '', $upload_dir_tmp = '', $in_reply_to = '', $references = '')
 	{
 		global $conf, $dolibarr_main_data_root, $user;
 
@@ -428,6 +442,8 @@ class CMailFile
 		$this->reply_to = dol_sanitizeEmail($replyto);
 		$this->errors_to = dol_sanitizeEmail($errors_to);
 		$this->trackid = $trackid;
+		$this->in_reply_to = $in_reply_to;
+		$this->references = $references;
 		// Set arrays with attached files info
 		$this->filename_list = $filename_list;
 		$this->mimetype_list = $mimetype_list;
@@ -462,7 +478,7 @@ class CMailFile
 			$text_body = "";
 			$files_encoded = "";
 
-			// Define smtp_headers (this also set ->msgid)
+			// Define smtp_headers (this also set SMTP headers from ->msgid, ->in_reply_to and ->references)
 			$smtp_headers = $this->write_smtpheaders();
 			if (!empty($moreinheader)) {
 				$smtp_headers .= $moreinheader; // $moreinheader contains the \r\n
@@ -516,15 +532,23 @@ class CMailFile
 			$smtps->setSubject($subjecttouse);
 			$smtps->setTO($this->getValidAddress($this->addr_to, 0, 1));
 			$smtps->setFrom($this->getValidAddress($this->addr_from, 0, 1));
-			$smtps->setTrackId($this->trackid);
 			$smtps->setReplyTo($this->getValidAddress($this->reply_to, 0, 1));
 
-			//X-Dolibarr-TRACKID is generated inside the smtps->getHeader
+			$smtps->setTrackId($this->trackid);
+
+			if (!empty($this->in_reply_to)) {
+				$smtps->setInReplyTo($this->in_reply_to);
+			}
+			if (!empty($this->references)) {
+				$smtps->setReferences($this->references);
+			}
 
 			if (!empty($moreinheader)) {
 				$smtps->setMoreInHeader($moreinheader);
 			}
 
+			//X-Dolibarr-TRACKID, In-Reply-To, References and $moreinheader will be added to header inside the smtps->getHeader
+
 			if (!empty($this->html)) {
 				if (!empty($css)) {
 					$this->css = $css;
@@ -592,8 +616,14 @@ class CMailFile
 			$msgid = $headers->get('Message-ID');
 			$msgid->setId($headerID);
 
+			// Add 'In-Reply-To:' header
+			if (!empty($this->in_reply_to)) {
+				$headers->addIdHeader('In-Reply-To', $this->in_reply_to);
+			}
 			// Add 'References:' header
-			//$headers->addIdHeader('References', $headerID);
+			if (!empty($this->references)) {
+				$headers->addIdHeader('References', $this->references);
+			}
 
 			if (!empty($moreinheader)) {
 				$moreinheaderarray = preg_split('/[\r\n]+/', $moreinheader);
@@ -1543,16 +1573,23 @@ class CMailFile
 
 		$trackid = $this->trackid;
 		if ($trackid) {
-			// References is kept in response and Message-ID is returned into In-Reply-To:
 			$this->msgid = time().'.phpmail-dolibarr-'.$trackid.'@'.$host;
 			$out .= 'Message-ID: <'.$this->msgid.">".$this->eol2; // Uppercase seems replaced by phpmail
-			//$out .= 'References: <'.$this->msgid.">".$this->eol2;
 			$out .= 'X-Dolibarr-TRACKID: '.$trackid.'@'.$host.$this->eol2;
 		} else {
 			$this->msgid = time().'.phpmail@'.$host;
 			$out .= 'Message-ID: <'.$this->msgid.">".$this->eol2;
 		}
 
+		// Add 'In-Reply-To:' header with the Message-Id we answer
+		if (!empty($this->in_reply_to)) {
+			$out .= 'In-Reply-To: <'.$this->in_reply_to.'>'.$this->eol2;
+		}
+		// Add 'References:' header with list of all Message-ID in thread history
+		if (!empty($this->references)) {
+			$out .= 'References: '.$this->references.$this->eol2;
+		}
+
 		if (!empty($_SERVER['REMOTE_ADDR'])) {
 			$out .= "X-RemoteAddr: ".$_SERVER['REMOTE_ADDR'].$this->eol2;
 		}
diff --git a/htdocs/core/class/comment.class.php b/htdocs/core/class/comment.class.php
index f60f5c44183..9ffa0d60a1e 100644
--- a/htdocs/core/class/comment.class.php
+++ b/htdocs/core/class/comment.class.php
@@ -77,7 +77,7 @@ class Comment extends CommonObject
 	public $comments = array();
 
 	/**
-	 * @var Comment 	Object oldcopy
+	 * @var static 	Object oldcopy
 	 */
 	public $oldcopy;
 
diff --git a/htdocs/core/class/discount.class.php b/htdocs/core/class/discount.class.php
index d51210bff34..29e663f4e27 100644
--- a/htdocs/core/class/discount.class.php
+++ b/htdocs/core/class/discount.class.php
@@ -303,7 +303,7 @@ class DiscountAbsolute extends CommonObject
 	 *  Delete object in database. If fk_facture_source is defined, we delete all family with same fk_facture_source. If not, only with id is removed
 	 *
 	 *  @param	User	$user		Object of user asking to delete
-	 *  @return	int<-1,1>			Return integer <0 if KO, >0 if OK
+	 *  @return	int<-2,1>			Return integer <0 if KO, >0 if OK
 	 */
 	public function delete($user)
 	{
@@ -427,7 +427,7 @@ class DiscountAbsolute extends CommonObject
 	 *
 	 *	@param		int		$rowidline		Invoice line id (To use discount into invoice lines)
 	 *	@param		int		$rowidinvoice	Invoice id (To use discount as a credit note to reduce payment of invoice)
-	 *	@return		int<-1,1>				Return integer <0 if KO, >0 if OK
+	 *	@return		int<-3,1>				Return integer <0 if KO, >0 if OK
 	 */
 	public function link_to_invoice($rowidline, $rowidinvoice)
 	{
@@ -483,7 +483,7 @@ class DiscountAbsolute extends CommonObject
 	 *	Link the discount to a particular invoice line or a particular invoice.
 	 *	Do not call this if discount is linked to a reconcialiated invoice
 	 *
-	 *	@return		int<-1,1>					Return integer <0 if KO, >0 if OK
+	 *	@return		int<-3,1>					Return integer <0 if KO, >0 if OK
 	 */
 	public function unlink_invoice()
 	{
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index 410dfb85bca..337f2366b1f 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -70,7 +70,9 @@ class Form
 	public $errors = array();
 
 	// Some properties used to return data by some methods
+	/** @var array<string,int> */
 	public $result;
+	/** @var int */
 	public $num;
 
 	// Cache arrays
@@ -213,7 +215,7 @@ class Form
 	 * @param string 	$formatfunc 	Call a specific method of $object->$formatfunc to output field in view mode (For example: 'dol_print_email')
 	 * @param string 	$paramid 		Key of parameter for id ('id', 'socid')
 	 * @param string 	$gm 			'auto' or 'tzuser' or 'tzuserrel' or 'tzserver' (when $typeofdata is a date)
-	 * @param array 	$moreoptions 	Array with more options. For example array('addnowlink'=>1), array('valuealreadyhtmlescaped'=>1)
+	 * @param array<string,int> 	$moreoptions 	Array with more options. For example array('addnowlink'=>1), array('valuealreadyhtmlescaped'=>1)
 	 * @param string 	$editaction 	[=''] use GETPOST default action or set action to edit mode
 	 * @return string                   HTML edit field
 	 */
@@ -408,7 +410,7 @@ class Form
 	 * Output edit in place form
 	 *
 	 * @param 	string 	$fieldname 	Name of the field
-	 * @param 	object 	$object 	Object
+	 * @param 	CommonObject	$object Object
 	 * @param 	boolean $perm 		Permission to allow button to edit parameter. Set it to 0 to have a not edited field.
 	 * @param 	string 	$typeofdata Type of data ('string' by default, 'email', 'amount:99', 'numeric:99', 'text' or 'textarea:rows:cols', 'datepicker' ('day' do not work, don't know why), 'ckeditor:dolibarr_zzz:width:height:savemethod:1:rows:cols', 'select;xxx[:class]'...)
 	 * @param 	string 	$check 		Same coe than $check parameter of GETPOST()
@@ -814,7 +816,7 @@ class Form
 	 * Generate select HTML to choose massaction
 	 *
 	 * @param string 	$selected 		Value auto selected when at least one record is selected. Not a preselected value. Use '0' by default.
-	 * @param array 	$arrayofaction 	array('code'=>'label', ...). The code is the key stored into the GETPOST('massaction') when submitting action.
+	 * @param array<string,string> 	$arrayofaction 	array('code'=>'label', ...). The code is the key stored into the GETPOST('massaction') when submitting action.
 	 * @param int 		$alwaysvisible 	1=select button always visible
 	 * @param string 	$name 			Name for massaction
 	 * @param string 	$cssclass 		CSS class used to check for select
@@ -927,10 +929,10 @@ class Form
 	 * @param string 		$morecss 				More css class
 	 * @param string 		$usecodeaskey 			''=Use id as key (default), 'code3'=Use code on 3 alpha as key, 'code2"=Use code on 2 alpha as key
 	 * @param int<0,1>|string 	$showempty 				Show empty choice
-	 * @param int 			$disablefavorites 		1=Disable favorites,
-	 * @param int 			$addspecialentries 		1=Add dedicated entries for group of countries (like 'European Economic Community', ...)
-	 * @param array 		$exclude_country_code 	Array of country code (iso2) to exclude
-	 * @param int 			$hideflags 				Hide flags
+	 * @param int<0,1>		$disablefavorites 		1=Disable favorites,
+	 * @param int<0,1> 		$addspecialentries 		1=Add dedicated entries for group of countries (like 'European Economic Community', ...)
+	 * @param string[] 		$exclude_country_code 	Array of country code (iso2) to exclude
+	 * @param int<0,1>		$hideflags 				Hide flags
 	 * @return string       	                	HTML string with select
 	 */
 	public function select_country($selected = '', $htmlname = 'country_id', $htmloption = '', $maxlength = 0, $morecss = 'minwidth300', $usecodeaskey = '', $showempty = 1, $disablefavorites = 0, $addspecialentries = 0, $exclude_country_code = array(), $hideflags = 0)
@@ -1061,9 +1063,9 @@ class Form
 	 * @param 	string 	$page 					Defined the form action
 	 * @param 	string 	$htmlname 				Name of html select object
 	 * @param 	string 	$htmloption 			Options html on select object
-	 * @param 	int 	$forcecombo 			Force to load all values and output a standard combobox (with no beautification)
-	 * @param 	array 	$events 				Event options to run on change. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
-	 * @param 	int 	$disableautocomplete 	Disable autocomplete
+	 * @param 	int<0,1>	$forcecombo 			Force to load all values and output a standard combobox (with no beautification)
+	 * @param 	array<array{method:string,url:string,htmlname:string,params:array<string,string>}> 	$events 				Event options to run on change. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
+	 * @param 	int<0,1>	$disableautocomplete 	Disable autocomplete
 	 * @return 	string                       	HTML string with select and input
 	 */
 	public function select_incoterms($selected = '', $location_incoterms = '', $page = '', $htmlname = 'incoterm_id', $htmloption = '', $forcecombo = 1, $events = array(), $disableautocomplete = 0)
@@ -1306,16 +1308,16 @@ class Form
 	 * @param string|int<1,1> 	$showempty 	Add an empty field (Can be '1' or text key to use on empty line like 'SelectThirdParty')
 	 * @param int 		$showtype 			Show third party type in combolist (customer, prospect or supplier)
 	 * @param int 		$forcecombo 		Force to load all values and output a standard combobox (with no beautification)
-	 * @param array 	$events 			Ajax event options to run on change. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
+	 * @param 	array<array{method:string,url:string,htmlname:string,params:array<string,string>}> 	$events 	Ajax event options to run on change. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
 	 * @param int 		$limit 				Maximum number of elements
 	 * @param string 	$morecss 			Add more css styles to the SELECT component
 	 * @param string 	$moreparam 			Add more parameters onto the select tag. For example 'style="width: 95%"' to avoid select2 component to go over parent container
 	 * @param string 	$selected_input_value 	Value of preselected input text (for use with ajax)
-	 * @param int 		$hidelabel 			Hide label (0=no, 1=yes, 2=show search icon (before) and placeholder, 3 search icon after)
-	 * @param array 	$ajaxoptions 		Options for ajax_autocompleter
+	 * @param int<0,3>	$hidelabel 			Hide label (0=no, 1=yes, 2=show search icon (before) and placeholder, 3 search icon after)
+	 * @param array<string,string|string[]>	$ajaxoptions 		Options for ajax_autocompleter
 	 * @param bool 		$multiple 			add [] in the name of element and add 'multiple' attribute (not working with ajax_autocompleter)
-	 * @param array 	$excludeids 		Exclude IDs from the select combo
-	 * @param int 		$showcode 			Show code
+	 * @param string[] 	$excludeids 		Exclude IDs from the select combo
+	 * @param int<0,1>	$showcode 			Show code
 	 * @return string  		                HTML string with select box for thirdparty.
 	 */
 	public function select_company($selected = '', $htmlname = 'socid', $filter = '', $showempty = '', $showtype = 0, $forcecombo = 0, $events = array(), $limit = 0, $morecss = 'minwidth100', $moreparam = '', $selected_input_value = '', $hidelabel = 1, $ajaxoptions = array(), $multiple = false, $excludeids = array(), $showcode = 0)
@@ -1384,16 +1386,16 @@ class Form
 	 * @param string|int<0,1> 	$showempty 	Add an empty field (Can be '1' or text to use on empty line like 'SelectThirdParty')
 	 * @param int<0,1>	$showtype 		Show third party type in combolist (customer, prospect or supplier)
 	 * @param int 		$forcecombo 	Force to use standard HTML select component without beautification
-	 * @param array 	$events 		Event options. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
+	 * @param 	array<array{method:string,url:string,htmlname:string,params:array<string,string>}> 	$events 	Event options. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
 	 * @param string 	$filterkey 		Filter on key value
-	 * @param int 		$outputmode 	0=HTML select string, 1=Array
+	 * @param int<0,1>	$outputmode 	0=HTML select string, 1=Array
 	 * @param int 		$limit 			Limit number of answers
 	 * @param string 	$morecss 		Add more css styles to the SELECT component
 	 * @param string 	$moreparam 		Add more parameters onto the select tag. For example 'style="width: 95%"' to avoid select2 component to go over parent container
 	 * @param bool 		$multiple 		add [] in the name of element and add 'multiple' attribute
-	 * @param array 	$excludeids 	Exclude IDs from the select combo
-	 * @param int 		$showcode 		Show code in list
-	 * @return array|string            	HTML string with
+	 * @param string[] 	$excludeids 	Exclude IDs from the select combo
+	 * @param int<0,1>	$showcode 		Show code in list
+	 * @return array<int,array{key:int,value:string,label:string,labelhtml:string}>|string            	HTML string with
 	 */
 	public function select_thirdparty_list($selected = '', $htmlname = 'socid', $filter = '', $showempty = '', $showtype = 0, $forcecombo = 0, $events = array(), $filterkey = '', $outputmode = 0, $limit = 0, $morecss = 'minwidth100', $moreparam = '', $multiple = false, $excludeids = array(), $showcode = 0)
 	{
@@ -1727,7 +1729,7 @@ class Form
 	 * @param string 	$morecss 		Add more class to class style
 	 * @param integer 	$showsoc 		Add company into label
 	 * @param int 		$forcecombo 	Force to use combo box
-	 * @param array 	$events 		Event options. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
+	 * @param 	array<array{method:string,url:string,htmlname:string,params:array<string,string>}> 	$events 	Event options. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
 	 * @param bool 		$options_only 	Return options only (for ajax treatment)
 	 * @param string 	$moreparam 		Add more parameters onto the select tag. For example 'style="width: 95%"' to avoid select2 component to go over parent container
 	 * @param string 	$htmlid 		Html id to use instead of htmlname
@@ -1758,7 +1760,7 @@ class Form
 	 * @param bool 			$options_only 		Return options only (for ajax treatment)
 	 * @param integer 		$showsoc 			Add company into label
 	 * @param int 			$forcecombo 		Force to use combo box (so no ajax beautify effect)
-	 * @param array 		$events 			Event options. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
+	 * @param 	array<array{method:string,url:string,htmlname:string,params:array<string,string>}> 	$events 	Event options. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
 	 * @param string 		$moreparam 			Add more parameters onto the select tag. For example 'style="width: 95%"' to avoid select2 component to go over parent container
 	 * @param string 		$htmlid 			Html id to use instead of htmlname
 	 * @param bool 			$multiple 			add [] in the name of element and add 'multiple' attribute
@@ -1970,11 +1972,11 @@ class Form
 	 *
 	 * @param string $selected Id user preselected
 	 * @param string $htmlname Field name in form
-	 * @param int $show_empty 0=liste sans valeur nulle, 1=ajoute valeur inconnue
-	 * @param array $exclude Array list of users id to exclude
-	 * @param int $disabled If select list must be disabled
-	 * @param array|string $include Array list of users id to include. User '' for all users or 'hierarchy' to have only supervised users or 'hierarchyme' to have supervised + me
-	 * @param array|int $enableonly Array list of users id to be enabled. All other must be disabled
+	 * @param int<0,1> $show_empty 0=liste sans valeur nulle, 1=ajoute valeur inconnue
+	 * @param int[] $exclude Array list of users id to exclude
+	 * @param int<0,1> $disabled If select list must be disabled
+	 * @param int[]|string $include Array list of users id to include. User '' for all users or 'hierarchy' to have only supervised users or 'hierarchyme' to have supervised + me
+	 * @param int[]|int $enableonly Array list of users id to be enabled. All other must be disabled
 	 * @param string $force_entity '0' or Ids of environment to force
 	 * @return    void
 	 * @deprecated        Use select_dolusers instead
@@ -1991,25 +1993,25 @@ class Form
 	/**
 	 *    Return select list of users
 	 *
-	 * @param string|int	$selected 		User id or user object of user preselected. If 0 or < -2, we use id of current user. If -1 or '', keep unselected (if empty is allowed)
+	 * @param string|int|User	$selected 	User id or user object of user preselected. If 0 or < -2, we use id of current user. If -1 or '', keep unselected (if empty is allowed)
 	 * @param string 		$htmlname 		Field name in form
-	 * @param int|string 	$show_empty 	0=list with no empty value, 1=add also an empty value into list
-	 * @param array|null	$exclude 		Array list of users id to exclude
+	 * @param int<0,1>|string 	$show_empty 	0=list with no empty value, 1=add also an empty value into list
+	 * @param int[]|null	$exclude 		Array list of users id to exclude
 	 * @param int 			$disabled 		If select list must be disabled
-	 * @param array|string 	$include 		Array list of users id to include. User '' for all users or 'hierarchy' to have only supervised users or 'hierarchyme' to have supervised + me
+	 * @param int[]|string 	$include 		Array list of users id to include. User '' for all users or 'hierarchy' to have only supervised users or 'hierarchyme' to have supervised + me
 	 * @param array|string	$enableonly 	Array list of users id to be enabled. If defined, it means that others will be disabled
 	 * @param string 		$force_entity 	'0' or list of Ids of environment to force separated by a coma
 	 * @param int 			$maxlength 		Maximum length of string into list (0=no limit)
-	 * @param int 			$showstatus 	0=show user status only if status is disabled, 1=always show user status into label, -1=never show user status
+	 * @param int<-1,1>		$showstatus 	0=show user status only if status is disabled, 1=always show user status into label, -1=never show user status
 	 * @param string 		$morefilter 	Add more filters into sql request (Example: 'employee = 1'). This value must not come from user input.
 	 * @param integer 		$show_every 	0=default list, 1=add also a value "Everybody" at beginning of list
 	 * @param string 		$enableonlytext If option $enableonlytext is set, we use this text to explain into label why record is disabled. Not used if enableonly is empty.
 	 * @param string 		$morecss 		More css
-	 * @param int 			$notdisabled 	Show only active users (this will also happened whatever is this option if USER_HIDE_INACTIVE_IN_COMBOBOX is on).
-	 * @param int 			$outputmode 	0=HTML select string, 1=Array
+	 * @param int<0,1> 		$notdisabled 	Show only active users (this will also happened whatever is this option if USER_HIDE_INACTIVE_IN_COMBOBOX is on).
+	 * @param int<0,2>		$outputmode 	0=HTML select string, 1=Array
 	 * @param bool 			$multiple 		add [] in the name of element and add 'multiple' attribute
-	 * @param int 			$forcecombo 	Force the component to be a simple combo box without ajax
-	 * @return array|string                    HTML select string
+	 * @param int<0,1> 			$forcecombo 	Force the component to be a simple combo box without ajax
+	 * @return string|array<int,string|array{id:int,label:string,labelhtml:string,color:string,picto:string}>	HTML select string
 	 * @see select_dolgroups()
 	 */
 	public function select_dolusers($selected = '', $htmlname = 'userid', $show_empty = 0, $exclude = null, $disabled = 0, $include = '', $enableonly = '', $force_entity = '', $maxlength = 0, $showstatus = 0, $morefilter = '', $show_every = 0, $enableonlytext = '', $morecss = '', $notdisabled = 0, $outputmode = 0, $multiple = false, $forcecombo = 0)
@@ -2205,7 +2207,7 @@ class Form
 					if (!empty($disableline)) {
 						$out .= ' disabled';
 					}
-					if ((is_object($selected) && $selected->id == $obj->rowid) || (!is_object($selected) && in_array($obj->rowid, $selected))) {
+					if ((!empty($selected[0]) && is_object($selected[0])) ? $selected[0]->id == $obj->rowid : in_array($obj->rowid, $selected)) {
 						$out .= ' selected';
 					}
 					$out .= ' data-html="';
@@ -2265,19 +2267,19 @@ class Form
 	 *
 	 * @param string 	$action 			Value for $action
 	 * @param string 	$htmlname			Field name in form
-	 * @param int 		$show_empty 		0=list without the empty value, 1=add empty value
-	 * @param array 	$exclude 			Array list of users id to exclude
-	 * @param int 		$disabled 			If select list must be disabled
-	 * @param array 	$include 			Array list of users id to include or 'hierarchy' to have only supervised users
-	 * @param array|int	$enableonly 		Array list of users id to be enabled. All other must be disabled
+	 * @param int<0,1> 	$show_empty 		0=list without the empty value, 1=add empty value
+	 * @param int[] 	$exclude 			Array list of users id to exclude
+	 * @param int<0,1>	$disabled 			If select list must be disabled
+	 * @param int[]|string 	$include 			Array list of users id to include or 'hierarchy' to have only supervised users
+	 * @param int[]|int	$enableonly 		Array list of users id to be enabled. All other must be disabled
 	 * @param string	$force_entity 		'0' or Ids of environment to force
 	 * @param int 		$maxlength 			Maximum length of string into list (0=no limit)
-	 * @param int 		$showstatus 		0=show user status only if status is disabled, 1=always show user status into label, -1=never show user status
+	 * @param int<0,1>	$showstatus 		0=show user status only if status is disabled, 1=always show user status into label, -1=never show user status
 	 * @param string 	$morefilter 		Add more filters into sql request
 	 * @param int 		$showproperties 	Show properties of each attendees
-	 * @param array 	$listofuserid 		Array with properties of each user
-	 * @param array 	$listofcontactid 	Array with properties of each contact
-	 * @param array 	$listofotherid 		Array with properties of each other contact
+	 * @param int[] 	$listofuserid 		Array with properties of each user
+	 * @param int[] 	$listofcontactid 	Array with properties of each contact
+	 * @param int[] 	$listofotherid 		Array with properties of each other contact
 	 * @return    string                    HTML select string
 	 * @see select_dolgroups()
 	 */
@@ -2289,9 +2291,13 @@ class Form
 		$userstatic = new User($this->db);
 		$out = '';
 
-		$assignedtouser = array();
 		if (!empty($_SESSION['assignedtouser'])) {
 			$assignedtouser = json_decode($_SESSION['assignedtouser'], true);
+			if (!is_array($assignedtouser)) {
+				$assignedtouser = array();
+			}
+		} else {
+			$assignedtouser = array();
 		}
 		$nbassignetouser = count($assignedtouser);
 
@@ -2360,16 +2366,16 @@ class Form
 	 * @param string 	$action 			Value for $action
 	 * @param string 	$htmlname			Field name in form
 	 * @param int 		$show_empty 		0=list without the empty value, 1=add empty value
-	 * @param array 	$exclude 			Array list of users id to exclude
-	 * @param int 		$disabled 			If select list must be disabled
-	 * @param array 	$include 			Array list of users id to include or 'hierarchy' to have only supervised users
-	 * @param array 	$enableonly 		Array list of users id to be enabled. All other must be disabled
+	 * @param int[] 	$exclude 			Array list of users id to exclude
+	 * @param int<0,1>	$disabled 			If select list must be disabled
+	 * @param int[]|string 	$include 		Array list of users id to include or 'hierarchy' to have only supervised users
+	 * @param int[] 	$enableonly 		Array list of users id to be enabled. All other must be disabled
 	 * @param string	$force_entity 		'0' or Ids of environment to force
 	 * @param int 		$maxlength 			Maximum length of string into list (0=no limit)
-	 * @param int 		$showstatus 		0=show user status only if status is disabled, 1=always show user status into label, -1=never show user status
+	 * @param int<-1,1>	$showstatus 		0=show user status only if status is disabled, 1=always show user status into label, -1=never show user status
 	 * @param string 	$morefilter 		Add more filters into sql request
 	 * @param int 		$showproperties 	Show properties of each attendees
-	 * @param array 	$listofresourceid 	Array with properties of each resource
+	 * @param array<int,array{transparency:bool|int<0,1>}> $listofresourceid 	Array with properties of each resource
 	 * @return    string                    HTML select string
 	 */
 	public function select_dolresources_forevent($action = '', $htmlname = 'userid', $show_empty = 0, $exclude = null, $disabled = 0, $include = array(), $enableonly = array(), $force_entity = '0', $maxlength = 0, $showstatus = 0, $morefilter = '', $showproperties = 0, $listofresourceid = array())
@@ -2383,9 +2389,13 @@ class Form
 		$resourcestatic = new Dolresource($this->db);
 
 		$out = '';
-		$assignedtoresource = array();
 		if (!empty($_SESSION['assignedtoresource'])) {
 			$assignedtoresource = json_decode($_SESSION['assignedtoresource'], true);
+			if (!is_array($assignedtoresource)) {
+				$assignedtoresource = array();
+			}
+		} else {
+			$assignedtoresource = array();
 		}
 		$nbassignetoresource = count($assignedtoresource);
 
@@ -2433,7 +2443,7 @@ class Form
 
 			$events = array();
 			$out .= img_picto('', 'resource', 'class="pictofixedwidth"');
-			$out .= $formresources->select_resource_list(0, $htmlname, [], 1, 1, 0, $events, '', 2, 0);
+			$out .= $formresources->select_resource_list(0, $htmlname, [], 1, 1, 0, $events, array(), 2, 0);
 			//$out .= $this->select_dolusers('', $htmlname, $show_empty, $exclude, $disabled, $include, $enableonly, $force_entity, $maxlength, $showstatus, $morefilter);
 			$out .= ' <input type="submit" disabled class="button valignmiddle smallpaddingimp reposition" id="' . $action . 'assignedtoresource" name="' . $action . 'assignedtoresource" value="' . dol_escape_htmltag($langs->trans("Add")) . '">';
 			$out .= '<br>';
@@ -2456,19 +2466,19 @@ class Form
 	 *  @param		int			$finished				2=all, 1=finished, 0=raw material
 	 *  @param		string		$selected_input_value	Value of preselected input text (for use with ajax)
 	 *  @param		int			$hidelabel				Hide label (0=no, 1=yes, 2=show search icon (before) and placeholder, 3 search icon after)
-	 *  @param		array		$ajaxoptions			Options for ajax_autocompleter
+	 *  @param		array<string,string|string[]>	$ajaxoptions			Options for ajax_autocompleter
 	 *  @param      int			$socid					Thirdparty Id (to get also price dedicated to this customer)
 	 *  @param		string|int<0,1>	$showempty			'' to not show empty line. Translation key to show an empty line. '1' show empty line with no text.
 	 * 	@param		int			$forcecombo				Force to use combo box
 	 *  @param      string      $morecss                Add more css on select
-	 *  @param      int         $hidepriceinlabel       1=Hide prices in label
+	 *  @param      int<0,1>	$hidepriceinlabel       1=Hide prices in label
 	 *  @param      string      $warehouseStatus        Warehouse status filter to count the quantity in stock. Following comma separated filter options can be used
 	 *										            'warehouseopen' = count products from open warehouses,
 	 *										            'warehouseclosed' = count products from closed warehouses,
 	 *										            'warehouseinternal' = count products from warehouses for internal correct/transfer only
-	 *  @param 		array 		$selected_combinations 	Selected combinations. Format: array([attrid] => attrval, [...])
-	 *  @param		int 		$nooutput				No print if 1, return the output into a string
-	 *  @param		int			$status_purchase		Purchase status: -1=No filter on purchase status, 0=Products not on purchase, 1=Products on purchase
+	 *  @param 		?mixed[]	$selected_combinations 	Selected combinations. Format: array([attrid] => attrval, [...])
+	 *  @param		int<0,1> 	$nooutput				No print if 1, return the output into a string
+	 *  @param		int<-1,1>	$status_purchase		Purchase status: -1=No filter on purchase status, 0=Products not on purchase, 1=Products on purchase
 	 *  @return		void|string
 	 */
 	public function select_produits($selected = 0, $htmlname = 'productid', $filtertype = '', $limit = 0, $price_level = 0, $status = 1, $finished = 2, $selected_input_value = '', $hidelabel = 0, $ajaxoptions = array(), $socid = 0, $showempty = '1', $forcecombo = 0, $morecss = '', $hidepriceinlabel = 0, $warehouseStatus = '', $selected_combinations = null, $nooutput = 0, $status_purchase = -1)
@@ -2618,17 +2628,17 @@ class Form
 	/**
 	 *  Return list of BOM for customer in Ajax if Ajax activated or go to select_produits_list
 	 *
-	 * @param string $selected Preselected BOM id
-	 * @param string $htmlname Name of HTML select field (must be unique in page).
-	 * @param int $limit Limit on number of returned lines
-	 * @param int $status Sell status -1=Return all bom, 0=Draft BOM, 1=Validated BOM
-	 * @param int $type type of the BOM (-1=Return all BOM, 0=Return disassemble BOM, 1=Return manufacturing BOM)
+	 * @param string	$selected Preselected BOM id
+	 * @param string	$htmlname Name of HTML select field (must be unique in page).
+	 * @param int		$limit Limit on number of returned lines
+	 * @param int		$status Sell status -1=Return all bom, 0=Draft BOM, 1=Validated BOM
+	 * @param int		$type type of the BOM (-1=Return all BOM, 0=Return disassemble BOM, 1=Return manufacturing BOM)
 	 * @param string|int<0,1>	$showempty	'' to not show empty line. Translation key to show an empty line. '1' show empty line with no text.
-	 * @param string $morecss Add more css on select
-	 * @param string $nooutput No print, return the output into a string
-	 * @param int $forcecombo Force to use combo box
-	 * @param array $TProducts Add filter on a defined product
-	 * @return        void|string
+	 * @param string	$morecss Add more css on select
+	 * @param string	$nooutput No print, return the output into a string
+	 * @param int		$forcecombo Force to use combo box
+	 * @param string[]	$TProducts Add filter on a defined product
+	 * @return void|string
 	 */
 	public function select_bom($selected = '', $htmlname = 'bom_id', $limit = 0, $status = 1, $type = 0, $showempty = '1', $morecss = '', $nooutput = '', $forcecombo = 0, $TProducts = [])
 	{
@@ -2952,7 +2962,7 @@ class Form
 
 			$num = $this->db->num_rows($result);
 
-			$events = null;
+			$events = array();
 
 			if (!$forcecombo) {
 				include_once DOL_DOCUMENT_ROOT . '/core/lib/ajax.lib.php';
@@ -3036,7 +3046,7 @@ class Form
 							$objp->price = $price_result;
 							$objp->unitprice = $price_result;
 							//Calculate the VAT
-							$objp->price_ttc = price2num($objp->price) * (1 + ($objp->tva_tx / 100));
+							$objp->price_ttc = (float) price2num($objp->price) * (1 + ($objp->tva_tx / 100));
 							$objp->price_ttc = price2num($objp->price_ttc, 'MU');
 						}
 					}
@@ -3073,14 +3083,14 @@ class Form
 	 * This define value for &$opt and &$optJson.
 	 * This function is called by select_produits_list().
 	 *
-	 * @param object 	$objp 			Resultset of fetch
+	 * @param stdClass 	$objp 			Resultset of fetch
 	 * @param string 	$opt 			Option (var used for returned value in string option format)
-	 * @param array 	$optJson 		Option (var used for returned value in json format)
+	 * @param array{key:string,value:string,label:string,label2:string,desc:string,type:string,price_ht:string,price_ttc:string,price_ht_locale:string,price_ttc_locale:string,pricebasetype:string,tva_tx:string,default_vat_code:string,qty:string,discount:string,duration_value:string,duration_unit:string,pbq:string,labeltrans:string,desctrans:string,ref_customer:string}	$optJson 		Option (var used for returned value in json format)
 	 * @param int 		$price_level 	Price level
 	 * @param int 		$selected 		Preselected value
-	 * @param int 		$hidepriceinlabel Hide price in label
+	 * @param int<0,1> 	$hidepriceinlabel Hide price in label
 	 * @param string 	$filterkey 		Filter key to highlight
-	 * @param int 		$novirtualstock Do not load virtual stock, even if slow option STOCK_SHOW_VIRTUAL_STOCK_IN_PRODUCTS_COMBO is on.
+	 * @param int<0,1>	$novirtualstock Do not load virtual stock, even if slow option STOCK_SHOW_VIRTUAL_STOCK_IN_PRODUCTS_COMBO is on.
 	 * @return    void
 	 */
 	protected function constructProductListOption(&$objp, &$opt, &$optJson, $price_level, $selected, $hidepriceinlabel = 0, $filterkey = '', $novirtualstock = 0)
@@ -3416,9 +3426,9 @@ class Form
 	 * @param string 	$htmlname 		Name of HTML Select
 	 * @param string 	$filtertype 	Filter on product type (''=nofilter, 0=product, 1=service)
 	 * @param string 	$filtre 		For a SQL filter
-	 * @param array 	$ajaxoptions 	Options for ajax_autocompleter
-	 * @param int 		$hidelabel 		Hide label (0=no, 1=yes)
-	 * @param int 		$alsoproductwithnosupplierprice 1=Add also product without supplier prices
+	 * @param array<string,string|string[]>	$ajaxoptions 	Options for ajax_autocompleter
+	 * @param int<0,1>	$hidelabel 		Hide label (0=no, 1=yes)
+	 * @param int<0,1>	$alsoproductwithnosupplierprice 1=Add also product without supplier prices
 	 * @param string 	$morecss 		More CSS
 	 * @param string 	$placeholder 	Placeholder
 	 * @return    void
@@ -3833,7 +3843,7 @@ class Form
 					'type' => $outtype,
 					'duration_value' => $outdurationvalue,
 					'duration_unit' => $outdurationunit,
-					'disabled' => (empty($objp->idprodfournprice) ? true : false),
+					'disabled' => empty($objp->idprodfournprice),
 					'description' => $objp->description
 				);
 				if (isModEnabled('multicurrency')) {
@@ -3872,7 +3882,7 @@ class Form
 					'type' => $outtype,
 					'duration_value' => $outdurationvalue,
 					'duration_unit' => $outdurationunit,
-					'disabled' => (empty($objp->idprodfournprice) ? true : false),
+					'disabled' => empty($objp->idprodfournprice),
 					'description' => $objp->description
 				);
 				if (isModEnabled('multicurrency')) {
@@ -5094,10 +5104,10 @@ class Form
 	 *                                 	    	 	- int (id of category)
 	 *                                 		 		- string (categories ids separated by comma)
 	 * 	                                  	 		- array (list of categories ids)
-	 * @param 	int 				$outputmode 	0=HTML select string, 1=Array with full label only, 2=Array extended, 3=Array with full picto + label
-	 * @param 	int 				$include 		[=0] Removed or 1=Keep only
+	 * @param 	int<0,3>			$outputmode 	0=HTML select string, 1=Array with full label only, 2=Array extended, 3=Array with full picto + label
+	 * @param 	int<0,1>			$include 		[=0] Removed or 1=Keep only
 	 * @param 	string 				$morecss 		More CSS
-	 * @return  string|array						String list or Array of categories
+	 * @return	string|array<int,string>|array<int,array{id:int,fulllabel:string,color:string,picto:string}>|array<int,array{rowid:int,id:int,fk_parent:int,label:string,description:string,color:string,position:string,visible:int,ref_ext:string,picto:string,fullpath:string,fulllabel:string}>		String list or Array of categories
 	 * @see select_categories()
 	 */
 	public function select_all_categories($type, $selected = '', $htmlname = "parent", $maxlength = 64, $markafterid = 0, $outputmode = 0, $include = 0, $morecss = '')
@@ -5175,6 +5185,7 @@ class Form
 		$output .= "\n";
 
 		if ($outputmode == 2) {
+			// TODO: handle error when $cate_arbo is not an array
 			return $cate_arbo;
 		} elseif ($outputmode == 1) {
 			return $outarray;
@@ -5193,7 +5204,7 @@ class Form
 	 * @param string $title Title
 	 * @param string $question Question
 	 * @param string $action Action
-	 * @param array $formquestion An array with forms complementary inputs
+	 * @param array<array{label:string,type:string,size:string,morecss:string,moreattr:string,style:string}>	$formquestion 	An array with complementary inputs to add into forms: array(array('label'=> ,'type'=> , 'size'=>, 'morecss'=>, 'moreattr'=>'autofocus' or 'style=...'))
 	 * @param string $selectedchoice "" or "no" or "yes"
 	 * @param int|string $useajax 0=No, 1=Yes use Ajax to show the popup, 2=Yes and also submit page with &confirm=no if choice is No, 'xxx'=Yes and preoutput confirm box with div id=dialog-confirm-xxx
 	 * @param int $height Force height of box
@@ -5224,9 +5235,9 @@ class Form
 	 * @param string 		$title 				Title
 	 * @param string 		$question 			Question
 	 * @param string 		$action 			Action
-	 * @param array|string|null 	$formquestion 		An array with complementary inputs to add into forms: array(array('label'=> ,'type'=> , 'size'=>, 'morecss'=>, 'moreattr'=>'autofocus' or 'style=...'))
-	 *                                                  'type' can be 'text', 'password', 'checkbox', 'radio', 'date', 'datetime', 'select', 'multiselect', 'morecss',
-	 *                                                  'other', 'onecolumn' or 'hidden'...
+	 * @param array<array{name:string,value:string,values:string[],default:string,label:string,type:string,size:string,morecss:string,moreattr:string,style:string,inputko?:int<0,1>}>|string|null 	$formquestion 		An array with complementary inputs to add into forms: array(array('label'=> ,'type'=> , 'size'=>, 'morecss'=>, 'moreattr'=>'autofocus' or 'style=...'))
+	 *                                                                                                                                                                                                                  'type' can be 'text', 'password', 'checkbox', 'radio', 'date', 'datetime', 'select', 'multiselect', 'morecss',
+	 *                                                                                                                                                                                                                  'other', 'onecolumn' or 'hidden'...
 	 * @param int|string 	$selectedchoice 	'' or 'no', or 'yes' or '1', 1, '0' or 0
 	 * @param int|string 	$useajax 			0=No, 1=Yes use Ajax to show the popup, 2=Yes and also submit page with &confirm=no if choice is No, 'xxx'=Yes and preoutput confirm box with div id=dialog-confirm-xxx
 	 * @param int|string 	$height 			Force height of box (0 = auto)
@@ -5434,7 +5445,7 @@ class Form
 						}
 					}
 					// Add name of fields to propagate with the GET when submitting the form with button KO.
-					if (isset($input['inputko']) && $input['inputko'] == 1) {
+					if (isset($input['inputko']) && $input['inputko'] == 1 && isset($input['name'])) {
 						array_push($inputko, $input['name']);
 					}
 				}
@@ -5448,7 +5459,7 @@ class Form
 			if (!empty($more)) {
 				$formconfirm .= '<div class="confirmquestions">' . $more . '</div>' . "\n";
 			}
-			$formconfirm .= ($question ? '<div class="confirmmessage">' . img_help('', '') . ' ' . $question . '</div>' : '');
+			$formconfirm .= ($question ? '<div class="confirmmessage">' . img_help(0, '') . ' ' . $question . '</div>' : '');
 			$formconfirm .= '</div>' . "\n";
 
 			$formconfirm .= "\n<!-- begin code of popup for formconfirm page=" . $page . " -->\n";
@@ -5877,8 +5888,8 @@ class Form
 	 * @param string $page Page
 	 * @param string $selected Id of user preselected
 	 * @param string $htmlname Name of input html field. If 'none', we just output the user link.
-	 * @param array $exclude List of users id to exclude
-	 * @param array $include List of users id to include
+	 * @param int[] $exclude List of users id to exclude
+	 * @param int[] $include List of users id to include
 	 * @return    void
 	 */
 	public function form_users($page, $selected = '', $htmlname = 'userid', $exclude = array(), $include = array())
@@ -6208,9 +6219,9 @@ class Form
 	 * @param string|int<0,1> 	$showempty 		Add an empty field (Can be '1' or text key to use on empty line like 'SelectThirdParty')
 	 * @param int<0,1>	$showtype 				Show third party type in combolist (customer, prospect or supplier)
 	 * @param int<0,1>	$forcecombo 			Force to use combo box
-	 * @param array 	$events 				Event options. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
+	 * @param 	array<array{method:string,url:string,htmlname:string,params:array<string,string>}> 	$events 	Event options. Example: array(array('method'=>'getContacts', 'url'=>dol_buildpath('/core/ajax/contacts.php',1), 'htmlname'=>'contactid', 'params'=>array('add-customer-contact'=>'disabled')))
 	 * @param int 		$nooutput 				No print output. Return it only.
-	 * @param array 	$excludeids 			Exclude IDs from the select combo
+	 * @param int[] 	$excludeids 			Exclude IDs from the select combo
 	 * @param string 	$textifnothirdparty 	Text to show if no thirdparty
 	 * @return    string                        HTML output or ''
 	 */
@@ -6773,9 +6784,9 @@ class Form
 	 * @param int 					$m 				1=Show also minutes, -1 has same effect but hour and minutes are prefilled with 23:59 if date is empty, 3 show minutes always empty
 	 * @param int 					$empty 			0=Fields required, 1=Empty inputs are allowed, 2=Empty inputs are allowed for hours only
 	 * @param string 				$form_name 		Not used
-	 * @param int 					$d 				1=Show days, month, years
-	 * @param int 					$addnowlink 	Add a link "Now", 1 with server time, 2 with local computer time
-	 * @param int 					$disabled 		Disable input fields
+	 * @param int<0,1> 				$d 				1=Show days, month, years
+	 * @param int<0,2>				$addnowlink 	Add a link "Now", 1 with server time, 2 with local computer time
+	 * @param int<0,1> 				$disabled 		Disable input fields
 	 * @param int|string			$fullday 		When a checkbox with id #fullday is checked, hours are set with 00:00 (if value if 'fulldaystart') or 23:59 (if value is 'fulldayend')
 	 * @param string 				$addplusone 	Add a link "+1 hour". Value must be name of another selectDate field.
 	 * @param int|string|array      $adddateof 		Add a link "Date of ..." using the following date. Must be array(array('adddateof'=>..., 'labeladddateof'=>...))
@@ -7223,7 +7234,7 @@ class Form
 	 *
 	 * @param string $prefix Prefix
 	 * @param string $selected Selected duration type
-	 * @param array $excludetypes Array of duration types to exclude. Example array('y', 'm')
+	 * @param string[] $excludetypes Array of duration types to exclude. Example array('y', 'm')
 	 * @return  string                    HTML select string
 	 */
 	public function selectTypeDuration($prefix, $selected = 'i', $excludetypes = array())
@@ -7325,7 +7336,7 @@ class Form
 
 		if ($typehour == 'select' || $typehour == 'textselect') {
 			$retstring .= '<select class="flat" id="select_' . $prefix . 'min" name="' . $prefix . 'min"' . ($disabled ? ' disabled' : '') . '>';
-			for ($min = 0; $min <= 55; $min = $min + 5) {
+			for ($min = 0; $min <= 55; $min += 5) {
 				$retstring .= '<option value="' . $min . '"';
 				if (is_numeric($minSelected) && $minSelected == $min) {
 					$retstring .= ' selected';
@@ -7361,14 +7372,14 @@ class Form
 	 * @param	int			$limit			Limit on number of returned lines
 	 * @param	int			$status			Ticket status
 	 * @param	string		$selected_input_value Value of preselected input text (for use with ajax)
-	 * @param	int			$hidelabel		Hide label (0=no, 1=yes, 2=show search icon (before) and placeholder, 3 search icon after)
-	 * @param	array		$ajaxoptions	Options for ajax_autocompleter
+	 * @param	int<0,3>	$hidelabel		Hide label (0=no, 1=yes, 2=show search icon (before) and placeholder, 3 search icon after)
+	 * @param	array<string,string|string[]>	$ajaxoptions	Options for ajax_autocompleter
 	 * @param	int			$socid Thirdparty Id (to get also price dedicated to this customer)
 	 * @param	string|int<0,1>	$showempty	'' to not show empty line. Translation key to show an empty line. '1' show empty line with no text.
 	 * @param	int<0,1>	$forcecombo	Force to use combo box
 	 * @param	string		$morecss		Add more css on select
-	 * @param	array		$selected_combinations	Selected combinations. Format: array([attrid] => attrval, [...])
-	 * @param	int			$nooutput		No print, return the output into a string
+	 * @param	array<string,string>	$selected_combinations	Selected combinations. Format: array([attrid] => attrval, [...])
+	 * @param	int<0,1>	$nooutput		No print, return the output into a string
 	 * @return	string
 	 */
 	public function selectTickets($selected = '', $htmlname = 'ticketid', $filtertype = '', $limit = 0, $status = 1, $selected_input_value = '', $hidelabel = 0, $ajaxoptions = array(), $socid = 0, $showempty = '1', $forcecombo = 0, $morecss = '', $selected_combinations = null, $nooutput = 0)
@@ -7409,7 +7420,7 @@ class Form
 				$out .= img_picto($langs->trans("Search"), 'search');
 			}
 		} else {
-			$out .= $this->selectTicketsList($selected, $htmlname, $filtertype, $limit, $status, 0, $socid, $showempty, $forcecombo, $morecss);
+			$out .= $this->selectTicketsList($selected, $htmlname, $filtertype, $limit, '', $status, 0, $showempty, $forcecombo, $morecss);
 		}
 
 		if (empty($nooutput)) {
@@ -7486,7 +7497,7 @@ class Form
 
 			$num = $this->db->num_rows($result);
 
-			$events = null;
+			$events = array();
 
 			if (!$forcecombo) {
 				include_once DOL_DOCUMENT_ROOT . '/core/lib/ajax.lib.php';
@@ -7550,7 +7561,7 @@ class Form
 	 *
 	 * @param object 	$objp 		Result set of fetch
 	 * @param string 	$opt 		Option (var used for returned value in string option format)
-	 * @param array 	$optJson 	Option (var used for returned value in json format)
+	 * @param mixed[] 	$optJson 	Option (var used for returned value in json format)
 	 * @param string 	$selected 	Preselected value
 	 * @param string 	$filterkey 	Filter key to highlight
 	 * @return    void
@@ -7587,14 +7598,14 @@ class Form
 	 * @param 	int 	$limit 					Limit on number of returned lines
 	 * @param 	int 	$status 				Ticket status
 	 * @param 	string 	$selected_input_value 	Value of preselected input text (for use with ajax)
-	 * @param 	int		$hidelabel 				Hide label (0=no, 1=yes, 2=show search icon (before) and placeholder, 3 search icon after)
-	 * @param 	array 	$ajaxoptions 			Options for ajax_autocompleter
+	 * @param 	int<0,3>	$hidelabel 				Hide label (0=no, 1=yes, 2=show search icon (before) and placeholder, 3 search icon after)
+	 * @param 	array<string,string|string[]>	$ajaxoptions 			Options for ajax_autocompleter
 	 * @param 	int 	$socid 					Thirdparty Id (to get also price dedicated to this customer)
 	 * @param 	string|int<0,1>	$showempty 		'' to not show empty line. Translation key to show an empty line. '1' show empty line with no text.
-	 * @param 	int 	$forcecombo 			Force to use combo box
+	 * @param 	int<0,1> 	$forcecombo 			Force to use combo box
 	 * @param 	string 	$morecss 				Add more css on select
-	 * @param 	array 	$selected_combinations 	Selected combinations. Format: array([attrid] => attrval, [...])
-	 * @param 	int 	$nooutput 				No print, return the output into a string
+	 * @param 	array<string,string> $selected_combinations 	Selected combinations. Format: array([attrid] => attrval, [...])
+	 * @param 	int<0,1>	$nooutput 				No print, return the output into a string
 	 * @return 	string
 	 */
 	public function selectProjects($selected = '', $htmlname = 'projectid', $filtertype = '', $limit = 0, $status = 1, $selected_input_value = '', $hidelabel = 0, $ajaxoptions = array(), $socid = 0, $showempty = '1', $forcecombo = 0, $morecss = '', $selected_combinations = null, $nooutput = 0)
@@ -7635,7 +7646,7 @@ class Form
 				$out .= img_picto($langs->trans("Search"), 'search');
 			}
 		} else {
-			$out .= $this->selectProjectsList($selected, $htmlname, $filtertype, $limit, $status, 0, $socid, $showempty, $forcecombo, $morecss);
+			$out .= $this->selectProjectsList($selected, $htmlname, $filtertype, $limit, '', $status, 0, $showempty, $forcecombo, $morecss);
 		}
 
 		if (empty($nooutput)) {
@@ -7711,7 +7722,7 @@ class Form
 
 			$num = $this->db->num_rows($result);
 
-			$events = null;
+			$events = array();
 
 			if (!$forcecombo) {
 				include_once DOL_DOCUMENT_ROOT . '/core/lib/ajax.lib.php';
@@ -7773,9 +7784,9 @@ class Form
 	 * constructProjectListOption.
 	 * This define value for &$opt and &$optJson.
 	 *
-	 * @param object 	$objp 		Result set of fetch
+	 * @param stdClass 	$objp 		Result set of fetch
 	 * @param string 	$opt 		Option (var used for returned value in string option format)
-	 * @param array 	$optJson 	Option (var used for returned value in json format)
+	 * @param array{key:string,value:string,type:string}	$optJson 	Option (var used for returned value in json format)
 	 * @param string 	$selected 	Preselected value
 	 * @param string 	$filterkey 	Filter key to highlight
 	 * @return    void
@@ -7816,14 +7827,14 @@ class Form
 	 * @param int $limit Limit on number of returned lines
 	 * @param int $status Ticket status
 	 * @param string $selected_input_value Value of preselected input text (for use with ajax)
-	 * @param int $hidelabel Hide label (0=no, 1=yes, 2=show search icon before and placeholder, 3 search icon after)
-	 * @param array $ajaxoptions Options for ajax_autocompleter
+	 * @param int<0,3> $hidelabel Hide label (0=no, 1=yes, 2=show search icon before and placeholder, 3 search icon after)
+	 * @param array<string,string|string[]> $ajaxoptions Options for ajax_autocompleter
 	 * @param int $socid Thirdparty Id (to get also price dedicated to this customer)
 	 * @param string|int<0,1> $showempty '' to not show empty line. Translation key to show an empty line. '1' show empty line with no text.
 	 * @param int $forcecombo Force to use combo box
 	 * @param string $morecss Add more css on select
-	 * @param array $selected_combinations Selected combinations. Format: array([attrid] => attrval, [...])
-	 * @param int	$nooutput No print, return the output into a string
+	 * @param array<string,string> $selected_combinations Selected combinations. Format: array([attrid] => attrval, [...])
+	 * @param int<0,1>	$nooutput No print, return the output into a string
 	 * @return        string
 	 */
 	public function selectMembers($selected = '', $htmlname = 'adherentid', $filtertype = '', $limit = 0, $status = 1, $selected_input_value = '', $hidelabel = 0, $ajaxoptions = array(), $socid = 0, $showempty = '1', $forcecombo = 0, $morecss = '', $selected_combinations = null, $nooutput = 0)
@@ -7945,7 +7956,7 @@ class Form
 
 			$num = $this->db->num_rows($result);
 
-			$events = null;
+			$events = array();
 
 			if (!$forcecombo) {
 				include_once DOL_DOCUMENT_ROOT . '/core/lib/ajax.lib.php';
@@ -8010,7 +8021,7 @@ class Form
 	 *
 	 * @param object 	$objp 			Result set of fetch
 	 * @param string 	$opt 			Option (var used for returned value in string option format)
-	 * @param array 	$optJson 		Option (var used for returned value in json format)
+	 * @param mixed[] 	$optJson 		Option (var used for returned value in json format)
 	 * @param string 	$selected 		Preselected value
 	 * @param string 	$filterkey 		Filter key to highlight
 	 * @return    void
@@ -8051,7 +8062,7 @@ class Form
 	 * @param	string	$morecss              More CSS
 	 * @param	string	$moreparams           More params provided to ajax call
 	 * @param 	int		$forcecombo           Force to load all values and output a standard combobox (with no beautification)
-	 * @param 	int		$disabled             1=Html component is disabled
+	 * @param 	int<0,1>	$disabled             1=Html component is disabled
 	 * @param	string	$selected_input_value Value of preselected input text (for use with ajax)
 	 * @param	string	$objectfield          Object:Field that contains the definition (in table $fields or $extrafields). Example: 'Object:xxx' or 'Module_Object:xxx' or 'Object:options_xxx' or 'Module_Object:options_xxx'
 	 * @return  string	                      	Return HTML string
@@ -8064,6 +8075,8 @@ class Form
 		$objectdescorig = $objectdesc;
 		$objecttmp = null;
 		$InfoFieldList = array();
+		$filter = '';  // Ensure filter has value (for static analysis)
+		$sortfield = '';  // Ensure filter has value (for static analysis)
 
 		if ($objectfield) {	// We must retrieve the objectdesc from the field or extrafield
 			// Example: $objectfield = 'product:options_package'
@@ -8138,6 +8151,7 @@ class Form
 			dol_syslog('selectForForms: Error bad setup of field objectdescorig=' . $objectdescorig.', objectfield='.$objectfield, LOG_WARNING);
 			return 'selectForForms: Error bad setup of field objectdescorig=' . $objectdescorig.', objectfield='.$objectfield;
 		}
+		'@phan-var-force CommonObject $objecttmp';
 
 		//var_dump($filter);
 		$prefixforautocompletemode = $objecttmp->element;
@@ -8386,7 +8400,7 @@ class Form
 
 			if (!$forcecombo) {
 				include_once DOL_DOCUMENT_ROOT . '/core/lib/ajax.lib.php';
-				$out .= ajax_combobox($htmlname, null, getDolGlobalInt($confkeyforautocompletemode, 0));
+				$out .= ajax_combobox($htmlname, array(), getDolGlobalInt($confkeyforautocompletemode, 0));
 			}
 		} else {
 			dol_print_error($this->db);
@@ -8406,15 +8420,15 @@ class Form
 	 *  Note: Do not apply langs->trans function on returned content, content may be entity encoded twice.
 	 *
 	 * @param string 		$htmlname 			Name of html select area. Try to start name with "multi" or "search_multi" if this is a multiselect
-	 * @param array 		$array 				Array like array(key => value) or array(key=>array('label'=>..., 'data-...'=>..., 'disabled'=>..., 'css'=>...))
+	 * @param array{label:string,data-html:string,disable?:int<0,1>,css?:string}	$array 	Array like array(key => value) or array(key=>array('label'=>..., 'data-...'=>..., 'disabled'=>..., 'css'=>...))
 	 * @param string|string[] $id				Preselected key or array of preselected keys for multiselect. Use 'ifone' to autoselect record if there is only one record.
-	 * @param int|string 	$show_empty 		0 no empty value allowed, 1 or string to add an empty value into list (If 1: key is -1 and value is '' or '&nbsp;', If placeholder string: key is -1 and value is the string), <0 to add an empty value with key that is this value.
-	 * @param int 			$key_in_label 		1 to show key into label with format "[key] value"
-	 * @param int 			$value_as_key 		1 to use value as key
+	 * @param int<0,1>|string 	$show_empty 		0 no empty value allowed, 1 or string to add an empty value into list (If 1: key is -1 and value is '' or '&nbsp;', If placeholder string: key is -1 and value is the string), <0 to add an empty value with key that is this value.
+	 * @param int<0,1>		$key_in_label 		1 to show key into label with format "[key] value"
+	 * @param int<0,1>		$value_as_key 		1 to use value as key
 	 * @param string 		$moreparam 			Add more parameters onto the select tag. For example 'style="width: 95%"' to avoid select2 component to go over parent container
-	 * @param int 			$translate 			1=Translate and encode value
+	 * @param int<0,1>		$translate 			1=Translate and encode value
 	 * @param int 			$maxlen 			Length maximum for labels
-	 * @param int 			$disabled 			Html select box is disabled
+	 * @param int<0,1>		$disabled 			Html select box is disabled
 	 * @param string 		$sort 				'ASC' or 'DESC' = Sort on label, '' or 'NONE' or 'POS' = Do not sort, we keep original order
 	 * @param string 		$morecss 			Add more class to css styles
 	 * @param int 			$addjscombo 		Add js combo
@@ -8436,7 +8450,9 @@ class Form
 		if ($value_as_key) {
 			$array = array_combine($array, $array);
 		}
-q
+
+    '@phan-var-force array{label:string,data-html:string,disable?:int<0,1>,css?:string}	$array'; // Array combine breaks information
+
 		$out = '';
 
 		if ($addjscombo < 0) {
@@ -8662,16 +8678,16 @@ q
 	 *  Note: Do not apply langs->trans function on returned content of Ajax service, content may be entity encoded twice.
 	 *
 	 * @param string 	$htmlname 				Name of html select area
-	 * @param array 	$array 					Array (key=>array('text'=>'A text', 'url'=>'An url'), ...)
+	 * @param array<string,array{text:string,url:string}> 	$array 	Array (key=>array('text'=>'A text', 'url'=>'An url'), ...)
 	 * @param string 	$id 					Preselected key
 	 * @param string 	$moreparam 				Add more parameters onto the select tag
-	 * @param int 		$disableFiltering 		If set to 1, results are not filtered with searched string
-	 * @param int 		$disabled 				Html select box is disabled
+	 * @param int<0,1>	$disableFiltering 		If set to 1, results are not filtered with searched string
+	 * @param int<0,1>	$disabled 				Html select box is disabled
 	 * @param int 		$minimumInputLength 	Minimum Input Length
 	 * @param string 	$morecss 				Add more class to css styles
-	 * @param int 		$callurlonselect 		If set to 1, some code is added so an url return by the ajax is called when value is selected.
+	 * @param int<0,1>	$callurlonselect 		If set to 1, some code is added so an url return by the ajax is called when value is selected.
 	 * @param string 	$placeholder 			String to use as placeholder
-	 * @param integer 	$acceptdelayedhtml 		1 = caller is requesting to have html js content not returned but saved into global $delayedhtmlcontent (so caller can show it at end of page to avoid flash FOUC effect)
+	 * @param int<0,1> 	$acceptdelayedhtml 		1 = caller is requesting to have html js content not returned but saved into global $delayedhtmlcontent (so caller can show it at end of page to avoid flash FOUC effect)
 	 * @param string	$textfortitle			Text to show on title.
 	 * @return	string      					HTML select string
 	 * @see selectArrayAjax(), ajax_combobox() in ajax.lib.php
@@ -8785,15 +8801,15 @@ q
 	 * @param 	string 		$htmlname 		Name of select
 	 * @param 	array<string,string|array{id:string,label:string,color:string,picto:string,labelhtml:string}>	$array 			Array(key=>value) or Array(key=>array('id'=>key, 'label'=>value, 'color'=> , 'picto'=> , 'labelhtml'=> ))
 	 * @param 	string[]	$selected 		Array of keys preselected
-	 * @param 	int 		$key_in_label 	1 to show key like in "[key] value"
-	 * @param 	int 		$value_as_key 	1 to use value as key
+	 * @param 	int<0,1>	$key_in_label 	1 to show key like in "[key] value"
+	 * @param 	int<0,1>	$value_as_key 	1 to use value as key
 	 * @param 	string 		$morecss 		Add more css style
-	 * @param 	int 		$translate 		Translate and encode value
+	 * @param 	int<0,1> 	$translate 		Translate and encode value
 	 * @param 	int|string 	$width 			Force width of select box. May be used only when using jquery couch. Example: 250, '95%'
 	 * @param 	string 		$moreattrib 	Add more options on select component. Example: 'disabled'
 	 * @param 	string 		$elemtype 		Type of element we show ('category', ...). Will execute a formatting function on it. To use in readonly mode if js component support HTML formatting.
 	 * @param 	string 		$placeholder 	String to use as placeholder
-	 * @param 	int 		$addjscombo 	Add js combo
+	 * @param 	int<-1,1> 	$addjscombo 	Add js combo
 	 * @return 	string                      HTML multiselect string
 	 * @see selectarray(), selectArrayAjax(), selectArrayFilter()
 	 */
@@ -8938,7 +8954,7 @@ q
 	 * Show a multiselect dropbox from an array. If a saved selection of fields exists for user (into $user->conf->MAIN_SELECTEDFIELDS_contextofpage), we use this one instead of default.
 	 *
 	 * @param string 	$htmlname 	Name of HTML field
-	 * @param array 	$array 		Array with array of fields we could show. This array may be modified according to setup of user.
+	 * @param array<string,array{label:string,checked:string,enabled?:string,type?:string,langfile?:string}> 	$array 	Array with array of fields we could show. This array may be modified according to setup of user.
 	 * @param string 	$varpage 	Id of context for page. Can be set by caller with $varpage=(empty($contextpage)?$_SERVER["PHP_SELF"]:$contextpage);
 	 * @param string 	$pos 		Position colon on liste value 'left' or '' (meaning 'right').
 	 * @return string            	HTML multiselect string
@@ -9059,8 +9075,8 @@ q
 	 *
 	 * @param int 		$id 		Id of object
 	 * @param string 	$type 		Type of category ('member', 'customer', 'supplier', 'product', 'contact'). Old mode (0, 1, 2, ...) is deprecated.
-	 * @param int 		$rendermode 0=Default, use multiselect. 1=Emulate multiselect (recommended)
-	 * @param int 		$nolink 	1=Do not add html links
+	 * @param int<0,1>	$rendermode 0=Default, use multiselect. 1=Emulate multiselect (recommended)
+	 * @param int<0,1> 	$nolink 	1=Do not add html links
 	 * @return string               String with categories
 	 */
 	public function showCategories($id, $type, $rendermode = 0, $nolink = 0)
@@ -9088,7 +9104,7 @@ q
 				$arrayselected[] = $c->id;
 			}
 
-			return $this->multiselectarray('categories', $cate_arbo, $arrayselected, '', 0, '', 0, '100%', 'disabled', 'category');
+			return $this->multiselectarray('categories', $cate_arbo, $arrayselected, 0, 0, '', 0, '100%', 'disabled', 'category');
 		}
 
 		return 'ErrorBadValueForParameterRenderMode'; // Should not happened
@@ -9099,9 +9115,9 @@ q
 	 *
 	 * @param 	CommonObject 	$object 						Object we want to show links to
 	 * @param 	string 			$morehtmlright 					More html to show on right of title
-	 * @param 	array 			$compatibleImportElementsList 	Array of compatibles elements object for "import from" action
+	 * @param 	array<int,string>	$compatibleImportElementsList 	Array of compatibles elements object for "import from" action
 	 * @param 	string 			$title 							Title
-	 * @return  int                                             Return integer <0 if KO, >=0 if OK
+	 * @return  int                                             Return Number of different types
 	 */
 	public function showLinkedObjectBlock($object, $morehtmlright = '', $compatibleImportElementsList = array(), $title = 'RelatedObjects')
 	{
@@ -9257,8 +9273,8 @@ q
 	 *  Show block with links to link to other objects.
 	 *
 	 * @param 	CommonObject 	$object 			Object we want to show links to
-	 * @param 	array 			$restrictlinksto 	Restrict links to some elements, for example array('order') or array('supplier_order'). null or array() if no restriction.
-	 * @param 	array 			$excludelinksto 	Do not show links of this type, for example array('order') or array('supplier_order'). null or array() if no exclusion.
+	 * @param 	string[] 			$restrictlinksto 	Restrict links to some elements, for example array('order') or array('supplier_order'). null or array() if no restriction.
+	 * @param 	string[] 			$excludelinksto 	Do not show links of this type, for example array('order') or array('supplier_order'). null or array() if no exclusion.
 	 * @return  string                              HTML block
 	 */
 	public function showLinkToObjectBlock($object, $restrictlinksto = array(), $excludelinksto = array())
@@ -9361,6 +9377,7 @@ q
 			$possiblelinks['order_supplier']['sql'] = "SELECT s.rowid as socid, s.nom as name, s.client, t.rowid, t.ref, t.ref_supplier, t.total_ht FROM ".$this->db->prefix()."societe as s, ".$this->db->prefix().'commande_fournisseur as t WHERE t.fk_soc = s.rowid AND t.entity IN ('.getEntity('commande_fournisseur').')';
 		}
 
+		$reshook = 0; // Ensure $reshook is defined for static analysis
 		if (!empty($listofidcompanytoscan)) {  // If empty, we don't have criteria to scan the object we can link to
 			// Can complete the possiblelink array
 			$hookmanager->initHooks(array('commonobject'));
@@ -9606,15 +9623,15 @@ q
 	 * Return a HTML area with the reference of object and a navigation bar for a business object
 	 * Note: To complete search with a particular filter on select, you can set $object->next_prev_filter set to define SQL criteria.
 	 *
-	 * @param object 	$object 		Object to show.
+	 * @param CommonObject	$object 		Object to show.
 	 * @param string 	$paramid 		Name of parameter to use to name the id into the URL next/previous link.
 	 * @param string 	$morehtml 		More html content to output just before the nav bar.
-	 * @param int 		$shownav 		Show Condition (navigation is shown if value is 1).
+	 * @param int<0,1>	$shownav 		Show Condition (navigation is shown if value is 1).
 	 * @param string 	$fieldid 		Name of field id into database to use for select next and previous (we make the select max and min on this field compared to $object->ref). Use 'none' to disable next/prev.
 	 * @param string 	$fieldref 		Name of field ref of object (object->ref) to show or 'none' to not show ref.
 	 * @param string 	$morehtmlref 	More html to show after ref.
 	 * @param string 	$moreparam 		More param to add in nav link url. Must start with '&...'.
-	 * @param int 		$nodbprefix 	Do not include DB prefix to forge table name.
+	 * @param int<0,1>	$nodbprefix 	Do not include DB prefix to forge table name.
 	 * @param string 	$morehtmlleft 	More html code to show before ref.
 	 * @param string 	$morehtmlstatus More html code to show under navigation arrows (status place).
 	 * @param string 	$morehtmlright 	More html code to show after ref.
@@ -9849,16 +9866,16 @@ q
 	 * Return HTML code to output a photo
 	 *
 	 * @param string 	$modulepart 				Key to define module concerned ('societe', 'userphoto', 'memberphoto')
-	 * @param object 	$object 					Object containing data to retrieve file name
+	 * @param Societe|Adherent|Contact|User|CommonObject	$object	Object containing data to retrieve file name
 	 * @param int 		$width 						Width of photo
 	 * @param int 		$height 					Height of photo (auto if 0)
-	 * @param int 		$caneditfield 				Add edit fields
+	 * @param int<0,1>	$caneditfield 				Add edit fields
 	 * @param string 	$cssclass 					CSS name to use on img for photo
 	 * @param string 	$imagesize 					'mini', 'small' or '' (original)
-	 * @param int 		$addlinktofullsize 			Add link to fullsize image
-	 * @param int 		$cache 						1=Accept to use image in cache
+	 * @param int<0,1>	$addlinktofullsize 			Add link to fullsize image
+	 * @param int<0,1>	$cache 						1=Accept to use image in cache
 	 * @param string 	$forcecapture 				'', 'user' or 'environment'. Force parameter capture on HTML input file element to ask a smartphone to allow to open camera to take photo. Auto if ''.
-	 * @param int		$noexternsourceoverwrite 	No overwrite image with extern source (like 'gravatar' or other module)
+	 * @param int<0,1>	$noexternsourceoverwrite 	No overwrite image with extern source (like 'gravatar' or other module)
 	 * @return string                            	HTML code to output photo
 	 * @see getImagePublicURLOfObject()
 	 */
@@ -9996,7 +10013,7 @@ q
 				$nophoto = '/public/theme/common/nophoto.png';
 				$defaultimg = 'identicon';        // For gravatar
 				if (in_array($modulepart, array('societe', 'userphoto', 'contact', 'memberphoto'))) {    // For modules that need a special image when photo not found
-					if ($modulepart == 'societe' || ($modulepart == 'memberphoto' && !empty($object->morphy) && strpos($object->morphy, 'mor')) !== false) {
+					if ($modulepart == 'societe' || ($modulepart == 'memberphoto' && !empty($object->morphy) && strpos($object->morphy, 'mor') !== false)) {
 						$nophoto = 'company';
 					} else {
 						$nophoto = '/public/theme/common/user_anonymous.png';
@@ -10015,8 +10032,8 @@ q
 					$ret .= '<img class="photo' . $modulepart . ($cssclass ? ' ' . $cssclass : '') . '" alt="" title="' . $email . ' Gravatar avatar" ' . ($width ? ' width="' . $width . '"' : '') . ($height ? ' height="' . $height . '"' : '') . ' src="https://www.gravatar.com/avatar/' . dol_hash(strtolower(trim($email)), 'sha256', 1) . '?s=' . $width . '&d=' . $defaultimg . '">'; // gravatar need md5 hash
 				} else {
 					if ($nophoto == 'company') {
-						$ret .= '<div class="divforspanimg photo' . $modulepart . ($cssclass ? ' ' . $cssclass : '') . '" alt="" ' . ($width ? ' width="' . $width . '"' : '') . ($height ? ' height="' . $height . '"' : '') . '>' . img_picto('', 'company') . '</div>';
-						$ret .= '<div class="difforspanimgright"></div>';
+						$ret .= '<div class="divforspanimg valignmiddle center photo' . $modulepart . ($cssclass ? ' ' . $cssclass : '') . '" alt="" ' . ($width ? ' width="' . $width . '"' : '') . ($height ? ' height="' . $height . '"' : '') . '>' . img_picto('', 'company') . '</div>';
+						//$ret .= '<div class="difforspanimgright"></div>';
 					} else {
 						$ret .= '<img class="photo' . $modulepart . ($cssclass ? ' ' . $cssclass : '') . '" alt="" ' . ($width ? ' width="' . $width . '"' : '') . ($height ? ' height="' . $height . '"' : '') . ' src="' . DOL_URL_ROOT . $nophoto . '">';
 					}
@@ -10053,15 +10070,15 @@ q
 	 *
 	 * @param int|object|object[] 	$selected 		Id group or group(s) preselected
 	 * @param string 				$htmlname 		Field name in form
-	 * @param int 					$show_empty 	0=liste sans valeur nulle, 1=ajoute valeur inconnue
-	 * @param string|array 			$exclude 		Array list of groups id to exclude
-	 * @param int 					$disabled 		If select list must be disabled
-	 * @param string|array 			$include 		Array list of groups id to include
-	 * @param array 				$enableonly 	Array list of groups id to be enabled. All other must be disabled
+	 * @param int<0,1> 				$show_empty 	0=liste sans valeur nulle, 1=ajoute valeur inconnue
+	 * @param string|int[] 			$exclude 		Array list of groups id to exclude
+	 * @param int<0,1> 				$disabled 		If select list must be disabled
+	 * @param string|int[] 			$include 		Array list of groups id to include
+	 * @param int[] 				$enableonly 	Array list of groups id to be enabled. All other must be disabled
 	 * @param string 				$force_entity 	'0' or Ids of environment to force
 	 * @param bool 					$multiple 		add [] in the name of element and add 'multiple' attribute (not working with ajax_autocompleter)
 	 * @param string 				$morecss 		More css to add to html component
-	 * @return    string							HTML Componont to select a group
+	 * @return	string								HTML Componont to select a group
 	 * @see select_dolusers()
 	 */
 	public function select_dolgroups($selected = 0, $htmlname = 'groupid', $show_empty = 0, $exclude = '', $disabled = 0, $include = '', $enableonly = array(), $force_entity = '0', $multiple = false, $morecss = '')
@@ -10251,12 +10268,12 @@ q
 	 *
 	 * @param string 	$selected 		preselected category
 	 * @param string 	$htmlname 		name of HTML select list
-	 * @param integer 	$useempty 		1=Add empty line
-	 * @param array 	$excludeid 		id to exclude
+	 * @param int<0,1>	$useempty 		1=Add empty line
+	 * @param int[] 	$excludeid 		id to exclude
 	 * @param string 	$target 		htmlname of target select to bind event
 	 * @param int 		$default_selected default category to select if fk_c_type_fees change = EX_KME
-	 * @param array 	$params 		param to give
-	 * @param int 		$info_admin 	Show the tooltip help picto to setup list
+	 * @param array<string,int|string>	$params	param to give
+	 * @param int<0,1>	$info_admin 	Show the tooltip help picto to setup list
 	 * @return    string
 	 */
 	public function selectExpenseCategories($selected = '', $htmlname = 'fk_c_exp_tax_cat', $useempty = 0, $excludeid = array(), $target = '', $default_selected = 0, $params = array(), $info_admin = 1)
@@ -10484,7 +10501,7 @@ q
 			// Use select2 selector
 			if (!empty($conf->use_javascript_ajax)) {
 				include_once DOL_DOCUMENT_ROOT . '/core/lib/ajax.lib.php';
-				$comboenhancement = ajax_combobox($htmlname, '', 0, $forcefocus);
+				$comboenhancement = ajax_combobox($htmlname, array(), 0, $forcefocus);
 				$out .= $comboenhancement;
 				$morecss = 'minwidth200imp maxwidth500';
 			}
@@ -10607,7 +10624,7 @@ q
 			// Use select2 selector
 			if (!empty($conf->use_javascript_ajax)) {
 				include_once DOL_DOCUMENT_ROOT . '/core/lib/ajax.lib.php';
-				$comboenhancement = ajax_combobox($htmlname, '', 0, $forcefocus);
+				$comboenhancement = ajax_combobox($htmlname, array(), 0, $forcefocus);
 				$out .= $comboenhancement;
 				$morecss = 'minwidth200imp maxwidth500';
 			}
@@ -10673,9 +10690,9 @@ q
 	/**
 	 * Output the component to make advanced search criteries
 	 *
-	 * @param 	array 	$arrayofcriterias 					Array of available search criteria. Example: array($object->element => $object->fields, 'otherfamily' => otherarrayoffields, ...)
-	 * @param 	array 	$search_component_params 			Array of selected search criteria
-	 * @param 	array 	$arrayofinputfieldsalreadyoutput 	Array of input fields already inform. The component will not generate a hidden input field if it is in this list.
+	 * @param 	array<array<string,array{type:string}>>	$arrayofcriterias 					Array of available search criteria. Example: array($object->element => $object->fields, 'otherfamily' => otherarrayoffields, ...)
+	 * @param 	array<int,string> 	$search_component_params Array of selected search criteria
+	 * @param 	string[] $arrayofinputfieldsalreadyoutput 	Array of input fields already inform. The component will not generate a hidden input field if it is in this list.
 	 * @param 	string 	$search_component_params_hidden 	String with $search_component_params criteria
 	 * @return	string                                    	HTML component for advanced search
 	 */
@@ -10825,11 +10842,11 @@ q
 	/**
 	 * selectModelMail
 	 *
-	 * @param 	string 	$prefix 		Prefix
-	 * @param	string 	$modelType 		Model type
-	 * @param 	int 	$default 		1=Show also Default mail template
-	 * @param 	int 	$addjscombo 	Add js combobox
-	 * @return  string                	HTML select string
+	 * @param	string		$prefix			Prefix
+	 * @param	string		$modelType		Model type
+	 * @param	int<0,1>	$default		1=Show also Default mail template
+	 * @param	int<0,1>	$addjscombo		Add js combobox
+	 * @return	string						HTML select string
 	 */
 	public function selectModelMail($prefix, $modelType = '', $default = 0, $addjscombo = 0)
 	{
@@ -10873,7 +10890,7 @@ q
 	 *
 	 * @param 	string 	$save_label 		Alternative label for save button
 	 * @param 	string 	$cancel_label 		Alternative label for cancel button
-	 * @param 	array 	$morebuttons 		Add additional buttons between save and cancel
+	 * @param 	array<array{addclass?:string,name?:string,label_key?:string}> $morebuttons 		Add additional buttons between save and cancel
 	 * @param 	bool 	$withoutdiv 		Option to remove enclosing centered div
 	 * @param 	string 	$morecss 			More CSS
 	 * @param 	string 	$dol_openinpopup 	If the button are shown in a context of a page shown inside a popup, we put here the string name of popup.
@@ -10982,10 +10999,10 @@ q
 	/**
 	* Return list of invoice subtypes.
 	*
-	* @param int    $selected     	Id of invoice subtype to preselect by default
-	* @param string $htmlname     	Select field name
-	* @param int    $addempty     	Add an empty entry
-	* @param int    $noinfoadmin  	0=Add admin info, 1=Disable admin info
+	* @param int		$selected     	Id of invoice subtype to preselect by default
+	* @param string		$htmlname     	Select field name
+	* @param int<0,1>	$addempty     	Add an empty entry
+	* @param int<0,1>	$noinfoadmin  	0=Add admin info, 1=Disable admin info
 	* @param string $morecss       	Add more CSS on select tag
 	* @return string  				String for the HTML select component
 	*/
diff --git a/htdocs/core/class/html.formticket.class.php b/htdocs/core/class/html.formticket.class.php
index aac53b58353..bb848a8c4d9 100644
--- a/htdocs/core/class/html.formticket.class.php
+++ b/htdocs/core/class/html.formticket.class.php
@@ -1164,7 +1164,7 @@ class FormTicket
 	 */
 	public function selectSeveritiesTickets($selected = '', $htmlname = 'ticketseverity', $filtertype = '', $format = 0, $empty = 0, $noadmininfo = 0, $maxlength = 0, $morecss = '')
 	{
-		global $langs, $user;
+		global $conf, $langs, $user;
 
 		$ticketstat = new Ticket($this->db);
 
@@ -1183,8 +1183,8 @@ class FormTicket
 			print '<option value="">&nbsp;</option>';
 		}
 
-		if (is_array($ticketstat->cache_severity_tickets) && count($ticketstat->cache_severity_tickets)) {
-			foreach ($ticketstat->cache_severity_tickets as $id => $arrayseverities) {
+		if (is_array($conf->cache['severity_tickets']) && count($conf->cache['severity_tickets'])) {
+			foreach ($conf->cache['severity_tickets'] as $id => $arrayseverities) {
 				// On passe si on a demande de filtrer sur des modes de paiments particuliers
 				if (count($filterarray) && !in_array($arrayseverities['type'], $filterarray)) {
 					continue;
diff --git a/htdocs/core/class/notify.class.php b/htdocs/core/class/notify.class.php
index f2a19b8269e..c4b0a371726 100644
--- a/htdocs/core/class/notify.class.php
+++ b/htdocs/core/class/notify.class.php
@@ -7,6 +7,7 @@
  * Copyright (C) 2022      Anthony Berton     	<anthony.berton@bb2a.fr>
  * Copyright (C) 2023      William Mead         <william.mead@manchenumerique.fr>
  * Copyright (C) 2024      Jon Bendtsen         <jon.bendtsen.github@jonb.dk>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -213,7 +214,7 @@ class Notify
 			$texte = img_object($langs->trans("Notifications"), 'email', 'class="pictofixedwidth"').$langs->trans("NoNotificationsWillBeSent");
 		} elseif ($nb == 1) {
 			$texte = img_object($langs->trans("Notifications"), 'email', 'class="pictofixedwidth"').$langs->trans("ANotificationsWillBeSent");
-		} elseif ($nb >= 2) {
+		} else { // Always >= 2 if ($nb >= 2) {
 			$texte = img_object($langs->trans("Notifications"), 'email', 'class="pictofixedwidth"').$langs->trans("SomeNotificationsWillBeSent", $nb);
 		}
 
@@ -485,7 +486,7 @@ class Notify
 							$newval2 = trim($obj->email);
 							$isvalid = isValidEmail($newval2);
 							if (empty($resarray[$newval2])) {
-								$resarray[$newval2] = array('type'=> 'tocontact', 'code'=>trim($obj->code), 'emaildesc'=>'Contact id '.$obj->rowid, 'email'=>$newval2, 'contactid'=>$obj->rowid, 'isemailvalid'=>$isvalid);
+								$resarray[$newval2] = array('type' => 'tocontact', 'code' => trim($obj->code), 'emaildesc' => 'Contact id '.$obj->rowid, 'email' => $newval2, 'contactid' => $obj->rowid, 'isemailvalid' => $isvalid);
 							}
 						}
 						$i++;
@@ -524,7 +525,7 @@ class Notify
 							$newval2 = trim($obj->email);
 							$isvalid = isValidEmail($newval2);
 							if (empty($resarray[$newval2])) {
-								$resarray[$newval2] = array('type'=> 'touser', 'code'=>trim($obj->code), 'emaildesc'=>'User id '.$obj->rowid, 'email'=>$newval2, 'userid'=>$obj->rowid, 'isemailvalid'=>$isvalid);
+								$resarray[$newval2] = array('type' => 'touser', 'code' => trim($obj->code), 'emaildesc' => 'User id '.$obj->rowid, 'email' => $newval2, 'userid' => $obj->rowid, 'isemailvalid' => $isvalid);
 							}
 						}
 						$i++;
@@ -575,7 +576,7 @@ class Notify
 						if ($newval2) {
 							$isvalid = isValidEmail($newval2, 0);
 							if (empty($resarray[$newval2])) {
-								$resarray[$newval2] = array('type'=> 'tofixedemail', 'code'=>trim($key), 'emaildesc'=>trim($val2), 'email'=>$newval2, 'isemailvalid'=>$isvalid);
+								$resarray[$newval2] = array('type' => 'tofixedemail', 'code' => trim($key), 'emaildesc' => trim($val2), 'email' => $newval2, 'isemailvalid' => $isvalid);
 							}
 						}
 					}
@@ -645,7 +646,7 @@ class Notify
 		if (getDolGlobalString('MAIN_APPLICATION_TITLE')) {
 			$application = getDolGlobalString('MAIN_APPLICATION_TITLE');
 		}
-		$replyto = $conf->notification->email_from;
+		$from = getDolGlobalString('NOTIFICATION_EMAIL_FROM');
 		$object_type = '';
 		$link = '';
 		$num = 0;
@@ -889,7 +890,7 @@ class Notify
 								$dir_output = $conf->$object_type->multidir_output[$object->entity ? $object->entity : $conf->entity]."/".get_exdir(0, 0, 0, 1, $object, $object_type);
 								$template = $notifcode.'_TEMPLATE';
 								$mesg = $outputlangs->transnoentitiesnoconv('Notify_'.$notifcode).' '.$newref.' '.$dir_output;
-							break;
+								break;
 						}
 
 						include_once DOL_DOCUMENT_ROOT.'/core/class/html.formmail.class.php';
@@ -915,7 +916,7 @@ class Notify
 
 						$ref = dol_sanitizeFileName($newref);
 						$pdf_path = $dir_output."/".$ref.".pdf";
-						if (!dol_is_file($pdf_path)||(is_object($arraydefaultmessage) && $arraydefaultmessage->id > 0 && !$arraydefaultmessage->joinfiles)) {
+						if (!dol_is_file($pdf_path) || (is_object($arraydefaultmessage) && $arraydefaultmessage->id > 0 && !$arraydefaultmessage->joinfiles)) {
 							// We can't add PDF as it is not generated yet.
 							$filepdf = '';
 						} else {
@@ -944,7 +945,7 @@ class Notify
 							$sendto = preg_replace('/[\s,]+$/', '', $sendto); // Clean end of string
 						}
 
-						$parameters = array('notifcode'=>$notifcode, 'sendto'=>$sendto, 'replyto'=>$replyto, 'file'=>$filename_list, 'mimefile'=>$mimetype_list, 'filename'=>$mimefilename_list, 'outputlangs'=>$outputlangs, 'labeltouse'=>$labeltouse);
+						$parameters = array('notifcode' => $notifcode, 'sendto' => $sendto, 'from' => $from, 'file' => $filename_list, 'mimefile' => $mimetype_list, 'filename' => $mimefilename_list, 'outputlangs' => $outputlangs, 'labeltouse' => $labeltouse);
 						if (!isset($action)) {
 							$action = '';
 						}
@@ -967,7 +968,7 @@ class Notify
 						$mailfile = new CMailFile(
 							$subject,
 							$sendto,
-							$replyto,
+							$from,
 							$message,
 							$filename_list,
 							$mimetype_list,
@@ -1210,7 +1211,7 @@ class Notify
 				}
 
 				if ($sendto) {
-					$parameters = array('notifcode'=>$notifcode, 'sendto'=>$sendto, 'replyto'=>$replyto, 'file'=>$filename_list, 'mimefile'=>$mimetype_list, 'filename'=>$mimefilename_list, 'subject'=>&$subject, 'message'=>&$message);
+					$parameters = array('notifcode' => $notifcode, 'sendto' => $sendto, 'from' => $from, 'file' => $filename_list, 'mimefile' => $mimetype_list, 'filename' => $mimefilename_list, 'subject' => &$subject, 'message' => &$message);
 					$reshook = $hookmanager->executeHooks('formatNotificationMessage', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks
 					if (empty($reshook)) {
 						if (!empty($hookmanager->resArray['files'])) {
@@ -1228,7 +1229,7 @@ class Notify
 					$mailfile = new CMailFile(
 						$subject,
 						$sendto,
-						$replyto,
+						$from,
 						$message,
 						$filename_list,
 						$mimetype_list,
diff --git a/htdocs/core/class/smtps.class.php b/htdocs/core/class/smtps.class.php
index bca65ed5d84..6b9a2a272f4 100644
--- a/htdocs/core/class/smtps.class.php
+++ b/htdocs/core/class/smtps.class.php
@@ -4,7 +4,7 @@
  * Copyright (C) 2005-2015 Laurent Destailleur  <eldy@users.sourceforge.net>
  * Copyright (C) 2006-2011 Regis Houssin
  * Copyright (C) 2016      Jonathan TISSEAU     <jonathan.tisseau@86dev.fr>
- * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
+ * Copyright (C) 2024      MDW                  <mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -88,6 +88,16 @@ class SMTPs
 	 */
 	private $_msgReplyTo = null;
 
+	/**
+	 * List of In-Reply-To
+	 */
+	private $_msgInReplyTo = null;
+
+	/**
+	 * List of Msg-Id
+	 */
+	private $_msgReferences = null;
+
 	/**
 	 * Who will the Message be sent to; TO, CC, BCC
 	 * Multi-diminsional array containing addresses the message will
@@ -1139,6 +1149,56 @@ class SMTPs
 		return $_retValue;
 	}
 
+	/**
+	 * Set References in the list of Msg-Id
+	 *
+	 * @param 	string 	$_strInReplyTo 	List of Msg-Id
+	 * @return 	void
+	 */
+	public function setInReplyTo($_strInReplyTo)
+	{
+		if ($_strInReplyTo) {
+			$this->_msgInReplyTo = $_strInReplyTo;
+		}
+	}
+
+	/**
+	 * Retrieves the InReplyTo from which mail we reply to
+	 *
+	 * @return 	string 				Msg-Id of email we reply to
+	 */
+	public function getInReplyTo()
+	{
+		$_retValue = $this->_msgInReplyTo;
+
+		return $_retValue;
+	}
+
+	/**
+	 * Set References in the list of Msg-Id
+	 *
+	 * @param 	string 	$_strReferences 	List of Msg-Id
+	 * @return 	void
+	 */
+	public function setReferences($_strReferences)
+	{
+		if ($_strReferences) {
+			$this->_msgReferences = $_strReferences;
+		}
+	}
+
+	/**
+	 * Retrieves the References from which mail will be the reply-to
+	 *
+	 * @return 	string 				List of Msg-Id
+	 */
+	public function getReferences()
+	{
+		$_retValue = $this->_msgReferences;
+
+		return $_retValue;
+	}
+
 	/**
 	 * Inserts given addresses into structured format.
 	 * This method takes a list of given addresses, via an array or a COMMA delimited string, and inserts them into a highly
@@ -1453,8 +1513,6 @@ class SMTPs
 		if ($trackid) {
 			$_header .= 'Message-ID: <'.time().'.SMTPs-dolibarr-'.$trackid.'@'.$host.">\r\n";
 			$_header .= 'X-Dolibarr-TRACKID: '.$trackid.'@'.$host."\r\n";
-			// References and In-Reply-To: will be set by caller
-			//$_header .= 'References: <'.time().'.SMTPs-dolibarr-'.$trackid.'@'.$host.">\r\n";
 		} else {
 			$_header .= 'Message-ID: <'.time().'.SMTPs@'.$host.">\r\n";
 		}
@@ -1489,7 +1547,13 @@ class SMTPs
 		$_header .= 'X-Dolibarr-Option: '.($conf->global->MAIN_MAIL_USE_MULTI_PART ? 'MAIN_MAIL_USE_MULTI_PART' : 'No MAIN_MAIL_USE_MULTI_PART')."\r\n";
 		$_header .= 'Mime-Version: 1.0'."\r\n";
 
-		// TODO Add also $this->references and In-Reply-To
+		// Add also $this->references and In-Reply-To
+		if ($this->getInReplyTo()) {
+			$_header .= "In-Reply-To: ".$this->getInReplyTo()."\r\n";
+		}
+		if ($this->getReferences()) {
+			$_header .= "References: ".$this->getReferences()."\r\n";
+		}
 
 		return $_header;
 	}
diff --git a/htdocs/core/db/Database.interface.php b/htdocs/core/db/Database.interface.php
index 1c9c7a5a05f..9a796160292 100644
--- a/htdocs/core/db/Database.interface.php
+++ b/htdocs/core/db/Database.interface.php
@@ -36,6 +36,14 @@ interface Database
 	 */
 	public function ifsql($test, $resok, $resko);
 
+	/**
+	 * Return SQL string to aggregate using the Standard Deviation of population
+	 *
+	 * @param	string	$nameoffield	Name of field
+	 * @return	string					SQL string
+	 */
+	public function stddevPop($nameoffield);
+
 	// phpcs:disable PEAR.NamingConventions.ValidFunctionName.ScopeNotCamelCaps
 	/**
 	 * Return datas as an array
diff --git a/htdocs/core/db/DoliDB.class.php b/htdocs/core/db/DoliDB.class.php
index 19bb694558b..01237c5c676 100644
--- a/htdocs/core/db/DoliDB.class.php
+++ b/htdocs/core/db/DoliDB.class.php
@@ -105,6 +105,17 @@ abstract class DoliDB implements Database
 		return '(CASE WHEN '.$test.' THEN '.$resok.' ELSE '.$resko.' END)';
 	}
 
+	/**
+	 * Return SQL string to aggregate using the Standard Deviation of population
+	 *
+	 * @param	string	$nameoffield	Name of field
+	 * @return	string					SQL string
+	 */
+	public function stddevPop($nameoffield)
+	{
+		return 'STDDEV_POP('.$nameoffield.')';
+	}
+
 	/**
 	 * Return SQL string to force an index
 	 *
diff --git a/htdocs/core/db/mysqli.class.php b/htdocs/core/db/mysqli.class.php
index 485477d052d..c98732c2d06 100644
--- a/htdocs/core/db/mysqli.class.php
+++ b/htdocs/core/db/mysqli.class.php
@@ -518,6 +518,7 @@ class DoliDBMysqli extends DoliDB
 	 */
 	public function escapeforlike($stringtoencode)
 	{
+		// We must first replace the \ char into \\, then we can replace _ and % into \_ and \%
 		return str_replace(array('\\', '_', '%'), array('\\\\', '\_', '\%'), (string) $stringtoencode);
 	}
 
diff --git a/htdocs/core/lib/ajax.lib.php b/htdocs/core/lib/ajax.lib.php
index 81fe78a073c..42a0139bdf5 100644
--- a/htdocs/core/lib/ajax.lib.php
+++ b/htdocs/core/lib/ajax.lib.php
@@ -2,6 +2,7 @@
 /* Copyright (C) 2007-2010 Laurent Destailleur  <eldy@users.sourceforge.net>
  * Copyright (C) 2007-2015 Regis Houssin        <regis.houssin@inodbox.com>
  * Copyright (C) 2012      Christophe Battarel  <christophe.battarel@altairis.fr>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -35,12 +36,12 @@
  * @param string	$urloption			More parameters on URL request
  * @param int		$minLength			Minimum number of chars to trigger that Ajax search
  * @param int		$autoselect			Automatic selection if just one value (trigger("change") on field is done if search return only 1 result)
- * @param array		$ajaxoptions		Multiple options array
- *                                      - Ex: array('update'=>array('field1','field2'...)) will reset field1 and field2 once select done
- *                                      - Ex: array('disabled'=> )
- *                                      - Ex: array('show'=> )
- *                                      - Ex: array('update_textarea'=> )
- *                                      - Ex: array('option_disabled'=> id to disable and warning to show if we select a disabled value (this is possible when using autocomplete ajax)
+ * @param array<string,string|string[]>	$ajaxoptions	Multiple options array
+ *                                                      - Ex: array('update'=>array('field1','field2'...)) will reset field1 and field2 once select done
+ *                                                      - Ex: array('disabled'=> )
+ *                                                      - Ex: array('show'=> )
+ *                                                      - Ex: array('update_textarea'=> )
+ *                                                      - Ex: array('option_disabled'=> id to disable and warning to show if we select a disabled value (this is possible when using autocomplete ajax)
  * @param string	$moreparams			More params provided to ajax call
  * @return string   					Script
  */
@@ -168,7 +169,7 @@ function ajax_autocompleter($selected, $htmlname, $url, $urloption = '', $minLen
 												multicurrency_unitprice: item.multicurrency_unitprice,
 		';
 	}
-		$script .= '
+	$script .= '
 												 description : item.description,
 												 ref_customer: item.ref_customer,
 												 tva_tx: item.tva_tx,
@@ -690,9 +691,9 @@ function ajax_constantonoff($code, $input = array(), $entity = null, $revertonof
 						confirmConstantAction("del", url, code, input, input.alert.del, entity, yesButton, noButton, strict, userid, token);
 					} else {';
 		if (empty($setzeroinsteadofdel)) {
-			$out .=' 	delConstant(url, code, input, entity, 0, '.((int) $forcereload).', userid, token);';
+			$out .= ' 	delConstant(url, code, input, entity, 0, '.((int) $forcereload).', userid, token);';
 		} else {
-			$out .=' 	setConstant(url, code, input, entity, 0, '.((int) $forcereload).', userid, token, 0);';
+			$out .= ' 	setConstant(url, code, input, entity, 0, '.((int) $forcereload).', userid, token, 0);';
 		}
 		$out .= '	}
 				});
diff --git a/htdocs/core/lib/barcode.lib.php b/htdocs/core/lib/barcode.lib.php
index ca18ed00cb1..f56000ae532 100644
--- a/htdocs/core/lib/barcode.lib.php
+++ b/htdocs/core/lib/barcode.lib.php
@@ -75,9 +75,9 @@ if (defined('PHP-BARCODE_PATH_COMMAND')) {
  *
  * @param	string	       $code		Code
  * @param	string	       $encoding	Encoding ('EAN13', 'ISBN', 'C128', 'UPC', 'CBR', 'QRCODE', 'DATAMATRIX', 'ANY'...)
- * @param	integer	       $scale		Scale
+ * @param	int<1,max>     $scale		Scale
  * @param	string	       $mode		'png' or 'jpg' ...
- * @return	array|string   $bars		array('encoding': the encoding which has been used, 'bars': the bars, 'text': text-positioning info) or string with error message
+ * @return	array{encoding:string,bars:string,text:string}|string   $bars		array('encoding': the encoding which has been used, 'bars': the bars, 'text': text-positioning info) or string with error message
  */
 function barcode_print($code, $encoding = "ANY", $scale = 2, $mode = "png")
 {
@@ -124,7 +124,7 @@ function barcode_print($code, $encoding = "ANY", $scale = 2, $mode = "png")
  *
  * @param	string	$code		Code
  * @param	string	$encoding	Encoding
- * @return	array|false			array('encoding': the encoding which has been used, 'bars': the bars, 'text': text-positioning info)
+ * @return	array{encoding:string,bars:string,text:string}|false			array('encoding': the encoding which has been used, 'bars': the bars, 'text': text-positioning info)
  */
 function barcode_encode($code, $encoding)
 {
@@ -172,7 +172,7 @@ function barcode_encode($code, $encoding)
  * Calculate EAN sum
  *
  * @param	string	$ean	EAN to encode
- * @return	integer			Sum
+ * @return	int<0,9>		EAN Sum
  */
 function barcode_gen_ean_sum($ean)
 {
@@ -206,8 +206,8 @@ function barcode_gen_ean_bars($ean)
 
 	$line = $guards[0];
 	for ($i = 1; $i < 13; $i++) {
-		$str = $digits[$ean[$i]];
-		if ($i < 7 && $mirror[$ean[0]][$i - 1] == 1) {
+		$str = $digits[(int) $ean[$i]];
+		if ($i < 7 && $mirror[(int) $ean[0]][$i - 1] == 1) {
 			$line .= strrev($str);
 		} else {
 			$line .= $str;
@@ -226,7 +226,7 @@ function barcode_gen_ean_bars($ean)
  *
  * @param	string	$ean		Code
  * @param	string	$encoding	Encoding
- * @return	array				array('encoding': the encoding which has been used, 'bars': the bars, 'text': text-positioning info, 'error': error message if error)
+ * @return	array{encoding:string,bars:string,text:string,error:string}|array{text:string,error:string}	array('encoding': the encoding which has been used, 'bars': the bars, 'text': text-positioning info, 'error': error message if error)
  */
 function barcode_encode_ean($ean, $encoding = "EAN-13")
 {
@@ -282,7 +282,7 @@ function barcode_encode_ean($ean, $encoding = "EAN-13")
  *
  * @param	string	$upc		Code
  * @param	string	$encoding	Encoding
- * @return	array				array('encoding': the encoding which has been used, 'bars': the bars, 'text': text-positioning info, 'error': error message if error)
+ * @return	array{encoding:string,bars:string,text:string,error:string}|array{text:string,error:string}	array('encoding': the encoding which has been used, 'bars': the bars, 'text': text-positioning info, 'error': error message if error)
  */
 function barcode_encode_upc($upc, $encoding = "UPC")
 {
@@ -332,7 +332,7 @@ function barcode_encode_upc($upc, $encoding = "UPC")
  *
  * @param	string	$code		Code
  * @param	string	$encoding	Encoding
- * @return	array|false			array('encoding': the encoding which has been used, 'bars': the bars, 'text': text-positioning info)
+ * @return	array{encoding:string,bars:string,text:string}|false			array('encoding': the encoding which has been used, 'bars': the bars, 'text': text-positioning info)
  */
 function barcode_encode_genbarcode($code, $encoding)
 {
@@ -403,10 +403,10 @@ function barcode_encode_genbarcode($code, $encoding)
  *
  * @param	string	$text		the text-line (<position>:<font-size>:<character> ...)
  * @param	string	$bars   	where to place the bars  (<space-width><bar-width><space-width><bar-width>...)
- * @param	int		$scale		scale factor ( 1 < scale < unlimited (scale 50 will produce 5400x300 pixels when using EAN-13!!!))
+ * @param	int<1,max>	$scale		scale factor ( 1 < scale < unlimited (scale 50 will produce 5400x300 pixels when using EAN-13!!!))
  * @param	string	$mode   	png,gif,jpg (default='png')
  * @param	int		$total_y	the total height of the image ( default: scale * 60 )
- * @param	array	$space		default:  $space[top]   = 2 * $scale; $space[bottom]= 2 * $scale;  $space[left]  = 2 * $scale;  $space[right] = 2 * $scale;
+ * @param	array{}|array{top:int,bottom:int,left:int,right:int}	$space		default:  $space[top]   = 2 * $scale; $space[bottom]= 2 * $scale;  $space[left]  = 2 * $scale;  $space[right] = 2 * $scale;
  * @return	string|void
  */
 function barcode_outimage($text, $bars, $scale = 1, $mode = "png", $total_y = 0, $space = [])
@@ -424,7 +424,7 @@ function barcode_outimage($text, $bars, $scale = 1, $mode = "png", $total_y = 0,
 	if ($total_y < 1) {
 		$total_y = (int) $scale * 60;
 	}
-	if (!$space) {
+	if (!is_array($space) || empty($space)) {
 		$space = array('top' => 2 * $scale, 'bottom' => 2 * $scale, 'left' => 2 * $scale, 'right' => 2 * $scale);
 	}
 
@@ -435,7 +435,7 @@ function barcode_outimage($text, $bars, $scale = 1, $mode = "png", $total_y = 0,
 	for ($i = 0; $i < $ln; $i++) {
 		$val = strtolower($bars[$i]);
 		if ($width) {
-			$xpos += $val * $scale;
+			$xpos += (int) $val * $scale;
 			$width = false;
 			continue;
 		}
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index ff84b50796d..1c5a6bde9b2 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -1073,6 +1073,9 @@ function sanitizeVal($out = '', $check = 'alphanohtml', $filter = null, $options
 			}
 			break;
 		case 'intcomma':
+			if (is_array($out)) {
+				$out = implode(',', $out);
+			}
 			if (preg_match('/[^0-9,-]+/i', $out)) {
 				$out = '';
 			}
@@ -1364,15 +1367,52 @@ function dol_buildpath($path, $type = 0, $returnemptyifnotfound = 0)
 	return $res;
 }
 
+/**
+ *	Get properties for an object - including magic properties when requested
+ *
+ *	Only returns properties that exist
+ *
+ *	@param	object		$obj		Object to get properties from
+ *	@param	string[]	$properties	Optional list of properties to get.
+ *  								When empty, only gets public properties.
+ *	@return array<string,mixed>		Hash for retrieved values (key=name)
+ */
+function dol_get_object_properties($obj, $properties = [])
+{
+	// Get real properties using get_object_vars() if $properties is empty
+	if (empty($properties)) {
+		return get_object_vars($obj);
+	}
+
+	$existingProperties = [];
+	$realProperties = get_object_vars($obj);
+
+	// Get the real or magic property values
+	foreach ($properties as $property) {
+		if (array_key_exists($property, $realProperties)) {
+			// Real property, add the value
+			$existingProperties[$property] = $obj->{$property};
+		} elseif (property_exists($obj, $property)) {
+			// Magic property
+			$existingProperties[$property] = $obj->{$property};
+		}
+	}
+
+	return $existingProperties;
+}
+
+
 /**
  *	Create a clone of instance of object (new instance with same value for each properties)
  *  With native = 0: Property that are reference are different memory area in the new object (full isolation clone). This means $this->db of new object may not be valid.
  *  With native = 1: Use PHP clone. Property that are reference are same pointer. This means $this->db of new object is still valid but point to same this->db than original object.
  *  With native = 2: Property that are reference are different memory area in the new object (full isolation clone). Only scalar and array values are cloned. This means method are not availables and $this->db of new object is not valid.
  *
- * 	@param	object	$object		Object to clone
+ *  @template T of object
+ *
+ * 	@param	T		$object		Object to clone
  *  @param	int		$native		0=Full isolation method, 1=Native PHP method, 2=Full isolation method keeping only scalar and array properties (recommended)
- *	@return object				Clone object
+ *	@return T					Clone object
  *  @see https://php.net/manual/language.oop5.cloning.php
  */
 function dol_clone($object, $native = 0)
@@ -8990,8 +9030,8 @@ function getCommonSubstitutionArray($outputlangs, $onlykey = 0, $exclude = null,
  *  $mesg = make_substitutions($mesg, $substitutionarray, $langs);
  *
  *  @param	string		$text	      					Source string in which we must do substitution
- *  @param  array		$substitutionarray				Array with key->val to substitute. Example: array('__MYKEY__' => 'MyVal', ...)
- *  @param	Translate	$outputlangs					Output language
+ *  @param  array<string,string>	$substitutionarray	Array with key->val to substitute. Example: array('__MYKEY__' => 'MyVal', ...)
+ *  @param	?Translate	$outputlangs					Output language
  *  @param	int			$converttextinhtmlifnecessary	0=Convert only value into HTML if text is already in HTML
  *  													1=Will also convert initial $text into HTML if we try to insert one value that is HTML
  * 	@return string  		    						Output string after substitutions
@@ -12164,6 +12204,17 @@ function getElementProperties($elementType)
 		$subelement = $regs[2];
 	}
 
+	// Object lines will use parent classpath and module ref
+	if (substr($elementType, -3) == 'det') {
+		$module = preg_replace('/det$/', '', $element);
+		$subelement = preg_replace('/det$/', '', $subelement);
+		$classpath = $module.'/class';
+		$classfile = $module;
+		$classname = preg_replace('/det$/', 'Line', $element);
+		if (in_array($module, array('expedition', 'propale', 'facture', 'contrat', 'fichinter', 'commandefournisseur'))) {
+			$classname = preg_replace('/det$/', 'Ligne', $element);
+		}
+	}
 	// For compatibility and to work with non standard path
 	if ($elementType == "action") {
 		$classpath = 'comm/action/class';
@@ -12588,16 +12639,17 @@ function getNonce()
 /**
  * Start a table with headers and a optional clickable number (don't forget to use "finishSimpleTable()" after the last table row)
  *
- * @param string	$header		The first left header of the table (automatic translated)
- * @param string	$link		(optional) The link to a internal dolibarr page, when click on the number (without the first "/")
- * @param string	$arguments	(optional) Additional arguments for the link (e.g. "search_status=0")
- * @param integer	$emptyRows	(optional) The count of empty rows after the first header
- * @param integer	$number		(optional) The number that is shown right after the first header, when not set the link is shown on the right side of the header as "FullList"
+ * @param string	$header			The first left header of the table (automatic translated)
+ * @param string	$link			(optional) The link to a internal dolibarr page, when click on the number (without the first "/")
+ * @param string	$arguments		(optional) Additional arguments for the link (e.g. "search_status=0")
+ * @param integer	$emptyRows		(optional) The count of empty columns after the first column
+ * @param integer	$number			(optional) The number that is shown right after the first header, when not set the link is shown on the right side of the header as "FullList"
+ * @param string	$pictofulllist 	(optional) The picto to use for the full list link
  * @return void
  *
  * @see finishSimpleTable()
  */
-function startSimpleTable($header, $link = "", $arguments = "", $emptyRows = 0, $number = -1)
+function startSimpleTable($header, $link = "", $arguments = "", $emptyRows = 0, $number = -1, $pictofulllist = '')
 {
 	global $langs;
 
@@ -12641,7 +12693,12 @@ function startSimpleTable($header, $link = "", $arguments = "", $emptyRows = 0,
 			print '<a class="commonlink" href="'.DOL_URL_ROOT.'/'.$link.'">';
 		}
 
-		print $langs->trans("FullList");
+		if ($pictofulllist) {
+			print img_picto($langs->trans("FullList"), $pictofulllist);
+		} else {
+			print $langs->trans("FullList");
+		}
+
 		print '</a>';
 		print '</th>';
 	}
diff --git a/htdocs/core/lib/images.lib.php b/htdocs/core/lib/images.lib.php
index 258317756d0..19c0c75b9c5 100644
--- a/htdocs/core/lib/images.lib.php
+++ b/htdocs/core/lib/images.lib.php
@@ -661,7 +661,7 @@ function vignette($file, $maxWidth = 160, $maxHeight = 120, $extName = '_small',
 	if ($exifAngle) {
 		$rotated = false;
 
-		if ($infoImg[2] === 'IMAGETYPE_PNG') { // In fact there is no exif on PNG but just in case
+		if ($infoImg[2] === IMAGETYPE_PNG) { // In fact there is no exif on PNG but just in case
 			imagealphablending($img, false);
 			imagesavealpha($img, true);
 			$rotated = imagerotate($img, $exifAngle, imagecolorallocatealpha($img, 0, 0, 0, 127));
diff --git a/htdocs/core/lib/invoice.lib.php b/htdocs/core/lib/invoice.lib.php
index 1efc998a384..95ed5249031 100644
--- a/htdocs/core/lib/invoice.lib.php
+++ b/htdocs/core/lib/invoice.lib.php
@@ -710,7 +710,9 @@ function getDraftSupplierTable($maxCount = 500, $socid = 0)
 					$facturesupplierstatic->ref_supplier = $obj->ref_supplier;
 					$facturesupplierstatic->type = $obj->type;
 					$facturesupplierstatic->statut = $obj->status;
+					$facturesupplierstatic->statusi = $obj->status;
 					$facturesupplierstatic->paye = $obj->paye;
+					$facturesupplierstatic->paid = $obj->paye;
 
 					$companystatic->id = $obj->socid;
 					$companystatic->name = $obj->name;
@@ -931,7 +933,9 @@ function getPurchaseInvoiceLatestEditTable($maxCount = 5, $socid = 0)
 		$objectstatic->id = $obj->rowid;
 		$objectstatic->ref = $obj->ref;
 		$objectstatic->paye = $obj->paye;
+		$objectstatic->paid = $obj->paye;
 		$objectstatic->statut = $obj->status;
+		$objectstatic->status = $obj->status;
 		$objectstatic->total_ht = $obj->total_ht;
 		$objectstatic->total_tva = $obj->total_tva;
 		$objectstatic->total_ttc = $obj->total_ttc;
@@ -1260,6 +1264,8 @@ function getPurchaseInvoiceUnpaidOpenTable($maxCount = 500, $socid = 0)
 					$facstatic->total_tva = $obj->total_tva;
 					$facstatic->total_ttc = $obj->total_ttc;
 					$facstatic->statut = $obj->status;
+					$facstatic->status = $obj->status;
+					$facstatic->paid = $obj->paye;
 					$facstatic->paye = $obj->paye;
 
 					$societestatic->id = $obj->socid;
diff --git a/htdocs/core/lib/modulebuilder.lib.php b/htdocs/core/lib/modulebuilder.lib.php
index 200b3422d3a..4e5b480eb73 100644
--- a/htdocs/core/lib/modulebuilder.lib.php
+++ b/htdocs/core/lib/modulebuilder.lib.php
@@ -31,9 +31,9 @@
  *  @param	string      $objectname		Name of object
  * 	@param	string		$newmask		New mask
  *  @param	string      $readdir		Directory source (use $destdir when not defined)
- *  @param	array		$addfieldentry	Array of 1 field entry to add array('key'=>,'type'=>,''label'=>,'visible'=>,'enabled'=>,'position'=>,'notnull'=>','index'=>,'searchall'=>,'comment'=>,'help'=>,'isameasure')
+ *  @param	array{}|array{name:string,key:string,type:string,label:string,picot?:string,enabled:int<0,1>,notnull:int<0,1>,position:int,visible:int,noteditable?:int<0,1>,alwayseditable?:int<0,1>,default?:string,index?:int,foreignkey?:string,searchall?:int,isameasure?:int<0,1>,css?:string,cssview?:string,csslist?:string,help?:string,showoncombobox?:int<0,1>,disabled?:int<0,1>,autofocusoncreate?:int<0,1>,arrayofkeyval?:array<string,string>,validate?:int<0,1>,comment?:string}	$addfieldentry	Array of 1 field entry to add
  *  @param	string		$delfieldentry	Id of field to remove
- * 	@return	int|object					Return integer <=0 if KO, Object if OK
+ * 	@return	int<-7,-1>|CommonObject		Return integer <=0 if KO, Object if OK
  *  @see rebuildObjectSql()
  */
 function rebuildObjectClass($destdir, $module, $objectname, $newmask, $readdir = '', $addfieldentry = array(), $delfieldentry = '')
@@ -89,6 +89,7 @@ function rebuildObjectClass($destdir, $module, $objectname, $newmask, $readdir =
 		} else {
 			return -4;
 		}
+		'@phan-var-force CommonObject $object';
 
 		// Backup old file
 		dol_copy($pathoffiletoedittarget, $pathoffiletoedittarget.'.back', $newmask, 1);
@@ -138,7 +139,7 @@ function rebuildObjectClass($destdir, $module, $objectname, $newmask, $readdir =
 				if (!empty($val['alwayseditable'])) {
 					$texttoinsert .= ' "alwayseditable"=>"'.dol_escape_php($val['alwayseditable']).'",';
 				}
-				if (!empty($val['default']) || (isset($val['default']) && $val['default'] === '0')) {
+				if (array_key_exists('default', $val) && (!empty($val['default']) || $val['default'] === '0')) {
 					$texttoinsert .= ' "default"=>"'.dol_escape_php($val['default']).'",';
 				}
 				if (!empty($val['index'])) {
@@ -549,11 +550,11 @@ function compareFirstValue($a, $b)
  * @param string      $file            filename or path
  * @param array<int,string[]> $permissions permissions existing in file
  * @param int|null    $key             key for permission needed
- * @param array|null  $right           $right to update or add
+ * @param array{0:string,1:string}|null  $right           $right to update or add
  * @param string|null $objectname      name of object
  * @param string|null $module          name of module
  * @param int<-2,2>   $action          0 for delete, 1 for add, 2 for update, -1 when delete object completely, -2 for generate rights after add
- * @return int                         1 if OK,-1 if KO
+ * @return int<-1,1>                   1 if OK,-1 if KO
  */
 function reWriteAllPermissions($file, $permissions, $key, $right, $objectname, $module, $action)
 {
@@ -672,7 +673,7 @@ function reWriteAllPermissions($file, $permissions, $key, $right, $objectname, $
  * Converts a formatted properties string into an associative array.
  *
  * @param string $string The formatted properties string.
- * @return array The resulting associative array.
+ * @return array<string,bool|int|float|string|mixed[]> The resulting associative array.
  */
 function parsePropertyString($string)
 {
@@ -874,7 +875,7 @@ function getFromFile($file, $start, $end)
  * Write all permissions of each object in AsciiDoc format
  * @param  string   $file           path of the class
  * @param  string   $destfile       file where write table of permissions
- * @return int                      1 if OK, -1 if KO
+ * @return int<-1,1>				1 if OK, -1 if KO
  */
 function writePermsInAsciiDoc($file, $destfile)
 {
@@ -959,9 +960,9 @@ function writePermsInAsciiDoc($file, $destfile)
  *
  * @param	string	$srcfile		Source file to use as example
  * @param  	string 	$file           Path of modified file
- * @param  	array  	$objects        Array of objects in the module
+ * @param  	string[]	$objects	Array of objects in the module
  * @param  	string 	$modulename     Name of module
- * @return 	int                    	Return 1 if OK, -1 if KO
+ * @return 	int<-1,1>              	Return 1 if OK, -1 if KO
  */
 function addObjectsToApiFile($srcfile, $file, $objects, $modulename)
 {
@@ -1044,9 +1045,9 @@ function addObjectsToApiFile($srcfile, $file, $objects, $modulename)
  * Remove 	Object variables and methods from API_Module File
  *
  * @param 	string   	$file         	File api module
- * @param  	array  		$objects        Array of objects in the module
+ * @param  	string[] 	$objects        Array of objects in the module
  * @param 	string   	$objectname   	Name of object want to remove
- * @return 	int                    		1 if OK, -1 if KO
+ * @return 	int<-1,1> 					1 if OK, -1 if KO
  */
 function removeObjectFromApiFile($file, $objects, $objectname)
 {
@@ -1091,12 +1092,12 @@ function removeObjectFromApiFile($file, $objects, $objectname)
 
 
 /**
- * @param    string         $file       path of filename
- * @param    mixed          $menus      all menus for module
- * @param    mixed|null     $menuWantTo  menu get for do actions
- * @param    int|null       $key        key for the concerned menu
- * @param    int            $action     for specify what action (0 = delete, 1 = add, 2 = update, -1 = when delete object)
- * @return   int            1 if OK, -1 if KO
+ * @param	string         $file       path of filename
+ * @param	array<int,array{fk_menu:string,type:string,titre:string,mainmenu:string,leftmenu:string,url:string,langs:string,position:int,enabled:int,perms:string,target:string,user:int}>		$menus      all menus for module
+ * @param	mixed|null     $menuWantTo  menu get for do actions
+ * @param	int|null       $key        key for the concerned menu
+ * @param	int<-1,2>      $action     for specify what action (0 = delete, 1 = add, 2 = update, -1 = when delete object)
+ * @return	int<-1,1>					1 if OK, -1 if KO
  */
 function reWriteAllMenus($file, $menus, $menuWantTo, $key, $action)
 {
@@ -1194,7 +1195,7 @@ function reWriteAllMenus($file, $menus, $menuWantTo, $key, $action)
  *
  * @param string $module The name of the module.
  * @param string $file The path to the module descriptor file.
- * @param array $dicts The dictionary data to be updated.
+ * @param array<string,string|array<string,int|string>> $dicts The dictionary data to be updated.
  * @return int Returns the number of replacements made in the file.
  */
 function updateDictionaryInFile($module, $file, $dicts)
@@ -1267,8 +1268,8 @@ function updateDictionaryInFile($module, $file, $dicts)
  * @param string $modulename The lowercase name of the module for which the dictionary table is being created.
  * @param string $file The file path to the Dolibarr module builder file where the dictionaries are defined.
  * @param string $namedic The name of the dictionary, which will also be used as the base for the table name.
- * @param array|null $dictionnaires An optional array containing pre-existing dictionary data, including 'tabname', 'tablib', 'tabsql', etc.
- * @return int|void Return int < 0 if error, return nothing on success
+ * @param array<string,string|array<string,int|string>>	$dictionnaires An optional array containing pre-existing dictionary data, including 'tabname', 'tablib', 'tabsql', etc.
+ * @return int<-1,-1>|void Return int < 0 if error, return nothing on success
  */
 function createNewDictionnary($modulename, $file, $namedic, $dictionnaires = null)
 {
@@ -1289,10 +1290,10 @@ function createNewDictionnary($modulename, $file, $namedic, $dictionnaires = nul
 
 	$columns = array(
 		'rowid' => array('type' => 'integer', 'value' => 11, 'extra' => 'AUTO_INCREMENT'),
-		'code' => array('type' => 'varchar', 'value' => 255, 'null'=>'NOT NULL'),
-		'label' => array('type' => 'varchar', 'value' => 255, 'null'=>'NOT NULL'),
-		'position' => array('type' => 'integer', 'value' => 11, 'null'=>'NULL'),
-		'use_default' => array('type' => 'varchar', 'value' => 11, 'default'=>'1'),
+		'code' => array('type' => 'varchar', 'value' => 255, 'null' => 'NOT NULL'),
+		'label' => array('type' => 'varchar', 'value' => 255, 'null' => 'NOT NULL'),
+		'position' => array('type' => 'integer', 'value' => 11, 'null' => 'NULL'),
+		'use_default' => array('type' => 'varchar', 'value' => 11, 'default' => '1'),
 		'active' => array('type' => 'integer', 'value' => 3)
 	);
 
@@ -1348,7 +1349,7 @@ function createNewDictionnary($modulename, $file, $namedic, $dictionnaires = nul
  *
  * @param string $file_api   filename or path of api
  * @param string $file_doc   filename or path of documentation
- * @return int               -1 if KO, 1 if OK, 0 if nothing change
+ * @return int<-1,1>         -1 if KO, 1 if OK, 0 if nothing change
  */
 function writeApiUrlsInDoc($file_api, $file_doc)
 {
diff --git a/htdocs/core/lib/pdf.lib.php b/htdocs/core/lib/pdf.lib.php
index 0594beb7ee3..6c591eab176 100644
--- a/htdocs/core/lib/pdf.lib.php
+++ b/htdocs/core/lib/pdf.lib.php
@@ -925,7 +925,7 @@ function pdf_bank(&$pdf, $outputlangs, $curx, $cury, $account, $onlynumber = 0,
 			$curx = $savcurx;
 			$cury += 8;
 		}
-	} else {
+	} elseif (!empty($account->number)) {
 		$pdf->SetFont('', 'B', $default_font_size - $diffsizecontent);
 		$pdf->SetXY($curx, $cury);
 		$pdf->MultiCell(100, 3, $outputlangs->transnoentities("Bank").': '.$outputlangs->convToOutputCharset($account->bank), 0, 'L', 0);
diff --git a/htdocs/core/lib/website2.lib.php b/htdocs/core/lib/website2.lib.php
index 9691b94642a..36af665f373 100644
--- a/htdocs/core/lib/website2.lib.php
+++ b/htdocs/core/lib/website2.lib.php
@@ -61,7 +61,7 @@ function dolSaveMasterFile($filemaster)
 function dolSavePageAlias($filealias, $object, $objectpage)
 {
 	// Now create the .tpl file
-	dol_syslog("dolSavePageAlias We regenerate the alias page filealias=".$filealias);
+	dol_syslog("dolSavePageAlias We regenerate the alias page filealias=".$filealias." and a wrapper into all language subdirectories");
 
 	$aliascontent = '<?php'."\n";
 	$aliascontent .= "// File generated to wrap the alias page - DO NOT MODIFY - It is just a wrapper to real page\n";
@@ -81,6 +81,8 @@ function dolSavePageAlias($filealias, $object, $objectpage)
 		$filename = basename($filealias);
 		$filealiassub = $dirname.'/'.$objectpage->lang.'/'.$filename;
 
+		dol_mkdir($dirname.'/'.$objectpage->lang, DOL_DATA_ROOT);
+
 		$aliascontent = '<?php'."\n";
 		$aliascontent .= "// File generated to wrap the alias page - DO NOT MODIFY - It is just a wrapper to real page\n";
 		$aliascontent .= 'global $dolibarr_main_data_root;'."\n";
diff --git a/htdocs/core/menus/init_menu_auguria.sql b/htdocs/core/menus/init_menu_auguria.sql
index d177030b841..41f73e38718 100644
--- a/htdocs/core/menus/init_menu_auguria.sql
+++ b/htdocs/core/menus/init_menu_auguria.sql
@@ -119,7 +119,7 @@ insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, left
 insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("societe") && isModEnabled("categorie")', __HANDLER__, 'left', 671__+MAX_llx_menu__, 'companies', '', 670__+MAX_llx_menu__, '/categories/card.php?mainmenu=companies&amp;action=create&amp;type=4', 'NewCategory', 1, 'categories', '$user->hasRight("categorie","creer")', '', 2, 0, __ENTITY__);
 
 -- Product - Product
-insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("product")', __HANDLER__, 'left', 2800__+MAX_llx_menu__, 'products', 'product', 3__+MAX_llx_menu__, '/product/index.php?mainmenu=products&amp;leftmenu=product&amp;type=0', 'Products', 0, 'products', '$user->rights->produit->lire', '', 2, 0, __ENTITY__);
+insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("product")', __HANDLER__, 'left', 2800__+MAX_llx_menu__, 'products', 'product', 3__+MAX_llx_menu__, '/product/index.php?mainmenu=products&amp;leftmenu=product', 'Products', 0, 'products', '$user->rights->produit->lire', '', 2, 0, __ENTITY__);
 insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("product")', __HANDLER__, 'left', 2801__+MAX_llx_menu__, 'products', '', 2800__+MAX_llx_menu__, '/product/card.php?mainmenu=products&amp;leftmenu=product&amp;action=create&amp;type=0', 'NewProduct', 1, 'products', '$user->rights->produit->creer', '', 2, 0, __ENTITY__);
 insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("product")', __HANDLER__, 'left', 2802__+MAX_llx_menu__, 'products', '', 2800__+MAX_llx_menu__, '/product/list.php?mainmenu=products&amp;leftmenu=product&amp;type=0', 'List', 1, 'products', '$user->rights->produit->lire', '', 2, 1, __ENTITY__);
 insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("product")', __HANDLER__, 'left', 2803__+MAX_llx_menu__, 'products', '', 2800__+MAX_llx_menu__, '/product/reassort.php?mainmenu=products&amp;type=0', 'MenuStocks', 1, 'products', '$user->rights->produit->lire && $user->rights->stock->lire', '', 2, 4, __ENTITY__);
@@ -131,13 +131,13 @@ insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, left
 insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("propal")', __HANDLER__, 'left', 2804__+MAX_llx_menu__, 'products', '', 2800__+MAX_llx_menu__, '/product/stats/card.php?mainmenu=products&amp;id=all&amp;leftmenu=stats&amp;type=0', 'Statistics', 1, 'main', '$user->rights->produit->lire', '', 2, 8, __ENTITY__);
 
 -- Product - Services
-insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("service")', __HANDLER__, 'left', 2900__+MAX_llx_menu__, 'products', 'service', 3__+MAX_llx_menu__, '/product/index.php?mainmenu=products&amp;leftmenu=service&amp;type=1', 'Services', 0, 'products', '$user->hasRight("service","lire")', '', 2, 1, __ENTITY__);
+insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("service")', __HANDLER__, 'left', 2900__+MAX_llx_menu__, 'products', 'service', 3__+MAX_llx_menu__, '/product/index.php?mainmenu=products&amp;leftmenu=service', 'Services', 0, 'products', '$user->hasRight("service","lire")', '', 2, 1, __ENTITY__);
 insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("service")', __HANDLER__, 'left', 2901__+MAX_llx_menu__, 'products', '', 2900__+MAX_llx_menu__, '/product/card.php?mainmenu=products&amp;leftmenu=service&amp;action=create&amp;type=1', 'NewService', 1, 'products', '$user->rights->service->creer', '', 2, 0, __ENTITY__);
 insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("service")', __HANDLER__, 'left', 2902__+MAX_llx_menu__, 'products', '', 2900__+MAX_llx_menu__, '/product/list.php?mainmenu=products&amp;leftmenu=service&amp;type=1', 'List', 1, 'products', '$user->hasRight("service","lire")', '', 2, 1, __ENTITY__);
 insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("propal")', __HANDLER__, 'left', 2903__+MAX_llx_menu__, 'products', '', 2900__+MAX_llx_menu__, '/product/stats/card.php?mainmenu=products&amp;id=all&amp;leftmenu=stats&amp;type=1', 'Statistics', 1, 'main', '$user->hasRight("service","lire")', '', 2, 5, __ENTITY__);
 
 -- Product - Stocks
-insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("stock")', __HANDLER__, 'left', 3100__+MAX_llx_menu__, 'products', 'stock', 3__+MAX_llx_menu__, '/product/stock/index.php?mainmenu=products&amp;leftmenu=stock', 'Stock', 0, 'stocks', '$user->rights->stock->lire', '', 2, 3, __ENTITY__);
+insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("stock")', __HANDLER__, 'left', 3100__+MAX_llx_menu__, 'products', 'stock', 3__+MAX_llx_menu__, '/product/index.php?mainmenu=products&amp;leftmenu=stock', 'Stock', 0, 'stocks', '$user->rights->stock->lire', '', 2, 3, __ENTITY__);
 insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("stock")', __HANDLER__, 'left', 3101__+MAX_llx_menu__, 'products', '', 3100__+MAX_llx_menu__, '/product/stock/card.php?mainmenu=products&amp;action=create', 'MenuNewWarehouse', 1, 'stocks', '$user->rights->stock->creer', '', 2, 0, __ENTITY__);
 insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("stock")', __HANDLER__, 'left', 3102__+MAX_llx_menu__, 'products', '', 3100__+MAX_llx_menu__, '/product/stock/list.php?mainmenu=products', 'List', 1, 'stocks', '$user->rights->stock->lire', '', 2, 1, __ENTITY__);
 insert into llx_menu (module, enabled, menu_handler, type, rowid, mainmenu, leftmenu, fk_menu, url, titre, level, langs, perms, target, usertype, position, entity) values ('', 'isModEnabled("stock")', __HANDLER__, 'left', 3104__+MAX_llx_menu__, 'products', '', 3100__+MAX_llx_menu__, '/product/stock/movement_list.php?mainmenu=products', 'Movements', 1, 'stocks', '$user->rights->stock->mouvement->lire', '', 2, 3, __ENTITY__);
diff --git a/htdocs/core/menus/standard/eldy.lib.php b/htdocs/core/menus/standard/eldy.lib.php
index 0349eef17ad..8d108688cf5 100644
--- a/htdocs/core/menus/standard/eldy.lib.php
+++ b/htdocs/core/menus/standard/eldy.lib.php
@@ -2069,7 +2069,7 @@ function get_left_menu_products($mainmenu, &$newmenu, $usemenuhider = 1, $leftme
 	if ($mainmenu == 'products') {
 		// Products
 		if (isModEnabled('product')) {
-			$newmenu->add("/product/index.php?leftmenu=product&amp;type=0", $langs->trans("Products"), 0, $user->hasRight('product', 'read'), '', $mainmenu, 'product', 0, '', '', '', img_picto('', 'product', 'class="paddingright pictofixedwidth"'));
+			$newmenu->add("/product/index.php?leftmenu=product", $langs->trans("Products"), 0, $user->hasRight('product', 'read'), '', $mainmenu, 'product', 0, '', '', '', img_picto('', 'product', 'class="paddingright pictofixedwidth"'));
 			$newmenu->add("/product/card.php?leftmenu=product&amp;action=create&amp;type=0", $langs->trans("NewProduct"), 1, $user->hasRight('product', 'creer'));
 			$newmenu->add("/product/list.php?leftmenu=product&amp;type=0", $langs->trans("List"), 1, $user->hasRight('product', 'read'));
 			if (isModEnabled('stock')) {
@@ -2097,7 +2097,7 @@ function get_left_menu_products($mainmenu, &$newmenu, $usemenuhider = 1, $leftme
 
 		// Services
 		if (isModEnabled('service')) {
-			$newmenu->add("/product/index.php?leftmenu=service&amp;type=1", $langs->trans("Services"), 0, $user->hasRight('service', 'read'), '', $mainmenu, 'service', 0, '', '', '', img_picto('', 'service', 'class="paddingright pictofixedwidth"'));
+			$newmenu->add("/product/index.php?leftmenu=service", $langs->trans("Services"), 0, $user->hasRight('service', 'read'), '', $mainmenu, 'service', 0, '', '', '', img_picto('', 'service', 'class="paddingright pictofixedwidth"'));
 			$newmenu->add("/product/card.php?leftmenu=service&amp;action=create&amp;type=1", $langs->trans("NewService"), 1, $user->hasRight('service', 'creer'));
 			$newmenu->add("/product/list.php?leftmenu=service&amp;type=1", $langs->trans("List"), 1, $user->hasRight('service', 'read'));
 
@@ -2121,7 +2121,7 @@ function get_left_menu_products($mainmenu, &$newmenu, $usemenuhider = 1, $leftme
 		// Warehouse
 		if (isModEnabled('stock')) {
 			$langs->load("stocks");
-			$newmenu->add("/product/stock/index.php?leftmenu=stock", $langs->trans("Warehouses"), 0, $user->hasRight('stock', 'lire'), '', $mainmenu, 'stock', 0, '', '', '', img_picto('', 'stock', 'class="paddingright pictofixedwidth"'));
+			$newmenu->add("/product/index.php?leftmenu=stock", $langs->trans("Warehouses"), 0, $user->hasRight('stock', 'lire'), '', $mainmenu, 'stock', 0, '', '', '', img_picto('', 'stock', 'class="paddingright pictofixedwidth"'));
 			$newmenu->add("/product/stock/card.php?action=create", $langs->trans("MenuNewWarehouse"), 1, $user->hasRight('stock', 'creer'));
 			$newmenu->add("/product/stock/list.php", $langs->trans("List"), 1, $user->hasRight('stock', 'lire'));
 			$newmenu->add("/product/stock/movement_list.php", $langs->trans("Movements"), 1, $user->hasRight('stock', 'mouvement', 'lire'));
diff --git a/htdocs/core/modules/action/doc/pdf_standard_actions.class.php b/htdocs/core/modules/action/doc/pdf_standard_actions.class.php
index 6a4a448a43c..bfd1c0b5bc8 100644
--- a/htdocs/core/modules/action/doc/pdf_standard_actions.class.php
+++ b/htdocs/core/modules/action/doc/pdf_standard_actions.class.php
@@ -2,6 +2,7 @@
 /* Copyright (C) 2004      Rodolphe Quiedeville <rodolphe@quiedeville.org>
  * Copyright (C) 2004-2012 Laurent Destailleur  <eldy@users.sourceforge.net>
  * Copyright (C) 2005-2009 Regis Houssin        <regis.houssin@inodbox.com>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -160,7 +161,7 @@ class pdf_standard_actions
 			global $action;
 			$object = new stdClass();
 
-			$parameters = array('file'=>$file, 'outputlangs'=>$outputlangs);
+			$parameters = array('file' => $file, 'outputlangs' => $outputlangs);
 			$reshook = $hookmanager->executeHooks('beforePDFCreation', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks
 
 			$pdf = pdf_getInstance($this->format);
@@ -204,7 +205,7 @@ class pdf_standard_actions
 				$hookmanager = new HookManager($this->db);
 			}
 			$hookmanager->initHooks(array('pdfgeneration'));
-			$parameters = array('file'=>$file, 'object'=>$object, 'outputlangs'=>$outputlangs);
+			$parameters = array('file' => $file, 'object' => $object, 'outputlangs' => $outputlangs);
 			global $action;
 			$reshook = $hookmanager->executeHooks('afterPDFCreation', $parameters, $this, $action); // Note that $action and $object may have been modified by some hooks
 			if ($reshook < 0) {
@@ -214,7 +215,7 @@ class pdf_standard_actions
 
 			dolChmod($file);
 
-			$this->result = array('fullpath'=>$file);
+			$this->result = array('fullpath' => $file);
 
 			return 1;
 		}
@@ -355,7 +356,7 @@ class pdf_standard_actions
 	 *	@param	TCPDF		$pdf     		Object PDF
 	 *	@param  Translate	$outputlangs	Object lang for output
 	 *	@param	int			$pagenb			Page nb
-	 *  @return	float|int                   Return topshift value
+	 *  @return	float						Return topshift value
 	 */
 	private function _pagehead(&$pdf, $outputlangs, $pagenb)
 	{
diff --git a/htdocs/core/modules/barcode/doc/phpbarcode.modules.php b/htdocs/core/modules/barcode/doc/phpbarcode.modules.php
index 231b55f37b7..05dfc085a1a 100644
--- a/htdocs/core/modules/barcode/doc/phpbarcode.modules.php
+++ b/htdocs/core/modules/barcode/doc/phpbarcode.modules.php
@@ -188,12 +188,21 @@ class modPhpbarcode extends ModeleBarCode
 
 		dol_mkdir($conf->barcode->dir_temp);
 		if (!is_writable($conf->barcode->dir_temp)) {
-			$this->error = $langs->transnoentities("ErrorFailedToWriteInTempDirectory", $conf->barcode->dir_temp);
+			if ($langs instanceof Translate) {
+				$this->error = $langs->transnoentities("ErrorFailedToWriteInTempDirectory", $conf->barcode->dir_temp);
+			} else {
+				$this->error = "ErrorFailedToWriteInTempDirectory ".$conf->barcode->dir_temp;
+			}
 			dol_syslog('Error in write_file: ' . $this->error, LOG_ERR);
 			return -1;
 		}
 
-		$file = $conf->barcode->dir_temp . '/barcode_' . $code . '_' . $encoding . '.png';
+		$newcode = $code;
+		if (!preg_match('/^\w+$/', $code) || dol_strlen($code) > 32) {
+			$newcode = dol_hash($newcode, 'md5');	// No need for security here, we can use md5
+		}
+
+		$file = $conf->barcode->dir_temp . '/barcode_' . $newcode . '_' . $encoding . '.png';
 
 		$filebarcode = $file; // global var to be used in barcode_outimage called by barcode_print in buildBarCode
 
diff --git a/htdocs/core/modules/barcode/doc/tcpdfbarcode.modules.php b/htdocs/core/modules/barcode/doc/tcpdfbarcode.modules.php
index b3d62ca0901..21829deb88f 100644
--- a/htdocs/core/modules/barcode/doc/tcpdfbarcode.modules.php
+++ b/htdocs/core/modules/barcode/doc/tcpdfbarcode.modules.php
@@ -152,16 +152,33 @@ class modTcpdfbarcode extends ModeleBarCode
 	 */
 	public function writeBarCode($code, $encoding, $readable = 'Y', $scale = 1, $nooutputiferror = 0)
 	{
-		global $conf, $langs, $_GET;
+		global $conf, $langs;
+
+		// Force value of temp directory because we may call this even if module barcode is disabled
+		if (empty($conf->barcode)) {
+			$conf->barcode = new stdClass();
+		}
+		if (empty($conf->barcode->dir_temp)) {
+			$conf->barcode->dir_temp = DOL_DATA_ROOT.'/barcode/temp';
+		}
 
 		dol_mkdir($conf->barcode->dir_temp);
 		if (!is_writable($conf->barcode->dir_temp)) {
-			$this->error = $langs->transnoentities("ErrorFailedToWriteInTempDirectory", $conf->barcode->dir_temp);
+			if ($langs instanceof Translate) {
+				$this->error = $langs->transnoentities("ErrorFailedToWriteInTempDirectory", $conf->barcode->dir_temp);
+			} else {
+				$this->error = "ErrorFailedToWriteInTempDirectory ".$conf->barcode->dir_temp;
+			}
 			dol_syslog('Error in write_file: ' . $this->error, LOG_ERR);
 			return -1;
 		}
 
-		$file = $conf->barcode->dir_temp . '/barcode_' . $code . '_' . $encoding . '.png';
+		$newcode = $code;
+		if (!preg_match('/^\w+$/', $code) || dol_strlen($code) > 32) {
+			$newcode = dol_hash($newcode, 'md5');	// No need for security here, we can use md5
+		}
+
+		$file = $conf->barcode->dir_temp . '/barcode_' . $newcode . '_' . $encoding . '.png';
 
 		$tcpdfEncoding = $this->getTcpdfEncodingType($encoding);
 		if (empty($tcpdfEncoding)) {
@@ -188,7 +205,8 @@ class modTcpdfbarcode extends ModeleBarCode
 				$barcodeobj = new TCPDFBarcode($code, $tcpdfEncoding);
 			}
 
-			dol_syslog("writeBarCode::TCPDF.getBarcodePngData");
+			dol_syslog("writeBarCode::TCPDF.getBarcodePngData file=".$file);
+
 			if ($imageData = (string) $barcodeobj->getBarcodePngData($width, $height, $color)) {
 				if (function_exists('imagecreate')) {
 					$imageData = imagecreatefromstring($imageData);
diff --git a/htdocs/core/modules/printing/printipp.modules.php b/htdocs/core/modules/printing/printipp.modules.php
index e83823777da..46806916537 100644
--- a/htdocs/core/modules/printing/printipp.modules.php
+++ b/htdocs/core/modules/printing/printipp.modules.php
@@ -1,6 +1,7 @@
 <?php
 /*
  * Copyright (C) 2014-2021  Frederic France      <frederic.france@netlogic.fr>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -51,7 +52,7 @@ class printing_printipp extends PrintingDriver
 	public $active = 'PRINTING_PRINTIPP';
 
 	/**
-	 * @var array array of setup value
+	 * @var array<int,array<string,int|string>> array of setup values
 	 */
 	public $conf = array();
 
@@ -112,11 +113,11 @@ class printing_printipp extends PrintingDriver
 		$this->port = getDolGlobalString('PRINTIPP_PORT');
 		$this->user = getDolGlobalString('PRINTIPP_USER');
 		$this->password = getDolGlobalString('PRINTIPP_PASSWORD');
-		$this->conf[] = array('varname'=>'PRINTIPP_HOST', 'required'=>1, 'example'=>'localhost', 'type'=>'text');
-		$this->conf[] = array('varname'=>'PRINTIPP_PORT', 'required'=>1, 'example'=>'631', 'type'=>'text');
-		$this->conf[] = array('varname'=>'PRINTIPP_USER', 'required'=>0, 'example'=>'', 'type'=>'text', 'moreattributes'=>'autocomplete="off"');
-		$this->conf[] = array('varname'=>'PRINTIPP_PASSWORD', 'required'=>0, 'example'=>'', 'type'=>'password', 'moreattributes'=>'autocomplete="off"');
-		$this->conf[] = array('enabled'=>1, 'type'=>'submit');
+		$this->conf[] = array('varname' => 'PRINTIPP_HOST', 'required' => 1, 'example' => 'localhost', 'type' => 'text');
+		$this->conf[] = array('varname' => 'PRINTIPP_PORT', 'required' => 1, 'example' => '631', 'type' => 'text');
+		$this->conf[] = array('varname' => 'PRINTIPP_USER', 'required' => 0, 'example' => '', 'type' => 'text', 'moreattributes' => 'autocomplete="off"');
+		$this->conf[] = array('varname' => 'PRINTIPP_PASSWORD', 'required' => 0, 'example' => '', 'type' => 'password', 'moreattributes' => 'autocomplete="off"');
+		$this->conf[] = array('enabled' => 1, 'type' => 'submit');
 	}
 
 	/**
@@ -194,6 +195,8 @@ class printing_printipp extends PrintingDriver
 	 *  Return list of available printers
 	 *
 	 *  @return  int                     0 if OK, >0 if KO
+	 *
+	 *  @phan-suppress PhanTypeExpectedObjectPropAccess
 	 */
 	public function listAvailablePrinters()
 	{
@@ -216,6 +219,7 @@ class printing_printipp extends PrintingDriver
 		$list = $this->getlistAvailablePrinters();
 		foreach ($list as $value) {
 			$printer_det = $this->getPrinterDetail($value);
+			'@phan-var-force stdClass $printer_det';
 			$html .= '<tr class="oddeven">';
 			$html .= '<td>'.$value.'</td>';
 			//$html.= '<td><pre>'.print_r($printer_det,true).'</pre></td>';
@@ -245,7 +249,7 @@ class printing_printipp extends PrintingDriver
 	/**
 	 *  Return list of available printers
 	 *
-	 *  @return array                list of printers
+	 *  @return string[]                List of printers (URIs)
 	 */
 	public function getlistAvailablePrinters()
 	{
@@ -267,7 +271,7 @@ class printing_printipp extends PrintingDriver
 	 *  Get printer detail
 	 *
 	 *  @param  string  $uri    URI
-	 *  @return array           List of attributes
+	 *  @return stdClass        List of attributes
 	 */
 	private function getPrinterDetail($uri)
 	{
diff --git a/htdocs/core/modules/supplier_invoice/doc/pdf_canelle.modules.php b/htdocs/core/modules/supplier_invoice/doc/pdf_canelle.modules.php
index 858aef6b33b..526490336d9 100644
--- a/htdocs/core/modules/supplier_invoice/doc/pdf_canelle.modules.php
+++ b/htdocs/core/modules/supplier_invoice/doc/pdf_canelle.modules.php
@@ -770,7 +770,7 @@ class pdf_canelle extends ModelePDFSuppliersInvoices
 		$depositsamount = $object->getSumDepositsUsed((isModEnabled("multicurrency") && $object->multicurrency_tx != 1) ? 1 : 0);
 		//print "x".$creditnoteamount."-".$depositsamount;exit;
 		$resteapayer = price2num($total_ttc - $deja_regle - $creditnoteamount - $depositsamount, 'MT');
-		if (!empty($object->paye)) {
+		if (!empty($object->paid)) {
 			$resteapayer = 0;
 		}
 
diff --git a/htdocs/core/website.inc.php b/htdocs/core/website.inc.php
index 4708d12e929..34f6d1a0945 100644
--- a/htdocs/core/website.inc.php
+++ b/htdocs/core/website.inc.php
@@ -1,5 +1,5 @@
 <?php
-/* Copyright (C) 2017-2019 Laurent Destailleur  <eldy@users.sourceforge.net>
+/* Copyright (C) 2017-2024 Laurent Destailleur  <eldy@users.sourceforge.net>
  *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -18,8 +18,9 @@
 
 /**
  *	\file			htdocs/core/website.inc.php
- *  \brief			Common file loaded by all website pages (after master.inc.php). It set the new object $weblangs, using parameter 'l'.
- *  				This file is included in top of all container pages and is run only when a web page is called.
+ *  \brief			Common file loaded by all website pages (after master.inc.php). It sets the new object $weblangs.
+ *  				This file is included in top of all container pages (in edit mode, in dolibarr web server mode and in external web server mode).
+ *  				It is run only when a web page is called.
  *  			    The global variable $websitekey must be defined.
  */
 
@@ -70,7 +71,31 @@ if (!is_object($pagelangs)) {
 if (!empty($pageid) && $pageid > 0) {
 	$websitepage->fetch($pageid);
 
-	$weblangs->setDefaultLang(GETPOSTISSET('lang') ? GETPOST('lang', 'aZ09') : (empty($_COOKIE['weblangs-shortcode']) ? 'auto' : preg_replace('/[^a-zA-Z0-9_\-]/', '', $_COOKIE['weblangs-shortcode'])));
+	// Rule to define weblang of visitor:
+	// 1 - Take parameter lang
+	// 2 - Cookie lang of website (set by a possible js lang selector)
+	// 3 - XX/... found in url page
+	// 4 - auto (so web browser lang)
+	$srclang = GETPOSTISSET('lang') ? GETPOST('lang', 'aZ09') : '';
+	if (empty($srclang)) {
+		$srclang = (empty($_COOKIE['weblangs-shortcode']) ? '' : preg_replace('/[^a-zA-Z0-9_\-]/', '', $_COOKIE['weblangs-shortcode']));
+	}
+	if (empty($srclang)) {
+		$reg = array();
+		// With Dolibarr server, url is in parameter pageref
+		if (defined('USEDOLIBARRSERVER') && !empty($_GET['pageref']) && preg_match('/^\/?(\w\w)\//', $_GET['pageref'], $reg) && $reg[1] != 'js') {	// We reuse $_GET['pageref'] because $pageref may have been cleaned already from the language code.
+			$srclang = $reg[1];
+		}
+		// With External server, url is in parameter pageref
+		if (defined('USEEXTERNALSERVER') && !empty($_SERVER['PHP_SELF']) && preg_match('/^\/?(\w\w)\//', $_SERVER['PHP_SELF'], $reg) && $reg[1] != 'js') {
+			$srclang = $reg[1];
+		}
+	}
+	if (empty($srclang)) {
+		$srclang= 'auto';
+	}
+	$weblangs->setDefaultLang($srclang);
+
 	$pagelangs->setDefaultLang($websitepage->lang ? $websitepage->lang : $weblangs->shortlang);
 
 	if (!defined('USEDOLIBARREDITOR') && (in_array($websitepage->type_container, array('menu', 'other')) || empty($websitepage->status) && !defined('USEDOLIBARRSERVER'))) {
diff --git a/htdocs/debugbar/class/TraceableDB.php b/htdocs/debugbar/class/TraceableDB.php
index 013a31b66ac..4ddcf1eb22e 100644
--- a/htdocs/debugbar/class/TraceableDB.php
+++ b/htdocs/debugbar/class/TraceableDB.php
@@ -293,7 +293,7 @@ class TraceableDB extends DoliDB
 	 */
 	public function escapeforlike($stringtoencode)
 	{
-		return str_replace(array('_', '\\', '%'), array('\_', '\\\\', '\%'), (string) $stringtoencode);
+		return $this->db->escapeforlike($stringtoencode);
 	}
 
 	// phpcs:disable PEAR.NamingConventions.ValidFunctionName.ScopeNotCamelCaps
diff --git a/htdocs/don/class/api_donations.class.php b/htdocs/don/class/api_donations.class.php
index 1312e385480..6773efc4c03 100644
--- a/htdocs/don/class/api_donations.class.php
+++ b/htdocs/don/class/api_donations.class.php
@@ -72,7 +72,7 @@ class Donations extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('don', $this->don->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		// Add external contacts ids
@@ -185,11 +185,11 @@ class Donations extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->don->context['caller'] = $request_data['caller'];
+				$this->don->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->don->$field = $value;
+			$this->don->$field = $this->_checkValForAPI($field, $value, $this->don);
 		}
 		/*if (isset($request_data["lines"])) {
 		  $lines = array();
@@ -225,7 +225,7 @@ class Donations extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('donation', $this->don->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		foreach ($request_data as $field => $value) {
 			if ($field == 'id') {
@@ -233,11 +233,11 @@ class Donations extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->don->context['caller'] = $request_data['caller'];
+				$this->don->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->don->$field = $value;
+			$this->don->$field = $this->_checkValForAPI($field, $value, $this->don);
 		}
 
 		if ($this->don->update(DolibarrApiAccess::$user) > 0) {
@@ -265,7 +265,7 @@ class Donations extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('donation', $this->don->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->don->delete(DolibarrApiAccess::$user)) {
@@ -314,7 +314,7 @@ class Donations extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('don', $this->don->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		// @phan-suppress-next-line PhanPluginSuspiciousParamPosition
@@ -331,7 +331,7 @@ class Donations extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('don', $this->don->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->don->fetchObjectLinked();
diff --git a/htdocs/expedition/class/api_shipments.class.php b/htdocs/expedition/class/api_shipments.class.php
index 3f3aa064030..b10346c8047 100644
--- a/htdocs/expedition/class/api_shipments.class.php
+++ b/htdocs/expedition/class/api_shipments.class.php
@@ -74,7 +74,7 @@ class Shipments extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('expedition', $this->shipment->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->shipment->fetchObjectLinked();
@@ -191,11 +191,11 @@ class Shipments extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->shipment->context['caller'] = $request_data['caller'];
+				$this->shipment->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->shipment->$field = $value;
+			$this->shipment->$field = $this->_checkValForAPI($field, $value, $this->shipment);
 		}
 		if (isset($request_data["lines"])) {
 			$lines = array();
@@ -234,7 +234,7 @@ class Shipments extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('expedition',$this->shipment->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$this->shipment->getLinesArray();
 		$result = array();
@@ -268,7 +268,7 @@ class Shipments extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('expedition',$this->shipment->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -336,7 +336,7 @@ class Shipments extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('expedition',$this->shipment->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -403,7 +403,7 @@ class Shipments extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('expedition', $this->shipment->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		// TODO Check the lineid $lineid is a line of object
@@ -440,7 +440,7 @@ class Shipments extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('expedition', $this->shipment->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		foreach ($request_data as $field => $value) {
 			if ($field == 'id') {
@@ -448,11 +448,11 @@ class Shipments extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->shipment->context['caller'] = $request_data['caller'];
+				$this->shipment->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->shipment->$field = $value;
+			$this->shipment->$field = $this->_checkValForAPI($field, $value, $this->shipment);
 		}
 
 		if ($this->shipment->update(DolibarrApiAccess::$user) > 0) {
@@ -480,7 +480,7 @@ class Shipments extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('expedition', $this->shipment->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->shipment->delete(DolibarrApiAccess::$user)) {
@@ -525,7 +525,7 @@ class Shipments extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('expedition', $this->shipment->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->shipment->valid(DolibarrApiAccess::$user, $notrigger);
@@ -648,7 +648,7 @@ class Shipments extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('expedition', $this->shipment->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->shipment->setClosed();
diff --git a/htdocs/expensereport/class/api_expensereports.class.php b/htdocs/expensereport/class/api_expensereports.class.php
index 75b116af9e9..852d8d1e0b9 100644
--- a/htdocs/expensereport/class/api_expensereports.class.php
+++ b/htdocs/expensereport/class/api_expensereports.class.php
@@ -86,7 +86,7 @@ class ExpenseReports extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('expensereport', $this->expensereport->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->expensereport->fetchObjectLinked();
@@ -183,11 +183,11 @@ class ExpenseReports extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->expensereport->context['caller'] = $request_data['caller'];
+				$this->expensereport->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->expensereport->$field = $value;
+			$this->expensereport->$field = $this->_checkValForAPI($field, $value, $this->expensereport);
 		}
 		/*if (isset($request_data["lines"])) {
 		  $lines = array();
@@ -225,7 +225,7 @@ class ExpenseReports extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('expensereport',$this->expensereport->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$this->expensereport->getLinesArray();
 		$result = array();
@@ -259,7 +259,7 @@ class ExpenseReports extends DolibarrApi
 	  }
 
 		  if( ! DolibarrApi::_checkAccessToResource('expensereport',$this->expensereport->id)) {
-			  throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			  throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 	  }
 
 	  $request_data = (object) $request_data;
@@ -327,7 +327,7 @@ class ExpenseReports extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('expensereport',$this->expensereport->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -391,7 +391,7 @@ class ExpenseReports extends DolibarrApi
 	  }
 
 		  if( ! DolibarrApi::_checkAccessToResource('expensereport',$this->expensereport->id)) {
-			  throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			  throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 	  }
 
 	  // TODO Check the lineid $lineid is a line of object
@@ -427,7 +427,7 @@ class ExpenseReports extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('expensereport', $this->expensereport->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		foreach ($request_data as $field => $value) {
 			if ($field == 'id') {
@@ -435,11 +435,11 @@ class ExpenseReports extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->expensereport->context['caller'] = $request_data['caller'];
+				$this->expensereport->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->expensereport->$field = $value;
+			$this->expensereport->$field = $this->_checkValForAPI($field, $value, $this->expensereport);
 		}
 
 		if ($this->expensereport->update(DolibarrApiAccess::$user) > 0) {
@@ -511,7 +511,7 @@ class ExpenseReports extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('expensereport',$this->expensereport->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if( ! $this->expensereport->valid(DolibarrApiAccess::$user, $idwarehouse)) {
diff --git a/htdocs/expensereport/index.php b/htdocs/expensereport/index.php
index d5f37475f66..ab95b3a5e0b 100644
--- a/htdocs/expensereport/index.php
+++ b/htdocs/expensereport/index.php
@@ -66,6 +66,8 @@ if (!$sortfield) {
 }
 $limit = GETPOSTINT('limit') ? GETPOSTINT('limit') : $conf->liste_limit;
 
+$max = getDolGlobalInt('MAIN_SIZE_SHORTLIST_LIMIT');
+
 
 /*
  * View
@@ -190,8 +192,6 @@ print '</div>';
 print '</div><div class="fichetwothirdright">';
 
 
-$max = 10;
-
 $langs->load("boxes");
 
 $sql = "SELECT u.rowid as uid, u.lastname, u.firstname, u.login, u.statut as user_status, u.photo, u.email, u.admin,";
@@ -223,7 +223,11 @@ if ($result) {
 	print '<th class="right">'.$langs->trans("AmountHT").'</th>';
 	print '<th class="right">'.$langs->trans("AmountTTC").'</th>';
 	print '<th class="right">'.$langs->trans("DateModificationShort").'</th>';
-	print '<th>&nbsp;</th>';
+	print '<th>';
+	print '<a href="'.DOL_URL_ROOT.'/expensereport/list.php?sortfield=d.tms&sortorder=DESC">';
+	print img_picto($langs->trans("FullList"), 'expensereport');
+	print '</a>';
+	print '</th>';
 	print '</tr>';
 	if ($num) {
 		$total_ttc = $totalam = $total = 0;
diff --git a/htdocs/fichinter/class/api_interventions.class.php b/htdocs/fichinter/class/api_interventions.class.php
index b8c5b4f187f..3c1dbf01b70 100644
--- a/htdocs/fichinter/class/api_interventions.class.php
+++ b/htdocs/fichinter/class/api_interventions.class.php
@@ -88,7 +88,7 @@ class Interventions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fichinter', $this->fichinter->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->fichinter->fetchObjectLinked();
@@ -198,11 +198,11 @@ class Interventions extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->fichinter->context['caller'] = $request_data['caller'];
+				$this->fichinter->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->fichinter->$field = $value;
+			$this->fichinter->$field = $this->_checkValForAPI($field, $value, $this->fichinter);
 		}
 
 		if ($this->fichinter->create(DolibarrApiAccess::$user) < 0) {
@@ -235,7 +235,7 @@ class Interventions extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('fichinter',$this->fichinter->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$this->fichinter->getLinesArray();
 		$result = array();
@@ -267,11 +267,11 @@ class Interventions extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->fichinter->context['caller'] = $request_data['caller'];
+				$this->fichinter->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->fichinter->$field = $value;
+			$this->fichinter->$field = $this->_checkValForAPI($field, $value, $this->fichinter);
 		}
 
 		if (!$result) {
@@ -279,7 +279,7 @@ class Interventions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fichinter', $this->fichinter->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$updateRes = $this->fichinter->addLine(
@@ -314,7 +314,7 @@ class Interventions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fichinter', $this->fichinter->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->fichinter->delete(DolibarrApiAccess::$user)) {
@@ -355,7 +355,7 @@ class Interventions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fichinter', $this->fichinter->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->fichinter->setValid(DolibarrApiAccess::$user, $notrigger);
@@ -391,7 +391,7 @@ class Interventions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fichinter', $this->fichinter->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->fichinter->setStatut(3);
diff --git a/htdocs/fourn/class/api_supplier_invoices.class.php b/htdocs/fourn/class/api_supplier_invoices.class.php
index 02028392a6f..13626a9e72e 100644
--- a/htdocs/fourn/class/api_supplier_invoices.class.php
+++ b/htdocs/fourn/class/api_supplier_invoices.class.php
@@ -211,7 +211,7 @@ class SupplierInvoices extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->invoice->context['caller'] = $request_data['caller'];
+				$this->invoice->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -258,10 +258,15 @@ class SupplierInvoices extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->invoice->context['caller'] = $request_data['caller'];
+				$this->invoice->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
+				continue;
+			}
+			if ($field == 'array_options' && is_array($value)) {
+				foreach ($value as $index => $val) {
+					$this->invoice->array_options[$index] = $this->_checkValForAPI($field, $val, $this->invoice);
+				}
 				continue;
 			}
-
 			$this->invoice->$field = $this->_checkValForAPI($field, $value, $this->invoice);
 		}
 
diff --git a/htdocs/fourn/class/api_supplier_orders.class.php b/htdocs/fourn/class/api_supplier_orders.class.php
index 156b395c377..21a9b3b77b0 100644
--- a/htdocs/fourn/class/api_supplier_orders.class.php
+++ b/htdocs/fourn/class/api_supplier_orders.class.php
@@ -73,7 +73,7 @@ class SupplierOrders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fournisseur', $this->order->id, 'commande_fournisseur', 'commande')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->order->fetchObjectLinked();
@@ -230,7 +230,7 @@ class SupplierOrders extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->order->context['caller'] = $request_data['caller'];
+				$this->order->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -273,7 +273,7 @@ class SupplierOrders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fournisseur', $this->order->id, 'commande_fournisseur', 'commande')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($request_data as $field => $value) {
@@ -282,7 +282,7 @@ class SupplierOrders extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->order->context['caller'] = $request_data['caller'];
+				$this->order->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -322,7 +322,7 @@ class SupplierOrders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fournisseur', $this->order->id, 'commande_fournisseur', 'commande')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$contacts = array();
 
@@ -365,7 +365,7 @@ class SupplierOrders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fournisseur', $this->order->id, 'commande_fournisseur', 'commande')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->order->add_contact($contactid, $type, $source);
@@ -414,7 +414,7 @@ class SupplierOrders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fournisseur', $this->order->id, 'commande_fournisseur', 'commande')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$contacts = $this->order->liste_contact(-1, $source, 0, $type);
@@ -462,7 +462,7 @@ class SupplierOrders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fournisseur', $this->order->id, 'commande_fournisseur', 'commande')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if ($this->order->delete(DolibarrApiAccess::$user) < 0) {
@@ -507,7 +507,7 @@ class SupplierOrders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fournisseur', $this->order->id, 'commande_fournisseur', 'commande')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->order->valid(DolibarrApiAccess::$user, $idwarehouse, $notrigger);
@@ -555,7 +555,7 @@ class SupplierOrders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fournisseur', $this->order->id, 'commande_fournisseur', 'commande')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->order->approve(DolibarrApiAccess::$user, $idwarehouse, $secondlevel);
@@ -606,7 +606,7 @@ class SupplierOrders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fournisseur', $this->order->id, 'commande_fournisseur', 'commande')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->order->commande(DolibarrApiAccess::$user, $date, $method, $comment);
@@ -669,7 +669,7 @@ class SupplierOrders extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('fournisseur', $this->order->id, 'commande_fournisseur', 'commande')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($lines as $line) {
diff --git a/htdocs/fourn/class/fournisseur.commande.class.php b/htdocs/fourn/class/fournisseur.commande.class.php
index 25ff3185583..d1d6aa84f14 100644
--- a/htdocs/fourn/class/fournisseur.commande.class.php
+++ b/htdocs/fourn/class/fournisseur.commande.class.php
@@ -3411,7 +3411,7 @@ class CommandeFournisseur extends CommonOrder
 
 	/**
 	 * Returns the rights used for this class
-	 * @return stdClass
+	 * @return int
 	 */
 	public function getRights()
 	{
diff --git a/htdocs/fourn/class/fournisseur.facture-rec.class.php b/htdocs/fourn/class/fournisseur.facture-rec.class.php
index cf5f79a3ed7..9c02861a112 100644
--- a/htdocs/fourn/class/fournisseur.facture-rec.class.php
+++ b/htdocs/fourn/class/fournisseur.facture-rec.class.php
@@ -380,7 +380,7 @@ class FactureFournisseurRec extends CommonInvoice
 					$result_insert = $this->addline(
 						$facfourn_src->lines[$i]->fk_product,
 						$facfourn_src->lines[$i]->ref_supplier,
-						$facfourn_src->lines[$i]->label,
+						$facfourn_src->lines[$i]->product_label,
 						$facfourn_src->lines[$i]->desc ? $facfourn_src->lines[$i]->desc : $facfourn_src->lines[$i]->description,
 						$facfourn_src->lines[$i]->pu_ht,
 						$facfourn_src->lines[$i]->pu_ttc,
diff --git a/htdocs/fourn/class/fournisseur.facture.class.php b/htdocs/fourn/class/fournisseur.facture.class.php
index 9fa472cc406..0d1e7f03642 100644
--- a/htdocs/fourn/class/fournisseur.facture.class.php
+++ b/htdocs/fourn/class/fournisseur.facture.class.php
@@ -147,17 +147,18 @@ class FactureFournisseur extends CommonInvoice
 
 	/**
 	 * Set to 1 if the invoice is completely paid, otherwise is 0
-	 * @var int
+	 * @var int<0,1>
 	 * @deprecated Use $paid
 	 */
 	public $paye;
 	/**
 	 * Set to 1 if the invoice is completely paid, otherwise is 0
-	 * @var int
+	 * @var int<0,1>
 	 */
 	public $paid;
 
 	/**
+	 * @var int
 	 * @deprecated	Use $user_creation_id
 	 */
 	public $author;
@@ -195,22 +196,32 @@ class FactureFournisseur extends CommonInvoice
 
 	// Warning: Do not set default value into property definition. it must stay null.
 	// For example to avoid to have substitution done when object is generic and not yet defined.
+	/** @var ?string */
 	public $localtax1;
+	/** @var ?string */
 	public $localtax2;
+	/** @var float|int */
 	public $total_ht;
+	/** @var float|int */
 	public $total_tva;
+	/** @var float|int */
 	public $total_localtax1;
+	/** @var float|int */
 	public $total_localtax2;
+	/** @var float|int */
 	public $total_ttc;
 
 	/**
 	 * @deprecated
 	 * @see $note_private, $note_public
+	 * @var string
 	 */
 	public $note;
-
+	/** @var string */
 	public $note_private;
+	/** @var string */
 	public $note_public;
+	/** @var int */
 	public $propalid;
 
 	/**
@@ -238,6 +249,7 @@ class FactureFournisseur extends CommonInvoice
 
 	/**
 	 * @deprecated
+	 * @var ?Fournisseur
 	 */
 	public $fournisseur;
 
@@ -247,7 +259,9 @@ class FactureFournisseur extends CommonInvoice
 	 */
 	public $fk_facture_source;
 
+	/** @var int */
 	public $fac_rec;
+	/** @var int */
 	public $fk_fac_rec_source;
 
 	public $fields = array(
@@ -419,6 +433,10 @@ class FactureFournisseur extends CommonInvoice
 				$nextdatewhen = dol_time_plus_duree($originaldatewhen, $_facrec->frequency, $_facrec->unit_frequency);
 				$previousdaynextdatewhen = dol_time_plus_duree($nextdatewhen, -1, 'd');
 				$this->socid = $_facrec->socid;
+			} else {
+				$originaldatewhen = 0;
+				$nextdatewhen = 0;
+				$previousdaynextdatewhen = 0;
 			}
 
 			$this->entity = $_facrec->entity; // Invoice created in same entity than template
@@ -476,7 +494,7 @@ class FactureFournisseur extends CommonInvoice
 					$_facrec->date_when = $now;
 				}
 				$next_date = $_facrec->getNextDate(); // Calculate next date
-				$result = $_facrec->setValueFrom('date_last_gen', $now, '', null, 'date', '', $user, '');
+				$result = $_facrec->setValueFrom('date_last_gen', $now, '', 0, 'date', '', $user, '');
 				//$_facrec->setValueFrom('nb_gen_done', $_facrec->nb_gen_done + 1);		// Not required, +1 already included into setNextDate when second param is 1.
 				$result = $_facrec->setNextDate($next_date, 1);
 			}
@@ -494,9 +512,7 @@ class FactureFournisseur extends CommonInvoice
 			if (!empty($newlang)) {
 				$outputlangs = new Translate("", $conf);
 				$outputlangs->setDefaultLang($newlang);
-			}
-
-			// Array of possible substitutions (See also file mailing-send.php that should manage same substitutions)
+			} // Array of possible substitutions (See also file mailing-send.php that should manage same substitutions)
 			$substitutionarray = getCommonSubstitutionArray($outputlangs, 0, null, $this);
 			$substitutionarray['__INVOICE_PREVIOUS_MONTH__'] = dol_print_date(dol_time_plus_duree($this->date, -1, 'm'), '%m');
 			$substitutionarray['__INVOICE_MONTH__'] = dol_print_date($this->date, '%m');
@@ -506,11 +522,10 @@ class FactureFournisseur extends CommonInvoice
 			$substitutionarray['__INVOICE_NEXT_MONTH_TEXT__'] = dol_print_date(dol_time_plus_duree($this->date, 1, 'm'), '%B');
 			$substitutionarray['__INVOICE_PREVIOUS_YEAR__'] = dol_print_date(dol_time_plus_duree($this->date, -1, 'y'), '%Y');
 			$substitutionarray['__INVOICE_YEAR__'] = dol_print_date($this->date, '%Y');
-			$substitutionarray['__INVOICE_NEXT_YEAR__'] = dol_print_date(dol_time_plus_duree($this->date, 1, 'y'), '%Y');
-			// Only for template invoice
-			$substitutionarray['__INVOICE_DATE_NEXT_INVOICE_BEFORE_GEN__'] = dol_print_date($originaldatewhen, 'dayhour');
-			$substitutionarray['__INVOICE_DATE_NEXT_INVOICE_AFTER_GEN__'] = dol_print_date($nextdatewhen, 'dayhour');
-			$substitutionarray['__INVOICE_PREVIOUS_DATE_NEXT_INVOICE_AFTER_GEN__'] = dol_print_date($previousdaynextdatewhen, 'dayhour');
+			$substitutionarray['__INVOICE_NEXT_YEAR__'] = dol_print_date(dol_time_plus_duree($this->date, 1, 'y'), '%Y'); // Only for template invoice
+			$substitutionarray['__INVOICE_DATE_NEXT_INVOICE_BEFORE_GEN__'] = $originaldatewhen ? dol_print_date($originaldatewhen, 'dayhour') : '';
+			$substitutionarray['__INVOICE_DATE_NEXT_INVOICE_AFTER_GEN__'] = $nextdatewhen ? dol_print_date($nextdatewhen, 'dayhour') : '';
+			$substitutionarray['__INVOICE_PREVIOUS_DATE_NEXT_INVOICE_AFTER_GEN__'] = $previousdaynextdatewhen ? dol_print_date($previousdaynextdatewhen, 'dayhour') : '';
 			$substitutionarray['__INVOICE_COUNTER_CURRENT__'] = $_facrec->nb_gen_done;
 			$substitutionarray['__INVOICE_COUNTER_MAX__'] = $_facrec->nb_gen_max;
 
@@ -680,7 +695,7 @@ class FactureFournisseur extends CommonInvoice
 						$this->updateline(
 							$idligne,
 							$line->desc ? $line->desc : $line->description,
-							$line->pu_ht,
+							$line->subprice,
 							$line->tva_tx,
 							$line->localtax1_tx,
 							$line->localtax2_tx,
@@ -709,7 +724,7 @@ class FactureFournisseur extends CommonInvoice
 			/*
 			 * Insert lines of template invoices
 			 */
-			if (! $error && $this->fac_rec > 0) {
+			if (! $error && $this->fac_rec > 0 && $_facrec instanceof FactureFournisseurRec) {
 				foreach ($_facrec->lines as $i => $val) {
 					if ($_facrec->lines[$i]->fk_product) {
 						$prod = new Product($this->db);
@@ -1156,8 +1171,12 @@ class FactureFournisseur extends CommonInvoice
 		if (isset($this->label)) {
 			$this->label = trim($this->label);
 		}
-		if (isset($this->paye)) {
-			$this->paye = (int) $this->paye;
+		if (isset($this->paid)) {
+			$this->paid = (int) (bool) $this->paye;
+			$this->paye = $this->paid;
+		} elseif (isset($this->paye)) {
+			$this->paid = (int) (bool) $this->paye;
+			$this->paye = $this->paid;
 		}
 		if (isset($this->close_code)) {
 			$this->close_code = trim($this->close_code);
@@ -1182,14 +1201,15 @@ class FactureFournisseur extends CommonInvoice
 		if (isset($this->total_ttc)) {
 			$this->total_ttc = (float) $this->total_ttc;
 		}
-		if (isset($this->statut)) {
-			$this->statut = (int) $this->statut;
-		}
 		if (isset($this->status)) {
 			$this->status = (int) $this->status;
+			$this->statut = $this->status;
+		} elseif (isset($this->statut)) {
+			$this->status = (int) $this->statut;
+			$this->statut = $this->status;
 		}
-		if (isset($this->author)) {
-			$this->author = trim($this->author);
+		if (isset($this->author)) {  // TODO: user_creation_id?
+			$this->author = trim((string) $this->author);
 		}
 		if (isset($this->fk_user_valid)) {
 			$this->fk_user_valid = trim($this->fk_user_valid);
@@ -1208,7 +1228,8 @@ class FactureFournisseur extends CommonInvoice
 			$this->cond_reglement_id = (int) $this->cond_reglement_id;
 		}
 		if (isset($this->note_private)) {
-			$this->note = trim($this->note_private);
+			$this->note_private = trim($this->note_private);
+			$this->note = $this->note_private;
 		}
 		if (isset($this->note_public)) {
 			$this->note_public = trim($this->note_public);
@@ -1239,7 +1260,7 @@ class FactureFournisseur extends CommonInvoice
 			$sql .= " tms=".(dol_strlen($this->tms) != 0 ? "'".$this->db->idate($this->tms)."'" : 'null').",";
 		}
 		$sql .= " libelle=".(isset($this->label) ? "'".$this->db->escape($this->label)."'" : "null").",";
-		$sql .= " paye=".(isset($this->paye) ? ((int) $this->paye) : "0").",";
+		$sql .= " paye=".(isset($this->paid) ? ((int) $this->paid) : "0").",";
 		$sql .= " close_code=".(isset($this->close_code) ? "'".$this->db->escape($this->close_code)."'" : "null").",";
 		$sql .= " close_note=".(isset($this->close_note) ? "'".$this->db->escape($this->close_note)."'" : "null").",";
 		$sql .= " localtax1=".(isset($this->localtax1) ? ((float) $this->localtax1) : "null").",";
@@ -1449,7 +1470,7 @@ class FactureFournisseur extends CommonInvoice
 			$this->fetch_lines();
 			$list_rowid_det = array();
 			foreach ($this->lines as $key => $invoiceline) {
-				$list_rowid_det[] = $invoiceline->rowid;
+				$list_rowid_det[] = $invoiceline->id;
 			}
 
 			// Consumned discounts are freed
@@ -1567,13 +1588,13 @@ class FactureFournisseur extends CommonInvoice
 	 *	@param  User	$user       Object user
 	 *	@param  string	$close_code	Code indicates whether the class has paid in full while payment is incomplete. Not implemented yet.
 	 *	@param  string	$close_note	Comment informs if the class has been paid while payment is incomplete. Not implemented yet.
-	 *	@return int         		Return integer <0 si ko, >0 si ok
+	 *	@return int<-1,1>     		Return integer <0 si ko, >0 si ok
 	 */
 	public function setPaid($user, $close_code = '', $close_note = '')
 	{
 		$error = 0;
 
-		if ($this->paye != 1) {
+		if ($this->paid != 1) {
 			$this->db->begin();
 
 			$now = dol_now();
@@ -1766,7 +1787,7 @@ class FactureFournisseur extends CommonInvoice
 		$this->fetch_lines();
 
 		// Check parameters
-		if ($this->statut > self::STATUS_DRAFT) {	// This is to avoid to validate twice (avoid errors on logs and stock management)
+		if ($this->status > self::STATUS_DRAFT) {	// This is to avoid to validate twice (avoid errors on logs and stock management)
 			dol_syslog(get_class($this)."::validate no draft status", LOG_WARNING);
 			return 0;
 		}
@@ -1939,6 +1960,7 @@ class FactureFournisseur extends CommonInvoice
 			if (!$error) {
 				$this->ref = $this->newref;
 				$this->statut = self::STATUS_VALIDATED;
+				$this->status = self::STATUS_VALIDATED;
 				//$this->date_validation=$now; this is stored into log table
 			}
 
@@ -1971,7 +1993,7 @@ class FactureFournisseur extends CommonInvoice
 
 		$error = 0;
 
-		if ($this->statut == self::STATUS_DRAFT) {
+		if ($this->status == self::STATUS_DRAFT) {
 			dol_syslog(__METHOD__." already draft status", LOG_WARNING);
 			return 0;
 		}
@@ -2327,8 +2349,8 @@ class FactureFournisseur extends CommonInvoice
 	 * @param 		int|null	$fk_unit 			Code of the unit to use. Null to use the default one
 	 * @param		double		$pu_devise			Amount in currency
 	 * @param		string		$ref_supplier		Supplier ref
-	 * @param	integer	$rang	line rank
-	 * @return    	int           					Return integer <0 if KO, >0 if OK
+	 * @param		int			$rang				Line rank
+	 * @return    	int<-1,1>      					Return integer <0 if KO, >0 if OK
 	 */
 	public function updateline($id, $desc, $pu, $vatrate, $txlocaltax1 = 0, $txlocaltax2 = 0, $qty = 1, $idproduct = 0, $price_base_type = 'HT', $info_bits = 0, $type = 0, $remise_percent = 0, $notrigger = 0, $date_start = '', $date_end = '', $array_options = [], $fk_unit = null, $pu_devise = 0, $ref_supplier = '', $rang = 0)
 	{
@@ -2428,7 +2450,7 @@ class FactureFournisseur extends CommonInvoice
 
 		$line->qty = ($this->type == self::TYPE_CREDIT_NOTE ? abs((float) $qty) : $qty); // For credit note, quantity is always positive and unit price negative
 		$line->subprice = ($this->type == self::TYPE_CREDIT_NOTE ? -abs($pu_ht) : $pu_ht); // For credit note, unit price always negative, always positive otherwise
-		$line->pu_ht = ($this->type == self::TYPE_CREDIT_NOTE ? -abs($pu_ht) : $pu_ht); // For credit note, unit price always negative, always positive otherwise
+		$line->pu_ht = $line->subprice;  // deprecated
 		$line->pu_ttc = ($this->type == self::TYPE_CREDIT_NOTE ? -abs($pu_ttc) : $pu_ttc); // For credit note, unit price always negative, always positive otherwise
 
 		$line->remise_percent = $remise_percent;
@@ -2737,9 +2759,9 @@ class FactureFournisseur extends CommonInvoice
 	/**
 	 * getTooltipContentArray
 	 *
-	 * @param array $params ex option, infologin
+	 * @param array{moretitle?:string} $params ex option, infologin
 	 * @since v18
-	 * @return array
+	 * @return array{picto:string,ref?:string,refsupplier?:string,label?:string,date?:string,date_echeance?:string,amountht?:string,total_ht?:string,totaltva?:string,amountlt1?:string,amountlt2?:string,amountrevenustamp?:string,totalttc?:string}
 	 */
 	public function getTooltipContentArray($params)
 	{
@@ -2968,12 +2990,13 @@ class FactureFournisseur extends CommonInvoice
 			$mybool = ((bool) @include_once $dir.$file) || $mybool;
 		}
 
-		if ($mybool === false) {
+		if (!$mybool) {
 			dol_print_error(null, "Failed to include file ".$file);
 			return '';
 		}
 
 		$obj = new $classname();
+		'@phan-var-force ModeleNumRefSuppliersInvoices $obj';
 		$numref = "";
 		$numref = $obj->getNextValue($soc, $this, $mode);
 
@@ -3047,7 +3070,7 @@ class FactureFournisseur extends CommonInvoice
 				$line->desc = $langs->trans("Description")." ".$xnbp;
 				$line->qty = 1;
 				$line->subprice = 100;
-				$line->pu_ht = 100; // the canelle template use pu_ht and not subprice
+				$line->pu_ht = $line->subprice; // the canelle template use pu_ht and not subprice
 				$line->price = 100;
 				$line->tva_tx = 19.6;
 				$line->localtax1_tx = 0;
@@ -3152,8 +3175,8 @@ class FactureFournisseur extends CommonInvoice
 
 		// Clear fields
 		$object->ref_supplier       = (empty($this->ref_supplier) ? $langs->trans("CopyOf").' '.$object->ref_supplier : $this->ref_supplier);
-		$object->author             = $user->id;
-		$object->user_validation_id = 0;
+		$object->author             = $user->id;  // FIXME? user_validation_id is replacement for author
+		$object->user_validation_id = 0;  // FIXME?  user_validation_id is replacement for author
 		$object->fk_facture_source  = 0;
 		$object->date_creation      = '';
 		$object->date_validation    = '';
@@ -3209,8 +3232,8 @@ class FactureFournisseur extends CommonInvoice
 	 *  @param      int			$hidedetails    Hide details of lines
 	 *  @param      int			$hidedesc       Hide description
 	 *  @param      int			$hideref        Hide ref
-	 *  @param   null|array  $moreparams     Array to provide more information
-	 *  @return     int         				Return integer <0 if KO, 0 if nothing done, >0 if OK
+	 *  @param   	?array<string,mixed>	$moreparams     Array to provide more information
+	 *  @return     int<-1,1>					Return integer <0 if KO, 0 if nothing done, >0 if OK
 	 */
 	public function generateDocument($modele, $outputlangs, $hidedetails = 0, $hidedesc = 0, $hideref = 0, $moreparams = null)
 	{
@@ -3239,7 +3262,7 @@ class FactureFournisseur extends CommonInvoice
 
 	/**
 	 * Returns the rights used for this class
-	 * @return stdClass
+	 * @return int
 	 */
 	public function getRights()
 	{
@@ -3326,7 +3349,7 @@ class FactureFournisseur extends CommonInvoice
 	 *	Return clicable link of object (with eventually picto)
 	 *
 	 *	@param      string	    $option                 Where point the link (0=> main card, 1,2 => shipment, 'nolink'=>No link)
-	 *  @param		array		$arraydata				Array of data
+	 *  @param		?array{selected?:int<0,1>}	$arraydata	Array of data
 	 *  @return		string								HTML Code for Kanban thumb.
 	 */
 	public function getKanbanView($option = '', $arraydata = null)
@@ -3721,6 +3744,9 @@ class SupplierInvoiceLine extends CommonObjectLine
 	 */
 	public $table_element = 'facture_fourn_det';
 
+	/**
+	 * @var static
+	 */
 	public $oldline;
 
 	/**
@@ -3778,7 +3804,7 @@ class SupplierInvoiceLine extends CommonObjectLine
 	/**
 	 * This field may contains label of line (when invoice create from order)
 	 * @var string
-	 * @deprecated
+	 * @deprecated  Use $product_label
 	 */
 	public $label;
 
@@ -3797,6 +3823,9 @@ class SupplierInvoiceLine extends CommonObjectLine
 	 */
 	public $fk_code_ventilation;
 
+	/**
+	 * @var int<0,1>
+	 */
 	public $skip_update_total; // Skip update price total for special lines
 
 	/**
@@ -3993,7 +4022,7 @@ class SupplierInvoiceLine extends CommonObjectLine
 		$this->product_desc		= $obj->product_desc;
 
 		$this->subprice = $obj->pu_ht;
-		$this->pu_ht = $obj->pu_ht;
+		$this->pu_ht = $this->subprice;
 		$this->pu_ttc			= $obj->pu_ttc;
 		$this->tva_tx			= $obj->tva_tx;
 		$this->localtax1_tx		= $obj->localtax1_tx;
@@ -4013,6 +4042,7 @@ class SupplierInvoiceLine extends CommonObjectLine
 		$this->fk_product		= $obj->fk_product;
 		$this->product_type = $obj->product_type;
 		$this->product_label		= $obj->product_label;
+		$this->label		= $obj->product_label;
 		$this->info_bits		    = $obj->info_bits;
 		$this->fk_parent_line    = $obj->fk_parent_line;
 		$this->special_code = $obj->special_code;
@@ -4093,7 +4123,7 @@ class SupplierInvoiceLine extends CommonObjectLine
 	{
 		global $conf;
 
-		$pu = price2num($this->pu_ht);
+		$pu = price2num($this->subprice);
 		$qty = price2num($this->qty);
 
 		// Check parameters
@@ -4145,7 +4175,7 @@ class SupplierInvoiceLine extends CommonObjectLine
 		$sql .= ", ref = '".$this->db->escape($this->ref_supplier ? $this->ref_supplier : $this->ref)."'";
 		$sql .= ", date_start = ".($this->date_start != '' ? "'".$this->db->idate($this->date_start)."'" : "null");
 		$sql .= ", date_end = ".($this->date_end != '' ? "'".$this->db->idate($this->date_end)."'" : "null");
-		$sql .= ", pu_ht = ".price2num($this->pu_ht);
+		$sql .= ", pu_ht = ".price2num($this->subprice);
 		$sql .= ", pu_ttc = ".price2num($this->pu_ttc);
 		$sql .= ", qty = ".price2num($this->qty);
 		$sql .= ", remise_percent = ".price2num($this->remise_percent);
@@ -4328,7 +4358,11 @@ class SupplierInvoiceLine extends CommonObjectLine
 		$sql .= ')';
 		$sql .= " VALUES (".$this->fk_facture_fourn.",";
 		$sql .= " ".($this->fk_parent_line > 0 ? "'".$this->db->escape($this->fk_parent_line)."'" : "null").",";
-		$sql .= " ".(!empty($this->label) ? "'".$this->db->escape($this->label)."'" : "null").",";
+		$product_label
+			= !empty($this->product_label)
+			  ? $this->product_label :
+				(!empty($this->label) ? $this->label : null);
+		$sql .= " ".(!empty($product_label) ? "'".$this->db->escape($product_label)."'" : "null").",";
 		$sql .= " '".$this->db->escape($this->desc ? $this->desc : $this->description)."',";
 		$sql .= " '".$this->db->escape($this->ref_supplier)."',";
 		$sql .= " ".price2num($this->qty).",";
@@ -4394,7 +4428,7 @@ class SupplierInvoiceLine extends CommonObjectLine
 								return -3;
 							}
 						} else {
-							$result = $discount->link_to_invoice($this->rowid, 0);
+							$result = $discount->link_to_invoice($this->id, 0);
 							if ($result < 0) {
 								$this->error = $discount->error;
 								dol_syslog(get_class($this)."::insert Error ".$this->error, LOG_ERR);
@@ -4453,7 +4487,7 @@ class SupplierInvoiceLine extends CommonObjectLine
 		$sql .= ", total_localtax1 = ".price2num($this->total_localtax1);
 		$sql .= ", total_localtax2 = ".price2num($this->total_localtax2);
 		$sql .= ", total_ttc = ".price2num($this->total_ttc);
-		$sql .= " WHERE rowid = ".((int) $this->rowid);
+		$sql .= " WHERE rowid = ".((int) $this->id);
 
 		dol_syslog("FactureFournisseurLigne.class.php::update_total", LOG_DEBUG);
 
diff --git a/htdocs/fourn/facture/card.php b/htdocs/fourn/facture/card.php
index e5e347d37c4..770bdedfe77 100644
--- a/htdocs/fourn/facture/card.php
+++ b/htdocs/fourn/facture/card.php
@@ -1764,7 +1764,7 @@ if (empty($reshook)) {
 					0,
 					$pu_devise,
 					GETPOST('fourn_ref', 'alpha'),
-					''
+					0
 				);
 			}
 			if ($idprod == -99 || $idprod == 0) {
@@ -2121,6 +2121,7 @@ if ($action == 'create') {
 			$classname = 'CommandeFournisseur';
 		}
 		$objectsrc = new $classname($db);
+		'@phan-var-force Project|Commande|Propal|Contrat|CommandeFournisseur|CommonObject $objectsrc';
 		$objectsrc->fetch($originid);
 		$objectsrc->fetch_thirdparty();
 
@@ -2222,8 +2223,8 @@ if ($action == 'create') {
 		$datetmp = dol_mktime(12, 0, 0, GETPOSTINT('echmonth'), GETPOSTINT('echday'), GETPOSTINT('echyear'));
 		$datedue = ($datetmp == '' ? -1 : $datetmp);
 
-		if (isModEnabled("multicurrency") && !empty($soc->multicurrency_code)) {
-			$currency_code = $soc->multicurrency_code;
+		if (isModEnabled("multicurrency") && !empty($societe->multicurrency_code)) {
+			$currency_code = $societe->multicurrency_code;
 		}
 	}
 
diff --git a/htdocs/fourn/facture/list.php b/htdocs/fourn/facture/list.php
index f40fab2257f..6ccb99e4c6e 100644
--- a/htdocs/fourn/facture/list.php
+++ b/htdocs/fourn/facture/list.php
@@ -345,10 +345,10 @@ if (empty($reshook)) {
 						setEventMessages($objecttmp->ref.' '.$langs->trans("ProcessingError"), $hookmanager->errors, 'errors');
 					}
 
-					if ($objecttmp->statut == FactureFournisseur::STATUS_DRAFT) {
+					if ($objecttmp->status == FactureFournisseur::STATUS_DRAFT) {
 						$error++;
 						setEventMessages($objecttmp->ref.' '.$langs->trans("Draft"), $objecttmp->errors, 'errors');
-					} elseif ($objecttmp->paye || $objecttmp->resteapayer == 0) {
+					} elseif ($objecttmp->paid || $objecttmp->resteapayer == 0) {
 						$error++;
 						setEventMessages($objecttmp->ref.' '.$langs->trans("AlreadyPaid"), $objecttmp->errors, 'errors');
 					} elseif ($objecttmp->resteapayer < 0) {
@@ -1589,6 +1589,7 @@ while ($i < $imaxinloop) {
 	$facturestatic->alreadypaid = ($paiement ? $paiement : 0);
 
 	$facturestatic->paye = $obj->paye;
+	$facturestatic->paid = $obj->paye;
 
 	$facturestatic->date = $db->jdate($obj->datef);
 
diff --git a/htdocs/fourn/paiement/card.php b/htdocs/fourn/paiement/card.php
index 966cde2511b..0616033cd9f 100644
--- a/htdocs/fourn/paiement/card.php
+++ b/htdocs/fourn/paiement/card.php
@@ -3,6 +3,7 @@
  * Copyright (C) 2005      Marc Barilley / Ocebo <marc@ocebo.com>
  * Copyright (C) 2006-2010 Laurent Destailleur   <eldy@users.sourceforge.net>
  * Copyright (C) 2014      Marcos García         <marcosgdf@gmail.com>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -309,6 +310,7 @@ if ($result > 0) {
 				$facturestatic->total_tva = $objp->total_tva;
 				$facturestatic->total_ttc = $objp->total_ttc;
 				$facturestatic->statut = $objp->status;
+				$facturestatic->status = $objp->status;
 				$facturestatic->alreadypaid = -1; // unknown
 
 				print '<tr class="oddeven">';
diff --git a/htdocs/holiday/list.php b/htdocs/holiday/list.php
index a4eaae03a85..c567bad831d 100644
--- a/htdocs/holiday/list.php
+++ b/htdocs/holiday/list.php
@@ -53,7 +53,6 @@ $cancel     = GETPOST('cancel', 'alpha'); // We click on a Cancel button
 $toselect   = GETPOST('toselect', 'array'); // Array of ids of elements selected into a list
 $contextpage = GETPOST('contextpage', 'aZ') ? GETPOST('contextpage', 'aZ') : 'holidaylist'; // To manage different context of search
 $mode        = GETPOST('mode', 'alpha'); // for switch mode view result
-
 $backtopage = GETPOST('backtopage', 'alpha'); // Go back to a dedicated page
 $optioncss = GETPOST('optioncss', 'aZ'); // Option for the css output (always '' except when 'print')
 
@@ -83,7 +82,7 @@ if (!$sortfield) {
 	$sortfield = "cp.ref";
 }
 
-$sall                = trim((GETPOST('search_all', 'alphanohtml') != '') ? GETPOST('search_all', 'alphanohtml') : GETPOST('sall', 'alphanohtml'));
+$search_all          = trim((GETPOST('search_all', 'alphanohtml') != '') ? GETPOST('search_all', 'alphanohtml') : GETPOST('sall', 'alphanohtml'));
 $search_ref          = GETPOST('search_ref', 'alphanohtml');
 $search_day_create   = GETPOST('search_day_create', 'int');
 $search_month_create = GETPOST('search_month_create', 'int');
@@ -94,10 +93,10 @@ $search_year_start   = GETPOST('search_year_start', 'int');
 $search_day_end      = GETPOST('search_day_end', 'int');
 $search_month_end    = GETPOST('search_month_end', 'int');
 $search_year_end     = GETPOST('search_year_end', 'int');
-$search_employee     = GETPOSTINT('search_employee');
-$search_valideur     = GETPOSTINT('search_valideur');
+$search_employee     = GETPOST('search_employee', 'intcomma');
+$search_valideur     = GETPOST('search_valideur', 'intcomma');
 $search_status       = GETPOST('search_status', 'intcomma');
-$search_type         = GETPOSTINT('search_type');
+$search_type         = GETPOST('search_type', 'intcomma');
 
 // Initialize technical objects
 $object = new Holiday($db);
@@ -322,8 +321,8 @@ $sql .= ", ".MAIN_DB_PREFIX."user as uu, ".MAIN_DB_PREFIX."user as ua";
 $sql .= " WHERE cp.entity IN (".getEntity('holiday').")";
 $sql .= " AND cp.fk_user = uu.rowid AND cp.fk_validator = ua.rowid "; // Hack pour la recherche sur le tableau
 // Search all
-if (!empty($sall)) {
-	$sql .= natural_search(array_keys($fieldstosearchall), $sall);
+if (!empty($search_all)) {
+	$sql .= natural_search(array_keys($fieldstosearchall), $search_all);
 }
 // Ref
 if (!empty($search_ref)) {
@@ -552,14 +551,14 @@ $objecttmp = new Holiday($db);
 $trackid = 'leav'.$object->id;
 include DOL_DOCUMENT_ROOT.'/core/tpl/massactions_pre.tpl.php';
 
-if ($sall) {
+if ($search_all) {
 	$setupstring = '';
 	foreach ($fieldstosearchall as $key => $val) {
 		$fieldstosearchall[$key] = $langs->trans($val);
 		$setupstring .= $key."=".$val.";";
 	}
 	print '<!-- Search done like if HOLIDAY_QUICKSEARCH_ON_FIELDS = '.$setupstring.' -->'."\n";
-	print '<div class="divsearchfieldfilter">'.$langs->trans("FilterOnInto", $sall).implode(', ', $fieldstosearchall).'</div>';
+	print '<div class="divsearchfieldfilter">'.$langs->trans("FilterOnInto", $search_all).implode(', ', $fieldstosearchall).'</div>';
 }
 
 $moreforfilter = '';
diff --git a/htdocs/hrm/compare.php b/htdocs/hrm/compare.php
index 8286c7f0cf4..7e0aab08e4e 100644
--- a/htdocs/hrm/compare.php
+++ b/htdocs/hrm/compare.php
@@ -5,6 +5,7 @@
  * Copyright (C) 2021  Jean-Pascal BOUDET <jean-pascal.boudet@atm-consulting.fr>
  * Copyright (C) 2021  Grégory BLEMAND <gregory.blemand@atm-consulting.fr>
  * Copyright (C) 2024       Frédéric France             <frederic.france@free.fr>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -153,16 +154,16 @@ $fk_usergroup1 = GETPOST('fk_usergroup1');
 						</tr>
 						<tr>
 							<td><?php
-									echo $langs->trans('OrJobToCompare') . '</td><td>';
-									$j = new Job($db);
-									$jobs = $j->fetchAll();
-									$TJobs = array();
+							echo $langs->trans('OrJobToCompare') . '</td><td>';
+							$j = new Job($db);
+							$jobs = $j->fetchAll();
+							$TJobs = array();
 
 							foreach ($jobs as &$j) {
 								$TJobs[$j->id] = $j->label;
 							}
 
-									print img_picto('', 'jobprofile', 'class="pictofixedwidth"').$form->selectarray('fk_job', $TJobs, $fk_job, 1);
+							print img_picto('', 'jobprofile', 'class="pictofixedwidth"').$form->selectarray('fk_job', $TJobs, $fk_job, 1);
 							?></td>
 						</tr>
 					</table>
@@ -502,8 +503,8 @@ function displayUsersListWithPicto(&$TUser, $fk_usergroup = 0, $namelist = 'list
  *
  * 		Allow to get skill(s) of a user
  *
- * 		@param array $TUser array of employees we need to get skills
- * 		@return array|int
+ * 		@param int[] $TUser array of employees we need to get skills
+ * 		@return array<int,stdClass>
  */
 function getSkillForUsers($TUser)
 {
@@ -515,12 +516,12 @@ function getSkillForUsers($TUser)
 	}
 
 	$sql = 'SELECT sk.rowid, sk.label, sk.description, sk.skill_type, sr.fk_object, sr.objecttype, sr.fk_skill, ';
-	$sql.= ' MAX(sr.rankorder) as rankorder';
-	$sql.= ' FROM '.MAIN_DB_PREFIX.'hrm_skill sk';
-	$sql.= ' LEFT JOIN '.MAIN_DB_PREFIX.'hrm_skillrank sr ON (sk.rowid = sr.fk_skill)';
-	$sql.= " WHERE sr.objecttype = '".$db->escape(SkillRank::SKILLRANK_TYPE_USER)."'";
-	$sql.= ' AND sr.fk_object IN ('.$db->sanitize(implode(',', $TUser)).')';
-	$sql.= " GROUP BY sk.rowid, sk.label, sk.description, sk.skill_type, sr.fk_object, sr.objecttype, sr.fk_skill "; // group par competence
+	$sql .= ' MAX(sr.rankorder) as rankorder';
+	$sql .= ' FROM '.MAIN_DB_PREFIX.'hrm_skill sk';
+	$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'hrm_skillrank sr ON (sk.rowid = sr.fk_skill)';
+	$sql .= " WHERE sr.objecttype = '".$db->escape(SkillRank::SKILLRANK_TYPE_USER)."'";
+	$sql .= ' AND sr.fk_object IN ('.$db->sanitize(implode(',', $TUser)).')';
+	$sql .= " GROUP BY sk.rowid, sk.label, sk.description, sk.skill_type, sr.fk_object, sr.objecttype, sr.fk_skill "; // group par competence
 
 	$resql = $db->query($sql);
 	$Tab = array();
@@ -530,10 +531,10 @@ function getSkillForUsers($TUser)
 		$num = 0;
 		while ($obj = $db->fetch_object($resql)) {
 			$sql1 = "SELECT COUNT(rowid) as how_many_max FROM ".MAIN_DB_PREFIX."hrm_skillrank as sr";
-			$sql1.=" WHERE sr.rankorder = ".((int) $obj->rankorder);
-			$sql1.=" AND sr.objecttype = '".$db->escape(SkillRank::SKILLRANK_TYPE_USER)."'";
-			$sql1.=" AND sr.fk_skill = ".((int) $obj->fk_skill);
-			$sql1.=" AND sr.fk_object IN (".$db->sanitize(implode(',', $TUser)).")";
+			$sql1 .= " WHERE sr.rankorder = ".((int) $obj->rankorder);
+			$sql1 .= " AND sr.objecttype = '".$db->escape(SkillRank::SKILLRANK_TYPE_USER)."'";
+			$sql1 .= " AND sr.fk_skill = ".((int) $obj->fk_skill);
+			$sql1 .= " AND sr.fk_object IN (".$db->sanitize(implode(',', $TUser)).")";
 			$resql1 = $db->query($sql1);
 
 			$objMax = $db->fetch_object($resql1);
@@ -561,7 +562,7 @@ function getSkillForUsers($TUser)
  * 		Allow to get skill(s) of a job
  *
  * 		@param int $fk_job job we need to get required skills
- * 		@return array|int
+ * 		@return stdClass[]
  */
 function getSkillForJob($fk_job)
 {
@@ -572,12 +573,12 @@ function getSkillForJob($fk_job)
 	}
 
 	$sql = 'SELECT sk.rowid, sk.label, sk.description, sk.skill_type, sr.fk_object, sr.objecttype, sr.fk_skill,';
-	$sql.= " MAX(sr.rankorder) as rankorder";
-	$sql.=' FROM '.MAIN_DB_PREFIX.'hrm_skill as sk';
-	$sql.='	LEFT JOIN '.MAIN_DB_PREFIX.'hrm_skillrank as sr ON (sk.rowid = sr.fk_skill)';
-	$sql.="	WHERE sr.objecttype = '".SkillRank::SKILLRANK_TYPE_JOB."'";
-	$sql.=' AND sr.fk_object = '.((int) $fk_job);
-	$sql.=' GROUP BY sk.rowid, sk.label, sk.description, sk.skill_type, sr.fk_object, sr.objecttype, sr.fk_skill'; // group par competence*/
+	$sql .= " MAX(sr.rankorder) as rankorder";
+	$sql .= ' FROM '.MAIN_DB_PREFIX.'hrm_skill as sk';
+	$sql .= '	LEFT JOIN '.MAIN_DB_PREFIX.'hrm_skillrank as sr ON (sk.rowid = sr.fk_skill)';
+	$sql .= "	WHERE sr.objecttype = '".SkillRank::SKILLRANK_TYPE_JOB."'";
+	$sql .= ' AND sr.fk_object = '.((int) $fk_job);
+	$sql .= ' GROUP BY sk.rowid, sk.label, sk.description, sk.skill_type, sr.fk_object, sr.objecttype, sr.fk_skill'; // group par competence*/
 
 	$resql = $db->query($sql);
 	$Tab = array();
diff --git a/htdocs/hrm/index.php b/htdocs/hrm/index.php
index 37ca42598d7..6790b12942c 100644
--- a/htdocs/hrm/index.php
+++ b/htdocs/hrm/index.php
@@ -223,8 +223,13 @@ if (isModEnabled('holiday') && $user->hasRight('holiday', 'read')) {
 		print '<th colspan="3">'.$langs->trans("BoxTitleLastLeaveRequests", min($max, $num)).'</th>';
 		print '<th>'.$langs->trans("from").'</th>';
 		print '<th>'.$langs->trans("to").'</th>';
-		print '<th class="right" colspan="2"><a href="'.DOL_URL_ROOT.'/holiday/list.php?sortfield=cp.tms&sortorder=DESC">'.$langs->trans("FullList").'</th>';
+		print '<th></th>';
+		print '<th class="right">';
+		print '<a href="'.DOL_URL_ROOT.'/holiday/list.php?sortfield=cp.tms&sortorder=DESC">';
+		print img_picto($langs->trans("FullList"), 'holiday');
+		print '</th>';
 		print '</tr>';
+
 		if ($num) {
 			while ($i < $num && $i < $max) {
 				$obj = $db->fetch_object($result);
@@ -300,11 +305,13 @@ if (isModEnabled('expensereport') && $user->hasRight('expensereport', 'read')) {
 		print '<tr class="liste_titre">';
 		print '<th colspan="2">'.$langs->trans("BoxTitleLastModifiedExpenses", min($max, $num)).'</th>';
 		print '<th class="right">'.$langs->trans("TotalTTC").'</th>';
-		print '<th class="right" colspan="2"><a href="'.DOL_URL_ROOT.'/expensereport/list.php?sortfield=d.tms&sortorder=DESC">'.$langs->trans("FullList").'</th>';
+		print '<th></th>';
+		print '<th class="right"><a href="'.DOL_URL_ROOT.'/expensereport/list.php?sortfield=d.tms&sortorder=DESC">';
+		print img_picto($langs->trans("FullList"), 'expensereport');
+		print '</th>';
 		print '</tr>';
-		if ($num) {
-			$total_ttc = $totalam = $total = 0;
 
+		if ($num) {
 			$expensereportstatic = new ExpenseReport($db);
 			$userstatic = new User($db);
 			while ($i < $num && $i < $max) {
@@ -377,7 +384,11 @@ if (isModEnabled('recruitment') && $user->hasRight('recruitment', 'recruitmentjo
 		print '<th colspan="3">';
 		print $langs->trans("BoxTitleLatestModifiedCandidatures", min($max, $num));
 		print '</th>';
-		print '<th class="right" colspan="2"><a href="'.DOL_URL_ROOT.'/recruitment/recruitmentcandidature_list.php?sortfield=t.tms&sortorder=DESC">'.$langs->trans("FullList").'</th>';
+		print '<th></th>';
+		print '<th class="right"><a href="'.DOL_URL_ROOT.'/recruitment/recruitmentcandidature_list.php?sortfield=t.tms&sortorder=DESC">';
+		print img_picto($langs->trans("FullList"), 'recruitmentcandidature');
+		//print $langs->trans("FullList");
+		print '</th>';
 		print '</tr>';
 		if ($num) {
 			while ($i < $num) {
diff --git a/htdocs/install/mysql/data/llx_accounting_account_fr.sql b/htdocs/install/mysql/data/llx_accounting_account_fr.sql
index f640e8de59b..a4b2a6e5386 100644
--- a/htdocs/install/mysql/data/llx_accounting_account_fr.sql
+++ b/htdocs/install/mysql/data/llx_accounting_account_fr.sql
@@ -517,6 +517,8 @@ INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, acc
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5971,'PCG14-DEV','FINAN',      '5', 0, 'Comptes financiers','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5972,'PCG14-DEV','EXPENSE',    '6', 0, 'Comptes de charges','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5973,'PCG14-DEV','INCOME',     '7', 0, 'Comptes de produits','1');
+-- Rowid 5974 ajouté en erratum, ajout de "697 - Imposition forfaitaire annuelle des sociétés" (absent de la liste dans PCG officiel, mais présent dans articles
+-- Rowid 5975 à 5977, ajouts pour les codes 4421 (pour le prélèvement à la source de l'impot sur le revenu), 4422 et 4423
 
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5000,'PCG14-DEV','CAPIT',   '10',5967,'Capital et réserves','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5001,'PCG14-DEV','CAPIT',  '101',5000,'Capital','1');
@@ -623,7 +625,7 @@ INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, acc
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5102,'PCG14-DEV','CAPIT', '1655',5100,'Cautionnements','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5103,'PCG14-DEV','CAPIT',  '166',5095,'Participation des salariés aux résultats','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5104,'PCG14-DEV','CAPIT', '1661',5103,'Comptes bloqués','1');
-INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5105,'PCG14-DEV','CAPIT', '1662',5013,'Fonds de participation','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5105,'PCG14-DEV','CAPIT', '1662',5103,'Fonds de participation','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5106,'PCG14-DEV','CAPIT',  '167',5095,'Emprunts et dettes assortis de conditions particulières','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5107,'PCG14-DEV','CAPIT', '1671',5106,'Emissions de titres participatifs','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5108,'PCG14-DEV','CAPIT', '1674',5106,'Avances conditionnées de l''Etat','1');
@@ -635,7 +637,7 @@ INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, acc
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5114,'PCG14-DEV','CAPIT', '1688',5110,'Intérêts courus','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5115,'PCG14-DEV','CAPIT','16881',5114,'sur emprunts obligataires convertibles','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5116,'PCG14-DEV','CAPIT','16883',5114,'sur autres emprunts obligataires','1');
-INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5117,'PCG14-DEV','CAPIT','16684',5114,'sur emprunts auprès des établissements de crédit','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5117,'PCG14-DEV','CAPIT','16884',5114,'sur emprunts auprès des établissements de crédit','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5118,'PCG14-DEV','CAPIT','16885',5114,'sur dépôts et cautionnements reçus','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5119,'PCG14-DEV','CAPIT','16886',5114,'sur participation des salariés aux résultats','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5120,'PCG14-DEV','CAPIT','16887',5114,'sur emprunts et dettes assortis de conditions particulières','1');
@@ -851,16 +853,16 @@ INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, acc
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5330,'PCG14-DEV','STOCK','3511',5329,'Produits intermédiaires (ou groupe) A','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5331,'PCG14-DEV','STOCK','3512',5329,'Produits intermédiaires (ou groupe) B','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5332,'PCG14-DEV','STOCK','355',5328,'Produits finis','1');
-INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5333,'PCG14-DEV','STOCK','3551',5333,'Produits finis (ou groupe) A','1');
-INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5334,'PCG14-DEV','STOCK','3552',5333,'Produits finis (ou groupe) B','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5333,'PCG14-DEV','STOCK','3551',5332,'Produits finis (ou groupe) A','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5334,'PCG14-DEV','STOCK','3552',5332,'Produits finis (ou groupe) B','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5335,'PCG14-DEV','STOCK','358',5328,'Produits résiduels (ou matières de récupération)','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5336,'PCG14-DEV','STOCK','3581',5335,'Déchets','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5337,'PCG14-DEV','STOCK','3585',5335,'Rebuts','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5338,'PCG14-DEV','STOCK','3586',5335,'Matières de récupération','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5339,'PCG14-DEV','STOCK','36',5969,'(compte à ouvrir, le cas échéant, sous l''intitulé ''Stocks provenant d''immobilisations'')','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5340,'PCG14-DEV','STOCK','37',5969,'Stocks de marchandises','1');
-INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5341,'PCG14-DEV','STOCK','371',5341,'Marchandises (ou groupe) A','1');
-INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5342,'PCG14-DEV','STOCK','372',5341,'Marchandises (ou groupe) B','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5341,'PCG14-DEV','STOCK','371',5340,'Marchandises (ou groupe) A','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5342,'PCG14-DEV','STOCK','372',5340,'Marchandises (ou groupe) B','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5343,'PCG14-DEV','STOCK','38',5969,'(lorsque l''entité tient un inventaire permanent en comptabilité générale, le compte 38 peut être utilisé pour comptabiliser les stocks en voie d''acheminement, mis en dépôt ou donnés en consignation)','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5344,'PCG14-DEV','STOCK','39',5969,'Dépréciations des stocks et en-cours','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5345,'PCG14-DEV','STOCK','391',5344,'Dépréciations des matières premières (et fournitures)','1');
@@ -947,6 +949,9 @@ INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, acc
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5426,'PCG14-DEV','THIRDPARTY','4418',5423,'Subventions d''équilibre','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5427,'PCG14-DEV','THIRDPARTY','4419',5423,'Avances sur subventions','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5428,'PCG14-DEV','THIRDPARTY','442',5422,'Etat - Impôts et taxes recouvrables sur des tiers','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5975,'PCG14-DEV','THIRDPARTY','4421',5428,'Prélèvements à la source (Impôt sur le revenu)','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5976,'PCG14-DEV','THIRDPARTY','4422',5428,'Prélèvements forfaitaires non libératoires','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5977,'PCG14-DEV','THIRDPARTY','4423',5428,'Retenues et prélèvements sur les distributions','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5429,'PCG14-DEV','THIRDPARTY','4424',5428,'Obligataires','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5430,'PCG14-DEV','THIRDPARTY','4425',5428,'Associés','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5431,'PCG14-DEV','THIRDPARTY','443',5422,'Opérations particulières avec l''Etat les collectivités publiques, les organismes internationaux','1');
@@ -1042,7 +1047,7 @@ INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, acc
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5521,'PCG14-DEV','THIRDPARTY','4962',5520,'Créances sur cessions d''immobilisations','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5522,'PCG14-DEV','THIRDPARTY','4965',5520,'Créances sur cessions de valeurs mobilières de placement','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5523,'PCG14-DEV','THIRDPARTY','4967',5520,'Autres comptes débiteurs','1');
-INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5524,'PCG14-DEV','FINAN','50',5524,'Parts dans des entreprises liées','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5524,'PCG14-DEV','FINAN','501',5971,'Parts dans des entreprises liées','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5526,'PCG14-DEV','FINAN','502',5524,'Actions propres','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5527,'PCG14-DEV','FINAN','5021',5526,'Actons destinées à être attribuées aux employés et affectées à des plans déterminés','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5528,'PCG14-DEV','FINAN','5022',5526,'Actons disponibles pour être attribuées aux employés ou pour la régularisation des cours de bourse','1');
@@ -1101,7 +1106,7 @@ INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, acc
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5581,'PCG14-DEV','EXPENSE','6012',5579,'Matières (ou groupe) B','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5582,'PCG14-DEV','EXPENSE','6017',5579,'Fournitures A, B, C,','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5583,'PCG14-DEV','EXPENSE','602',5578,'Achats stockés - Autres approvisionnements','1');
-INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5584,'PCG14-DEV','EXPENSE','6201',5583,'Matières consommables','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5584,'PCG14-DEV','EXPENSE','6021',5583,'Matières consommables','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5585,'PCG14-DEV','EXPENSE','60211',5584,'Matières (ou groupe) C','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5586,'PCG14-DEV','EXPENSE','60212',5584,'Matières (ou groupe) D','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5587,'PCG14-DEV','EXPENSE','6022',5583,'Fournitures consommables','1');
@@ -1122,8 +1127,8 @@ INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, acc
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5602,'PCG14-DEV','EXPENSE','6064',5599,'Fournitures administratives','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5603,'PCG14-DEV','EXPENSE','6068',5599,'Autres matières et fournitures','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5604,'PCG14-DEV','EXPENSE','607',5578,'Achats de marchandises','1');
-INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5605,'PCG14-DEV','EXPENSE','6071',5605,'Marchandise (ou groupe) A','1');
-INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5606,'PCG14-DEV','EXPENSE','6072',5605,'Marchandise (ou groupe) B','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5605,'PCG14-DEV','EXPENSE','6071',5604,'Marchandise (ou groupe) A','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5606,'PCG14-DEV','EXPENSE','6072',5604,'Marchandise (ou groupe) B','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5607,'PCG14-DEV','EXPENSE','608',5578,'(Compte réservé, le cas échéant, à la récapitulation des frais accessoires incorporés aux achats)','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5608,'PCG14-DEV','EXPENSE','609',5578,'Rabais, remises et ristournes obtenus sur achats','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5609,'PCG14-DEV','EXPENSE','6091',5608,'de matières premières (et fournitures)','1');
@@ -1133,7 +1138,7 @@ INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, acc
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5613,'PCG14-DEV','EXPENSE','6096',5608,'d''approvisionnements non stockés','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5614,'PCG14-DEV','EXPENSE','6097',5608,'de marchandises','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5615,'PCG14-DEV','EXPENSE','6098',5608,'Rabais, remises et ristournes non affectés','1');
-INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5616,'PCG14-DEV','EXPENSE','603',5578,'Variations des stocks (approvisionnements et marchandises)','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5616,'PCG14-DEV','EXPENSE','603',5972,'Variations des stocks (approvisionnements et marchandises)','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5617,'PCG14-DEV','EXPENSE','6031',5616,'Variation des stocks de matières premières (et fournitures)','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5618,'PCG14-DEV','EXPENSE','6032',5616,'Variation des stocks des autres approvisionnements','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5619,'PCG14-DEV','EXPENSE','6037',5616,'Variation des stocks de marchandises','1');
@@ -1350,6 +1355,7 @@ INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, acc
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5830,'PCG14-DEV','EXPENSE','6952',5828,'Contribution additionnelle à l''impôt sur les bénéfices','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5831,'PCG14-DEV','EXPENSE','6954',5828,'Impôts dus à l''étranger','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5832,'PCG14-DEV','EXPENSE','696',5826,'Suppléments d''impôt sur les sociétés liés aux distributions','1');
+INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5974,'PCG14-DEV','EXPENSE','697',5826,'Imposition forfaitaire annuelle des sociétés','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5833,'PCG14-DEV','EXPENSE','698',5826,'Intégration fiscale','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5834,'PCG14-DEV','EXPENSE','6981',5833,'Intégration fiscale - Charges','1');
 INSERT INTO llx_accounting_account (entity, rowid, fk_pcg_version, pcg_type, account_number, account_parent, label, active) VALUES (__ENTITY__, 5835,'PCG14-DEV','EXPENSE','6989',5833,'Intégration fiscale - Produits','1');
diff --git a/htdocs/install/mysql/migration/19.0.0-20.0.0.sql b/htdocs/install/mysql/migration/19.0.0-20.0.0.sql
index a99b9731232..f682187eb03 100644
--- a/htdocs/install/mysql/migration/19.0.0-20.0.0.sql
+++ b/htdocs/install/mysql/migration/19.0.0-20.0.0.sql
@@ -288,3 +288,7 @@ ALTER TABLE llx_expeditiondet ADD COLUMN element_type varchar(50) DEFAULT 'order
 
 ALTER TABLE llx_receptiondet_batch CHANGE COLUMN fk_commande fk_element integer;
 ALTER TABLE llx_receptiondet_batch CHANGE COLUMN fk_commandefourndet fk_elementdet integer;
+
+ALTER TABLE llx_supplier_proposaldet MODIFY ref_fourn VARCHAR(128) NULL;
+
+ALTER TABLE llx_projet ADD COLUMN ref_ext varchar(50) after ref;
diff --git a/htdocs/install/mysql/tables/llx_projet.sql b/htdocs/install/mysql/tables/llx_projet.sql
index 8b4db824ca5..3c71ab719e6 100644
--- a/htdocs/install/mysql/tables/llx_projet.sql
+++ b/htdocs/install/mysql/tables/llx_projet.sql
@@ -26,7 +26,8 @@ create table llx_projet
   tms              	timestamp DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   dateo            	date,						-- date start project
   datee            	date,						-- date end project
-  ref              	varchar(50),
+  ref              	varchar(50),				-- reference number
+  ref_ext          	varchar(50),				-- reference into an external system (not used by dolibarr)
   entity           	integer DEFAULT 1 NOT NULL,	-- multi company id
   title            	varchar(255) NOT NULL,
   description      	text,
@@ -37,7 +38,7 @@ create table llx_projet
   fk_opp_status    	integer DEFAULT NULL,	        -- if project is used to manage opportunities
   opp_percent	   	double(5,2),
   fk_opp_status_end	integer DEFAULT NULL,	        -- if project is used to manage opportunities (the opportunity status the project has when set to lose)
-  date_close       	datetime DEFAULT NULL,    
+  date_close       	datetime DEFAULT NULL,
   fk_user_close    	integer DEFAULT NULL,
   note_private     	text,
   note_public      	text,
diff --git a/htdocs/install/mysql/tables/llx_supplier_proposaldet.sql b/htdocs/install/mysql/tables/llx_supplier_proposaldet.sql
index bbf3decd7fa..2e61c58cc18 100644
--- a/htdocs/install/mysql/tables/llx_supplier_proposaldet.sql
+++ b/htdocs/install/mysql/tables/llx_supplier_proposaldet.sql
@@ -47,7 +47,7 @@ CREATE TABLE llx_supplier_proposaldet (
   fk_product_fournisseur_price integer DEFAULT NULL,
   special_code integer DEFAULT 0,
   rang integer DEFAULT 0,
-  ref_fourn varchar(30) DEFAULT NULL,
+  ref_fourn varchar(128) DEFAULT NULL,
   fk_multicurrency        integer,
   multicurrency_code      varchar(3),
   multicurrency_subprice  double(24,8) DEFAULT 0,
diff --git a/htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php b/htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php
index 8bb3e044889..0a01ba6b471 100644
--- a/htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php
+++ b/htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php
@@ -238,7 +238,7 @@ class KnowledgeManagement extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->knowledgerecord->context['caller'] = $request_data['caller'];
+				$this->knowledgerecord->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -286,7 +286,7 @@ class KnowledgeManagement extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->knowledgerecord->context['caller'] = $request_data['caller'];
+				$this->knowledgerecord->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
diff --git a/htdocs/langs/en_US/admin.lang b/htdocs/langs/en_US/admin.lang
index 90077daa51b..a9d4bde40ae 100644
--- a/htdocs/langs/en_US/admin.lang
+++ b/htdocs/langs/en_US/admin.lang
@@ -89,7 +89,7 @@ NotAvailableWhenAjaxDisabled=Not available when Ajax disabled
 AllowToSelectProjectFromOtherCompany=On document of a third party, can choose a project linked to another third party
 TimesheetPreventAfterFollowingMonths=Prevent recording time spent after the following number of months
 PROJECT_DISPLAY_LINKED_BY_CONTACT=Display project linked by a common contact
-PROJECT_DISPLAY_LINKED_BY_CONTACT_help=That option add a new list on Project tab with all projects linked to that thirdparty via a contact relationship
+PROJECT_DISPLAY_LINKED_BY_CONTACT_help=This option adds a new list on Project tab with all projects linked to thirdparty via a contact relationship
 JavascriptDisabled=JavaScript disabled
 UsePreviewTabs=Use preview tabs
 ShowPreview=Show preview
diff --git a/htdocs/langs/en_US/cashdesk.lang b/htdocs/langs/en_US/cashdesk.lang
index ff42af8c3fb..3baf275ab15 100644
--- a/htdocs/langs/en_US/cashdesk.lang
+++ b/htdocs/langs/en_US/cashdesk.lang
@@ -106,7 +106,7 @@ ControlCashOpening=Open the "Control cash box" popup when opening the POS
 CloseCashFence=Close cash box control
 CashReport=Cash report
 MainPrinterToUse=Main printer to use
-MainPrinterToUseMore=empty means the browser printer system
+MainPrinterToUseMore=leave empty to use the browser printer system
 OrderPrinterToUse=Order printer to use
 MainTemplateToUse=Main template to use
 MainTemplateToUseMore=when not using browser printing system
diff --git a/htdocs/langs/en_US/companies.lang b/htdocs/langs/en_US/companies.lang
index 81febdac01c..74c2c99e055 100644
--- a/htdocs/langs/en_US/companies.lang
+++ b/htdocs/langs/en_US/companies.lang
@@ -273,6 +273,11 @@ EditContact=Edit contact
 EditContactAddress=Edit contact/address
 Contact=Contact/Address
 Contacts=Contacts/Addresses
+ContactNotes=Notes
+ContactPersonalData=Personal data
+ContactRelatedItems=Related items
+ContactLinkedFiles=Linked files
+ContactEvents=Events/Agenda
 ContactId=Contact id
 ContactsAddresses=Contacts/Addresses
 FromContactName=Name:
@@ -401,7 +406,8 @@ ListSuppliersShort=List of Vendors
 ListProspectsShort=List of Prospects
 ListCustomersShort=List of Customers
 ThirdPartiesArea=Third Parties/Contacts
-LastModifiedThirdParties=Latest %s Third Parties which were modified
+LastModifiedThirdParties=The latest %s modified Third Parties
+LastModifiedContacts=The latest %s modified contacts
 UniqueThirdParties=Total number of Third Parties
 InActivity=Open
 ActivityCeased=Closed
diff --git a/htdocs/langs/en_US/errors.lang b/htdocs/langs/en_US/errors.lang
index d8ebfa352e5..5d5c4f7f0a7 100644
--- a/htdocs/langs/en_US/errors.lang
+++ b/htdocs/langs/en_US/errors.lang
@@ -414,4 +414,4 @@ ThisIdNotDefined=Id not defined
 OperNotDefined=Payment method not defined
 ErrorThisContactXIsAlreadyDefinedAsThisType=%s is already defined as contact for this type.
 ErrorThisGroupIsAlreadyDefinedAsThisType=The contacts with this group are already defined as contact for this type.
-EmptyMessageNotAllowedError=Empty Message Not Allowed Error
+EmptyMessageNotAllowedError=Empty message is not allowed
diff --git a/htdocs/langs/en_US/help.lang b/htdocs/langs/en_US/help.lang
index 88a1b006591..eafea7c0281 100644
--- a/htdocs/langs/en_US/help.lang
+++ b/htdocs/langs/en_US/help.lang
@@ -21,4 +21,4 @@ LinkToGoldMember=You can call one of the trainers preselected by Dolibarr for yo
 PossibleLanguages=Supported languages
 SubscribeToFoundation=Help the Dolibarr project, subscribe to the foundation
 SeeOfficalSupport=For official Dolibarr support in your language: <br><b><a href="%s" target="_blank" rel="noopener noreferrer">%s</a></b>
-AIProcessingPleaseWait=AI interrogation in progress, please wait...
\ No newline at end of file
+AIProcessingPleaseWait=AI is processing your request, please wait...
diff --git a/htdocs/langs/en_US/other.lang b/htdocs/langs/en_US/other.lang
index 12955cc9f0e..41a8ac3985d 100644
--- a/htdocs/langs/en_US/other.lang
+++ b/htdocs/langs/en_US/other.lang
@@ -42,6 +42,7 @@ notiftouserandtofixedemail=To user and fixed mail
 Notify_ORDER_VALIDATE=Sales order validated
 Notify_ORDER_SENTBYMAIL=Sales order sent by mail
 Notify_ORDER_CLOSE=Sales order delivered
+Notify_ORDER_CANCEL=Sales order canceled
 Notify_ORDER_SUPPLIER_SENTBYMAIL=Purchase order sent by email
 Notify_ORDER_SUPPLIER_VALIDATE=Purchase order recorded
 Notify_ORDER_SUPPLIER_APPROVE=Purchase order approved
diff --git a/htdocs/langs/en_US/salaries.lang b/htdocs/langs/en_US/salaries.lang
index 2f6ad0a56be..adf8ed60dff 100644
--- a/htdocs/langs/en_US/salaries.lang
+++ b/htdocs/langs/en_US/salaries.lang
@@ -1,6 +1,6 @@
 # Dolibarr language file - Source file is en_US - salaries
 SALARIES_ACCOUNTING_ACCOUNT_PAYMENT=Account (from the Chart of Account) used by default for "users" on salaries
-SALARIES_ACCOUNTING_ACCOUNT_PAYMENT_Desc=The dedicated account defined on the user card will be used for Subledger accounting only. This one will be used for General Ledger, bt also as the default value of Subledger accounting if no dedicated user accounting account is defined on the user.
+SALARIES_ACCOUNTING_ACCOUNT_PAYMENT_Desc=The dedicated account defined on the user card will be used for Subledger accounting only. This one will be used for General Ledger, but also as the default value of Subledger accounting if no dedicated user accounting account is defined on the user.
 SALARIES_ACCOUNTING_ACCOUNT_CHARGE=Accounting account by default for wage payments
 CREATE_NEW_SALARY_WITHOUT_AUTO_PAYMENT=By default, leave empty the option "Automatically create a total payment" when creating a Salary
 Salary=Salary
diff --git a/htdocs/langs/en_US/stocks.lang b/htdocs/langs/en_US/stocks.lang
index 7740eb8d647..c7e32d9d706 100644
--- a/htdocs/langs/en_US/stocks.lang
+++ b/htdocs/langs/en_US/stocks.lang
@@ -332,5 +332,6 @@ ConfirmDeleteBatch=Are you sure you want to delete lot/serial ?
 WarehouseUsage=Warehouse usage
 InternalWarehouse=Internal warehouse
 ExternalWarehouse=External warehouse
-QtyCurrentlyKnownInStock=The quantity the system think you have in stock. As long as the inventory is not closed, this is a realtime value and it may change if you continue to make stock movement during the inventory (not recommended).
-QtyInStockWhenInventoryWasValidated=The quantity the system think you had in stock when the inventory was validated (before the stock correction)
+LatestModifiedWarehouses=Latest %s modified warehouses
+QtyCurrentlyKnownInStock=System estimated quantity you have in stock. As long as the inventory is not closed, this is a realtime value and it may change if you continue to make stock movement during the inventory (not recommended).
+QtyInStockWhenInventoryWasValidated=System estimated quantity you had in stock when the inventory was validated (before the stock correction)
diff --git a/htdocs/langs/en_US/website.lang b/htdocs/langs/en_US/website.lang
index a1543ba61f5..5676ed45400 100644
--- a/htdocs/langs/en_US/website.lang
+++ b/htdocs/langs/en_US/website.lang
@@ -162,7 +162,7 @@ AssignedContacts=Assigned contacts
 WebsiteTypeLabel=Type of Web site
 WebsiteTypeDolibarrWebsite=Web site (Module WebSites CMS)
 WebsiteTypeDolibarrPortal=Native and ready to use web portal (Module Web Portal)
-WebPortalURL=Web portal URL 
+WebPortalURL=Web portal URL
 NewWebsiteAccount=New accounts for websites
 ModuleWebPortalName=Web portal
 ModuleWebPortalDesc=A ready to use native web portal for customers, suppliers, partners or members
@@ -235,4 +235,5 @@ WebPortalPartnership=Partnership
 WebPortalPropal=Proposal
 WebPortalGroupMenuAdmin=Administration
 WebPortalGroupMenuTechnical=System
-PreviewPageContent=Page content 
+PreviewPageContent=Page content
+Cart=Cart
diff --git a/htdocs/langs/fr_FR/website.lang b/htdocs/langs/fr_FR/website.lang
index 5dc984ebce6..6771817e37e 100644
--- a/htdocs/langs/fr_FR/website.lang
+++ b/htdocs/langs/fr_FR/website.lang
@@ -235,3 +235,4 @@ WebPortalPartnership=Partenariat
 WebPortalPropal=Proposition
 WebPortalGroupMenuAdmin=Administration
 WebPortalGroupMenuTechnical=Système
+Cart=Panier
diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index 1acf1271eaf..910720b56f2 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -220,10 +220,10 @@ function testSqlAndScriptInject($val, $type)
 /**
  * Return true if security check on parameters are OK, false otherwise.
  *
- * @param		string|array	$var		Variable name
- * @param		int				$type		1=GET, 0=POST, 2=PHP_SELF
- * @param		int				$stopcode	0=No stop code, 1=Stop code (default) if injection found
- * @return		boolean|null				True if there is no injection.
+ * @param		string|array<string,string>	$var		Variable name
+ * @param		int<0,2>		$type		1=GET, 0=POST, 2=PHP_SELF
+ * @param		int<0,1>		$stopcode	0=No stop code, 1=Stop code (default) if injection found
+ * @return		boolean						True if there is no injection.
  */
 function analyseVarsForSqlAndScriptsInjection(&$var, $type, $stopcode = 1)
 {
@@ -1599,8 +1599,8 @@ if (!function_exists("llxHeader")) {
 /**
  *  Show HTTP header. Called by top_htmlhead().
  *
- *  @param  string  $contenttype    Content type. For example, 'text/html'
- *  @param	int		$forcenocache	Force disabling of cache for the page
+ *  @param  string  	$contenttype    Content type. For example, 'text/html'
+ *  @param	int<0,1>	$forcenocache	Force disabling of cache for the page
  *  @return	void
  */
 function top_httphead($contenttype = 'text/html', $forcenocache = 0)
@@ -1730,15 +1730,15 @@ function top_httphead($contenttype = 'text/html', $forcenocache = 0)
  * Output html header of a page. It calls also top_httphead()
  * This code is also duplicated into security2.lib.php::dol_loginfunction
  *
- * @param 	string 	$head			 Optional head lines
- * @param 	string 	$title			 HTML title
- * @param 	int    	$disablejs		 Disable js output
- * @param 	int    	$disablehead	 Disable head output
- * @param 	array  	$arrayofjs		 Array of complementary js files
- * @param 	array  	$arrayofcss		 Array of complementary css files
- * @param 	int    	$disableforlogin Do not load heavy js and css for login pages
- * @param   int     $disablenofollow Disable nofollow tag for meta robots
- * @param   int     $disablenoindex  Disable noindex tag for meta robots
+ * @param 	string		$head			 Optional head lines
+ * @param 	string		$title			 HTML title
+ * @param 	int<0,1>   	$disablejs		 Disable js output
+ * @param 	int<0,1>   	$disablehead	 Disable head output
+ * @param 	string[]	$arrayofjs		 Array of complementary js files
+ * @param 	string[]	$arrayofcss		 Array of complementary css files
+ * @param 	int<0,1>	$disableforlogin Do not load heavy js and css for login pages
+ * @param   int<0,1>	$disablenofollow Disable nofollow tag for meta robots
+ * @param   int<0,1>	$disablenoindex  Disable noindex tag for meta robots
  * @return	void
  */
 function top_htmlhead($head, $title = '', $disablejs = 0, $disablehead = 0, $arrayofjs = array(), $arrayofcss = array(), $disableforlogin = 0, $disablenofollow = 0, $disablenoindex = 0)
@@ -2146,10 +2146,10 @@ function top_htmlhead($head, $title = '', $disablejs = 0, $disablehead = 0, $arr
  *  @param      string			$head    			Lines in the HEAD
  *  @param      string			$title   			Title of web page
  *  @param      string			$target  			Target to use in menu links (Example: '' or '_top')
- *	@param		int				$disablejs			Do not output links to js (Ex: qd fonction utilisee par sous formulaire Ajax)
- *	@param		int				$disablehead		Do not output head section
- *	@param		array			$arrayofjs			Array of js files to add in header
- *	@param		array			$arrayofcss			Array of css files to add in header
+ *	@param		int<0,1>		$disablejs			Do not output links to js (Ex: qd fonction utilisee par sous formulaire Ajax)
+ *	@param		int<0,1>		$disablehead		Do not output head section
+ *	@param		string[]		$arrayofjs			Array of js files to add in header
+ *	@param		string[]		$arrayofcss			Array of css files to add in header
  *  @param		string			$morequerystring	Query string to add to the link "print" to get same parameters (use only if autodetect fails)
  *  @param      string			$helppagename    	Name of wiki page for help ('' by default).
  * 				     		    		            Syntax is: For a wiki page: EN:EnglishPage|FR:FrenchPage|ES:SpanishPage|DE:GermanPage
@@ -2412,7 +2412,7 @@ function top_menu($head, $title = '', $target = '', $disablejs = 0, $disablehead
 /**
  * Build the tooltip on user login
  *
- * @param	int			$hideloginname		Hide login name. Show only the image.
+ * @param	int<0,1>	$hideloginname		Hide login name. Show only the image.
  * @param	string		$urllogout			URL for logout (Will use DOL_URL_ROOT.'/user/logout.php?token=...' if empty)
  * @return  string                  		HTML content
  */
@@ -3201,15 +3201,15 @@ function top_menu_search()
 /**
  *  Show left menu bar
  *
- *  @param  array	$menu_array_before 	       	Table of menu entries to show before entries of menu handler. This param is deprecated and must be provided to ''.
- *  @param  string	$helppagename    	       	Name of wiki page for help ('' by default).
- * 				     		                   	Syntax is: For a wiki page: EN:EnglishPage|FR:FrenchPage|ES:SpanishPage|DE:GermanPage
- * 									         	For other external page: http://server/url
- *  @param  string	$notused             		Deprecated. Used in past to add content into left menu. Hooks can be used now.
- *  @param  array	$menu_array_after           Table of menu entries to show after entries of menu handler
- *  @param  int		$leftmenuwithoutmainarea    Must be set to 1. 0 by default for backward compatibility with old modules.
- *  @param  string	$title                      Title of web page
- *  @param  int  	$acceptdelayedhtml          1 if caller request to have html delayed content not returned but saved into global $delayedhtmlcontent (so caller can show it at end of page to avoid flash FOUC effect)
+ *  @param  string		$menu_array_before 	       	Table of menu entries to show before entries of menu handler. This param is deprecated and must be provided to ''.
+ *  @param  string		$helppagename    	       	Name of wiki page for help ('' by default).
+ *                                                  Syntax is: For a wiki page: EN:EnglishPage|FR:FrenchPage|ES:SpanishPage|DE:GermanPage
+ *                                                  For other external page: http://server/url
+ *  @param  string		$notused             		Deprecated. Used in past to add content into left menu. Hooks can be used now.
+ *  @param  array		$menu_array_after           Table of menu entries to show after entries of menu handler
+ *  @param  int			$leftmenuwithoutmainarea    Must be set to 1. 0 by default for backward compatibility with old modules.
+ *  @param  string		$title                      Title of web page
+ *  @param  int<0,1>	$acceptdelayedhtml          1 if caller request to have html delayed content not returned but saved into global $delayedhtmlcontent (so caller can show it at end of page to avoid flash FOUC effect)
  *  @return	void
  */
 function left_menu($menu_array_before, $helppagename = '', $notused = '', $menu_array_after = array(), $leftmenuwithoutmainarea = 0, $title = '', $acceptdelayedhtml = 0)
@@ -3523,7 +3523,7 @@ function main_area($title = '')
  *
  *  @param	string		$helppagename		Page name ('EN:xxx,ES:eee,FR:fff,DE:ddd...' or 'http://localpage')
  *  @param  Translate	$langs				Language
- *  @return	array		Array of help urls
+ *  @return	array{helpbaseurl:string,helppage:string,mode:string}	Array of help urls
  */
 function getHelpParamFor($helppagename, $langs)
 {
diff --git a/htdocs/modulebuilder/template/class/api_mymodule.class.php b/htdocs/modulebuilder/template/class/api_mymodule.class.php
index d716869cfcc..25291332ffd 100644
--- a/htdocs/modulebuilder/template/class/api_mymodule.class.php
+++ b/htdocs/modulebuilder/template/class/api_mymodule.class.php
@@ -76,7 +76,7 @@ class MyModuleApi extends DolibarrApi
 			throw new RestException(403);
 		}
 		if (!DolibarrApi::_checkAccessToResource('myobject', $id, 'mymodule_myobject')) {
-			throw new RestException(403, 'Access to instance id='.$this->myobject->id.' of object not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access to instance id='.$id.' of object not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->myobject->fetch($id);
@@ -206,7 +206,14 @@ class MyModuleApi extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->myobject->context['caller'] = $request_data['caller'];
+				$this->myobject->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
+				continue;
+			}
+
+			if ($field == 'array_options' && is_array($value)) {
+				foreach ($value as $index => $val) {
+					$this->myobject->array_options[$index] = $this->_checkValForAPI('extrafields', $val, $this->myobject);
+				}
 				continue;
 			}
 
@@ -255,7 +262,14 @@ class MyModuleApi extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->myobject->context['caller'] = $request_data['caller'];
+				$this->myobject->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
+				continue;
+			}
+
+			if ($field == 'array_options' && is_array($value)) {
+				foreach ($value as $index => $val) {
+					$this->myobject->array_options[$index] = $this->_checkValForAPI('extrafields', $val, $this->myobject);
+				}
 				continue;
 			}
 
diff --git a/htdocs/modulebuilder/template/mymoduleindex.php b/htdocs/modulebuilder/template/mymoduleindex.php
index f11670f0906..9597abbd11f 100644
--- a/htdocs/modulebuilder/template/mymoduleindex.php
+++ b/htdocs/modulebuilder/template/mymoduleindex.php
@@ -63,9 +63,10 @@ $langs->loadLangs(array("mymodule@mymodule"));
 
 $action = GETPOST('action', 'aZ09');
 
-$max = 5;
 $now = dol_now();
 
+$max = getDolGlobalInt('MAIN_SIZE_SHORTLIST_LIMIT');
+
 // Security check - Protection if external user
 $socid = GETPOST('socid', 'int');
 if (isset($user->socid) && $user->socid > 0) {
@@ -184,9 +185,6 @@ END MODULEBUILDER DRAFT MYOBJECT */
 print '</div><div class="fichetwothirdright">';
 
 
-$NBMAX = getDolGlobalInt('MAIN_SIZE_SHORTLIST_LIMIT');
-$max = getDolGlobalInt('MAIN_SIZE_SHORTLIST_LIMIT');
-
 /* BEGIN MODULEBUILDER LASTMODIFIED MYOBJECT
 // Last modified myobject
 if (isModEnabled('mymodule') && $user->hasRight('mymodule', 'read')) {
diff --git a/htdocs/mrp/class/api_mos.class.php b/htdocs/mrp/class/api_mos.class.php
index a67d23b6877..23d07091d5b 100644
--- a/htdocs/mrp/class/api_mos.class.php
+++ b/htdocs/mrp/class/api_mos.class.php
@@ -187,11 +187,11 @@ class Mos extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->mo->context['caller'] = $request_data['caller'];
+				$this->mo->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->mo->$field = $value;
+			$this->mo->$field = $this->_checkValForAPI($field, $value, $this->mo);
 		}
 
 		$this->checkRefNumbering();
@@ -221,7 +221,7 @@ class Mos extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('mrp', $this->mo->id, 'mrp_mo')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($request_data as $field => $value) {
@@ -230,11 +230,11 @@ class Mos extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->mo->context['caller'] = $request_data['caller'];
+				$this->mo->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->mo->$field = $value;
+			$this->mo->$field = $this->_checkValForAPI($field, $value, $this->mo);
 		}
 
 		$this->checkRefNumbering();
@@ -347,7 +347,7 @@ class Mos extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$stockmove->context['caller'] = $request_data['caller'];
+				$stockmove->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 		}
diff --git a/htdocs/mrp/index.php b/htdocs/mrp/index.php
index 835a06cc7c6..409f1847a8b 100644
--- a/htdocs/mrp/index.php
+++ b/htdocs/mrp/index.php
@@ -42,6 +42,8 @@ $langs->loadLangs(array("companies", "mrp"));
 // Security check
 $result = restrictedArea($user, 'bom|mrp');
 
+$max = getDolGlobalInt('MAIN_SIZE_SHORTLIST_LIMIT');
+
 
 /*
  * View
@@ -93,7 +95,8 @@ if ($conf->use_javascript_ajax) {
 
 		print '<div class="div-table-responsive-no-min">';
 		print '<table class="noborder nohover centpercent">';
-		print '<tr class="liste_titre"><th colspan="2">'.$langs->trans("Statistics").' - '.$langs->trans("ManufacturingOrder").'</th></tr>'."\n";
+		print '<tr class="liste_titre"><th colspan="2">'.$langs->trans("Statistics").' - '.$langs->trans("ManufacturingOrder").'</th>';
+		print '</tr>'."\n";
 		$listofstatus = array(0, 1, 2, 3, 9);
 		foreach ($listofstatus as $status) {
 			$dataseries[] = array($staticmo->LibStatut($status, 1), (isset($vals[$status]) ? (int) $vals[$status] : 0));
@@ -150,12 +153,11 @@ print '<br>';
 
 print '</div><div class="fichetwothirdright">';
 
+
 /*
  * Last modified BOM
  */
 
-$max = 5;
-
 $sql = "SELECT a.rowid, a.status, a.ref, a.tms as datem, a.status, a.fk_product";
 $sql .= " FROM ".MAIN_DB_PREFIX."bom_bom as a";
 $sql .= " WHERE a.entity IN (".getEntity('bom').")";
@@ -167,7 +169,9 @@ if ($resql) {
 	print '<div class="div-table-responsive-no-min">';
 	print '<table class="noborder centpercent">';
 	print '<tr class="liste_titre">';
-	print '<th colspan="4">'.$langs->trans("LatestBOMModified", $max).'</th></tr>';
+	print '<th colspan="2">'.$langs->trans("LatestBOMModified", $max).'</th>';
+	print '<th class="right"><a href="'.DOL_URL_ROOT.'/bom/bom_list.php?sortfield=t.tms&sortorder=DESC">'.img_picto($langs->trans("FullList"), 'bom').'</th>';
+	print '</tr>';
 
 	$num = $db->num_rows($resql);
 	if ($num) {
@@ -190,7 +194,7 @@ if ($resql) {
 		}
 	} else {
 		print '<tr class="oddeven">';
-		print '<td><span class="opacitymedium">'.$langs->trans("None").'</span></td>';
+		print '<td colspan="3"><span class="opacitymedium">'.$langs->trans("None").'</span></td>';
 		print '</tr>';
 	}
 	print "</table></div>";
@@ -203,7 +207,6 @@ if ($resql) {
  * Last modified MOs
  */
 
-$max = 5;
 
 $sql = "SELECT a.rowid, a.status, a.ref, a.tms as datem, a.status";
 $sql .= " FROM ".MAIN_DB_PREFIX."mrp_mo as a";
@@ -216,7 +219,9 @@ if ($resql) {
 	print '<div class="div-table-responsive-no-min">';
 	print '<table class="noborder centpercent">';
 	print '<tr class="liste_titre">';
-	print '<th colspan="4">'.$langs->trans("LatestMOModified", $max).'</th></tr>';
+	print '<th colspan="2">'.$langs->trans("LatestMOModified", $max).'</th>';
+	print '<th class="right"><a href="'.DOL_URL_ROOT.'/mrp/mo_list.php?sortfield=t.tms&sortorder=DESC">'.img_picto($langs->trans("FullList"), 'mrp').'</th>';
+	print '</tr>';
 
 	$num = $db->num_rows($resql);
 	if ($num) {
@@ -238,7 +243,7 @@ if ($resql) {
 		}
 	} else {
 		print '<tr class="oddeven">';
-		print '<td><span class="opacitymedium">'.$langs->trans("None").'</span></td>';
+		print '<td colspan="3"><span class="opacitymedium">'.$langs->trans("None").'</span></td>';
 		print '</tr>';
 	}
 	print "</table></div>";
diff --git a/htdocs/multicurrency/class/api_multicurrencies.class.php b/htdocs/multicurrency/class/api_multicurrencies.class.php
index 3158263c0b7..77bc13f098b 100644
--- a/htdocs/multicurrency/class/api_multicurrencies.class.php
+++ b/htdocs/multicurrency/class/api_multicurrencies.class.php
@@ -212,8 +212,16 @@ class MultiCurrencies extends DolibarrApi
 		}
 
 		$multicurrency = new MultiCurrency($this->db);
-		$multicurrency->code = $request_data['code'];
-		$multicurrency->name = $request_data['name'];
+
+		foreach ($request_data as $field => $value) {
+			if ($field === 'caller') {
+				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
+				$multicurrency->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
+				continue;
+			}
+
+			$multicurrency->$field = $this->_checkValForAPI($field, $value, $multicurrency);
+		}
 
 		// Create Currency
 		if ($multicurrency->create(DolibarrApiAccess::$user) < 0) {
@@ -258,11 +266,11 @@ class MultiCurrencies extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$multicurrency->context['caller'] = $request_data['caller'];
+				$multicurrency->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$multicurrency->$field = $value;
+			$multicurrency->$field = $this->_checkValForAPI($field, $value, $multicurrency);
 		}
 
 		if ($multicurrency->update(DolibarrApiAccess::$user) < 0) {
diff --git a/htdocs/partnership/class/api_partnerships.class.php b/htdocs/partnership/class/api_partnerships.class.php
index 0fda760e704..8261422c64a 100644
--- a/htdocs/partnership/class/api_partnerships.class.php
+++ b/htdocs/partnership/class/api_partnerships.class.php
@@ -198,7 +198,7 @@ class Partnerships extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->partnership->context['caller'] = $request_data['caller'];
+				$this->partnership->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -246,7 +246,7 @@ class Partnerships extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->partnership->context['caller'] = $request_data['caller'];
+				$this->partnership->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
diff --git a/htdocs/product/card.php b/htdocs/product/card.php
index 478f9641615..a9a7923b3c2 100644
--- a/htdocs/product/card.php
+++ b/htdocs/product/card.php
@@ -923,7 +923,7 @@ if (empty($reshook)) {
 				// We use native clone to keep this->db valid and allow to use later all the methods of object.
 				$clone = dol_clone($object, 1);
 
-				$clone->id = null;
+				$clone->id = 0;
 				$clone->ref = GETPOST('clone_ref', 'alphanohtml');
 				$clone->status = 0;
 				$clone->status_buy = 0;
diff --git a/htdocs/product/class/api_products.class.php b/htdocs/product/class/api_products.class.php
index 48ab72e66d4..0d01072f8e8 100644
--- a/htdocs/product/class/api_products.class.php
+++ b/htdocs/product/class/api_products.class.php
@@ -315,11 +315,11 @@ class Products extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->product->context['caller'] = $request_data['caller'];
+				$this->product->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->product->$field = $value;
+			$this->product->$field = $this->_checkValForAPI($field, $value, $this->product);
 		}
 		if ($this->product->create(DolibarrApiAccess::$user) < 0) {
 			throw new RestException(500, "Error creating product", array_merge(array($this->product->error), $this->product->errors));
@@ -351,7 +351,7 @@ class Products extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('product', $this->product->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$oldproduct = dol_clone($this->product);
@@ -365,11 +365,11 @@ class Products extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->product->context['caller'] = $request_data['caller'];
+				$this->product->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->product->$field = $value;
+			$this->product->$field = $this->_checkValForAPI($field, $value, $this->product);
 		}
 
 		$updatetype = false;
@@ -453,7 +453,7 @@ class Products extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('product', $this->product->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		// The Product::delete() method uses the global variable $user.
@@ -494,7 +494,7 @@ class Products extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('product', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$childrenArbo = $this->product->getChildsArbo($id, 1);
@@ -532,7 +532,7 @@ class Products extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('product', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->product->add_sousproduit($id, $subproduct_id, $qty, $incdec);
@@ -562,7 +562,7 @@ class Products extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('product', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->product->del_sousproduit($id, $subproduct_id);
@@ -775,7 +775,7 @@ class Products extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('product', $this->productsupplier->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$socid = DolibarrApiAccess::$user->socid ? DolibarrApiAccess::$user->socid : '';
@@ -832,7 +832,7 @@ class Products extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('product', $this->productsupplier->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$resultsupplier = 0;
@@ -987,7 +987,7 @@ class Products extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('product', $this->product->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$product_fourn_list = array();
@@ -1281,11 +1281,11 @@ class Products extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$prodattr->context['caller'] = $request_data['caller'];
+				$prodattr->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$prodattr->$field = $value;
+			$prodattr->$field = $this->_checkValForAPI($field, $value, $prodattr);
 		}
 
 		if ($prodattr->update(DolibarrApiAccess::$user) > 0) {
@@ -1594,11 +1594,11 @@ class Products extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$objectval->context['caller'] = $request_data['caller'];
+				$objectval->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$objectval->$field = $value;
+			$objectval->$field = $this->_checkValForAPI($field, $value, $objectval);
 		}
 
 		if ($objectval->update(DolibarrApiAccess::$user) > 0) {
@@ -1861,11 +1861,11 @@ class Products extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$prodcomb->context['caller'] = $request_data['caller'];
+				$prodcomb->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$prodcomb->$field = $value;
+			$prodcomb->$field = $this->_checkValForAPI($field, $value, $prodcomb);
 		}
 
 		$result = $prodcomb->update(DolibarrApiAccess::$user);
@@ -2064,7 +2064,7 @@ class Products extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('product', $this->product->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!empty($includestockdata) && DolibarrApiAccess::$user->hasRight('stock', 'lire')) {
diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php
index cd24b0197a7..641ba49ed29 100644
--- a/htdocs/product/class/product.class.php
+++ b/htdocs/product/class/product.class.php
@@ -72,7 +72,7 @@ class Product extends CommonObject
 	public $fk_element = 'fk_product';
 
 	/**
-	 * @var Product
+	 * @var static
 	 */
 	public $oldcopy;
 
diff --git a/htdocs/product/index.php b/htdocs/product/index.php
index d7fb18d737b..02ffb3632f2 100644
--- a/htdocs/product/index.php
+++ b/htdocs/product/index.php
@@ -78,11 +78,16 @@ if (GETPOST('addbox')) {
 	}
 }
 
+$max = getDolGlobalInt('MAIN_SIZE_SHORTLIST_LIMIT');
+
 
 /*
  * View
  */
 
+$producttmp = new Product($db);
+$warehouse = new Entrepot($db);
+
 $transAreaType = $langs->trans("ProductsAndServicesArea");
 
 $helpurl = '';
@@ -304,15 +309,14 @@ if (isModEnabled('category') && getDolGlobalString('CATEGORY_GRAPHSTATS_ON_PRODU
  * Latest modified products
  */
 if ((isModEnabled("product") || isModEnabled("service")) && ($user->hasRight("produit", "lire") || $user->hasRight("service", "lire"))) {
-	$max = 15;
 	$sql = "SELECT p.rowid, p.label, p.price, p.ref, p.fk_product_type, p.tosell, p.tobuy, p.tobatch, p.fk_price_expression,";
 	$sql .= " p.entity,";
 	$sql .= " p.tms as datem";
 	$sql .= " FROM ".MAIN_DB_PREFIX."product as p";
 	$sql .= " WHERE p.entity IN (".getEntity($product_static->element, 1).")";
-	if ($type != '') {
+	/*if ($type != '') {
 		$sql .= " AND p.fk_product_type = ".((int) $type);
-	}
+	}*/
 	// Add where from hooks
 	$parameters = array();
 	$reshook = $hookmanager->executeHooks('printFieldListWhere', $parameters, $product_static); // Note that $action and $object may have been modified by hook
@@ -330,10 +334,10 @@ if ((isModEnabled("product") || isModEnabled("service")) && ($user->hasRight("pr
 
 		if ($num > 0) {
 			$transRecordedType = $langs->trans("LastModifiedProductsAndServices", $max);
-			if (GETPOSTISSET("type") && GETPOST("type") == '0') {
+			if (!isModEnabled('service')) {
 				$transRecordedType = $langs->trans("LastRecordedProducts", $max);
 			}
-			if (GETPOSTISSET("type") && GETPOST("type") == '1') {
+			if (!isModEnabled('product')) {
 				$transRecordedType = $langs->trans("LastRecordedServices", $max);
 			}
 
@@ -346,7 +350,15 @@ if ((isModEnabled("product") || isModEnabled("service")) && ($user->hasRight("pr
 			}
 
 			$lastmodified .= '<tr class="liste_titre"><th colspan="'.$colnb.'">'.$transRecordedType.'</th>';
-			$lastmodified .= '<th class="right" colspan="3"><a href="'.DOL_URL_ROOT.'/product/list.php?sortfield=p.tms&sortorder=DESC">'.$langs->trans("FullList").'</td>';
+			$lastmodified .= '<th class="right" colspan="3">';
+			$lastmodified .= '<a href="'.DOL_URL_ROOT.'/product/list.php?sortfield=p.tms&sortorder=DESC&type=0">';
+			//$lastmodified .= $langs->trans("FullList");
+			$lastmodified .= img_picto($langs->trans("FullList").' - '.$langs->trans("Products"), 'product');
+			$lastmodified .= '</a> &nbsp; ';
+			$lastmodified .= '<a href="'.DOL_URL_ROOT.'/product/list.php?sortfield=p.tms&sortorder=DESC&type=1">';
+			//$langs->trans("FullList").'</a>';
+			$lastmodified .= img_picto($langs->trans("FullList").' - '.$langs->trans("Services"), 'service');
+			$lastmodified .= '</th>';
 			$lastmodified .= '</tr>';
 
 			while ($i < $num) {
@@ -435,6 +447,174 @@ if ((isModEnabled("product") || isModEnabled("service")) && ($user->hasRight("pr
 	}
 }
 
+$latestwarehouse = '';
+if (isModEnabled('stock')) {
+	$sql = "SELECT e.rowid, e.ref as label, e.lieu, e.statut as status";
+	$sql .= " FROM ".MAIN_DB_PREFIX."entrepot as e";
+	$sql .= " WHERE e.statut in (".Entrepot::STATUS_CLOSED.",".Entrepot::STATUS_OPEN_ALL.")";
+	$sql .= " AND e.entity IN (".getEntity('stock').")";
+	$sql .= $db->order('e.tms', 'DESC');
+	$sql .= $db->plimit($max + 1, 0);
+
+	$result = $db->query($sql);
+
+	if ($result) {
+		$num = $db->num_rows($result);
+
+		$latestwarehouse .= '<div class="div-table-responsive-no-min">';
+		$latestwarehouse .= '<table class="noborder centpercent">';
+		$latestwarehouse .= '<tr class="liste_titre">';
+		$latestwarehouse .= '<th>';
+		$latestwarehouse .= $langs->trans("LatestModifiedWarehouses", $max);
+		//$latestwarehouse .= '<a href="'.DOL_URL_ROOT.'/product/stock/list.php">';
+		// TODO: "search_status" on "/product/stock/list.php" currently only accept a single integer value
+		//print '<a href="'.DOL_URL_ROOT.'/product/stock/list.php?search_status='.Entrepot::STATUS_CLOSED.','.Entrepot::STATUS_OPEN_ALL.'">';
+		//$latestwarehouse .= '<span class="badge">'.$num.'</span>';
+		$latestwarehouse .= '</th><th class="right">';
+		$latestwarehouse .= '<a href="'.DOL_URL_ROOT.'/product/stock/list.php?sortfield=p.tms&sortorder=DESC">';
+		$latestwarehouse .= img_picto($langs->trans("FullList"), 'stock');
+		$latestwarehouse .= '</a>';
+		$latestwarehouse .= '</th>';
+		$latestwarehouse .= '</tr>';
+
+		$i = 0;
+		if ($num) {
+			while ($i < min($max, $num)) {
+				$objp = $db->fetch_object($result);
+
+				$warehouse->id = $objp->rowid;
+				$warehouse->statut = $objp->status;
+				$warehouse->label = $objp->label;
+				$warehouse->lieu = $objp->lieu;
+
+				$latestwarehouse .= '<tr class="oddeven">';
+				$latestwarehouse .= '<td>';
+				$latestwarehouse .= $warehouse->getNomUrl(1);
+				$latestwarehouse .= '</td>'."\n";
+				$latestwarehouse .= '<td class="right">';
+				$latestwarehouse .= $warehouse->getLibStatut(5);
+				$latestwarehouse .= '</td>';
+				$latestwarehouse .= "</tr>\n";
+				$i++;
+			}
+			$db->free($result);
+		} else {
+			$latestwarehouse .= '<tr><td>'.$langs->trans("None").'</td><td></td></tr>';
+		}
+		/*if ($num > $max) {
+			$latestwarehouse .= '<tr><td><span class="opacitymedium">'.$langs->trans("More").'...</span></td><td></td></tr>';
+		}*/
+
+		$latestwarehouse .= "</table>";
+		$latestwarehouse .= '</div>';
+		$latestwarehouse .= '<br>';
+	} else {
+		dol_print_error($db);
+	}
+}
+
+
+$latestmovement = '';
+if (isModEnabled('product')) {
+	// Latest movements
+	$sql = "SELECT p.rowid, p.label as produit, p.tobatch, p.tosell, p.tobuy,";
+	$sql .= " e.ref as warehouse_ref, e.rowid as warehouse_id, e.ref as warehouse_label, e.lieu, e.statut as warehouse_status,";
+	$sql .= " m.rowid as mid, m.value as qty, m.datem, m.batch, m.eatby, m.sellby";
+	$sql .= " FROM ".MAIN_DB_PREFIX."entrepot as e";
+	$sql .= ", ".MAIN_DB_PREFIX."stock_mouvement as m";
+	$sql .= ", ".MAIN_DB_PREFIX."product as p";
+	$sql .= " WHERE m.fk_product = p.rowid";
+	$sql .= " AND m.fk_entrepot = e.rowid";
+	$sql .= " AND e.entity IN (".getEntity('stock').")";
+	if (!getDolGlobalString('STOCK_SUPPORTS_SERVICES')) {
+		$sql .= " AND p.fk_product_type = ".Product::TYPE_PRODUCT;
+	}
+	$sql .= $db->order("datem", "DESC");
+	$sql .= $db->plimit($max, 0);
+
+	dol_syslog("Index:list stock movements", LOG_DEBUG);
+	$resql = $db->query($sql);
+	if ($resql) {
+		$num = $db->num_rows($resql);
+
+		$latestmovement .= '<div class="div-table-responsive-no-min">';
+		$latestmovement .= '<table class="noborder centpercent">';
+		$latestmovement .= '<tr class="liste_titre">';
+		$latestmovement .= '<th>'.$langs->trans("LastMovements", min($num, $max)).'</th>';
+		$latestmovement .= '<th>'.$langs->trans("Product").'</th>';
+		if (isModEnabled('productbatch')) {
+			$latestmovement .= '<th>'.$langs->trans("Batch").'</th>';
+		}
+		$latestmovement .= '<th>'.$langs->trans("Warehouse").'</th>';
+		$latestmovement .= '<th class="right"><a class="notasortlink" href="'.DOL_URL_ROOT.'/product/stock/movement_list.php">';
+		$latestmovement .= img_picto($langs->trans("FullList"), 'movement');
+		$latestmovement .= '</a></th>';
+		$latestmovement .= "</tr>\n";
+
+		$tmplotstatic = new Productlot($db);
+
+		$i = 0;
+		while ($i < min($num, $max)) {
+			$objp = $db->fetch_object($resql);
+
+			$producttmp->id = $objp->rowid;
+			$producttmp->ref = $objp->produit;
+			$producttmp->status_batch = $objp->tobatch;
+			$producttmp->status_sell = $objp->tosell;
+			$producttmp->status_buy = $objp->tobuy;
+
+			$warehouse->id = $objp->warehouse_id;
+			$warehouse->ref = $objp->warehouse_ref;
+			$warehouse->statut = $objp->warehouse_status;
+			$warehouse->label = $objp->warehouse_label;
+			$warehouse->lieu = $objp->lieu;
+
+			$tmplotstatic->batch = $objp->batch;
+			$tmplotstatic->sellby = $objp->sellby;
+			$tmplotstatic->eatby = $objp->eatby;
+
+			$latestmovement .= '<tr class="oddeven">';
+			$latestmovement .= '<td class="nowraponall">'.img_picto($langs->trans("Ref").' '.$objp->mid, 'movement', 'class="pictofixedwidth"').dol_print_date($db->jdate($objp->datem), 'dayhour').'</td>';
+			$latestmovement .= '<td class="tdoverflowmax150">';
+			$latestmovement .= $producttmp->getNomUrl(1);
+			$latestmovement .= "</td>\n";
+			if (isModEnabled('productbatch')) {
+				$latestmovement .= '<td>';
+				$latestmovement .= $tmplotstatic->getNomUrl(0, 'nolink');
+				$latestmovement .= '</td>';
+				/*if (empty($conf->global->PRODUCT_DISABLE_SELLBY)) {
+				 print '<td>'.dol_print_date($db->jdate($objp->sellby), 'day').'</td>';
+				 }
+				 if (empty($conf->global->PRODUCT_DISABLE_EATBY)) {
+				 print '<td>'.dol_print_date($db->jdate($objp->eatby), 'day').'</td>';
+				 }*/
+			}
+			$latestmovement .= '<td class="tdoverflowmax150">';
+			$latestmovement .= $warehouse->getNomUrl(1);
+			$latestmovement .= "</td>\n";
+			$latestmovement .= '<td class="right">';
+			if ($objp->qty < 0) {
+				$latestmovement .= '<span class="stockmovementexit">';
+			}
+			if ($objp->qty > 0) {
+				$latestmovement .= '<span class="stockmovemententry">';
+				$latestmovement .= '+';
+			}
+			$latestmovement .= $objp->qty;
+			$latestmovement .= '</span>';
+			$latestmovement .= '</td>';
+			$latestmovement .= "</tr>\n";
+			$i++;
+		}
+		$db->free($resql);
+
+		$latestmovement .= "</table>";
+		$latestmovement .= '</div>';
+		$latestmovement .= '<br>';
+	} else {
+		dol_print_error($db);
+	}
+}
 
 // TODO Move this into a page that should be available into menu "accountancy - report - turnover - per quarter"
 // Also method used for counting must provide the 2 possible methods like done by all other reports into menu "accountancy - report - turnover":
@@ -468,6 +648,8 @@ $boxlist .= "</div>\n";
 
 $boxlist .= '<div class="secondcolumn fichehalfright boxhalfright" id="boxhalfright">';
 $boxlist .= $lastmodified;
+$boxlist .= $latestwarehouse;
+$boxlist .= $latestmovement;
 $boxlist .= $resultboxes['boxlistb'];
 $boxlist .= '</div>'."\n";
 
diff --git a/htdocs/product/stock/class/api_stockmovements.class.php b/htdocs/product/stock/class/api_stockmovements.class.php
index e2457e09f8d..485aebbc9e6 100644
--- a/htdocs/product/stock/class/api_stockmovements.class.php
+++ b/htdocs/product/stock/class/api_stockmovements.class.php
@@ -75,7 +75,7 @@ class StockMovements extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('warehouse',$this->stockmovement->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($this->stockmovement);
@@ -228,7 +228,7 @@ class StockMovements extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('stock',$this->stockmovement->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach($request_data as $field => $value) {
@@ -260,7 +260,7 @@ class StockMovements extends DolibarrApi
 		}
 
 		if (! DolibarrApi::_checkAccessToResource('stock',$this->stockmovement->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (! $this->stockmovement->delete(DolibarrApiAccess::$user)) {
diff --git a/htdocs/product/stock/class/api_warehouses.class.php b/htdocs/product/stock/class/api_warehouses.class.php
index 1af08af0534..ecea11b5dea 100644
--- a/htdocs/product/stock/class/api_warehouses.class.php
+++ b/htdocs/product/stock/class/api_warehouses.class.php
@@ -72,7 +72,7 @@ class Warehouses extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('stock', $this->warehouse->id, 'entrepot')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($this->warehouse);
@@ -173,11 +173,11 @@ class Warehouses extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->warehouse->context['caller'] = $request_data['caller'];
+				$this->warehouse->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->warehouse->$field = $value;
+			$this->warehouse->$field = $this->_checkValForAPI($field, $value, $this->warehouse);
 		}
 		if ($this->warehouse->create(DolibarrApiAccess::$user) < 0) {
 			throw new RestException(500, "Error creating warehouse", array_merge(array($this->warehouse->error), $this->warehouse->errors));
@@ -204,7 +204,7 @@ class Warehouses extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('stock', $this->warehouse->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($request_data as $field => $value) {
@@ -213,11 +213,11 @@ class Warehouses extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->warehouse->context['caller'] = $request_data['caller'];
+				$this->warehouse->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->warehouse->$field = $value;
+			$this->warehouse->$field = $this->_checkValForAPI($field, $value, $this->warehouse);
 		}
 
 		if ($this->warehouse->update($id, DolibarrApiAccess::$user)) {
@@ -244,7 +244,7 @@ class Warehouses extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('stock', $this->warehouse->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->warehouse->delete(DolibarrApiAccess::$user)) {
diff --git a/htdocs/product/stock/massstockmove.php b/htdocs/product/stock/massstockmove.php
index 8963040b36e..77c23f943c4 100644
--- a/htdocs/product/stock/massstockmove.php
+++ b/htdocs/product/stock/massstockmove.php
@@ -308,7 +308,7 @@ if ($action == 'createmovements' && $user->hasRight('stock', 'mouvement', 'creer
 
 		$db->commit();
 		setEventMessages($langs->trans("StockMovementRecorded"), null, 'mesgs');
-		header("Location: ".DOL_URL_ROOT.'/product/stock/index.php'); // Redirect to avoid pb when using back
+		header("Location: ".DOL_URL_ROOT.'/product/stock/list.php'); // Redirect to avoid pb when using back
 		exit;
 	} else {
 		$db->rollback();
diff --git a/htdocs/product/stock/movement_list.php b/htdocs/product/stock/movement_list.php
index 34c08a3186f..99305884287 100644
--- a/htdocs/product/stock/movement_list.php
+++ b/htdocs/product/stock/movement_list.php
@@ -64,8 +64,8 @@ $mode       = GETPOST('mode', 'aZ'); // The output mode ('list', 'kanban', 'hier
 $id = GETPOSTINT('id');
 $ref = GETPOST('ref', 'alpha');
 $msid = GETPOSTINT('msid');
-$idproduct = GETPOSTINT('idproduct');
-$product_id = GETPOSTINT("product_id");
+$idproduct = GETPOST('idproduct', 'intcomma');
+$product_id = GETPOST("product_id", 'intcomma');
 $show_files = GETPOSTINT('show_files');
 
 $search_all = trim((GETPOST('search_all', 'alphanohtml') != '') ? GETPOST('search_all', 'alphanohtml') : GETPOST('sall', 'alphanohtml'));
@@ -86,8 +86,8 @@ $search_inventorycode = trim(GETPOST("search_inventorycode"));
 $search_user = trim(GETPOST("search_user"));
 $search_batch = trim(GETPOST("search_batch"));
 $search_qty = trim(GETPOST("search_qty"));
-$search_type_mouvement = GETPOSTINT('search_type_mouvement');
-$search_fk_project = GETPOSTINT("search_fk_project");
+$search_type_mouvement = GETPOST('search_type_mouvement');
+$search_fk_project = GETPOST("search_fk_project");
 
 $type = GETPOSTINT("type");
 
diff --git a/htdocs/product/stock/replenish.php b/htdocs/product/stock/replenish.php
index e83e505f3e0..53a0b5060e7 100644
--- a/htdocs/product/stock/replenish.php
+++ b/htdocs/product/stock/replenish.php
@@ -845,7 +845,9 @@ while ($i < ($limit ? min($num, $limit) : $num)) {
 			}
 		} else {
 			$stock = $prod->stock_reel;
-			$stockwarehouse = $prod->stock_warehouse[$fk_entrepot]->real;
+			if (getDolGlobalString('STOCK_ALLOW_ADD_LIMIT_STOCK_BY_WAREHOUSE') && $fk_entrepot > 0) {
+				$stockwarehouse = $prod->stock_warehouse[$fk_entrepot]->real;
+			}
 		}
 
 		// Force call prod->load_stats_xxx to choose status to count (otherwise it is loaded by load_stock function)
diff --git a/htdocs/projet/class/api_projects.class.php b/htdocs/projet/class/api_projects.class.php
index b3637643169..cae608e5c5e 100644
--- a/htdocs/projet/class/api_projects.class.php
+++ b/htdocs/projet/class/api_projects.class.php
@@ -77,18 +77,78 @@ class Projects extends DolibarrApi
 
 		$result = $this->project->fetch($id);
 		if (!$result) {
-			throw new RestException(404, 'Project not found');
+			throw new RestException(404, 'Project with supplied id not found');
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('project', $this->project->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->project->fetchObjectLinked();
 		return $this->_cleanObjectDatas($this->project);
 	}
 
+	/**
+	 * Get properties of a project object
+	 *
+	 * Return an array with project information
+	 *
+	 * @param	string	$ref			Ref of project
+	 * @return  Object					Object with cleaned properties
+	 *
+	 * @url GET ref/{ref}
+	 *
+	 * @throws	RestException
+	 */
+	public function getByRef($ref)
+	{
+		if (!DolibarrApiAccess::$user->hasRight('projet', 'lire')) {
+			throw new RestException(403);
+		}
 
+		$result = $this->project->fetch('', $ref);
+		if (!$result) {
+			throw new RestException(404, 'Project with supplied ref not found');
+		}
+
+		if (!DolibarrApi::_checkAccessToResource('project', $this->project->id)) {
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+		}
+
+		$this->project->fetchObjectLinked();
+		return $this->_cleanObjectDatas($this->project);
+	}
+
+	/**
+	 * Get properties of a project object
+	 *
+	 * Return an array with project information
+	 *
+	 * @param	string	$email_msgid	Email msgid of project
+	 * @return  Object					Object with cleaned properties
+	 *
+	 * @url GET email_msgid/{email_msgid}
+	 *
+	 * @throws	RestException
+	 */
+	public function getByMsgId($email_msgid)
+	{
+		if (!DolibarrApiAccess::$user->hasRight('projet', 'lire')) {
+			throw new RestException(403);
+		}
+
+		$result = $this->project->fetch('', '', '', $email_msgid);
+		if (!$result) {
+			throw new RestException(404, 'Project with supplied email_msgid not found');
+		}
+
+		if (!DolibarrApi::_checkAccessToResource('project', $this->project->id)) {
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+		}
+
+		$this->project->fetchObjectLinked();
+		return $this->_cleanObjectDatas($this->project);
+	}
 
 	/**
 	 * List projects
@@ -202,11 +262,11 @@ class Projects extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->project->context['caller'] = $request_data['caller'];
+				$this->project->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->project->$field = $value;
+			$this->project->$field = $this->_checkValForAPI($field, $value, $this->project);
 		}
 		/*if (isset($request_data["lines"])) {
 		  $lines = array();
@@ -244,7 +304,7 @@ class Projects extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('project', $this->project->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$this->project->getLinesArray(DolibarrApiAccess::$user);
 		$result = array();
@@ -284,7 +344,7 @@ class Projects extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('project', $this->project->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		require_once DOL_DOCUMENT_ROOT.'/projet/class/task.class.php';
@@ -327,7 +387,7 @@ class Projects extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('project',$this->project->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -394,7 +454,7 @@ class Projects extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('project',$this->project->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -454,7 +514,7 @@ class Projects extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('project', $this->project->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		foreach ($request_data as $field => $value) {
 			if ($field == 'id') {
@@ -462,11 +522,11 @@ class Projects extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->project->context['caller'] = $request_data['caller'];
+				$this->project->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->project->$field = $value;
+			$this->project->$field = $this->_checkValForAPI($field, $value, $this->project);
 		}
 
 		if ($this->project->update(DolibarrApiAccess::$user) >= 0) {
@@ -494,7 +554,7 @@ class Projects extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('project', $this->project->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->project->delete(DolibarrApiAccess::$user)) {
@@ -538,7 +598,7 @@ class Projects extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('project', $this->project->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->project->setValid(DolibarrApiAccess::$user, $notrigger);
diff --git a/htdocs/projet/class/api_tasks.class.php b/htdocs/projet/class/api_tasks.class.php
index 89907456672..2188087a220 100644
--- a/htdocs/projet/class/api_tasks.class.php
+++ b/htdocs/projet/class/api_tasks.class.php
@@ -77,7 +77,7 @@ class Tasks extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('task', $this->task->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if ($includetimespent == 1) {
@@ -198,11 +198,11 @@ class Tasks extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->task->context['caller'] = $request_data['caller'];
+				$this->task->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->task->$field = $value;
+			$this->task->$field = $this->_checkValForAPI($field, $value, $this->task);
 		}
 		/*if (isset($request_data["lines"])) {
 		  $lines = array();
@@ -239,7 +239,7 @@ class Tasks extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('project',$this->project->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$this->project->getLinesArray(DolibarrApiAccess::$user);
 		$result = array();
@@ -284,7 +284,7 @@ class Tasks extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('tasks', $this->task->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$usert = DolibarrApiAccess::$user;
@@ -325,7 +325,7 @@ class Tasks extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('project',$this->project->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -392,7 +392,7 @@ class Tasks extends DolibarrApi
 		}
 
 		if( ! DolibarrApi::_checkAccessToResource('project',$this->project->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -451,7 +451,7 @@ class Tasks extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('task', $this->task->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		foreach ($request_data as $field => $value) {
 			if ($field == 'id') {
@@ -459,11 +459,17 @@ class Tasks extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->task->context['caller'] = $request_data['caller'];
+				$this->task->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
+				continue;
+			}
+			if ($field == 'array_options' && is_array($value)) {
+				foreach ($value as $index => $val) {
+					$this->task->array_options[$index] = $this->_checkValForAPI($field, $val, $this->task);;
+				}
 				continue;
 			}
 
-			$this->task->$field = $value;
+			$this->task->$field = $this->_checkValForAPI($field, $value, $this->task);
 		}
 
 		if ($this->task->update(DolibarrApiAccess::$user) > 0) {
@@ -491,7 +497,7 @@ class Tasks extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('task', $this->task->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->task->delete(DolibarrApiAccess::$user)) {
@@ -534,7 +540,7 @@ class Tasks extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('project', $this->task->fk_project)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$uid = $user_id;
@@ -590,7 +596,7 @@ class Tasks extends DolibarrApi
 		$this->timespentRecordChecks($id, $timespent_id);
 
 		if (!DolibarrApi::_checkAccessToResource('task', $this->task->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$newdate = dol_stringtotime($date, 1);
@@ -635,7 +641,7 @@ class Tasks extends DolibarrApi
 		$this->timespentRecordChecks($id, $timespent_id);
 
 		if (!DolibarrApi::_checkAccessToResource('task', $this->task->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if ($this->task->delTimeSpent(DolibarrApiAccess::$user, 0) < 0) {
diff --git a/htdocs/projet/tasks/list.php b/htdocs/projet/tasks/list.php
index d4a51ee90f4..34be3bb5c3f 100644
--- a/htdocs/projet/tasks/list.php
+++ b/htdocs/projet/tasks/list.php
@@ -1127,7 +1127,7 @@ if (getDolGlobalString('PROJECT_TIMES_SPENT_FORMAT')) {
 // --------------------------------------------------------------------
 $i = 0;
 $savnbfield = $totalarray['nbfield'];
-$totalarray = array();
+
 $totalarray['nbfield'] = 0;
 $imaxinloop = ($limit ? min($num, $limit) : $num);
 while ($i < $imaxinloop) {
diff --git a/htdocs/public/website/index.php b/htdocs/public/website/index.php
index 29e389ae1bd..09d91111f63 100644
--- a/htdocs/public/website/index.php
+++ b/htdocs/public/website/index.php
@@ -81,6 +81,11 @@ $error = 0;
 $websitekey = GETPOST('website', 'alpha');
 $pageid = GETPOST('page', 'alpha') ? GETPOST('page', 'alpha') : GETPOST('pageid', 'alpha');
 $pageref = GETPOST('pageref', 'alphanohtml') ? GETPOST('pageref', 'alphanohtml') : '';
+// If page is xx/pagename, xx is a language, we set $pageref to pagename
+$reg = array();
+if (preg_match('/^(\w\w)\/(.*)$/', $pageref, $reg)) {
+	$pageref = $reg[2];
+}
 
 $accessallowed = 1;
 $type = '';
diff --git a/htdocs/reception/class/api_receptions.class.php b/htdocs/reception/class/api_receptions.class.php
index e8a035c4049..e5f646cf407 100644
--- a/htdocs/reception/class/api_receptions.class.php
+++ b/htdocs/reception/class/api_receptions.class.php
@@ -73,7 +73,7 @@ class Receptions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('reception', $this->reception->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->reception->fetchObjectLinked();
@@ -188,11 +188,11 @@ class Receptions extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->reception->context['caller'] = $request_data['caller'];
+				$this->reception->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->reception->$field = $value;
+			$this->reception->$field = $this->_checkValForAPI($field, $value, $this->reception);
 		}
 		if (isset($request_data["lines"])) {
 			$lines = array();
@@ -231,7 +231,7 @@ class Receptions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('reception',$this->reception->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$this->reception->getLinesArray();
 		$result = array();
@@ -265,7 +265,7 @@ class Receptions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('reception',$this->reception->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -333,7 +333,7 @@ class Receptions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('reception',$this->reception->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$request_data = (object) $request_data;
@@ -398,7 +398,7 @@ class Receptions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('reception', $this->reception->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		// TODO Check the lineid $lineid is a line of object
@@ -435,7 +435,7 @@ class Receptions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('reception', $this->reception->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		foreach ($request_data as $field => $value) {
 			if ($field == 'id') {
@@ -443,11 +443,11 @@ class Receptions extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->reception->context['caller'] = $request_data['caller'];
+				$this->reception->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->reception->$field = $value;
+			$this->reception->$field = $this->_checkValForAPI($field, $value, $this->reception);
 		}
 
 		if ($this->reception->update(DolibarrApiAccess::$user) > 0) {
@@ -474,7 +474,7 @@ class Receptions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('reception', $this->reception->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->reception->delete(DolibarrApiAccess::$user)) {
@@ -519,7 +519,7 @@ class Receptions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('reception', $this->reception->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->reception->valid(DolibarrApiAccess::$user, $notrigger);
@@ -642,7 +642,7 @@ class Receptions extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('reception', $this->reception->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->reception->setClosed();
diff --git a/htdocs/reception/list.php b/htdocs/reception/list.php
index 73020077bc5..280d8b31459 100644
--- a/htdocs/reception/list.php
+++ b/htdocs/reception/list.php
@@ -487,7 +487,7 @@ if (empty($reshook)) {
 								$product_type,
 								$rang,
 								false,
-								0,
+								array(),
 								null,
 								$lines[$i]->rowid,
 								0,
diff --git a/htdocs/recruitment/class/api_recruitments.class.php b/htdocs/recruitment/class/api_recruitments.class.php
index 030c9c81e69..59f9c7e2df0 100644
--- a/htdocs/recruitment/class/api_recruitments.class.php
+++ b/htdocs/recruitment/class/api_recruitments.class.php
@@ -329,7 +329,7 @@ class Recruitments extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->jobposition->context['caller'] = $request_data['caller'];
+				$this->jobposition->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -367,7 +367,7 @@ class Recruitments extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->jobposition->context['caller'] = $request_data['caller'];
+				$this->jobposition->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -415,7 +415,7 @@ class Recruitments extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->jobposition->context['caller'] = $request_data['caller'];
+				$this->jobposition->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -464,7 +464,7 @@ class Recruitments extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->candidature->context['caller'] = $request_data['caller'];
+				$this->candidature->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
diff --git a/htdocs/resource/class/dolresource.class.php b/htdocs/resource/class/dolresource.class.php
index a1ab7ab07f7..36b6dfd78d0 100644
--- a/htdocs/resource/class/dolresource.class.php
+++ b/htdocs/resource/class/dolresource.class.php
@@ -128,7 +128,7 @@ class Dolresource extends CommonObject
 	public $cache_code_type_resource;
 
 	/**
-	 * @var Dolresource Clone of object before changing it
+	 * @var static Clone of object before changing it
 	 */
 	public $oldcopy;
 
diff --git a/htdocs/salaries/virement_request.php b/htdocs/salaries/virement_request.php
index 2c9b444655e..e4aeb57fd4f 100644
--- a/htdocs/salaries/virement_request.php
+++ b/htdocs/salaries/virement_request.php
@@ -3,6 +3,7 @@
  * Copyright (C) 2015       Charlie BENKE        <charlie@patas-monkey.com>
  * Copyright (C) 2017-2019  Alexandre Spangaro   <aspangaro@open-dsi.fr>
  * Copyright (C) 2021		Gauthier VERDOL         <gauthier.verdol@atm-consulting.fr>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -117,7 +118,7 @@ if ($type == 'bank-transfer') {
 // Load object
 if ($id > 0 || !empty($ref)) {
 	$ret = $object->fetch($id, $ref);
-	$isdraft = (($obj->statut == FactureFournisseur::STATUS_DRAFT) ? 1 : 0);
+	$isdraft = (($obj->status == FactureFournisseur::STATUS_DRAFT) ? 1 : 0);
 	if ($ret > 0) {
 		$object->fetch_thirdparty();
 	}
@@ -346,21 +347,21 @@ print '<div class="fichehalfright">';
 /*
 	 * Payments
 	 */
-	$sql = "SELECT p.rowid, p.num_payment as num_payment, p.datep as dp, p.amount,";
-	$sql .= " c.code as type_code,c.libelle as paiement_type,";
-	$sql .= ' ba.rowid as baid, ba.ref as baref, ba.label, ba.number as banumber, ba.account_number, ba.currency_code as bacurrency_code, ba.fk_accountancy_journal';
-	$sql .= " FROM ".MAIN_DB_PREFIX."payment_salary as p";
-	$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'bank as b ON p.fk_bank = b.rowid';
-	$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'bank_account as ba ON b.fk_account = ba.rowid';
-	$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_paiement as c ON p.fk_typepayment = c.id";
-	$sql .= ", ".MAIN_DB_PREFIX."salary as s";
-	$sql .= " WHERE p.fk_salary = ".((int) $id);
-	$sql .= " AND p.fk_salary = s.rowid";
-	$sql .= " AND s.entity IN (".getEntity('tax').")";
-	$sql .= " ORDER BY dp DESC";
+$sql = "SELECT p.rowid, p.num_payment as num_payment, p.datep as dp, p.amount,";
+$sql .= " c.code as type_code,c.libelle as paiement_type,";
+$sql .= ' ba.rowid as baid, ba.ref as baref, ba.label, ba.number as banumber, ba.account_number, ba.currency_code as bacurrency_code, ba.fk_accountancy_journal';
+$sql .= " FROM ".MAIN_DB_PREFIX."payment_salary as p";
+$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'bank as b ON p.fk_bank = b.rowid';
+$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'bank_account as ba ON b.fk_account = ba.rowid';
+$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_paiement as c ON p.fk_typepayment = c.id";
+$sql .= ", ".MAIN_DB_PREFIX."salary as s";
+$sql .= " WHERE p.fk_salary = ".((int) $id);
+$sql .= " AND p.fk_salary = s.rowid";
+$sql .= " AND s.entity IN (".getEntity('tax').")";
+$sql .= " ORDER BY dp DESC";
 
-	//print $sql;
-	$resql = $db->query($sql);
+//print $sql;
+$resql = $db->query($sql);
 if ($resql) {
 	$totalpaid = 0;
 
@@ -450,23 +451,23 @@ print dol_get_fiche_end();
 print '<div class="tabsAction">'."\n";
 
 $sql = "SELECT pfd.rowid, pfd.traite, pfd.date_demande as date_demande,";
-	$sql .= " pfd.date_traite as date_traite, pfd.amount, pfd.fk_prelevement_bons,";
-	$sql .= " pb.ref, pb.date_trans, pb.method_trans, pb.credite, pb.date_credit, pb.datec, pb.statut as status, pb.amount as pb_amount,";
-	$sql .= " u.rowid as user_id, u.email, u.lastname, u.firstname, u.login, u.statut as user_status";
-	$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_demande as pfd";
-	$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."user as u on pfd.fk_user_demande = u.rowid";
-	$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."prelevement_bons as pb ON pb.rowid = pfd.fk_prelevement_bons";
+$sql .= " pfd.date_traite as date_traite, pfd.amount, pfd.fk_prelevement_bons,";
+$sql .= " pb.ref, pb.date_trans, pb.method_trans, pb.credite, pb.date_credit, pb.datec, pb.statut as status, pb.amount as pb_amount,";
+$sql .= " u.rowid as user_id, u.email, u.lastname, u.firstname, u.login, u.statut as user_status";
+$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_demande as pfd";
+$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."user as u on pfd.fk_user_demande = u.rowid";
+$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."prelevement_bons as pb ON pb.rowid = pfd.fk_prelevement_bons";
 if ($type == 'salaire') {
 	$sql .= " WHERE pfd.fk_salary = ".((int) $object->id);
 } else {
 	$sql .= " WHERE fk_facture = ".((int) $object->id);
 }
-	$sql .= " AND pfd.traite = 0";
-	$sql .= " AND pfd.type = 'ban'";
-	$sql .= " ORDER BY pfd.date_demande DESC";
-	$resql = $db->query($sql);
+$sql .= " AND pfd.traite = 0";
+$sql .= " AND pfd.type = 'ban'";
+$sql .= " ORDER BY pfd.date_demande DESC";
+$resql = $db->query($sql);
 
-	$hadRequest = $db->num_rows($resql);
+$hadRequest = $db->num_rows($resql);
 if ($object->paye == 0 && $hadRequest == 0) {
 	if ($resteapayer > 0) {
 		if ($user_perms) {
@@ -528,31 +529,31 @@ $bprev = new BonPrelevement($db);
 	 * Withdrawals
 	 */
 
-	print '<div class="div-table-responsive-no-min">';
-	print '<table class="noborder centpercent">';
+print '<div class="div-table-responsive-no-min">';
+print '<table class="noborder centpercent">';
 
-	print '<tr class="liste_titre">';
-	 // Action column
+print '<tr class="liste_titre">';
+// Action column
 if (getDolGlobalString('MAIN_CHECKBOX_LEFT_COLUMN')) {
 	print '<td>&nbsp;</td>';
 }
-	print '<td class="left">'.$langs->trans("DateRequest").'</td>';
-	print '<td>'.$langs->trans("User").'</td>';
-	print '<td class="center">'.$langs->trans("Amount").'</td>';
-	print '<td class="center">'.$langs->trans("DateProcess").'</td>';
+print '<td class="left">'.$langs->trans("DateRequest").'</td>';
+print '<td>'.$langs->trans("User").'</td>';
+print '<td class="center">'.$langs->trans("Amount").'</td>';
+print '<td class="center">'.$langs->trans("DateProcess").'</td>';
 if ($type == 'bank-transfer') {
 	print '<td class="center">'.$langs->trans("BankTransferReceipt").'</td>';
 } else {
 	print '<td class="center">'.$langs->trans("WithdrawalReceipt").'</td>';
 }
-	print '<td>&nbsp;</td>';
-	 // Action column
+print '<td>&nbsp;</td>';
+// Action column
 if (!getDolGlobalString('MAIN_CHECKBOX_LEFT_COLUMN')) {
 	print '<td>&nbsp;</td>';
 }
-	print '</tr>';
+print '</tr>';
 
-	$num = 0;
+$num = 0;
 if ($resql) {
 	$i = 0;
 
@@ -653,25 +654,25 @@ if ($resql) {
 	dol_print_error($db);
 }
 
-	// Past requests when bon prelevement
+// Past requests when bon prelevement
 
-	$sql = "SELECT pfd.rowid, pfd.traite, pfd.date_demande as date_demande,";
-	$sql .= " pfd.date_traite as date_traite, pfd.amount, pfd.fk_prelevement_bons,";
-	$sql .= " pb.ref, pb.date_trans, pb.method_trans, pb.credite, pb.date_credit, pb.datec, pb.statut as status, pb.amount as pb_amount,";
-	$sql .= " u.rowid as user_id, u.email, u.lastname, u.firstname, u.login, u.statut as user_status";
-	$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_demande as pfd";
-	$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."user as u on pfd.fk_user_demande = u.rowid";
-	$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."prelevement_bons as pb ON pb.rowid = pfd.fk_prelevement_bons";
+$sql = "SELECT pfd.rowid, pfd.traite, pfd.date_demande as date_demande,";
+$sql .= " pfd.date_traite as date_traite, pfd.amount, pfd.fk_prelevement_bons,";
+$sql .= " pb.ref, pb.date_trans, pb.method_trans, pb.credite, pb.date_credit, pb.datec, pb.statut as status, pb.amount as pb_amount,";
+$sql .= " u.rowid as user_id, u.email, u.lastname, u.firstname, u.login, u.statut as user_status";
+$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_demande as pfd";
+$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."user as u on pfd.fk_user_demande = u.rowid";
+$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."prelevement_bons as pb ON pb.rowid = pfd.fk_prelevement_bons";
 if ($type == 'salaire') {
 	$sql .= " WHERE pfd.fk_salary = ".((int) $object->id);
 } else {
 	$sql .= " WHERE fk_facture = ".((int) $object->id);
 }
-	$sql .= " AND pfd.traite = 1";
-	$sql .= " AND pfd.type = 'ban'";
-	$sql .= " ORDER BY pfd.date_demande DESC";
+$sql .= " AND pfd.traite = 1";
+$sql .= " AND pfd.type = 'ban'";
+$sql .= " ORDER BY pfd.date_demande DESC";
 
-	$resql = $db->query($sql);
+$resql = $db->query($sql);
 if ($resql) {
 	$numOfBp = $db->num_rows($resql);
 	$i = 0;
@@ -766,8 +767,8 @@ if ($num == 0 && $numOfBp == 0) {
 	print '<tr class="oddeven"><td colspan="7"><span class="opacitymedium">'.$langs->trans("None").'</span></td></tr>';
 }
 
-	print "</table>";
-	print '</div>';
+print "</table>";
+print '</div>';
 
 // End of page
 llxFooter();
diff --git a/htdocs/societe/class/api_contacts.class.php b/htdocs/societe/class/api_contacts.class.php
index db6e2158e1f..4ff0235e74f 100644
--- a/htdocs/societe/class/api_contacts.class.php
+++ b/htdocs/societe/class/api_contacts.class.php
@@ -87,7 +87,7 @@ class Contacts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contact', $this->contact->id, 'socpeople&societe')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if ($includecount) {
@@ -135,7 +135,7 @@ class Contacts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contact', $this->contact->id, 'socpeople&societe')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if ($includecount) {
@@ -288,12 +288,12 @@ class Contacts extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->contact->context['caller'] = $request_data['caller'];
+				$this->contact->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 			if ($field == 'array_options' && is_array($value)) {
 				foreach ($value as $index => $val) {
-					$this->contact->array_options[$index] = $val;
+					$this->contact->array_options[$index] = $this->_checkValForAPI('extrafields', $val, $this->contact);
 				}
 				continue;
 			}
@@ -328,7 +328,7 @@ class Contacts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contact', $this->contact->id, 'socpeople&societe')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($request_data as $field => $value) {
@@ -337,12 +337,12 @@ class Contacts extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->contact->context['caller'] = $request_data['caller'];
+				$this->contact->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 			if ($field == 'array_options' && is_array($value)) {
 				foreach ($value as $index => $val) {
-					$this->contact->array_options[$index] = $val;
+					$this->contact->array_options[$index] = $this->_checkValForAPI('extrafields', $val, $this->contact);
 				}
 				continue;
 			}
@@ -378,7 +378,7 @@ class Contacts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contact', $this->contact->id, 'socpeople&societe')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$this->contact->oldcopy = clone $this->contact;
 		return $this->contact->delete(DolibarrApiAccess::$user);
@@ -498,10 +498,10 @@ class Contacts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contact', $this->contact->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		if (!DolibarrApi::_checkAccessToResource('category', $category->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$category->add_type($this->contact, 'contact');
@@ -538,10 +538,10 @@ class Contacts extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('contact', $this->contact->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		if (!DolibarrApi::_checkAccessToResource('category', $category->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$category->del_type($this->contact, 'contact');
diff --git a/htdocs/societe/class/api_thirdparties.class.php b/htdocs/societe/class/api_thirdparties.class.php
index 1735efc4f7f..15cbe1d4d1f 100644
--- a/htdocs/societe/class/api_thirdparties.class.php
+++ b/htdocs/societe/class/api_thirdparties.class.php
@@ -256,7 +256,7 @@ class Thirdparties extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->company->context['caller'] = $request_data['caller'];
+				$this->company->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -292,7 +292,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $this->company->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($request_data as $field => $value) {
@@ -301,7 +301,7 @@ class Thirdparties extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->company->context['caller'] = $request_data['caller'];
+				$this->company->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -349,7 +349,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $this->company->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$companytoremove = new Societe($this->db);
@@ -359,7 +359,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $companytoremove->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$user = DolibarrApiAccess::$user;
@@ -387,7 +387,7 @@ class Thirdparties extends DolibarrApi
 			throw new RestException(404, 'Thirdparty not found');
 		}
 		if (!DolibarrApi::_checkAccessToResource('societe', $this->company->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$this->company->oldcopy = clone $this->company;
 
@@ -493,7 +493,7 @@ class Thirdparties extends DolibarrApi
 			throw new RestException(404, 'User not found');
 		}
 		if (!DolibarrApi::_checkAccessToResource('societe', $this->company->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$result = $this->company->add_commercial(DolibarrApiAccess::$user, $representative_id);
 
@@ -527,7 +527,7 @@ class Thirdparties extends DolibarrApi
 			throw new RestException(404, 'User not found');
 		}
 		if (!DolibarrApi::_checkAccessToResource('societe', $this->company->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		$result = $this->company->del_commercial(DolibarrApiAccess::$user, $representative_id);
 
@@ -598,10 +598,10 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $this->company->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		if (!DolibarrApi::_checkAccessToResource('category', $category->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$category->add_type($this->company, 'customer');
@@ -636,10 +636,10 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $this->company->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		if (!DolibarrApi::_checkAccessToResource('category', $category->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$category->del_type($this->company, 'customer');
@@ -713,10 +713,10 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $this->company->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		if (!DolibarrApi::_checkAccessToResource('category', $category->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$category->add_type($this->company, 'supplier');
@@ -751,10 +751,10 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $this->company->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		if (!DolibarrApi::_checkAccessToResource('category', $category->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$category->del_type($this->company, 'supplier');
@@ -788,7 +788,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->company->fetch($id);
@@ -830,7 +830,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->company->fetch($id);
@@ -871,7 +871,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->company->fetch($id);
@@ -912,7 +912,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->company->fetch($id);
@@ -955,7 +955,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$result = $this->company->fetch($id);
@@ -1014,7 +1014,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		/*$result = $this->thirdparty->fetch($id);
@@ -1057,7 +1057,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		/*$result = $this->thirdparty->fetch($id);
@@ -1265,7 +1265,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		/**
@@ -1345,11 +1345,11 @@ class Thirdparties extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->company->context['caller'] = $request_data['caller'];
+				$this->company->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$account->$field = $value;
+			$account->$field = $this->_checkValForAPI('extrafields', $value, $account);
 		}
 
 		if ($account->create(DolibarrApiAccess::$user) < 0) {
@@ -1402,11 +1402,11 @@ class Thirdparties extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$account->context['caller'] = $request_data['caller'];
+				$account->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$account->$field = $value;
+			$account->$field = $this->_checkValForAPI($field, $value, $account);
 		}
 
 		if (empty($account->rum)) {
@@ -1562,7 +1562,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		/**
@@ -1654,11 +1654,11 @@ class Thirdparties extends DolibarrApi
 			foreach ($request_data as $field => $value) {
 				if ($field === 'caller') {
 					// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-					$account->context['caller'] = $request_data['caller'];
+					$account->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 					continue;
 				}
 
-				$account->$field = $value;
+				$account->$field = $this->_checkValForAPI($field, $value, $account);
 			}
 
 			if ($account->create(DolibarrApiAccess::$user) < 0) {
@@ -1717,11 +1717,11 @@ class Thirdparties extends DolibarrApi
 			foreach ($request_data as $field => $value) {
 				if ($field === 'caller') {
 					// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-					$account->context['caller'] = $request_data['caller'];
+					$account->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 					continue;
 				}
 
-				$account->$field = $value;
+				$account->$field = $this->_checkValForAPI($field, $value, $account);
 			}
 
 			$account->fk_soc = $id;
@@ -1756,11 +1756,11 @@ class Thirdparties extends DolibarrApi
 			foreach ($request_data as $field => $value) {
 				if ($field === 'caller') {
 					// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-					$account->context['caller'] = $request_data['caller'];
+					$account->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 					continue;
 				}
 
-				$account->$field = $value;
+				$account->$field = $this->_checkValForAPI($field, $value, $account);
 			}
 
 			if ($account->update(DolibarrApiAccess::$user) < 0) {
@@ -1818,11 +1818,11 @@ class Thirdparties extends DolibarrApi
 			foreach ($request_data as $field => $value) {
 				if ($field === 'caller') {
 					// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-					$account->context['caller'] = $request_data['caller'];
+					$account->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 					continue;
 				}
 
-				$account->$field = $value;
+				$account->$field = $this->_checkValForAPI($field, $value, $account);
 			}
 
 			if ($account->update(DolibarrApiAccess::$user) < 0) {
@@ -2003,7 +2003,7 @@ class Thirdparties extends DolibarrApi
 		global $conf;
 
 		if (!DolibarrApiAccess::$user->hasRight('societe', 'lire')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login.'. No read permission on thirdparties.');
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login.'. No read permission on thirdparties.');
 		}
 
 		if ($rowid === 0) {
@@ -2016,7 +2016,7 @@ class Thirdparties extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('societe', $this->company->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login.' on this thirdparty');
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login.' on this thirdparty');
 		}
 		if (isModEnabled('mailing')) {
 			$this->company->getNoEmail();
diff --git a/htdocs/societe/class/societe.class.php b/htdocs/societe/class/societe.class.php
index 4723d7085bd..aecf5211359 100644
--- a/htdocs/societe/class/societe.class.php
+++ b/htdocs/societe/class/societe.class.php
@@ -145,7 +145,7 @@ class Societe extends CommonObject
 	public $restrictiononfksoc = 1;
 
 	/**
-	 * @var Societe To store a cloned copy of object before to edit it and keep track of old properties
+	 * @var static To store a cloned copy of object before to edit it and keep track of old properties
 	 */
 	public $oldcopy;
 
@@ -2498,11 +2498,11 @@ class Societe extends CommonObject
 	/**
 	 * 	Returns amount of included taxes of the current discounts/credits available from the company
 	 *
-	 *	@param	?User	$user			Filter on a user author of discounts
-	 * 	@param	string	$filter			Other filter
-	 * 	@param	integer	$maxvalue		Filter on max value for discount
-	 * 	@param	int		$discount_type	0 => customer discount, 1 => supplier discount
-	 *	@return	int						Return integer <0 if KO, Credit note amount otherwise
+	 *	@param	?User		$user			Filter on a user author of discounts
+	 * 	@param	string		$filter			Other filter
+	 * 	@param	int			$maxvalue		Filter on max value for discount
+	 * 	@param	int<0,1>	$discount_type	0 => customer discount, 1 => supplier discount
+	 *	@return	float|int<-1,-1>		Return integer <0 if KO, Credit note amount otherwise
 	 */
 	public function getAvailableDiscounts($user = null, $filter = '', $maxvalue = 0, $discount_type = 0)
 	{
diff --git a/htdocs/societe/index.php b/htdocs/societe/index.php
index 3f008867bd3..f2b5fd2b824 100644
--- a/htdocs/societe/index.php
+++ b/htdocs/societe/index.php
@@ -30,6 +30,7 @@
 // Load Dolibarr environment
 require '../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/societe/class/societe.class.php';
+require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php';
 
 
@@ -42,7 +43,6 @@ $hookmanager = new HookManager($db);
 $hookmanager->initHooks(array('thirdpartiesindex'));
 
 
-
 $socid = GETPOSTINT('socid');
 if ($user->socid) {
 	$socid = $user->socid;
@@ -52,6 +52,7 @@ if ($user->socid) {
 $result = restrictedArea($user, 'societe', 0, '', '', '', '');
 
 $thirdparty_static = new Societe($db);
+$contact_static = new Contact($db);
 
 if (!isset($form) || !is_object($form)) {
 	$form = new Form($db);
@@ -73,6 +74,8 @@ if (GETPOST('addbox')) {
 	}
 }
 
+$max = getDolGlobalInt('MAIN_SIZE_SHORTLIST_LIMIT');
+
 
 /*
  * View
@@ -86,9 +89,7 @@ llxHeader("", $langs->trans("ThirdParties"), $helpurl);
 print load_fiche_titre($transAreaType, $resultboxes['selectboxlist'], 'companies');
 
 
-/*
- * Statistics area
- */
+// Statistics area
 
 $third = array(
 		'customer' => 0,
@@ -276,7 +277,6 @@ if (isModEnabled('category') && getDolGlobalString('CATEGORY_GRAPHSTATS_ON_THIRD
 /*
  * Latest modified third parties
  */
-$max = 15;
 $sql = "SELECT s.rowid, s.nom as name, s.email, s.client, s.fournisseur";
 $sql .= ", s.code_client";
 $sql .= ", s.code_fournisseur";
@@ -294,6 +294,7 @@ $sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
 if (getDolGlobalString('MAIN_COMPANY_PERENTITY_SHARED')) {
 	$sql .= " LEFT JOIN " . MAIN_DB_PREFIX . "societe_perentity as spe ON spe.fk_soc = s.rowid AND spe.entity = " . ((int) $conf->entity);
 }
+// TODO Replace this
 if (!$user->hasRight('societe', 'client', 'voir')) {
 	$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
 }
@@ -333,7 +334,7 @@ if ($result) {
 
 		$lastmodified .= '<tr class="liste_titre"><th colspan="2">'.$transRecordedType.'</th>';
 		$lastmodified .= '<th>&nbsp;</th>';
-		$lastmodified .= '<th class="right"><a href="'.DOL_URL_ROOT.'/societe/list.php?sortfield=s.tms&sortorder=DESC">'.$langs->trans("FullList").'</th>';
+		$lastmodified .= '<th class="right"><a href="'.DOL_URL_ROOT.'/societe/list.php?sortfield=s.tms&sortorder=DESC">'.img_picto($langs->trans("FullList"), 'company').'</th>';
 		$lastmodified .= '</tr>'."\n";
 
 		while ($i < $num) {
@@ -384,7 +385,132 @@ if ($result) {
 	dol_print_error($db);
 }
 
-//print '</div></div></div>';
+
+
+/*
+ * Latest modified contacts
+ */
+$sql = "SELECT s.rowid, s.nom as name, s.email, s.client, s.fournisseur";
+$sql .= ", s.code_client";
+$sql .= ", s.code_fournisseur";
+if (getDolGlobalString('MAIN_COMPANY_PERENTITY_SHARED')) {
+	$sql .= ", spe.accountancy_code_supplier as code_compta_fournisseur";
+	$sql .= ", spe.accountancy_code_customer as code_compta";
+} else {
+	$sql .= ", s.code_compta_fournisseur";
+	$sql .= ", s.code_compta";
+}
+$sql .= ", s.logo";
+$sql .= ", s.entity";
+$sql .= ", s.canvas";
+$sql .= ", s.tms as date_modification, s.status as status";
+$sql .= ", sp.rowid as cid, sp.canvas as ccanvas, sp.email as cemail, sp.firstname, sp.lastname";
+$sql .= ", sp.address as caddress, sp.phone as cphone";
+$sql .= " FROM ".MAIN_DB_PREFIX."societe as s, ".MAIN_DB_PREFIX."socpeople as sp";
+if (getDolGlobalString('MAIN_COMPANY_PERENTITY_SHARED')) {
+	$sql .= " LEFT JOIN " . MAIN_DB_PREFIX . "societe_perentity as spe ON spe.fk_soc = s.rowid AND spe.entity = " . ((int) $conf->entity);
+}
+// TODO Replace this
+if (!$user->hasRight('societe', 'client', 'voir')) {
+	$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
+}
+$sql .= ' WHERE s.entity IN ('.getEntity('societe').') AND sp.fk_soc = s.rowid';
+if (!$user->hasRight('societe', 'client', 'voir')) {
+	$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
+}
+if (!$user->hasRight('fournisseur', 'lire')) {
+	$sql .= " AND (s.fournisseur != 1 OR s.client != 0)";
+}
+// Add where from hooks
+$parameters = array('socid' => $socid);
+$reshook = $hookmanager->executeHooks('printFieldListWhere', $parameters, $thirdparty_static); // Note that $action and $object may have been modified by hook
+if (empty($reshook)) {
+	if ($socid > 0) {
+		$sql .= " AND s.rowid = ".((int) $socid);
+	}
+}
+$sql .= $hookmanager->resPrint;
+$sql .= $db->order("s.tms", "DESC");
+$sql .= $db->plimit($max, 0);
+
+//print $sql;
+$lastmodifiedcontact = '';
+$result = $db->query($sql);
+if ($result) {
+	$num = $db->num_rows($result);
+
+	$i = 0;
+
+	if ($num > 0) {
+		$transRecordedType = $langs->trans("LastModifiedContacts", $max);
+
+		$lastmodifiedcontact = "\n<!-- last contacts modified -->\n";
+		$lastmodifiedcontact .= '<div class="div-table-responsive-no-min">';
+		$lastmodifiedcontact .= '<table class="noborder centpercent">';
+
+		$lastmodifiedcontact .= '<tr class="liste_titre"><th colspan="2">'.$transRecordedType.'</th>';
+		$lastmodifiedcontact .= '<th>&nbsp;</th>';
+		$lastmodifiedcontact .= '<th class="right"><a href="'.DOL_URL_ROOT.'/socpeople/list.php?sortfield=s.tms&sortorder=DESC">'.img_picto($langs->trans("FullList"), 'contact').'</th>';
+		$lastmodifiedcontact .= '</tr>'."\n";
+
+		while ($i < $num) {
+			$objp = $db->fetch_object($result);
+
+			$thirdparty_static->id = $objp->rowid;
+			$thirdparty_static->name = $objp->name;
+			$thirdparty_static->client = $objp->client;
+			$thirdparty_static->fournisseur = $objp->fournisseur;
+			$thirdparty_static->logo = $objp->logo;
+			$thirdparty_static->date_modification = $db->jdate($objp->date_modification);
+			$thirdparty_static->status = $objp->status;
+			$thirdparty_static->code_client = $objp->code_client;
+			$thirdparty_static->code_fournisseur = $objp->code_fournisseur;
+			$thirdparty_static->canvas = $objp->canvas;
+			$thirdparty_static->email = $objp->email;
+			$thirdparty_static->entity = $objp->entity;
+			$thirdparty_static->code_compta_fournisseur = $objp->code_compta_fournisseur;
+			$thirdparty_static->code_compta = $objp->code_compta;
+			$thirdparty_static->code_compta_client = $objp->code_compta;
+
+			$contact_static->id = $objp->cid;
+			$contact_static->firstname = $objp->firstname;
+			$contact_static->lastname = $objp->lastname;
+			$contact_static->email = $objp->cemail;
+			$contact_static->socid = $objp->rowid;
+			$contact_static->canvas = $objp->ccanvas;
+			$contact_static->phone_pro = $objp->cphone;
+			$contact_static->address = $objp->caddress;
+
+			$lastmodifiedcontact .= '<tr class="oddeven">';
+			// Name
+			$lastmodifiedcontact .= '<td class="nowrap tdoverflowmax200">';
+			$lastmodifiedcontact .= $thirdparty_static->getNomUrl(1);
+			$lastmodifiedcontact .= "</td>\n";
+			// Contact
+			$lastmodifiedcontact .= '<td>';
+			$lastmodifiedcontact .= $contact_static->getNomUrl(1);
+			$lastmodifiedcontact .= '</td>';
+			// Last modified date
+			$lastmodifiedcontact .= '<td class="right tddate" title="'.dol_escape_htmltag($langs->trans("DateModification").' '.dol_print_date($thirdparty_static->date_modification, 'dayhour', 'tzuserrel')).'">';
+			$lastmodifiedcontact .= dol_print_date($thirdparty_static->date_modification, 'day', 'tzuserrel');
+			$lastmodifiedcontact .= "</td>";
+			$lastmodifiedcontact .= '<td class="right nowrap">';
+			$lastmodifiedcontact .= $thirdparty_static->getLibStatut(3);
+			$lastmodifiedcontact .= "</td>";
+			$lastmodifiedcontact .= "</tr>\n";
+			$i++;
+		}
+
+		$db->free($result);
+
+		$lastmodifiedcontact .= "</table>\n";
+		$lastmodifiedcontact .= '</div>';
+		$lastmodifiedcontact .= "<!-- End last contacts modified -->\n";
+	}
+} else {
+	dol_print_error($db);
+}
+
 
 // boxes
 print '<div class="clearboth"></div>';
@@ -403,6 +529,8 @@ $boxlist .= '</div>'."\n";
 $boxlist .= '<div class="secondcolumn fichehalfright boxhalfright" id="boxhalfright">';
 $boxlist .= $lastmodified;
 $boxlist .= '<br>';
+$boxlist .= $lastmodifiedcontact;
+$boxlist .= '<br>';
 $boxlist .= $resultboxes['boxlistb'];
 $boxlist .= '</div>'."\n";
 
diff --git a/htdocs/supplier_proposal/class/api_supplier_proposals.class.php b/htdocs/supplier_proposal/class/api_supplier_proposals.class.php
index bde171e7d68..89a8ebb965b 100644
--- a/htdocs/supplier_proposal/class/api_supplier_proposals.class.php
+++ b/htdocs/supplier_proposal/class/api_supplier_proposals.class.php
@@ -51,6 +51,38 @@ class SupplierProposals extends DolibarrApi
 		$this->supplier_proposal = new SupplierProposal($this->db);
 	}
 
+	/**
+	 * Delete commercial proposal
+	 *
+	 * @param   int     $id         Supplier proposal ID
+	 * @return  array
+	 */
+	public function delete($id)
+	{
+		if (!DolibarrApiAccess::$user->hasRight('supplier_proposal', 'supprimer')) {
+			throw new RestException(403);
+		}
+		$result = $this->supplier_proposal->fetch($id);
+		if (!$result) {
+			throw new RestException(404, 'Supplier Proposal not found');
+		}
+
+		if (!DolibarrApi::_checkAccessToResource('supplier_proposal', $this->supplier_proposal->id)) {
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+		}
+
+		if (!$this->supplier_proposal->delete(DolibarrApiAccess::$user)) {
+			throw new RestException(500, 'Error when delete Supplier Proposal : '.$this->supplier_proposal->error);
+		}
+
+		return array(
+			'success' => array(
+				'code' => 200,
+				'message' => 'Supplier Proposal deleted'
+			)
+		);
+	}
+
 	/**
 	 * Get properties of a supplier proposal (price request) object
 	 *
@@ -73,13 +105,106 @@ class SupplierProposals extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('supplier_proposal', $this->supplier_proposal->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		$this->supplier_proposal->fetchObjectLinked();
 		return $this->_cleanObjectDatas($this->supplier_proposal);
 	}
 
+	/**
+	 * Create supplier proposal (price request) object
+	 *
+	 * @param   array   $request_data   Request data
+	 * @return  int     ID of supplier proposal
+	 */
+	public function post($request_data = null)
+	{
+		if (!DolibarrApiAccess::$user->hasRight('supplier_proposal', 'creer')) {
+			throw new RestException(403, "Insuffisant rights");
+		}
+		// Check mandatory fields
+		$result = $this->_validate($request_data);
+
+		foreach ($request_data as $field => $value) {
+			if ($field === 'caller') {
+				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
+				$this->supplier_proposal->context['caller'] = $request_data['caller'];
+				continue;
+			}
+
+			$this->supplier_proposal->$field = $value;
+		}
+		/*if (isset($request_data["lines"])) {
+		  $lines = array();
+		  foreach ($request_data["lines"] as $line) {
+			array_push($lines, (object) $line);
+		  }
+		  $this->propal->lines = $lines;
+		}*/
+		if ($this->supplier_proposal->create(DolibarrApiAccess::$user) < 0) {
+			throw new RestException(500, "Error creating supplier proposal", array_merge(array($this->supplier_proposal->error), $this->supplier_proposal->errors));
+		}
+
+		return $this->supplier_proposal->id;
+	}
+
+	/**
+	 * Update supplier proposal general fields (won't touch lines of supplier proposal)
+	 *
+	 * @param	int		$id             Id of supplier proposal to update
+	 * @param	array	$request_data   Datas
+	 * @return	Object					Object with cleaned properties
+	 */
+	public function put($id, $request_data = null)
+	{
+		if (!DolibarrApiAccess::$user->hasRight('supplier_proposal', 'creer')) {
+			throw new RestException(403);
+		}
+
+		$result = $this->supplier_proposal->fetch($id);
+		if (!$result) {
+			throw new RestException(404, 'Supplier proposal not found');
+		}
+
+		if (!DolibarrApi::_checkAccessToResource('supplier_proposal', $this->supplier_proposal->id)) {
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+		}
+		foreach ($request_data as $field => $value) {
+			if ($field == 'id') {
+				continue;
+			}
+			if ($field === 'caller') {
+				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
+				$this->supplier_proposal->context['caller'] = $request_data['caller'];
+				continue;
+			}
+			if ($field == 'array_options' && is_array($value)) {
+				foreach ($value as $index => $val) {
+					$this->supplier_proposal->array_options[$index] = $val;
+				}
+				continue;
+			}
+			$this->supplier_proposal->$field = $value;
+		}
+
+		// update end of validity date
+		if (empty($this->supplier_proposal->fin_validite) && !empty($this->supplier_proposal->duree_validite) && !empty($this->supplier_proposal->date_creation)) {
+			$this->supplier_proposal->fin_validite = $this->supplier_proposal->date_creation + ($this->supplier_proposal->duree_validite * 24 * 3600);
+		}
+		if (!empty($this->supplier_proposal->fin_validite)) {
+			if ($this->supplier_proposal->set_echeance(DolibarrApiAccess::$user, $this->supplier_proposal->fin_validite) < 0) {
+				throw new RestException(500, $this->supplier_proposal->error);
+			}
+		}
+
+		if ($this->supplier_proposal->update(DolibarrApiAccess::$user) > 0) {
+			return $this->get($id);
+		} else {
+			throw new RestException(500, $this->supplier_proposal->error);
+		}
+	}
+
 	/**
 	 * List supplier proposals
 	 *
diff --git a/htdocs/theme/eldy/global.inc.php b/htdocs/theme/eldy/global.inc.php
index 0d2f314b5a3..7ea503d532c 100644
--- a/htdocs/theme/eldy/global.inc.php
+++ b/htdocs/theme/eldy/global.inc.php
@@ -2,6 +2,7 @@
 /*
 /* Copyright (C) 2004-2017	Laurent Destailleur		<eldy@users.sourceforge.net>
  * Copyright (C) 2024       Frédéric France             <frederic.france@free.fr>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -27,6 +28,59 @@ if (!defined('ISLOADEDBYSTEELSHEET')) {
 
 $leftmenuwidth = 210;
 
+'
+@phan-var-force string $badgeDanger
+@phan-var-force string $badgeWarning
+@phan-var-force string $borderwidth
+@phan-var-force string $colorbackbody
+@phan-var-force string $colorbackhmenu1
+@phan-var-force string $colorbacklinebreak
+@phan-var-force string $colorbacklineimpair1
+@phan-var-force string $colorbacklineimpair2
+@phan-var-force string $colorbacklinepair1
+@phan-var-force string $colorbacklinepair2
+@phan-var-force string $colorbacklinepairchecked
+@phan-var-force string $colorbacklinepairhover
+@phan-var-force string $colorbacktabactive
+@phan-var-force string $colorbacktabcard1
+@phan-var-force string $colorbacktitle1
+@phan-var-force string $colorbackvmenu1
+@phan-var-force string $colorblind_deuteranopes_textSuccess
+@phan-var-force string $colorblind_deuteranopes_textWarning
+@phan-var-force string $colorshadowtitle
+@phan-var-force string $colortext
+@phan-var-force string $colortextbackhmenu
+@phan-var-force string $colortextbacktab
+@phan-var-force string $colortextbackvmenu
+@phan-var-force string $colortextlink
+@phan-var-force string $colortexttitle
+@phan-var-force string $colortexttitlelink
+@phan-var-force string $colortexttitlenotab
+@phan-var-force string $colortexttitlenotab2
+@phan-var-force string $colortopbordertitle1
+@phan-var-force int<0,1> $disableimages
+@phan-var-force int<0,1> $dol_optimize_smallscreen
+@phan-var-force string $fontlist
+@phan-var-force string $fontsize
+@phan-var-force int $heightmenu
+@phan-var-force string $heightrow
+@phan-var-force string $img_button
+@phan-var-force string $left
+@phan-var-force string $maxwidthloginblock
+@phan-var-force int $minwidthtmenu
+@phan-var-force int $nbtopmenuentries
+@phan-var-force int $nbtopmenuentriesreal
+@phan-var-force string $path
+@phan-var-force string $right
+@phan-var-force string $textDanger
+@phan-var-force string $textSuccess
+@phan-var-force string $textWarning
+@phan-var-force string $toolTipBgColor
+@phan-var-force string $toolTipFontColor
+@phan-var-force int<0,1> $useboldtitle
+@phan-var-force int $userborderontable
+';
+
 ?>
 /* <style type="text/css" > */
 
@@ -162,6 +216,8 @@ body {
 	font-weight: 400;
 	background-color: var(--colorbackbody);
 	<?php print 'direction: '.$langs->trans("DIRECTION").";\n"; ?>
+	/*transform: scale(1.2);
+	transform-origin: 0 0;*/
 }
 
 /* Style used to protect html content in output to avoid attack by replacing full page with js content */
@@ -1810,7 +1866,7 @@ select.widthcentpercentminusxx, span.widthcentpercentminusxx:not(.select2-select
 @media only screen and (max-width: 767px)
 {
 	div.refidno {
-		font-size: <?php print is_numeric($fontsize) ? ($fontsize + 3).'px' : $fontsize; ?> !important;
+		font-size: <?php print is_numeric($fontsize) ? ((int) $fontsize + 3).'px' : $fontsize; ?> !important;
 	}
 	.divadvancedsearchfield {
 		padding-left: 5px;
@@ -1871,7 +1927,7 @@ select.widthcentpercentminusxx, span.widthcentpercentminusxx:not(.select2-select
 		margin: 3px 2px 3px 2px !important;
 	}
 	div.refidno {
-		font-size: <?php print is_numeric($fontsize) ? ($fontsize + 3).'px' : $fontsize; ?> !important;
+		font-size: <?php print is_numeric($fontsize) ? ((int) $fontsize + 3).'px' : $fontsize; ?> !important;
 	}
 
 	div#login_left, div#login_right {
@@ -2877,12 +2933,12 @@ li.tmenu:hover .tmenuimage:not(.menuhider), li.tmenu:hover .tmenuimage:not(.menu
 	// Add here more div for other menu entries. moduletomainmenu=array('module name'=>'name of class for div')
 
 	$moduletomainmenu = array(
-		'user'=>'', 'syslog'=>'', 'societe'=>'companies', 'projet'=>'project', 'propale'=>'commercial', 'commande'=>'commercial',
-		'produit'=>'products', 'service'=>'products', 'stock'=>'products',
-		'don'=>'accountancy', 'tax'=>'accountancy', 'banque'=>'accountancy', 'facture'=>'accountancy', 'compta'=>'accountancy', 'accounting'=>'accountancy', 'adherent'=>'members', 'import'=>'tools', 'export'=>'tools', 'mailing'=>'tools',
-		'contrat'=>'commercial', 'ficheinter'=>'commercial', 'ticket'=>'ticket', 'deplacement'=>'commercial',
-		'fournisseur'=>'companies',
-		'barcode'=>'', 'fckeditor'=>'', 'categorie'=>'',
+		'user' => '', 'syslog' => '', 'societe' => 'companies', 'projet' => 'project', 'propale' => 'commercial', 'commande' => 'commercial',
+		'produit' => 'products', 'service' => 'products', 'stock' => 'products',
+		'don' => 'accountancy', 'tax' => 'accountancy', 'banque' => 'accountancy', 'facture' => 'accountancy', 'compta' => 'accountancy', 'accounting' => 'accountancy', 'adherent' => 'members', 'import' => 'tools', 'export' => 'tools', 'mailing' => 'tools',
+		'contrat' => 'commercial', 'ficheinter' => 'commercial', 'ticket' => 'ticket', 'deplacement' => 'commercial',
+		'fournisseur' => 'companies',
+		'barcode' => '', 'fckeditor' => '', 'categorie' => '',
 	);
 	$mainmenuused = 'home';
 	foreach ($conf->modules as $val) {
@@ -3002,7 +3058,7 @@ form#login {
 	max-width: 560px;
 <?php
 if (getDolGlobalString('MAIN_LOGIN_BACKGROUND')) {
-		print '	background-color: rgba(255, 255, 255, 0.9);';
+	print '	background-color: rgba(255, 255, 255, 0.9);';
 } else {
 	print '	background-color: #FFFFFF;';
 }
@@ -3041,11 +3097,8 @@ if (getDolGlobalString('MAIN_LOGIN_BACKGROUND')) {
 	padding-left: 10px;
 	width: 14px;
 }
-.login_table .tdinputlogin input#username, .login_table .tdinputlogin input#password {
-	font-size: 1em;
-}
-.login_table .tdinputlogin input#securitycode {
-	font-size: 1em;
+.login_table .tdinputlogin input#username, .login_table .tdinputlogin input#password, .login_table .tdinputlogin input#securitycode {
+	font-size: 1.1em;
 }
 /* For the static info message */
 .login_main_home {
@@ -3226,6 +3279,7 @@ span.userimg div.userphoto {
 	width: 1.4em;
 	height: 1.4em;
 	padding-top: 1px;
+	display: inline-block;
 }
 img.userphotosmall {			/* size for user photo in lists */
 	border-radius: 0.6em;
@@ -5237,7 +5291,7 @@ div.ui-tooltip.mytooltip {
 
 <?php
 if (getDolGlobalString('THEME_DARKMODEENABLED')) {
-		print "/* For dark mode */\n";
+	print "/* For dark mode */\n";
 	if (getDolGlobalInt('THEME_DARKMODEENABLED') != 2) {
 		print "@media (prefers-color-scheme: dark) {";	// To test, click on the 3 dots menu, then Other options then Display then emulate prefer-color-schemes
 	} else {
diff --git a/htdocs/theme/eldy/info-box.inc.php b/htdocs/theme/eldy/info-box.inc.php
index c8bb250ad55..380ce399eb6 100644
--- a/htdocs/theme/eldy/info-box.inc.php
+++ b/htdocs/theme/eldy/info-box.inc.php
@@ -514,7 +514,7 @@ if (GETPOSTISSET('THEME_SATURATE_RATIO')) {
 	flex-grow : 1;
 	flex-shrink: 1;
 	flex-basis: auto;
-	width: 280px;
+	width: 290px;
 }
 .box-flex-item.filler {
 	height: 0;
diff --git a/htdocs/theme/eldy/style.css.php b/htdocs/theme/eldy/style.css.php
index 31bc2e0d493..cf7b332b201 100644
--- a/htdocs/theme/eldy/style.css.php
+++ b/htdocs/theme/eldy/style.css.php
@@ -216,7 +216,7 @@ $tmpval = (!empty($tmppart[0]) ? $tmppart[0] : 0) + (!empty($tmppart[1]) ? $tmpp
 if ($tmpval <= 460) {
 	$colortextbackvmenu = 'FFFFFF';
 } else {
-	$colortextbackvmenu = '000000';
+	$colortextbackvmenu = '222222';
 }
 
 $colortopbordertitle1 = implode(',', colorStringToArray($colortopbordertitle1)); // Normalize value to 'x,y,z'
diff --git a/htdocs/theme/md/info-box.inc.php b/htdocs/theme/md/info-box.inc.php
index d28a60a2ddd..98e2e033085 100644
--- a/htdocs/theme/md/info-box.inc.php
+++ b/htdocs/theme/md/info-box.inc.php
@@ -567,7 +567,7 @@ if (GETPOSTISSET('THEME_SATURATE_RATIO')) {
 	flex-shrink: 1;
 	flex-basis: auto;
 
-	width: 280px;
+	width: 290px;
 	margin: 5px 0px 0px 15px;
 }
 .box-flex-item.filler{
@@ -616,6 +616,3 @@ if (GETPOSTISSET('THEME_SATURATE_RATIO')) {
 		max-width: calc(100% - 82px);
 	}
 }
-
-
-
diff --git a/htdocs/theme/md/style.css.php b/htdocs/theme/md/style.css.php
index bc8c94f6f2e..34f26193d76 100644
--- a/htdocs/theme/md/style.css.php
+++ b/htdocs/theme/md/style.css.php
@@ -225,7 +225,7 @@ $tmpval = (!empty($tmppart[0]) ? $tmppart[0] : 0) + (!empty($tmppart[1]) ? $tmpp
 if ($tmpval <= 460) {
 	$colortextbackvmenu = 'FFFFFF';
 } else {
-	$colortextbackvmenu = '000000';
+	$colortextbackvmenu = '222222';
 }
 
 $colortopbordertitle1 = implode(',', colorStringToArray($colortopbordertitle1)); // Normalize value to 'x,y,z'
@@ -2655,7 +2655,7 @@ img.hideonsmartphone.pictoactionview {
 
 .pictofixedwidth {
 	text-align: <?php echo $left; ?>;
-	width: 20px;
+	width: 21px;
 	/* padding-right: 0; */
 }
 
@@ -3355,6 +3355,14 @@ img.userphoto {			/* size for user photo in lists */
 	background-size: contain;
 	vertical-align: middle;
 }
+span.userimg div.userphoto {
+	background-color: #eee;
+	border-radius: 0.72em;
+	width: 1.4em;
+	height: 1.4em;
+	padding-top: 1px;
+	display: inline-block;
+}
 img.userphotosmall {			/* size for user photo in lists */
 	border-radius: 0.6em;
 	width: 1.2em;
diff --git a/htdocs/ticket/class/api_tickets.class.php b/htdocs/ticket/class/api_tickets.class.php
index a9ed23f8d61..2ba1e31631a 100644
--- a/htdocs/ticket/class/api_tickets.class.php
+++ b/htdocs/ticket/class/api_tickets.class.php
@@ -179,7 +179,7 @@ class Tickets extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('ticket', $this->ticket->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 		return $this->_cleanObjectDatas($this->ticket);
 	}
@@ -294,11 +294,11 @@ class Tickets extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->ticket->context['caller'] = $request_data['caller'];
+				$this->ticket->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->ticket->$field = $value;
+			$this->ticket->$field = $this->_checkValForAPI($field, $value, $this->ticket);
 		}
 		if (empty($this->ticket->ref)) {
 			$this->ticket->ref = $ticketstatic->getDefaultRef();
@@ -315,7 +315,7 @@ class Tickets extends DolibarrApi
 	}
 
 	/**
-	 * Create ticket object
+	 * Add a new message to an existing ticket identified by property ->track_id into request.
 	 *
 	 * @param array $request_data   Request datas
 	 * @return int  ID of ticket
@@ -333,11 +333,11 @@ class Tickets extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->ticket->context['caller'] = $request_data['caller'];
+				$this->ticket->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->ticket->$field = $value;
+			$this->ticket->$field = $this->_checkValForAPI($field, $value, $this->ticket);
 		}
 		$ticketMessageText = $this->ticket->message;
 		$result = $this->ticket->fetch('', '', $this->ticket->track_id);
@@ -370,17 +370,17 @@ class Tickets extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('ticket', $this->ticket->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->ticket->context['caller'] = $request_data['caller'];
+				$this->ticket->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->ticket->$field = $value;
+			$this->ticket->$field = $this->_checkValForAPI($field, $value, $this->ticket);
 		}
 
 		if ($this->ticket->update(DolibarrApiAccess::$user) > 0) {
@@ -408,7 +408,7 @@ class Tickets extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('ticket', $this->ticket->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->ticket->delete(DolibarrApiAccess::$user)) {
@@ -523,7 +523,14 @@ class Tickets extends DolibarrApi
 			"cache_category_tickets",
 			"regeximgext",
 			"labelStatus",
-			"labelStatusShort"
+			"labelStatusShort",
+			"multicurrency_code",
+			"multicurrency_tx",
+			"multicurrency_total_ht",
+			"multicurrency_total_ttc",
+			"multicurrency_total_tva",
+			"multicurrency_total_localtax1",
+			"multicurrency_total_localtax2"
 		);
 		foreach ($attr2clean as $toclean) {
 			unset($object->$toclean);
diff --git a/htdocs/ticket/class/ticket.class.php b/htdocs/ticket/class/ticket.class.php
index 70aba99dcea..70d607c9633 100644
--- a/htdocs/ticket/class/ticket.class.php
+++ b/htdocs/ticket/class/ticket.class.php
@@ -228,11 +228,6 @@ class Ticket extends CommonObject
 	 */
 	public $cache_category_tickets;
 
-	/**
-	 * @var array tickets severity
-	 */
-	public $cache_severity_tickets;
-
 	/**
 	 * @var array cache msgs ticket
 	 */
@@ -249,7 +244,7 @@ class Ticket extends CommonObject
 	public $labelStatusShort;
 
 	/**
-	 * @var int Notify thirdparty at create
+	 * @var int 	Notify thirdparty at create
 	 */
 	public $notify_tiers_at_create;
 
@@ -269,7 +264,7 @@ class Ticket extends CommonObject
 	public $ip;
 
 	/**
-	 * @var Ticket $oldcopy  State of this ticket as it was stored before an update operation (for triggers)
+	 * @var static $oldcopy  State of this ticket as it was stored before an update operation (for triggers)
 	 */
 	public $oldcopy;
 
@@ -548,21 +543,21 @@ class Ticket extends CommonObject
 			$sql .= ") VALUES (";
 			$sql .= " ".(!isset($this->ref) ? '' : "'".$this->db->escape($this->ref)."'").",";
 			$sql .= " ".(!isset($this->track_id) ? 'NULL' : "'".$this->db->escape($this->track_id)."'").",";
-			$sql .= " ".($this->fk_soc > 0 ? $this->db->escape($this->fk_soc) : "null").",";
-			$sql .= " ".($this->fk_project > 0 ? $this->db->escape($this->fk_project) : "null").",";
-			$sql .= " ".($this->fk_contract > 0 ? $this->db->escape($this->fk_contract) : "null").",";
+			$sql .= " ".($this->fk_soc > 0 ? ((int) $this->fk_soc) : "null").",";
+			$sql .= " ".($this->fk_project > 0 ? ((int) $this->fk_project) : "null").",";
+			$sql .= " ".($this->fk_contract > 0 ? ((int) $this->fk_contract) : "null").",";
 			$sql .= " ".(!isset($this->origin_email) ? 'NULL' : "'".$this->db->escape($this->origin_email)."'").",";
 			$sql .= " ".(!isset($this->origin_replyto) ? 'NULL' : "'".$this->db->escape($this->origin_replyto)."'").",";
 			$sql .= " ".(!isset($this->origin_references) ? 'NULL' : "'".$this->db->escape($this->origin_references)."'").",";
-			$sql .= " ".(!isset($this->fk_user_create) ? ($user->id > 0 ? $user->id : 'NULL') : ($this->fk_user_create > 0 ? $this->fk_user_create : 'NULL')).",";
-			$sql .= " ".($this->fk_user_assign > 0 ? $this->fk_user_assign : 'NULL').",";
+			$sql .= " ".(!isset($this->fk_user_create) ? ($user->id > 0 ? ((int) $user->id) : 'NULL') : ($this->fk_user_create > 0 ? ((int) $this->fk_user_create) : 'NULL')).",";
+			$sql .= " ".($this->fk_user_assign > 0 ? ((int) $this->fk_user_assign) : 'NULL').",";
 			$sql .= " ".(empty($this->email_msgid) ? 'NULL' : "'".$this->db->escape($this->email_msgid)."'").",";
 			$sql .= " ".(empty($this->email_date) ? 'NULL' : "'".$this->db->idate($this->email_date)."'").",";
 			$sql .= " ".(!isset($this->subject) ? 'NULL' : "'".$this->db->escape($this->subject)."'").",";
 			$sql .= " ".(!isset($this->message) ? 'NULL' : "'".$this->db->escape($this->message)."'").",";
-			$sql .= " ".(!isset($this->fk_statut) ? '0' : "'".$this->db->escape($this->fk_statut)."'").",";
-			$sql .= " ".(!isset($this->resolution) ? 'NULL' : "'".$this->db->escape($this->resolution)."'").",";
-			$sql .= " ".(!isset($this->progress) ? '0' : "'".$this->db->escape($this->progress)."'").",";
+			$sql .= " ".(!isset($this->fk_statut) ? '0' : ((int) $this->fk_statut)).",";
+			$sql .= " ".(!isset($this->resolution) ? 'NULL' : ((int) $this->resolution)).",";
+			$sql .= " ".(!isset($this->progress) ? '0' : ((int) $this->progress)).",";
 			$sql .= " ".(!isset($this->timing) ? 'NULL' : "'".$this->db->escape($this->timing)."'").",";
 			$sql .= " ".(!isset($this->type_code) ? 'NULL' : "'".$this->db->escape($this->type_code)."'").",";
 			$sql .= " ".(empty($this->category_code) || $this->category_code == '-1' ? 'NULL' : "'".$this->db->escape($this->category_code)."'").",";
@@ -571,7 +566,7 @@ class Ticket extends CommonObject
 			$sql .= " ".(!isset($this->date_read) || dol_strlen($this->date_read) == 0 ? 'NULL' : "'".$this->db->idate($this->date_read)."'").",";
 			$sql .= " ".(!isset($this->date_close) || dol_strlen($this->date_close) == 0 ? 'NULL' : "'".$this->db->idate($this->date_close)."'");
 			$sql .= ", ".((int) $this->entity);
-			$sql .= ", ".(!isset($this->notify_tiers_at_create) ? '1' : "'".$this->db->escape($this->notify_tiers_at_create)."'");
+			$sql .= ", ".(!isset($this->notify_tiers_at_create) ? 1 : ((int) $this->notify_tiers_at_create));
 			$sql .= ", '".$this->db->escape($this->model_pdf)."'";
 			$sql .= ", ".(!isset($this->ip) ? 'NULL' : "'".$this->db->escape($this->ip)."'");
 			$sql .= ")";
@@ -1432,12 +1427,12 @@ class Ticket extends CommonObject
 	 */
 	public function loadCacheSeveritiesTickets()
 	{
-		global $langs;
+		global $conf, $langs;
 
-		if (!empty($this->cache_severity_tickets) && count($this->cache_severity_tickets)) {
+		if (!empty($conf->cache['severity_tickets']) && count($conf->cache['severity_tickets'])) {
+			// Cache already loaded
 			return 0;
 		}
-		// Cache deja charge
 
 		$sql = "SELECT rowid, code, label, use_default, pos, description";
 		$sql .= " FROM ".MAIN_DB_PREFIX."c_ticket_severity";
@@ -1452,11 +1447,11 @@ class Ticket extends CommonObject
 			while ($i < $num) {
 				$obj = $this->db->fetch_object($resql);
 
-				$this->cache_severity_tickets[$obj->rowid]['code'] = $obj->code;
+				$conf->cache['severity_tickets'][$obj->rowid]['code'] = $obj->code;
 				$label = ($langs->trans("TicketSeverityShort".$obj->code) != "TicketSeverityShort".$obj->code ? $langs->trans("TicketSeverityShort".$obj->code) : ($obj->label != '-' ? $obj->label : ''));
-				$this->cache_severity_tickets[$obj->rowid]['label'] = $label;
-				$this->cache_severity_tickets[$obj->rowid]['use_default'] = $obj->use_default;
-				$this->cache_severity_tickets[$obj->rowid]['pos'] = $obj->pos;
+				$conf->cache['severity_tickets'][$obj->rowid]['label'] = $label;
+				$conf->cache['severity_tickets'][$obj->rowid]['use_default'] = $obj->use_default;
+				$conf->cache['severity_tickets'][$obj->rowid]['pos'] = $obj->pos;
 				$i++;
 			}
 			return $num;
@@ -3020,20 +3015,22 @@ class Ticket extends CommonObject
 				if (!empty($this->email_msgid)) {
 					// We must also add 1 entry In-Reply-To: <$this->email_msgid> with Message-ID we respond from (See RFC5322).
 					$moreinheader .= 'In-Reply-To: <'.$this->email_msgid.'>'."\r\n";
+					// TODO We should now be able to give the in_reply_to as a dedicated parameter of new CMailFile() instead of into $moreinheader.
 				}
 
 				// We should add here also a header 'References:'
 				// According to RFC5322, we should add here all the References fields of the initial message concatenated with
 				// the Message-ID of the message we respond from (but each ID must be once).
 				$references = '';
-				if (empty($this->origin_references)) {
-					// TODO If No References is set, use the In-Reply-To for $references .= (empty($references) ? '' : ' ').Source In-reply-To
-				} else {
+				if (!empty($this->origin_references)) {		// $this->origin_references should be '<'.$this->origin_references.'>'
 					$references .= (empty($references) ? '' : ' ').$this->origin_references;
 				}
-				$references .= (empty($references) ? '' : ' ').'<'.$this->email_msgid.'>';
+				if (!empty($this->email_msgid) && !preg_match('/'.preg_quote($this->email_msgid, '/').'/', $references)) {
+					$references .= (empty($references) ? '' : ' ').'<'.$this->email_msgid.'>';
+				}
 				if ($references) {
 					$moreinheader .= 'References: '.$references."\r\n";
+					// TODO We should now be able to give the references as a dedicated parameter of new CMailFile() instead of into $moreinheader.
 				}
 
 				$mailfile = new CMailFile($subject, $receiver, $from, $message, $filepath, $mimetype, $filename, $sendtocc, '', $deliveryreceipt, -1, '', '', $trackid, $moreinheader, 'ticket', '', $upload_dir_tmp);
diff --git a/htdocs/ticket/index.php b/htdocs/ticket/index.php
index 14e0ab382d8..76d3b9e9dce 100644
--- a/htdocs/ticket/index.php
+++ b/htdocs/ticket/index.php
@@ -2,6 +2,7 @@
 /* Copyright (C) 2013-2016  Jean-François FERRY     <hello@librethic.io>
  * Copyright (C) 2019       Nicolas ZABOURI         <info@inovea-conseil.com>
  * Copyright (C) 2021-2024	Frédéric France				<frederic.france@netlogic.fr>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -405,7 +406,7 @@ if ($user->hasRight('ticket', 'read')) {
 
 				// Category
 				print '<td class="nowrap">';
-				if (!empty($obp->category_code)) {
+				if (!empty($objp->category_code)) {
 					$s = $langs->getLabelFromKey($db, 'TicketCategoryShort'.$objp->category_code, 'c_ticket_category', 'code', 'label', $objp->category_code);
 					print '<span title="'.dol_escape_htmltag($s).'">'.$s.'</span>';
 				}
diff --git a/htdocs/user/class/api_users.class.php b/htdocs/user/class/api_users.class.php
index de46e5b1005..417f1f39f3a 100644
--- a/htdocs/user/class/api_users.class.php
+++ b/htdocs/user/class/api_users.class.php
@@ -163,7 +163,7 @@ class Users extends DolibarrApi
 		}
 
 		if ($id > 0 && !DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if ($includepermissions) {
@@ -202,7 +202,7 @@ class Users extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if ($includepermissions) {
@@ -241,7 +241,7 @@ class Users extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if ($includepermissions) {
@@ -276,7 +276,7 @@ class Users extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if ($includepermissions) {
@@ -325,7 +325,7 @@ class Users extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->useraccount->context['caller'] = $request_data['caller'];
+				$this->useraccount->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 			/*if ($field == 'pass') {
@@ -336,7 +336,7 @@ class Users extends DolibarrApi
 			}
 			*/
 
-			$this->useraccount->$field = $value;
+			$this->useraccount->$field = $this->_checkValForAPI($field, $value, $this->useraccount);
 		}
 
 		if ($this->useraccount->create(DolibarrApiAccess::$user) < 0) {
@@ -370,7 +370,7 @@ class Users extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		foreach ($request_data as $field => $value) {
@@ -391,7 +391,7 @@ class Users extends DolibarrApi
 			}
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->useraccount->context['caller'] = $request_data['caller'];
+				$this->useraccount->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
@@ -416,7 +416,7 @@ class Users extends DolibarrApi
 					throw new RestException(500, 'Error when updating status of user: '.$this->useraccount->error);
 				}
 			} else {
-				$this->useraccount->$field = $value;
+				$this->useraccount->$field = $this->_checkValForAPI($field, $value, $this->useraccount);
 			}
 		}
 
diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php
index 95f404bd701..58b7ff20d31 100644
--- a/htdocs/user/class/user.class.php
+++ b/htdocs/user/class/user.class.php
@@ -11,10 +11,11 @@
  * Copyright (C) 2013-2015  Alexandre Spangaro      <aspangaro@open-dsi.fr>
  * Copyright (C) 2015       Marcos García           <marcosgdf@gmail.com>
  * Copyright (C) 2018       charlene Benke          <charlie@patas-monkey.com>
- * Copyright (C) 2018-2021	Nicolas ZABOURI				<info@inovea-conseil.com>
- * Copyright (C) 2019-2024  Frédéric France				<frederic.france@free.fr>
- * Copyright (C) 2019       Abbes Bahfir				<dolipar@dolipar.org>
- * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
+ * Copyright (C) 2018-2021	Nicolas ZABOURI			<info@inovea-conseil.com>
+ * Copyright (C) 2019-2024  Frédéric France			<frederic.france@free.fr>
+ * Copyright (C) 2019       Abbes Bahfir			<dolipar@dolipar.org>
+ * Copyright (C) 2024		MDW						<mdeweerd@users.noreply.github.com>
+ * Copyright (C) 2024		Lenin Rivas				<lenin.rivas777@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -83,7 +84,7 @@ class User extends CommonObject
 	public $id = 0;
 
 	/**
-	 * @var User old copy of User
+	 * @var static old copy of User
 	 */
 	public $oldcopy;
 
@@ -379,6 +380,16 @@ class User extends CommonObject
 	 */
 	public $fk_warehouse;
 
+	/**
+	 *@var int id of establishment
+	 */
+	public $fk_establishment;
+
+	/**
+	 *@var string label of establishment
+	 */
+	public $label_establishment;
+
 	/**
 	 * @var int egroupware id
 	 */
@@ -485,10 +496,12 @@ class User extends CommonObject
 		$sql .= " u.national_registration_number,";
 		$sql .= " u.ref_employee,";
 		$sql .= " c.code as country_code, c.label as country,";
-		$sql .= " d.code_departement as state_code, d.nom as state";
+		$sql .= " d.code_departement as state_code, d.nom as state,";
+		$sql .= " s.label as label_establishment, u.fk_establishment";
 		$sql .= " FROM ".$this->db->prefix()."user as u";
 		$sql .= " LEFT JOIN ".$this->db->prefix()."c_country as c ON u.fk_country = c.rowid";
 		$sql .= " LEFT JOIN ".$this->db->prefix()."c_departements as d ON u.fk_state = d.rowid";
+		$sql .= " LEFT JOIN ".$this->db->prefix()."establishment as s ON u.fk_establishment = s.rowid";
 
 		if ($entity < 0) {
 			if ((!isModEnabled('multicompany') || !getDolGlobalString('MULTICOMPANY_TRANSVERSE_MODE')) && (!empty($user->entity))) {
@@ -627,6 +640,8 @@ class User extends CommonObject
 				$this->default_range = $obj->default_range;
 				$this->default_c_exp_tax_cat = $obj->default_c_exp_tax_cat;
 				$this->fk_warehouse = $obj->fk_warehouse;
+				$this->fk_establishment = $obj->fk_establishment;
+				$this->label_establishment = $obj->label_establishment;
 
 				// Protection when module multicompany was set, admin was set to first entity and then, the module was disabled,
 				// in such case, this admin user must be admin for ALL entities.
@@ -2003,6 +2018,7 @@ class User extends CommonObject
 
 		$this->birth						= empty($this->birth) ? '' : $this->birth;
 		$this->fk_warehouse					= (int) $this->fk_warehouse;
+		$this->fk_establishment				= (int) $this->fk_establishment;
 
 		$this->setUpperOrLowerCase();
 
@@ -2117,6 +2133,7 @@ class User extends CommonObject
 		$sql .= ", default_range = ".($this->default_range > 0 ? $this->default_range : 'null');
 		$sql .= ", default_c_exp_tax_cat = ".($this->default_c_exp_tax_cat > 0 ? $this->default_c_exp_tax_cat : 'null');
 		$sql .= ", fk_warehouse = ".($this->fk_warehouse > 0 ? $this->fk_warehouse : "null");
+		$sql .= ", fk_establishment = ".($this->fk_establishment > 0 ? $this->fk_establishment : "null");
 		$sql .= ", lang = ".($this->lang ? "'".$this->db->escape($this->lang)."'" : "null");
 		$sql .= " WHERE rowid = ".((int) $this->id);
 
diff --git a/htdocs/user/class/usergroup.class.php b/htdocs/user/class/usergroup.class.php
index 401d661e5b7..5a88c37ccad 100644
--- a/htdocs/user/class/usergroup.class.php
+++ b/htdocs/user/class/usergroup.class.php
@@ -218,6 +218,9 @@ class UserGroup extends CommonObject
 					$ret[$obj->rowid] = $newgroup;
 				}
 
+				if (!is_array($ret[$obj->rowid]->usergroup_entity)) {
+					$ret[$obj->rowid]->usergroup_entity = array();
+				}
 				$ret[$obj->rowid]->usergroup_entity[] = $obj->usergroup_entity;
 			}
 
@@ -293,6 +296,9 @@ class UserGroup extends CommonObject
 					}
 				}
 				if ($mode != 1 && !empty($obj->usergroup_entity)) {
+					if (!is_array($ret[$obj->rowid]->usergroup_entity)) {
+						$ret[$obj->rowid]->usergroup_entity = array();
+					}
 					$ret[$obj->rowid]->usergroup_entity[] = $obj->usergroup_entity;
 				}
 			}
diff --git a/htdocs/variants/class/ProductAttributeValue.class.php b/htdocs/variants/class/ProductAttributeValue.class.php
index aac6c880ad5..d75ba4a8ebb 100644
--- a/htdocs/variants/class/ProductAttributeValue.class.php
+++ b/htdocs/variants/class/ProductAttributeValue.class.php
@@ -262,8 +262,8 @@ class ProductAttributeValue extends CommonObjectLine
 	 *
 	 * @param 	int 	$prodattr_id	 	Product attribute id
 	 * @param 	bool 	$only_used 			Fetch only used attribute values
-	 * @param	int		$returnonlydata		0: return object, 1: return only data
-	 * @return 	ProductAttributeValue[]		Array of object
+	 * @param	int<0,1>	$returnonlydata		0: return object, 1: return only data
+	 * @return 	ProductAttributeValue[]|stdClass[]	Array of object
 	 */
 	public function fetchAllByProductAttribute($prodattr_id, $only_used = false, $returnonlydata = 0)
 	{
diff --git a/htdocs/variants/class/ProductCombination.class.php b/htdocs/variants/class/ProductCombination.class.php
index 11c9f1db2e5..63fc85ce623 100644
--- a/htdocs/variants/class/ProductCombination.class.php
+++ b/htdocs/variants/class/ProductCombination.class.php
@@ -663,8 +663,8 @@ class ProductCombination
 	/**
 	 * Retrieves all unique attributes for a parent product
 	 *
-	 * @param int $productid 			Product rowid
-	 * @return ProductAttribute[]		Array of attributes
+	 * @param	int $productid			Product rowid
+	 * @return	ProductAttributeValue[]	Array of attributes
 	 */
 	public function getUniqueAttributesAndValuesByFkProductParent($productid)
 	{
@@ -696,6 +696,7 @@ class ProductCombination
 
 			$attrval = new ProductAttributeValue($this->db);
 			foreach ($res = $attrval->fetchAllByProductAttribute($attr->id, true) as $val) {
+				'@phan-var-force ProductAttributeValue $val';
 				$tmp->values[] = $val;
 			}
 
@@ -720,7 +721,7 @@ class ProductCombination
 	 * @param User 			$user 				Object user
 	 * @param Product 		$product 			Parent product
 	 * @param array<array<string,string>> $combinations Attribute and value combinations.
-	 * @param array 		$variations 		Price and weight variations
+	 * @param array<string,array<string,array{weight:string|float,price:string|float}>> $variations 	Price and weight variations
 	 * @param bool|array 	$price_var_percent 	Is the price variation a relative variation?
 	 * @param bool|float 	$forced_pricevar 	If the price variation is forced
 	 * @param bool|float 	$forced_weightvar 	If the weight variation is forced
@@ -813,7 +814,6 @@ class ProductCombination
 					return -1;
 				}
 			}
-
 			if ($forced_weightvar === false) {
 				$weight_impact += (float) price2num($variations[$currcombattr][$currcombval]['weight']);
 			}
diff --git a/htdocs/viewimage.php b/htdocs/viewimage.php
index 2ebe4c8e9a4..b415af7be7b 100644
--- a/htdocs/viewimage.php
+++ b/htdocs/viewimage.php
@@ -339,6 +339,7 @@ if ($modulepart == 'barcode') {
 
 	// Load barcode class
 	$classname = "mod".ucfirst($generator);
+
 	$module = new $classname($db);
 	if ($module->encodingIsSupported($encoding)) {
 		$result = $module->buildBarCode($code, $encoding, $readable);
diff --git a/htdocs/webservices/server_supplier_invoice.php b/htdocs/webservices/server_supplier_invoice.php
index 85744ccc24e..77442df3f03 100644
--- a/htdocs/webservices/server_supplier_invoice.php
+++ b/htdocs/webservices/server_supplier_invoice.php
@@ -1,5 +1,6 @@
 <?php
 /* Copyright (C) 2006-2016 Laurent Destailleur  <eldy@users.sourceforge.net>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -79,11 +80,11 @@ $server->wsdl->addComplexType(
 	'all',
 	'',
 	array(
-		'dolibarrkey' => array('name'=>'dolibarrkey', 'type'=>'xsd:string'),
-		'sourceapplication' => array('name'=>'sourceapplication', 'type'=>'xsd:string'),
-		'login' => array('name'=>'login', 'type'=>'xsd:string'),
-		'password' => array('name'=>'password', 'type'=>'xsd:string'),
-		'entity' => array('name'=>'entity', 'type'=>'xsd:string'),
+		'dolibarrkey' => array('name' => 'dolibarrkey', 'type' => 'xsd:string'),
+		'sourceapplication' => array('name' => 'sourceapplication', 'type' => 'xsd:string'),
+		'login' => array('name' => 'login', 'type' => 'xsd:string'),
+		'password' => array('name' => 'password', 'type' => 'xsd:string'),
+		'entity' => array('name' => 'entity', 'type' => 'xsd:string'),
 	)
 );
 // Define WSDL Return object
@@ -94,8 +95,8 @@ $server->wsdl->addComplexType(
 	'all',
 	'',
 	array(
-		'result_code' => array('name'=>'result_code', 'type'=>'xsd:string'),
-		'result_label' => array('name'=>'result_label', 'type'=>'xsd:string'),
+		'result_code' => array('name' => 'result_code', 'type' => 'xsd:string'),
+		'result_label' => array('name' => 'result_label', 'type' => 'xsd:string'),
 	)
 );
 
@@ -107,21 +108,21 @@ $server->wsdl->addComplexType(
 	'all',
 	'',
 	array(
-		'id' => array('name'=>'id', 'type'=>'xsd:string'),
-		'type' => array('name'=>'type', 'type'=>'xsd:int'),
-		'desc' => array('name'=>'desc', 'type'=>'xsd:string'),
-		'fk_product' => array('name'=>'fk_product', 'type'=>'xsd:int'),
-		'total_net' => array('name'=>'total_net', 'type'=>'xsd:double'),
-		'total_vat' => array('name'=>'total_vat', 'type'=>'xsd:double'),
-		'total' => array('name'=>'total', 'type'=>'xsd:double'),
-		'vat_rate' => array('name'=>'vat_rate', 'type'=>'xsd:double'),
-		'qty' => array('name'=>'qty', 'type'=>'xsd:double'),
-		'date_start' => array('name'=>'date_start', 'type'=>'xsd:date'),
-		'date_end' => array('name'=>'date_end', 'type'=>'xsd:date'),
+		'id' => array('name' => 'id', 'type' => 'xsd:string'),
+		'type' => array('name' => 'type', 'type' => 'xsd:int'),
+		'desc' => array('name' => 'desc', 'type' => 'xsd:string'),
+		'fk_product' => array('name' => 'fk_product', 'type' => 'xsd:int'),
+		'total_net' => array('name' => 'total_net', 'type' => 'xsd:double'),
+		'total_vat' => array('name' => 'total_vat', 'type' => 'xsd:double'),
+		'total' => array('name' => 'total', 'type' => 'xsd:double'),
+		'vat_rate' => array('name' => 'vat_rate', 'type' => 'xsd:double'),
+		'qty' => array('name' => 'qty', 'type' => 'xsd:double'),
+		'date_start' => array('name' => 'date_start', 'type' => 'xsd:date'),
+		'date_end' => array('name' => 'date_end', 'type' => 'xsd:date'),
 		// From product
-		'product_ref' => array('name'=>'product_ref', 'type'=>'xsd:string'),
-		'product_label' => array('name'=>'product_label', 'type'=>'xsd:string'),
-		'product_desc' => array('name'=>'product_desc', 'type'=>'xsd:string')
+		'product_ref' => array('name' => 'product_ref', 'type' => 'xsd:string'),
+		'product_label' => array('name' => 'product_label', 'type' => 'xsd:string'),
+		'product_desc' => array('name' => 'product_desc', 'type' => 'xsd:string')
 	)
 );
 
@@ -133,7 +134,7 @@ $server->wsdl->addComplexType(
 	'SOAP-ENC:Array',
 	array(),
 	array(
-		array('ref'=>'SOAP-ENC:arrayType', 'wsdl:arrayType'=>'tns:line[]')
+		array('ref' => 'SOAP-ENC:arrayType', 'wsdl:arrayType' => 'tns:line[]')
 	),
 	'tns:line'
 );
@@ -145,29 +146,29 @@ $server->wsdl->addComplexType(
 	'all',
 	'',
 	array(
-		'id' => array('name'=>'id', 'type'=>'xsd:string'),
-		'ref' => array('name'=>'ref', 'type'=>'xsd:string'),
-		'ref_ext' => array('name'=>'ref_ext', 'type'=>'xsd:string'),
-		'ref_supplier' => array('name'=>'ref_supplier', 'type'=>'xsd:string'),
-		'fk_user_author' => array('name'=>'fk_user_author', 'type'=>'xsd:int'),
-		'fk_user_valid' => array('name'=>'fk_user_valid', 'type'=>'xsd:int'),
-		'fk_thirdparty' => array('name'=>'fk_thirdparty', 'type'=>'xsd:int'),
-		'date_creation' => array('name'=>'date_creation', 'type'=>'xsd:dateTime'),
-		'date_validation' => array('name'=>'date_validation', 'type'=>'xsd:dateTime'),
-		'date_modification' => array('name'=>'date_modification', 'type'=>'xsd:dateTime'),
-		'date_invoice' => array('name'=>'date_invoice', 'type'=>'xsd:date'),
-		'date_term' => array('name'=>'date_modification', 'type'=>'xsd:date'),
-		'label' => array('name'=>'label', 'type'=>'xsd:date'),
-		'type' => array('name'=>'type', 'type'=>'xsd:int'),
-		'total_net' => array('name'=>'type', 'type'=>'xsd:double'),
-		'total_vat' => array('name'=>'type', 'type'=>'xsd:double'),
-		'total' => array('name'=>'type', 'type'=>'xsd:double'),
-		'note_private' => array('name'=>'note_private', 'type'=>'xsd:string'),
-		'note_public' => array('name'=>'note_public', 'type'=>'xsd:string'),
-		'status' => array('name'=>'status', 'type'=>'xsd:int'),
-		'close_code' => array('name'=>'close_code', 'type'=>'xsd:string'),
-		'close_note' => array('name'=>'close_note', 'type'=>'xsd:string'),
-		'lines' => array('name'=>'lines', 'type'=>'tns:LinesArray')
+		'id' => array('name' => 'id', 'type' => 'xsd:string'),
+		'ref' => array('name' => 'ref', 'type' => 'xsd:string'),
+		'ref_ext' => array('name' => 'ref_ext', 'type' => 'xsd:string'),
+		'ref_supplier' => array('name' => 'ref_supplier', 'type' => 'xsd:string'),
+		'fk_user_author' => array('name' => 'fk_user_author', 'type' => 'xsd:int'),
+		'fk_user_valid' => array('name' => 'fk_user_valid', 'type' => 'xsd:int'),
+		'fk_thirdparty' => array('name' => 'fk_thirdparty', 'type' => 'xsd:int'),
+		'date_creation' => array('name' => 'date_creation', 'type' => 'xsd:dateTime'),
+		'date_validation' => array('name' => 'date_validation', 'type' => 'xsd:dateTime'),
+		'date_modification' => array('name' => 'date_modification', 'type' => 'xsd:dateTime'),
+		'date_invoice' => array('name' => 'date_invoice', 'type' => 'xsd:date'),
+		'date_term' => array('name' => 'date_modification', 'type' => 'xsd:date'),
+		'label' => array('name' => 'label', 'type' => 'xsd:date'),
+		'type' => array('name' => 'type', 'type' => 'xsd:int'),
+		'total_net' => array('name' => 'type', 'type' => 'xsd:double'),
+		'total_vat' => array('name' => 'type', 'type' => 'xsd:double'),
+		'total' => array('name' => 'type', 'type' => 'xsd:double'),
+		'note_private' => array('name' => 'note_private', 'type' => 'xsd:string'),
+		'note_public' => array('name' => 'note_public', 'type' => 'xsd:string'),
+		'status' => array('name' => 'status', 'type' => 'xsd:int'),
+		'close_code' => array('name' => 'close_code', 'type' => 'xsd:string'),
+		'close_note' => array('name' => 'close_note', 'type' => 'xsd:string'),
+		'lines' => array('name' => 'lines', 'type' => 'tns:LinesArray')
 	)
 );
 
@@ -179,7 +180,7 @@ $server->wsdl->addComplexType(
 	'SOAP-ENC:Array',
 	array(),
 	array(
-		array('ref'=>'SOAP-ENC:arrayType', 'wsdl:arrayType'=>'tns:invoice[]')
+		array('ref' => 'SOAP-ENC:arrayType', 'wsdl:arrayType' => 'tns:invoice[]')
 	),
 	'tns:invoice'
 );
@@ -192,7 +193,7 @@ $server->wsdl->addComplexType(
 	'SOAP-ENC:Array',
 	array(),
 	array(
-		array('ref'=>'SOAP-ENC:arrayType', 'wsdl:arrayType'=>'tns:invoice[]')
+		array('ref' => 'SOAP-ENC:arrayType', 'wsdl:arrayType' => 'tns:invoice[]')
 	),
 	'tns:invoice'
 );
@@ -210,9 +211,9 @@ $styleuse = 'encoded'; // encoded/literal/literal wrapped
 $server->register(
 	'getSupplierInvoice',
 	// Entry values
-	array('authentication'=>'tns:authentication', 'id'=>'xsd:string', 'ref'=>'xsd:string', 'ref_ext'=>'xsd:string'),
+	array('authentication' => 'tns:authentication', 'id' => 'xsd:string', 'ref' => 'xsd:string', 'ref_ext' => 'xsd:string'),
 	// Exit values
-	array('result'=>'tns:result', 'invoice'=>'tns:invoice'),
+	array('result' => 'tns:result', 'invoice' => 'tns:invoice'),
 	$ns,
 	$ns.'#getSupplierInvoice',
 	$styledoc,
@@ -222,9 +223,9 @@ $server->register(
 $server->register(
 	'getSupplierInvoicesForThirdParty',
 	// Entry values
-	array('authentication'=>'tns:authentication', 'idthirdparty'=>'xsd:string'),
+	array('authentication' => 'tns:authentication', 'idthirdparty' => 'xsd:string'),
 	// Exit values
-	array('result'=>'tns:result', 'invoices'=>'tns:invoices'),
+	array('result' => 'tns:result', 'invoices' => 'tns:invoices'),
 	$ns,
 	$ns.'#getSupplierInvoicesForThirdParty',
 	$styledoc,
@@ -277,43 +278,43 @@ function getSupplierInvoice($authentication, $id = 0, $ref = '', $ref_ext = '')
 				foreach ($invoice->lines as $line) {
 					//var_dump($line); exit;
 					$linesresp[] = array(
-						'id'=>$line->rowid,
-						'type'=>$line->product_type,
-						'total_net'=>$line->total_ht,
-						'total_vat'=>$line->total_tva,
-						'total'=>$line->total_ttc,
-						'vat_rate'=>$line->tva_tx,
-						'qty'=>$line->qty
+						'id' => $line->rowid,
+						'type' => $line->product_type,
+						'total_net' => $line->total_ht,
+						'total_vat' => $line->total_tva,
+						'total' => $line->total_ttc,
+						'vat_rate' => $line->tva_tx,
+						'qty' => $line->qty
 					);
 					$i++;
 				}
 
 				// Create invoice
 				$objectresp = array(
-					'result'=>array('result_code'=>'OK', 'result_label'=>''),
-					'invoice'=>array(
+					'result' => array('result_code' => 'OK', 'result_label' => ''),
+					'invoice' => array(
 					'id' => $invoice->id,
 					'ref' => $invoice->ref,
-					'ref_supplier'=>$invoice->ref_supplier,
+					'ref_supplier' => $invoice->ref_supplier,
 					'ref_ext' => $invoice->ref_ext,
 					'fk_user_author' => $invoice->fk_user_author,
 					'fk_user_valid' => $invoice->fk_user_valid,
 					'fk_thirdparty' => $invoice->fk_soc,
-					'type'=>$invoice->type,
-					'status'=>$invoice->statut,
-					'total_net'=>$invoice->total_ht,
-					'total_vat'=>$invoice->total_tva,
-					'total'=>$invoice->total_ttc,
-					'date_creation'=>dol_print_date($invoice->datec, 'dayhourrfc'),
-					'date_modification'=>dol_print_date($invoice->tms, 'dayhourrfc'),
-					'date_invoice'=>dol_print_date($invoice->date, 'dayhourrfc'),
-					'date_term'=>dol_print_date($invoice->date_echeance, 'dayhourrfc'),
-					'label'=>$invoice->label,
-					'paid'=>$invoice->paid,
-					'note_private'=>$invoice->note_private,
-					'note_public'=>$invoice->note_public,
-					'close_code'=>$invoice->close_code,
-					'close_note'=>$invoice->close_note,
+					'type' => $invoice->type,
+					'status' => $invoice->status,
+					'total_net' => $invoice->total_ht,
+					'total_vat' => $invoice->total_tva,
+					'total' => $invoice->total_ttc,
+					'date_creation' => dol_print_date($invoice->datec, 'dayhourrfc'),
+					'date_modification' => dol_print_date($invoice->tms, 'dayhourrfc'),
+					'date_invoice' => dol_print_date($invoice->date, 'dayhourrfc'),
+					'date_term' => dol_print_date($invoice->date_echeance, 'dayhourrfc'),
+					'label' => $invoice->label,
+					'paid' => $invoice->paid,
+					'note_private' => $invoice->note_private,
+					'note_public' => $invoice->note_public,
+					'close_code' => $invoice->close_code,
+					'close_note' => $invoice->close_note,
 
 					'lines' => $linesresp,
 					// 'lines' => array('0'=>array('id'=>222,'type'=>1),
@@ -333,7 +334,7 @@ function getSupplierInvoice($authentication, $id = 0, $ref = '', $ref_ext = '')
 	}
 
 	if ($error) {
-		$objectresp = array('result'=>array('result_code' => $errorcode, 'result_label' => $errorlabel));
+		$objectresp = array('result' => array('result_code' => $errorcode, 'result_label' => $errorlabel));
 	}
 
 	return $objectresp;
@@ -402,44 +403,44 @@ function getSupplierInvoicesForThirdParty($authentication, $idthirdparty)
 				$linesresp = array();
 				foreach ($invoice->lines as $line) {
 					$linesresp[] = array(
-						'id'=>$line->rowid,
-						'type'=>$line->product_type,
-						'desc'=>dol_htmlcleanlastbr($line->description),
-						'total_net'=>$line->total_ht,
-						'total_vat'=>$line->total_tva,
-						'total'=>$line->total_ttc,
-						'vat_rate'=>$line->tva_tx,
-						'qty'=>$line->qty,
-						'product_ref'=>$line->product_ref,
-						'product_label'=>$line->product_label,
-						'product_desc'=>$line->product_desc,
+						'id' => $line->rowid,
+						'type' => $line->product_type,
+						'desc' => dol_htmlcleanlastbr($line->desc),
+						'total_net' => $line->total_ht,
+						'total_vat' => $line->total_tva,
+						'total' => $line->total_ttc,
+						'vat_rate' => $line->tva_tx,
+						'qty' => $line->qty,
+						'product_ref' => $line->product_ref,
+						'product_label' => $line->product_label,
+						'product_desc' => $line->product_desc,
 					);
 				}
 
 				// Now define invoice
 				$linesinvoice[] = array(
-					'id'=>$invoice->id,
-					'ref'=>$invoice->ref,
-					'ref_supplier'=>$invoice->ref_supplier,
-					'ref_ext'=>$invoice->ref_ext,
+					'id' => $invoice->id,
+					'ref' => $invoice->ref,
+					'ref_supplier' => $invoice->ref_supplier,
+					'ref_ext' => $invoice->ref_ext,
 					'fk_user_author' => $invoice->user_creation_id,
 					'fk_user_valid' => $invoice->user_validation_id,
 					'fk_thirdparty' => $invoice->socid,
-					'type'=>$invoice->type,
-					'status'=>$invoice->status,
-					'total_net'=>$invoice->total_ht,
-					'total_vat'=>$invoice->total_tva,
-					'total'=>$invoice->total_ttc,
-					'date_creation'=>dol_print_date($invoice->datec, 'dayhourrfc'),
-					'date_modification'=>dol_print_date($invoice->tms, 'dayhourrfc'),
-					'date_invoice'=>dol_print_date($invoice->date, 'dayhourrfc'),
-					'date_term'=>dol_print_date($invoice->date_echeance, 'dayhourrfc'),
-					'label'=>$invoice->label,
-					'paid'=>$invoice->paid,
-					'note_private'=>$invoice->note_private,
-					'note_public'=>$invoice->note_public,
-					'close_code'=>$invoice->close_code,
-					'close_note'=>$invoice->close_note,
+					'type' => $invoice->type,
+					'status' => $invoice->status,
+					'total_net' => $invoice->total_ht,
+					'total_vat' => $invoice->total_tva,
+					'total' => $invoice->total_ttc,
+					'date_creation' => dol_print_date($invoice->datec, 'dayhourrfc'),
+					'date_modification' => dol_print_date($invoice->tms, 'dayhourrfc'),
+					'date_invoice' => dol_print_date($invoice->date, 'dayhourrfc'),
+					'date_term' => dol_print_date($invoice->date_echeance, 'dayhourrfc'),
+					'label' => $invoice->label,
+					'paid' => $invoice->paid,
+					'note_private' => $invoice->note_private,
+					'note_public' => $invoice->note_public,
+					'close_code' => $invoice->close_code,
+					'close_note' => $invoice->close_note,
 
 					'lines' => $linesresp
 				);
@@ -448,8 +449,8 @@ function getSupplierInvoicesForThirdParty($authentication, $idthirdparty)
 			}
 
 			$objectresp = array(
-				'result'=>array('result_code'=>'OK', 'result_label'=>''),
-				'invoices'=>$linesinvoice
+				'result' => array('result_code' => 'OK', 'result_label' => ''),
+				'invoices' => $linesinvoice
 
 			);
 		} else {
@@ -460,7 +461,7 @@ function getSupplierInvoicesForThirdParty($authentication, $idthirdparty)
 	}
 
 	if ($error) {
-		$objectresp = array('result'=>array('result_code' => $errorcode, 'result_label' => $errorlabel));
+		$objectresp = array('result' => array('result_code' => $errorcode, 'result_label' => $errorlabel));
 	}
 
 	return $objectresp;
diff --git a/htdocs/zapier/class/api_zapier.class.php b/htdocs/zapier/class/api_zapier.class.php
index b18dd175029..89464a4ee5c 100644
--- a/htdocs/zapier/class/api_zapier.class.php
+++ b/htdocs/zapier/class/api_zapier.class.php
@@ -85,7 +85,7 @@ class Zapier extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('hook', $this->hook->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		return $this->_cleanObjectDatas($this->hook);
@@ -120,7 +120,7 @@ class Zapier extends DolibarrApi
 		// }
 
 		// if (! DolibarrApi::_checkAccessToResource('hook', $this->hook->id)) {
-		//     throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+		//     throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		// }
 
 		return $arraychoices;
@@ -242,11 +242,11 @@ class Zapier extends DolibarrApi
 		foreach ($request_data as $field => $value) {
 			if ($field === 'caller') {
 				// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
-				$this->hook->context['caller'] = $request_data['caller'];
+				$this->hook->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
 				continue;
 			}
 
-			$this->hook->$field = $value;
+			$this->hook->$field = $this->_checkValForAPI($field, $value, $this->hook);
 		}
 
 		$this->hook->fk_user = DolibarrApiAccess::$user->id;
@@ -279,7 +279,7 @@ class Zapier extends DolibarrApi
 		}
 
 		if (!DolibarrApi::_checkAccessToResource('hook', $this->hook->id)) {
-			throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
+			throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
 		}
 
 		if (!$this->hook->delete(DolibarrApiAccess::$user)) {
diff --git a/test/phpunit/CommonClassTest.class.php b/test/phpunit/CommonClassTest.class.php
index 0db9b170871..ee5db8c46d4 100644
--- a/test/phpunit/CommonClassTest.class.php
+++ b/test/phpunit/CommonClassTest.class.php
@@ -235,6 +235,69 @@ abstract class CommonClassTest extends TestCase
 		}
 	}
 
+
+	/**
+	 * Call method, even if protected.
+	 *
+	 * @param object $obj  Object on which to call method
+	 * @param string $name Method to call
+	 * @param array  $args Arguments to provide in method call
+	 * @return mixed Return value
+	 */
+	public static function callMethod($obj, $name, array $args = [])
+	{
+		$class = new \ReflectionClass($obj);
+		$method = $class->getMethod($name);
+		// If PHP is older then 8.1.0
+		if (PHP_VERSION_ID < 80100) {
+			$method->setAccessible(true);
+		}
+		return $method->invokeArgs($obj, $args);
+	}
+
+
+	/**
+	 * Compare all public properties values of 2 objects
+	 *
+	 * @param   Object $oA                      Object operand 1
+	 * @param   Object $oB                      Object operand 2
+	 * @param   boolean $ignoretype             False will not report diff if type of value differs
+	 * @param   array $fieldstoignorearray      Array of fields to ignore in diff
+	 * @return  array                           Array with differences
+	 */
+	public function objCompare($oA, $oB, $ignoretype = true, $fieldstoignorearray = array('id'))
+	{
+		$retAr = array();
+
+		if (get_class($oA) !== get_class($oB)) {
+			$retAr[] = "Supplied objects are not of same class.";
+		} else {
+			$oVarsA = get_object_vars($oA);
+			$oVarsB = get_object_vars($oB);
+			$aKeys = array_keys($oVarsA);
+			if (method_exists($oA, 'deprecatedProperties')) {
+				// Update exclusions
+				foreach (self::callMethod($oA, 'deprecatedProperties') as $deprecated => $new) {
+					if (in_array($deprecated, $fieldstoignorearray)) {
+						$fieldstoignorearray[] = $new;
+					}
+				}
+			}
+			foreach ($aKeys as $sKey) {
+				if (in_array($sKey, $fieldstoignorearray)) {
+					continue;
+				}
+				if (! $ignoretype && ($oVarsA[$sKey] !== $oVarsB[$sKey])) {
+					$retAr[] = get_class($oA).'::'.$sKey.' : '.(is_object($oVarsA[$sKey]) ? get_class($oVarsA[$sKey]) : json_encode($oVarsA[$sKey])).' <> '.(is_object($oVarsB[$sKey]) ? get_class($oVarsB[$sKey]) : json_encode($oVarsB[$sKey]));
+				}
+				if ($ignoretype && ($oVarsA[$sKey] != $oVarsB[$sKey])) {
+					$retAr[] = get_class($oA).'::'.$sKey.' : '.(is_object($oVarsA[$sKey]) ? get_class($oVarsA[$sKey]) : json_encode($oVarsA[$sKey])).' <> '.(is_object($oVarsB[$sKey]) ? get_class($oVarsB[$sKey]) : json_encode($oVarsB[$sKey]));
+				}
+			}
+		}
+		return $retAr;
+	}
+
 	/**
 	 * Map deprecated module names to new module names
 	 */
diff --git a/test/phpunit/FactureRecTest.php b/test/phpunit/FactureRecTest.php
index 2644c4fe084..801a6656131 100644
--- a/test/phpunit/FactureRecTest.php
+++ b/test/phpunit/FactureRecTest.php
@@ -1,6 +1,7 @@
 <?php
 /* Copyright (C) 2013 Laurent Destailleur  <eldy@users.sourceforge.net>
  * Copyright (C) 2023 Alexandre Janniaux   <alexandre.janniaux@gmail.com>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -117,38 +118,4 @@ class FactureRecTest extends CommonClassTest
 		$localobject->note_private = 'New note';
 		//$localobject->note='New note after update';
 	}
-
-	/**
-	 * Compare all public properties values of 2 objects
-	 *
-	 * @param 	Object		$oA						Object operand 1
-	 * @param 	Object		$oB						Object operand 2
-	 * @param	boolean		$ignoretype				False will not report diff if type of value differs
-	 * @param	array		$fieldstoignorearray	Array of fields to ignore in diff
-	 * @return	array								Array with differences
-	 */
-	public function objCompare($oA, $oB, $ignoretype = true, $fieldstoignorearray = array('id'))
-	{
-		$retAr = array();
-
-		if (get_class($oA) !== get_class($oB)) {
-			$retAr[] = "Supplied objects are not of same class.";
-		} else {
-			$oVarsA = get_object_vars($oA);
-			$oVarsB = get_object_vars($oB);
-			$aKeys = array_keys($oVarsA);
-			foreach ($aKeys as $sKey) {
-				if (in_array($sKey, $fieldstoignorearray)) {
-					continue;
-				}
-				if (! $ignoretype && ($oVarsA[$sKey] !== $oVarsB[$sKey])) {
-					$retAr[] = $sKey.' : '.(is_object($oVarsA[$sKey]) ? get_class($oVarsA[$sKey]) : $oVarsA[$sKey]).' <> '.(is_object($oVarsB[$sKey]) ? get_class($oVarsB[$sKey]) : $oVarsB[$sKey]);
-				}
-				if ($ignoretype && ($oVarsA[$sKey] != $oVarsB[$sKey])) {
-					$retAr[] = $sKey.' : '.(is_object($oVarsA[$sKey]) ? get_class($oVarsA[$sKey]) : $oVarsA[$sKey]).' <> '.(is_object($oVarsB[$sKey]) ? get_class($oVarsB[$sKey]) : $oVarsB[$sKey]);
-				}
-			}
-		}
-		return $retAr;
-	}
 }
diff --git a/test/phpunit/FactureTest.php b/test/phpunit/FactureTest.php
index e2f9fa5f68c..2fc0bb6d67d 100644
--- a/test/phpunit/FactureTest.php
+++ b/test/phpunit/FactureTest.php
@@ -2,6 +2,7 @@
 /* Copyright (C) 2010 Laurent Destailleur   <eldy@users.sourceforge.net>
  * Copyright (C) 2018 Frédéric France       <frederic.france@netlogic.fr>
  * Copyright (C) 2023 Alexandre Janniaux   <alexandre.janniaux@gmail.com>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -155,7 +156,7 @@ class FactureTest extends CommonClassTest
 
 		$this->assertLessThan($result, 0);
 
-		// Test everything are still same than specimen
+		// Test everything is still the same as specimen
 		$newlocalobject = new Facture($db);
 		$newlocalobject->initAsSpecimen();
 		$this->changeProperties($newlocalobject);
@@ -168,6 +169,7 @@ class FactureTest extends CommonClassTest
 			$localobject,
 			$newlocalobject,
 			true,
+			// Not comparing:
 			array(
 				'newref','oldref','id','lines','client','thirdparty','brouillon','user_creation_id','date_creation','date_validation','datem','date_modification',
 				'ref','statut','status','paye','specimen','ref','actiontypecode','actionmsg2','actionmsg','mode_reglement','cond_reglement',
@@ -281,38 +283,4 @@ class FactureTest extends CommonClassTest
 		$localobject->note_private = 'New note';
 		//$localobject->note='New note after update';
 	}
-
-	/**
-	 * Compare all public properties values of 2 objects
-	 *
-	 * @param   Object $oA                      Object operand 1
-	 * @param   Object $oB                      Object operand 2
-	 * @param   boolean $ignoretype             False will not report diff if type of value differs
-	 * @param   array $fieldstoignorearray      Array of fields to ignore in diff
-	 * @return  array                           Array with differences
-	 */
-	public function objCompare($oA, $oB, $ignoretype = true, $fieldstoignorearray = array('id'))
-	{
-		$retAr = array();
-
-		if (get_class($oA) !== get_class($oB)) {
-			$retAr[] = "Supplied objects are not of same class.";
-		} else {
-			$oVarsA = get_object_vars($oA);
-			$oVarsB = get_object_vars($oB);
-			$aKeys = array_keys($oVarsA);
-			foreach ($aKeys as $sKey) {
-				if (in_array($sKey, $fieldstoignorearray)) {
-					continue;
-				}
-				if (! $ignoretype && ($oVarsA[$sKey] !== $oVarsB[$sKey])) {
-					$retAr[] = $sKey.' : '.(is_object($oVarsA[$sKey]) ? get_class($oVarsA[$sKey]) : $oVarsA[$sKey]).' <> '.(is_object($oVarsB[$sKey]) ? get_class($oVarsB[$sKey]) : $oVarsB[$sKey]);
-				}
-				if ($ignoretype && ($oVarsA[$sKey] != $oVarsB[$sKey])) {
-					$retAr[] = $sKey.' : '.(is_object($oVarsA[$sKey]) ? get_class($oVarsA[$sKey]) : $oVarsA[$sKey]).' <> '.(is_object($oVarsB[$sKey]) ? get_class($oVarsB[$sKey]) : $oVarsB[$sKey]);
-				}
-			}
-		}
-		return $retAr;
-	}
 }
diff --git a/test/phpunit/InventoryTest.php b/test/phpunit/InventoryTest.php
index 2d9808e12ce..7761608d1a6 100644
--- a/test/phpunit/InventoryTest.php
+++ b/test/phpunit/InventoryTest.php
@@ -2,6 +2,7 @@
 /* Copyright (C) 2010 Laurent Destailleur   <eldy@users.sourceforge.net>
  * Copyright (C) 2018 Frédéric France       <frederic.france@netlogic.fr>
  * Copyright (C) 2023 Alexandre Janniaux    <alexandre.janniaux@gmail.com>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -267,38 +268,4 @@ class InventoryTest extends CommonClassTest
 
 		return $result;
 	}
-
-	/**
-	 * Compare all public properties values of 2 objects
-	 *
-	 * @param   Object $oA                      Object operand 1
-	 * @param   Object $oB                      Object operand 2
-	 * @param   boolean $ignoretype             False will not report diff if type of value differs
-	 * @param   array $fieldstoignorearray      Array of fields to ignore in diff
-	 * @return  array                           Array with differences
-	 */
-	public function objCompare($oA, $oB, $ignoretype = true, $fieldstoignorearray = array('id'))
-	{
-		$retAr = array();
-
-		if (get_class($oA) !== get_class($oB)) {
-			$retAr[] = "Supplied objects are not of same class.";
-		} else {
-			$oVarsA = get_object_vars($oA);
-			$oVarsB = get_object_vars($oB);
-			$aKeys = array_keys($oVarsA);
-			foreach ($aKeys as $sKey) {
-				if (in_array($sKey, $fieldstoignorearray)) {
-					continue;
-				}
-				if (! $ignoretype && ($oVarsA[$sKey] !== $oVarsB[$sKey])) {
-					$retAr[] = $sKey.' : '.(is_object($oVarsA[$sKey]) ? get_class($oVarsA[$sKey]) : $oVarsA[$sKey]).' <> '.(is_object($oVarsB[$sKey]) ? get_class($oVarsB[$sKey]) : $oVarsB[$sKey]);
-				}
-				if ($ignoretype && ($oVarsA[$sKey] != $oVarsB[$sKey])) {
-					$retAr[] = $sKey.' : '.(is_object($oVarsA[$sKey]) ? get_class($oVarsA[$sKey]) : $oVarsA[$sKey]).' <> '.(is_object($oVarsB[$sKey]) ? get_class($oVarsB[$sKey]) : $oVarsB[$sKey]);
-				}
-			}
-		}
-		return $retAr;
-	}
 }
diff --git a/test/phpunit/UserTest.php b/test/phpunit/UserTest.php
index 877d258d60b..d5328982f3a 100644
--- a/test/phpunit/UserTest.php
+++ b/test/phpunit/UserTest.php
@@ -1,6 +1,7 @@
 <?php
 /* Copyright (C) 2010-2015 Laurent Destailleur  <eldy@users.sourceforge.net>
  * Copyright (C) 2023      Alexandre Janniaux   <alexandre.janniaux@gmail.com>
+ * Copyright (C) 2024		MDW							<mdeweerd@users.noreply.github.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -403,38 +404,4 @@ class UserTest extends CommonClassTest
 	{
 		$localobject->note_private = 'New note after update';
 	}
-
-	/**
-	 * Compare all public properties values of 2 objects
-	 *
-	 * @param   Object      $oA                     Object operand 1
-	 * @param   Object      $oB                     Object operand 2
-	 * @param   boolean     $ignoretype             False will not report diff if type of value differs
-	 * @param   array       $fieldstoignorearray    Array of fields to ignore in diff
-	 * @return  array                               Array with differences
-	 */
-	public function objCompare($oA, $oB, $ignoretype = true, $fieldstoignorearray = array('id'))
-	{
-		$retAr = array();
-
-		if (get_class($oA) !== get_class($oB)) {
-			$retAr[] = "Supplied objects are not of same class.";
-		} else {
-			$oVarsA = get_object_vars($oA);
-			$oVarsB = get_object_vars($oB);
-			$aKeys = array_keys($oVarsA);
-			foreach ($aKeys as $sKey) {
-				if (in_array($sKey, $fieldstoignorearray)) {
-					continue;
-				}
-				if (! $ignoretype && ($oVarsA[$sKey] !== $oVarsB[$sKey])) {
-					$retAr[] = $sKey.' : '.(is_object($oVarsA[$sKey]) ? get_class($oVarsA[$sKey]) : $oVarsA[$sKey]).' <> '.(is_object($oVarsB[$sKey]) ? get_class($oVarsB[$sKey]) : $oVarsB[$sKey]);
-				}
-				if ($ignoretype && ($oVarsA[$sKey] != $oVarsB[$sKey])) {
-					$retAr[] = $sKey.' : '.(is_object($oVarsA[$sKey]) ? get_class($oVarsA[$sKey]) : $oVarsA[$sKey]).' <> '.(is_object($oVarsB[$sKey]) ? get_class($oVarsB[$sKey]) : $oVarsB[$sKey]);
-				}
-			}
-		}
-		return $retAr;
-	}
 }