N°8413 - Make data synchro work on DBObject

N°8308 - Broken URL in sending mail
2026-02-23 12:24:18 +01:00 · 2025-06-04 11:51:34 +02:00 · 2025-06-02 17:15:51 +02:00 · 2025-06-02 16:09:29 +02:00 · 2025-05-28 10:59:50 +02:00 · 2025-05-27 10:41:05 +02:00
80 changed files with 2055 additions and 555 deletions
--- a/.doc/itop-version-history.md
+++ b/.doc/itop-version-history.md
@@ -93,6 +93,12 @@ gitGraph
    checkout support/3.2
    commit id: "2024-06-25" tag: "3.2.0-beta1" type: REVERSE
    commit id: "2024-08-07" tag: "3.2.0"
+    checkout support/2.7
+    commit id: "2025-02-25" tag: "2.7.12"
+    checkout support/3.1
+    commit id: "2025-02-25 " tag: "3.1.3"
+    checkout support/3.2
+    commit id: "2025-02-25  " tag: "3.2.1"
 ```

 To learn more, check the [iTop community versions history on the official wiki](https://www.itophub.io/wiki/page?id=latest:release:start).
--- a/README.md
+++ b/README.md
@@ -106,6 +106,7 @@ We would like to give a special thank you 🤗 to the people from the community
 - Raenker, Martin
 - Roháč, Richard (a.k.a [@RohacRichard](https://github.com/RohacRichard))
 - Rosenke, Stephan
+- Rossi, Tommaso (a.k.a [@tomrss](https://www.github.com/tomrss))
 - Rudner, Björn (a.k.a [@rudnerbjoern](https://github.com/rudnerbjoern))
 - Šafránek, Jaroslav (a.k.a [jkcinik](https://sourceforge.net/u/jkcinik/profile/) on SourceForge)
 - Seki, Shoji
@@ -115,6 +116,7 @@ We would like to give a special thank you 🤗 to the people from the community
 - Tarjányi, Csaba (a.k.a [@tacsaby](https://github.com/tacsaby))
 - Tulio, Marco
 - Turrubiates, Miguel
+- Vlk, Karel (a.k.a [@vlk-charles](https://www.github.com/vlk-charles))

 ### Aliases

--- a/application/applicationextension.inc.php
+++ b/application/applicationextension.inc.php
@@ -1711,6 +1711,11 @@ interface iRestServiceProvider
 	public function ExecOperation($sVersion, $sVerb, $aParams);
 }

+interface iRestInputSanitizer
+{
+	public function SanitizeJsonInput(string $sJsonInput): string;
+}
+
 /**
 * Minimal REST response structure. Derive this structure to add response data and error codes.
 *
@@ -1802,6 +1807,14 @@ class RestResult
 	 * @api
 	 */
 	public $message;
+	
+	/**
+	 * Sanitize the content of this result to hide sensitive information
+	 */
+	public function SanitizeContent()
+	{
+		// The default implementation does nothing
+	}
 }

 /**
--- a/application/cmdbabstract.class.inc.php
+++ b/application/cmdbabstract.class.inc.php
@@ -3079,7 +3079,7 @@ JS
 		} else {
 			$sCancelButtonOnClickScript .= "function() { BackToDetails('$sClass', $iKey, '$sDefaultUrl', $sJSToken)};";
 		}
-		$sCancelButtonOnClickScript .= "$('#form_{$this->m_iFormId} button.cancel').on('click', fOnClick{$this->m_iFormId}CancelButton);";
+		$sCancelButtonOnClickScript .= "$('#form_{$this->m_iFormId} button.cancel').on('click.navigation.itop', fOnClick{$this->m_iFormId}CancelButton);";
 		$oPage->add_ready_script($sCancelButtonOnClickScript);

 		$iFieldsCount = count($aFieldsMap);
--- a/application/dashboard.class.inc.php
+++ b/application/dashboard.class.inc.php
@@ -524,9 +524,7 @@ EOF
 	 */
 	public function Render($oPage, $bEditMode = false, $aExtraParams = array(), $bCanEdit = true)
 	{
-		if (!array_key_exists('dashboard_div_id', $aExtraParams)) {
-			$aExtraParams['dashboard_div_id'] = utils::Sanitize($this->GetId(), '', 'element_identifier');
-		}
+		$aExtraParams['dashboard_div_id'] = utils::Sanitize($aExtraParams['dashboard_div_id'] ?? null, $this->GetId(), utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER);

 		/** @var \DashboardLayoutMultiCol $oLayout */
 		$oLayout = new $this->sLayoutClass();
@@ -1052,7 +1050,7 @@ EOF
 		$sSelectorHtml .= '</div>';

 		$sFile = addslashes($this->GetDefinitionFile());
-		$sReloadURL = $this->GetReloadURL();
+		$sReloadURL = json_encode($this->GetReloadURL());

 		$bFromDashboardPage = isset($aAjaxParams['from_dashboard_page']) ? isset($aAjaxParams['from_dashboard_page']) : false;
 		if ($bFromDashboardPage) {
@@ -1141,7 +1139,6 @@ JS
 			->AddCSSClass('ibo-action-button');

 		$oToolbar->AddSubBlock($oActionButton);
-
 		$aActions = array();
 		$sFile = addslashes(utils::LocalPath($this->sDefinitionFile));
 		$sJSExtraParams = json_encode($aExtraParams);
@@ -1166,7 +1163,7 @@ JS
 		$oToolbar->AddSubBlock($oActionButton)
 			->AddSubBlock($oActionsMenu);

-		$sReloadURL = $this->GetReloadURL();
+		$sReloadURL = json_encode($this->GetReloadURL());
 		$oPage->add_script(
 			<<<EOF
 function EditDashboard(sId, sDashboardFile, aExtraParams)
@@ -1273,7 +1270,7 @@ EOF
 		$sTitle = json_encode($this->sTitle);
 		$sFile = json_encode($this->GetDefinitionFile());
 		$sUrl = utils::GetAbsoluteUrlAppRoot().'pages/ajax.render.php';
-		$sReloadURL = $this->GetReloadURL();
+		$sReloadURL = json_encode($this->GetReloadURL());

 		$sExitConfirmationMessage = addslashes(Dict::S('UI:NavigateAwayConfirmationMessage'));
 		$sCancelConfirmationMessage = addslashes(Dict::S('UI:CancelConfirmationMessage'));
--- a/application/ui.extkeywidget.class.inc.php
+++ b/application/ui.extkeywidget.class.inc.php
@@ -250,7 +250,7 @@ class UIExtKeyWidget
 					foreach ($aAdditionalField as $sAdditionalField) {
 						array_push($aArguments, $oObj->Get($sAdditionalField));
 					}
-					$aOption['additional_field'] = utils::HtmlEntities(vsprintf($sFormatAdditionalField, $aArguments));
+					$aOption['additional_field'] = utils::HtmlEntities(utils::VSprintf($sFormatAdditionalField, $aArguments));
 				}
 				if (!empty($sObjectImageAttCode)) {
 					// Try to retrieve image for contact
--- a/application/utils.inc.php
+++ b/application/utils.inc.php
@@ -419,11 +419,26 @@ class utils
 	 * @since 2.7.7, 3.0.2, 3.1.0 N°4899 - new 'url' filter
 	 * @since 2.7.10 N°6606 use the utils::ENUM_SANITIZATION_* const
 	 * @since 2.7.10 N°6606 new case for ENUM_SANITIZATION_FILTER_PHP_CLASS
+	 * @since 3.2.1-1 N°8242 Allow value to be an array for every filter
 	 *
 	 * @link https://www.php.net/manual/en/filter.filters.sanitize.php PHP sanitization filters
 	 */
 	protected static function Sanitize_Internal($value, $sSanitizationFilter)
 	{
+		if (is_array($value))
+		{
+			$retValue = array();
+			foreach ($value as $key => $val)
+			{
+				$retValue[$key] = self::Sanitize_Internal($val, $sSanitizationFilter); // recursively check arrays
+				if ($retValue[$key] === false)
+				{
+					return false;
+				}
+			}
+			return $retValue;
+		}
+
 		switch ($sSanitizationFilter)
 		{
 			case static::ENUM_SANITIZATION_FILTER_INTEGER:
@@ -454,52 +469,36 @@ class utils
 			case static::ENUM_SANITIZATION_FILTER_PARAMETER:
 			case static::ENUM_SANITIZATION_FILTER_FIELD_NAME:
 			case static::ENUM_SANITIZATION_FILTER_TRANSACTION_ID:
-				if (is_array($value))
+				switch ($sSanitizationFilter)
 				{
-					$retValue = array();
-					foreach ($value as $key => $val)
-					{
-						$retValue[$key] = self::Sanitize_Internal($val, $sSanitizationFilter); // recursively check arrays
-						if ($retValue[$key] === false)
-						{
-							$retValue = false;
-							break;
-						}
-					}
-				}
-				else
-				{
-					switch ($sSanitizationFilter)
-					{
-						case static::ENUM_SANITIZATION_FILTER_TRANSACTION_ID:
-							// Same as parameter type but keep the dot character
-							// transaction_id, the dot is mostly for Windows servers when using file storage as the tokens are named *.tmp
-							// - See N°1835
-							// - Note: It must be included at the regexp beginning otherwise you'll get an invalid character error
-							$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[\. A-Za-z0-9_=-]*$/')));
-							break;
+					case static::ENUM_SANITIZATION_FILTER_TRANSACTION_ID:
+						// Same as parameter type but keep the dot character
+						// transaction_id, the dot is mostly for Windows servers when using file storage as the tokens are named *.tmp
+						// - See N°1835
+						// - Note: It must be included at the regexp beginning otherwise you'll get an invalid character error
+						$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[\. A-Za-z0-9_=-]*$/')));
+						break;

-						case static::ENUM_SANITIZATION_FILTER_ROUTE:
-						case static::ENUM_SANITIZATION_FILTER_OPERATION:
-							// - Routes should be of the "controller_namespace_code.controller_method_name" form
-							// - Operations should be allowed to be namespaced as well even though then don't have dedicated controller yet
-							$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[\.A-Za-z0-9_-]*$/')));
-							break;
+					case static::ENUM_SANITIZATION_FILTER_ROUTE:
+					case static::ENUM_SANITIZATION_FILTER_OPERATION:
+						// - Routes should be of the "controller_namespace_code.controller_method_name" form
+						// - Operations should be allowed to be namespaced as well even though then don't have dedicated controller yet
+						$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[\.A-Za-z0-9_-]*$/')));
+						break;

-						case static::ENUM_SANITIZATION_FILTER_PARAMETER:
-							$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[ A-Za-z0-9_=-]*$/'))); // the '=', '%3D, '%2B', '%2F'
-							// Characters are used in serialized filters (starting 2.5, only the url encoded versions are presents, but the "=" is kept for BC)
-							break;
+					case static::ENUM_SANITIZATION_FILTER_PARAMETER:
+						$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[ A-Za-z0-9_=-]*$/'))); // the '=', '%3D, '%2B', '%2F'
+						// Characters are used in serialized filters (starting 2.5, only the url encoded versions are presents, but the "=" is kept for BC)
+						break;

-						case static::ENUM_SANITIZATION_FILTER_FIELD_NAME:
-							$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[A-Za-z0-9_]+(->[A-Za-z0-9_]+)*$/'))); // att_code or att_code->name or AttCode->Name or AttCode->Key2->Name
-							break;
+					case static::ENUM_SANITIZATION_FILTER_FIELD_NAME:
+						$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[A-Za-z0-9_]+(->[A-Za-z0-9_]+)*$/'))); // att_code or att_code->name or AttCode->Name or AttCode->Key2->Name
+						break;

-						case static::ENUM_SANITIZATION_FILTER_CONTEXT_PARAM:
-							$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[ A-Za-z0-9_=%:+-]*$/')));
-							break;
+					case static::ENUM_SANITIZATION_FILTER_CONTEXT_PARAM:
+						$retValue = filter_var($value, FILTER_VALIDATE_REGEXP, array("options" => array("regexp" => '/^[ A-Za-z0-9_=%:+-]*$/')));
+						break;

-					}
 				}
 				break;

@@ -522,8 +521,8 @@ class utils

 			// For URL
 			case static::ENUM_SANITIZATION_FILTER_URL:
-                // N°6350 - returns only valid URLs
-				$retValue = filter_var($value, FILTER_VALIDATE_URL);
+				$retValue = filter_var($value, FILTER_SANITIZE_URL);
+				$retValue = filter_var($retValue, FILTER_VALIDATE_URL);
 				break;

 			default:
@@ -1556,6 +1555,11 @@ class utils
 				}
 				$aResult[] = new JSPopupMenuItem('UI:Menu:AddToDashboard', Dict::S('UI:Menu:AddToDashboard'), "DashletCreationDlg('$sOQL', '$sContext')");
 				$aResult[] = new JSPopupMenuItem('UI:Menu:ShortcutList', Dict::S('UI:Menu:ShortcutList'), "ShortcutListDlg('$sOQL', '$sDataTableId', '$sContext')");
+                if (ApplicationMenu::IsMenuIdEnabled('RunQueriesMenu')) {
+                    $oMenuItemPlay = new JSPopupMenuItem('UI:Menu:OpenOQL', Dict::S('UI:Edit:TestQuery'), "OpenOql('$sOQL')");
+                    $oMenuItemPlay->SetIconClass('fas fa-play');
+                    $aResult[] = $oMenuItemPlay;
+                }

 				break;

@@ -2076,6 +2080,127 @@ SQL;
 		);
 	}

+	/**
+	*  Format a string using vsprintf with safety checks to avoid ValueError
+	*
+	*  This method fills missing arguments with their original format specifiers,
+	*  then calls vsprintf with the complete array.
+	*
+	* @param string $sFormat The format string
+	* @param array $aArgs The arguments to format
+	* @param bool $bLogErrors Whether to log errors (defaults to true)
+	*
+	* @return string The formatted string
+	 * @since 3.2.2
+	*/
+	public static function VSprintf(string $sFormat, array $aArgs, bool $bLogErrors = true): string
+	{
+		// Extract all format specifiers
+		$sPattern = '/%(?:(?:[1-9][0-9]*)\$)?[-+\'0# ]*(?:[0-9]*|\*)?(?:\.(?:[0-9]*|\*))?(?:[hlL])?[diouxXeEfFgGcrs%]/';
+		preg_match_all($sPattern, $sFormat, $aMatches, PREG_OFFSET_CAPTURE);
+
+		// Process matches, keeping track of their positions and excluding escaped percent signs (%%)
+		$aSpecifierMatches = [];
+		foreach ($aMatches[0] as $sMatch) {
+			if ($sMatch[0] !== '%%') {
+				$aSpecifierMatches[] = $sMatch;
+			}
+		}
+
+		// Check for positional specifiers and build position map
+		$bHasPositional = false;
+		$iMaxPosition = 0;
+		$aPositions = [];
+		$aUniquePositions = [];
+
+		foreach ($aSpecifierMatches as $index => $match) {
+			$sSpec = $match[0];
+			if (preg_match('/^%([1-9][0-9]*)\$/', $sSpec, $posMatch)) {
+				$bHasPositional = true;
+				$iPosition = (int)$posMatch[1] - 1; // Convert to 0-based
+				$aPositions[$index] = $iPosition;
+				$aUniquePositions[$iPosition] = true;
+				$iMaxPosition = max($iMaxPosition, $iPosition + 1);
+			} else {
+				$aPositions[$index] = $index;
+				$aUniquePositions[$index] = true;
+				$iMaxPosition = max($iMaxPosition, $index + 1);
+			}
+		}
+
+		// Count unique positions, this tells us how many arguments we actually need
+		$iExpectedCount = count($aUniquePositions);
+		$iActualCount = count($aArgs);
+
+		// If we have enough arguments, just use vsprintf
+		if ($iActualCount >= $iExpectedCount) {
+			return vsprintf($sFormat, $aArgs);
+		}
+		// else log the error if needed
+		if ($bLogErrors) {
+			IssueLog::Warning("Format string requires $iExpectedCount arguments, but only $iActualCount provided. Format: '$sFormat'"	);
+		}
+
+		// Create a replacement map
+		if ($bHasPositional) {
+			// For positional, we need to handle the exact positions
+			$aReplacements = array_fill(0, $iMaxPosition, null);
+
+			// Fill in the real arguments first
+			foreach ($aArgs as $index => $sValue) {
+				if ($index < $iMaxPosition) {
+					$aReplacements[$index] = $sValue;
+				}
+			}
+
+			// For null values in the replacement map, use the original specifier
+			foreach ($aSpecifierMatches as $index => $sMatch) {
+				$iPosition = $aPositions[$index];
+				if ($aReplacements[$iPosition] === null) {
+					// Use the original format specifier when we don't have an argument
+					$aReplacements[$iPosition] = $sMatch[0];
+				}
+			}
+
+			// Remove any remaining nulls (for positions that weren't referenced)
+			$aReplacements = array_filter($aReplacements, static function($val) { return $val !== null; });
+		} else {
+			// For non-positional, we need to map each position
+			$aReplacements = [];
+			$iUsed = 0;
+
+			// Create a map of what values to use for each position
+			$aPositionValues = [];
+			for ($i = 0; $i < $iMaxPosition; $i++) {
+				if (isset($aUniquePositions[$i])) {
+					if ($iUsed < $iActualCount) {
+						// We have an actual argument for this position
+						$aPositionValues[$i] = $aArgs[$iUsed++];
+					} else {
+						// Mark this position to use the original specifier
+						$aPositionValues[$i] = null;
+					}
+				}
+			}
+
+			// Build the replacements array preserving the original order
+			foreach ($aSpecifierMatches as $index => $sMatch) {
+				$iPosition = $aPositions[$index];
+				if (isset($aPositionValues[$iPosition])) {
+					$aReplacements[] = $aPositionValues[$iPosition];
+				} else {
+					// Use the original format specifier when we don't have an argument
+					$aReplacements[] = $sMatch[0];
+					// Mark this position as used, so if it appears again, it gets the same replacement
+					$aPositionValues[$iPosition] = $sMatch[0];
+				}
+			}
+		}
+
+		// Process the format string with our filled-in arguments
+		return vsprintf($sFormat, $aReplacements);
+	}
+
 	/**
 	 * Convert a string containing some (valid) HTML markup to plain text
 	 *
--- a/core/attributedef.class.inc.php
+++ b/core/attributedef.class.inc.php
@@ -142,7 +142,7 @@ abstract class AttributeDefinition

 	protected $aCSSClasses;

-	public function GetType()
+    public function GetType()
 	{
 		return Dict::S('Core:'.get_class($this));
 	}
@@ -4193,7 +4193,7 @@ class AttributeFinalClass extends AttributeString
 */
 class AttributePassword extends AttributeString implements iAttributeNoGroupBy
 {
-	const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;
+    const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;

 	/**
 	 * Useless constructor, but if not present PHP 7.4.0/7.4.1 is crashing :( (N°2329)
@@ -4270,7 +4270,7 @@ class AttributePassword extends AttributeString implements iAttributeNoGroupBy
 */
 class AttributeEncryptedString extends AttributeString implements iAttributeNoGroupBy
 {
-	const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;
+    const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;

 	protected function GetSQLCol($bFullSpec = false)
 	{
@@ -6346,7 +6346,15 @@ class AttributeDateTime extends AttributeDBField

 		$oFormField = parent::MakeFormField($oObject, $oFormField);

-		return $oFormField;
+        // After call to the parent as it sets the current value
+        $oValue = $oObject->Get($this->GetCode());
+        if ($oValue === $this->GetNullValue()) {
+            $oValue = $this->GetDefaultValue($oObject);
+        }
+        $oFormField->SetCurrentValue($this->GetFormat()->Format($oValue));
+
+
+        return $oFormField;
 	}

 	/**
@@ -10004,7 +10012,7 @@ class AttributeSubItem extends AttributeDefinition
 */
 class AttributeOneWayPassword extends AttributeDefinition implements iAttributeNoGroupBy
 {
-	const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;
+    const SEARCH_WIDGET_TYPE = self::SEARCH_WIDGET_TYPE_RAW;

 	/**
 	 * Useless constructor, but if not present PHP 7.4.0/7.4.1 is crashing :( (N°2329)
--- a/core/dict.class.inc.php
+++ b/core/dict.class.inc.php
@@ -206,7 +206,7 @@ class Dict
 		}

 		try{
-			return vsprintf($sLocalizedFormat, $aArguments);
+			return utils::VSprintf($sLocalizedFormat, $aArguments);
 		} catch(\Throwable $e){
 			\IssueLog::Error("Cannot format dict key", null, ["sFormatCode" => $sFormatCode, "sLangCode" => $sLangCode, 'exception_msg' => $e->getMessage() ]);
 			return $sFormatCode.' - '.implode(', ', $aArguments);
--- a/core/modelreflection.class.inc.php
+++ b/core/modelreflection.class.inc.php
@@ -77,7 +77,7 @@ abstract class ModelReflection
 			return $sFormatCode.' - '.implode(', ', $aArguments);
 		}

-		return vsprintf($sLocalizedFormat, $aArguments);
+		return utils::VSprintf($sLocalizedFormat, $aArguments);
 	}

 	/**
--- a/core/restservices.class.inc.php
+++ b/core/restservices.class.inc.php
@@ -44,6 +44,8 @@ class ObjectResult
 	 * @var string
 	 * @api
 	 */
+    use SanitizeTrait;
+
 	public $message;
 	/**
 	 * @var mixed|null
@@ -74,6 +76,52 @@ class ObjectResult
 		$this->fields = array();
 	}

+	/**
+	 * Creates an ObjectResult from a DBObject.
+	 *
+	 * @param DBObject $oObj The object.
+	 * @param array|null $aFieldSpec An array of class => attribute codes (Cf. RestUtils::GetFieldList). List of the attributes to be reported.
+	 * @param boolean $bExtendedOutput Output all of the link set attributes ?
+	 * @param integer $iCode An error code (RestResult::OK is no issue has been found)
+	 * @param string $sMessage Description of the error if any, an empty string otherwise
+	 * 
+	 * @return ObjectResult
+	 */
+	public static function FromDBObject(DBObject $oObj, ?array $aFieldSpec = null, $bExtendedOutput = false, $iCode = 0, $sMessage = '') : ObjectResult {
+
+		$oObjRes = new ObjectResult($oObj::class, $oObj->GetKey());
+		$oObjRes->code = $iCode;
+		$oObjRes->message = $sMessage;
+
+		$aFields = null;
+		if (!is_null($aFieldSpec))
+		{
+			// Enum all classes in the hierarchy, starting with the current one
+			foreach (MetaModel::EnumParentClasses($oObj::class, ENUM_PARENT_CLASSES_ALL, false) as $sRefClass)
+			{
+				if (array_key_exists($sRefClass, $aFieldSpec))
+				{
+					$aFields = $aFieldSpec[$sRefClass];
+					break;
+				}
+			}
+		}
+		if (is_null($aFields))
+		{
+			// No fieldspec given, or not found...
+			$aFields = array('id', 'friendlyname');
+		}
+
+		foreach ($aFields as $sAttCode)
+		{
+			$oObjRes->AddField($oObj, $sAttCode, $bExtendedOutput);
+		}
+
+		return $oObjRes;
+
+	}
+
+
 	/**
 	 * Helper to make an output value for a given attribute
 	 *
@@ -156,6 +204,19 @@ class ObjectResult
 	{
 		$this->fields[$sAttCode] = $this->MakeResultValue($oObject, $sAttCode, $bExtendedOutput);
 	}
+
+public function SanitizeContent()
+	{
+		foreach($this->fields as $sFieldAttCode => $fieldValue)
+		{
+            try {
+			$oAttDef = MetaModel::GetAttributeDef($this->class, $sFieldAttCode);
+            } catch (Exception $e) { // for special cases like ID
+                continue;
+            }
+                $this->SanitizeFieldIfSensitive($this->fields, $sFieldAttCode, $fieldValue, $oAttDef);
+		}
+	}
 }


@@ -189,38 +250,21 @@ class RestResultWithObjects extends RestResult
 	 */
 	public function AddObject($iCode, $sMessage, $oObject, $aFieldSpec = null, $bExtendedOutput = false)
 	{
-		$sClass = get_class($oObject);
-		$oObjRes = new ObjectResult($sClass, $oObject->GetKey());
-		$oObjRes->code = $iCode;
-		$oObjRes->message = $sMessage;
-
-		$aFields = null;
-		if (!is_null($aFieldSpec))
-		{
-			// Enum all classes in the hierarchy, starting with the current one
-			foreach (MetaModel::EnumParentClasses($sClass, ENUM_PARENT_CLASSES_ALL, false) as $sRefClass)
-			{
-				if (array_key_exists($sRefClass, $aFieldSpec))
-				{
-					$aFields = $aFieldSpec[$sRefClass];
-					break;
-				}
-			}
-		}
-		if (is_null($aFields))
-		{
-			// No fieldspec given, or not found...
-			$aFields = array('id', 'friendlyname');
-		}
-
-		foreach ($aFields as $sAttCode)
-		{
-			$oObjRes->AddField($oObject, $sAttCode, $bExtendedOutput);
-		}
+		$oObjRes = ObjectResult::FromDBObject($oObject, $aFieldSpec, $bExtendedOutput, $iCode, $sMessage);

 		$sObjKey = get_class($oObject).'::'.$oObject->GetKey();
 		$this->objects[$sObjKey] = $oObjRes;
 	}
+
+public function SanitizeContent()
+	{
+		parent::SanitizeContent();
+
+		foreach($this->objects as $sObjKey => $oObjRes)
+		{
+			$oObjRes->SanitizeContent();
+		}
+	}
 }

 /**
@@ -308,9 +352,10 @@ class RestDelete
 *
 * @package     Core
 */
-class CoreServices implements iRestServiceProvider
+class CoreServices implements iRestServiceProvider, iRestInputSanitizer
 {
-	/**
+    use SanitizeTrait;
+    /**
 	 * Enumerate services delivered by this class
 	 * 	 
 	 * @param string $sVersion The version (e.g. 1.0) supported by the services
@@ -528,18 +573,18 @@ class CoreServices implements iRestServiceProvider
            }
 			else
 			{
-                                if (!$bExtendedOutput && RestUtils::GetOptionalParam($aParams, 'output_fields', '*') != '*') 
+                                if (!$bExtendedOutput && RestUtils::GetOptionalParam($aParams, 'output_fields', '*') != '*')
                                {
                                        $aFields = $aShowFields[$sClass];
                                        //Id is not a valid attribute to optimize
-                                        if (in_array('id', $aFields)) 
+                                        if (in_array('id', $aFields))
                                        {
                                            unset($aFields[array_search('id', $aFields)]);
                                        }
                                        $aAttToLoad = array($oObjectSet->GetClassAlias() => $aFields);
                                        $oObjectSet->OptimizeColumnLoad($aAttToLoad);
                                }
-                                
+
 				while ($oObject = $oObjectSet->Fetch())
 				{
 					$oResult->AddObject(0, '', $oObject, $aShowFields, $bExtendedOutput);
@@ -737,6 +782,33 @@ class CoreServices implements iRestServiceProvider
 		return $oResult;
 	}

+	public function SanitizeJsonInput(string $sJsonInput): string
+	{
+        $sSanitizedJsonInput = $sJsonInput;
+        $aJsonData = json_decode($sSanitizedJsonInput, true);
+        $sOperation = $aJsonData['operation'];
+
+        switch ($sOperation) {
+            case 'core/check_credentials':
+                if (isset($aJsonData['password'])) {
+                    $aJsonData['password'] = '*****';
+                }
+                break;
+            case 'core/update':
+            case 'core/create':
+            default :
+            $sClass = $aJsonData['class'];
+            if (isset($aJsonData['fields'])) {
+                foreach ($aJsonData['fields'] as $sFieldAttCode => $fieldValue) {
+                    $oAttDef = MetaModel::GetAttributeDef($sClass, $sFieldAttCode);
+                    $this->SanitizeFieldIfSensitive($aJsonData['fields'], $sFieldAttCode, $fieldValue, $oAttDef);
+                }
+            }
+            break;
+        }
+		return json_encode($aJsonData, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE);
+	}
+
 	/**
 	 * Helper for object deletion	
 	 */
@@ -875,3 +947,50 @@ class CoreServices implements iRestServiceProvider
 		return $iLimit * max(0, $iPage - 1);
 	}
 }
+
+trait SanitizeTrait
+{
+    /**
+     * Sanitize a field if it is sensitive.
+     *
+     * @param array $fields The fields array
+     * @param string $sFieldAttCode The attribute code
+     * @param mixed $oAttDef The attribute definition
+     * @throws Exception
+     */
+    private function SanitizeFieldIfSensitive(array &$fields, string $sFieldAttCode, $fieldValue, $oAttDef): void
+    {
+        // for simple attribute
+        if ($oAttDef instanceof iAttributeNoGroupBy) // iAttributeNoGroupBy is equivalent to sensitive attribute
+        {
+            $fields[$sFieldAttCode] = '*****';
+            return;
+        }
+        // for 1-n / n-n relation
+        if ($oAttDef instanceof AttributeLinkedSet) {
+            foreach ($fieldValue as $i => $aLnkValues) {
+                foreach ($aLnkValues as $sLnkAttCode => $sLnkValue) {
+                    $oLnkAttDef = MetaModel::GetAttributeDef($oAttDef->GetLinkedClass(), $sLnkAttCode);
+                    if ($oLnkAttDef instanceof iAttributeNoGroupBy) { // 1-n relation
+                        $fields[$sFieldAttCode][$i][$sLnkAttCode] = '*****';
+                    }
+                    elseif ($oAttDef instanceof AttributeLinkedSetIndirect && $oLnkAttDef instanceof AttributeExternalField) { // for n-n relation
+                        $oExtKeyAttDef = MetaModel::GetAttributeDef($oLnkAttDef->GetTargetClass(), $oLnkAttDef->GetExtAttCode());
+                        if ($oExtKeyAttDef instanceof iAttributeNoGroupBy) {
+                            $fields[$sFieldAttCode][$i][$sLnkAttCode] = '*****';
+                        }
+                    }
+                }
+            }
+            return;
+        }
+
+        // for external attribute
+        if ($oAttDef instanceof AttributeExternalField) {
+            $oExtKeyAttDef = MetaModel::GetAttributeDef($oAttDef->GetTargetClass(), $oAttDef->GetExtAttCode());
+            if ($oExtKeyAttDef instanceof iAttributeNoGroupBy) {
+                $fields[$sFieldAttCode] = '*****';
+            }
+        }
+    }
+}
--- a/core/valuesetdef.class.inc.php
+++ b/core/valuesetdef.class.inc.php
@@ -435,7 +435,7 @@ class ValueSetObjects extends ValueSetDefinition
 				foreach ($aAdditionalField as $sAdditionalField) {
 					array_push($aArguments, $oObject->Get($sAdditionalField));
 				}
-				$aData['additional_field'] = vsprintf($sFormatAdditionalField, $aArguments);
+				$aData['additional_field'] = utils::VSprintf($sFormatAdditionalField, $aArguments);
 			} else {
 				$aData['additional_field'] = '';
 			}
--- a/datamodels/2.x/authent-cas/composer.json
+++ b/datamodels/2.x/authent-cas/composer.json
@@ -1,4 +1,5 @@
 {
+  "name": "combodo/authent-cas",
  "config" : {
    "classmap-authoritative" : true
  },
--- a/datamodels/2.x/authent-cas/composer.lock
+++ b/datamodels/2.x/authent-cas/composer.lock
@@ -4,15 +4,15 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "d751713988987e9331980363e24189ce",
+    "content-hash": "2f342cfe65023402c1e00d88698d52b9",
    "packages": [],
    "packages-dev": [],
    "aliases": [],
    "minimum-stability": "stable",
-    "stability-flags": [],
+    "stability-flags": {},
    "prefer-stable": false,
    "prefer-lowest": false,
-    "platform": [],
-    "platform-dev": [],
-    "plugin-api-version": "2.1.0"
+    "platform": {},
+    "platform-dev": {},
+    "plugin-api-version": "2.6.0"
 }
--- a/datamodels/2.x/authent-cas/vendor/autoload.php
+++ b/datamodels/2.x/authent-cas/vendor/autoload.php
@@ -2,6 +2,24 @@

 // autoload.php @generated by Composer

+if (PHP_VERSION_ID < 50600) {
+    if (!headers_sent()) {
+        header('HTTP/1.1 500 Internal Server Error');
+    }
+    $err = 'Composer 2.3.0 dropped support for autoloading on PHP <5.6 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;
+    if (!ini_get('display_errors')) {
+        if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
+            fwrite(STDERR, $err);
+        } elseif (!headers_sent()) {
+            echo $err;
+        }
+    }
+    trigger_error(
+        $err,
+        E_USER_ERROR
+    );
+}
+
 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInit1878ad96115c3aa0fa5e9fd9807f5db0::getLoader();
+return ComposerAutoloaderInit2f342cfe65023402c1e00d88698d52b9::getLoader();
--- a/datamodels/2.x/authent-cas/vendor/composer/ClassLoader.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/ClassLoader.php
@@ -42,35 +42,37 @@ namespace Composer\Autoload;
 */
 class ClassLoader
 {
-    /** @var ?string */
+    /** @var \Closure(string):void */
+    private static $includeFile;
+
+    /** @var string|null */
    private $vendorDir;

    // PSR-4
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, int>>
+     * @var array<string, array<string, int>>
     */
    private $prefixLengthsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, array<int, string>>
+     * @var array<string, list<string>>
     */
    private $prefixDirsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr4 = array();

    // PSR-0
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, string[]>>
+     * List of PSR-0 prefixes
+     *
+     * Structured as array('F (first letter)' => array('Foo\Bar (full prefix)' => array('path', 'path2')))
+     *
+     * @var array<string, array<string, list<string>>>
     */
    private $prefixesPsr0 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr0 = array();

@@ -78,8 +80,7 @@ class ClassLoader
    private $useIncludePath = false;

    /**
-     * @var string[]
-     * @psalm-var array<string, string>
+     * @var array<string, string>
     */
    private $classMap = array();

@@ -87,29 +88,29 @@ class ClassLoader
    private $classMapAuthoritative = false;

    /**
-     * @var bool[]
-     * @psalm-var array<string, bool>
+     * @var array<string, bool>
     */
    private $missingClasses = array();

-    /** @var ?string */
+    /** @var string|null */
    private $apcuPrefix;

    /**
-     * @var self[]
+     * @var array<string, self>
     */
    private static $registeredLoaders = array();

    /**
-     * @param ?string $vendorDir
+     * @param string|null $vendorDir
     */
    public function __construct($vendorDir = null)
    {
        $this->vendorDir = $vendorDir;
+        self::initializeIncludeClosure();
    }

    /**
-     * @return string[]
+     * @return array<string, list<string>>
     */
    public function getPrefixes()
    {
@@ -121,8 +122,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, array<int, string>>
+     * @return array<string, list<string>>
     */
    public function getPrefixesPsr4()
    {
@@ -130,8 +130,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirs()
    {
@@ -139,8 +138,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirsPsr4()
    {
@@ -148,8 +146,7 @@ class ClassLoader
    }

    /**
-     * @return string[] Array of classname => path
-     * @psalm-var array<string, string>
+     * @return array<string, string> Array of classname => path
     */
    public function getClassMap()
    {
@@ -157,8 +154,7 @@ class ClassLoader
    }

    /**
-     * @param string[] $classMap Class to filename map
-     * @psalm-param array<string, string> $classMap
+     * @param array<string, string> $classMap Class to filename map
     *
     * @return void
     */
@@ -175,24 +171,25 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix, either
     * appending or prepending to the ones previously set for this prefix.
     *
-     * @param string          $prefix  The prefix
-     * @param string[]|string $paths   The PSR-0 root directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix
+     * @param list<string>|string $paths   The PSR-0 root directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @return void
     */
    public function add($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            if ($prepend) {
                $this->fallbackDirsPsr0 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr0
                );
            } else {
                $this->fallbackDirsPsr0 = array_merge(
                    $this->fallbackDirsPsr0,
-                    (array) $paths
+                    $paths
                );
            }

@@ -201,19 +198,19 @@ class ClassLoader

        $first = $prefix[0];
        if (!isset($this->prefixesPsr0[$first][$prefix])) {
-            $this->prefixesPsr0[$first][$prefix] = (array) $paths;
+            $this->prefixesPsr0[$first][$prefix] = $paths;

            return;
        }
        if ($prepend) {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixesPsr0[$first][$prefix]
            );
        } else {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
                $this->prefixesPsr0[$first][$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -222,9 +219,9 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace, either
     * appending or prepending to the ones previously set for this namespace.
     *
-     * @param string          $prefix  The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths   The PSR-4 base directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths   The PSR-4 base directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @throws \InvalidArgumentException
     *
@@ -232,17 +229,18 @@ class ClassLoader
     */
    public function addPsr4($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            // Register directories for the root namespace.
            if ($prepend) {
                $this->fallbackDirsPsr4 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr4
                );
            } else {
                $this->fallbackDirsPsr4 = array_merge(
                    $this->fallbackDirsPsr4,
-                    (array) $paths
+                    $paths
                );
            }
        } elseif (!isset($this->prefixDirsPsr4[$prefix])) {
@@ -252,18 +250,18 @@ class ClassLoader
                throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
            }
            $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
-            $this->prefixDirsPsr4[$prefix] = (array) $paths;
+            $this->prefixDirsPsr4[$prefix] = $paths;
        } elseif ($prepend) {
            // Prepend directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixDirsPsr4[$prefix]
            );
        } else {
            // Append directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
                $this->prefixDirsPsr4[$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -272,8 +270,8 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix,
     * replacing any others previously set for this prefix.
     *
-     * @param string          $prefix The prefix
-     * @param string[]|string $paths  The PSR-0 base directories
+     * @param string              $prefix The prefix
+     * @param list<string>|string $paths  The PSR-0 base directories
     *
     * @return void
     */
@@ -290,8 +288,8 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace,
     * replacing any others previously set for this namespace.
     *
-     * @param string          $prefix The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths  The PSR-4 base directories
+     * @param string              $prefix The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths  The PSR-4 base directories
     *
     * @throws \InvalidArgumentException
     *
@@ -425,7 +423,8 @@ class ClassLoader
    public function loadClass($class)
    {
        if ($file = $this->findFile($class)) {
-            includeFile($file);
+            $includeFile = self::$includeFile;
+            $includeFile($file);

            return true;
        }
@@ -476,9 +475,9 @@ class ClassLoader
    }

    /**
-     * Returns the currently registered loaders indexed by their corresponding vendor directories.
+     * Returns the currently registered loaders keyed by their corresponding vendor directories.
     *
-     * @return self[]
+     * @return array<string, self>
     */
    public static function getRegisteredLoaders()
    {
@@ -555,18 +554,26 @@ class ClassLoader

        return false;
    }
-}

-/**
- * Scope isolated include.
- *
- * Prevents access to $this/self from included files.
- *
- * @param  string $file
- * @return void
- * @private
- */
-function includeFile($file)
-{
-    include $file;
+    /**
+     * @return void
+     */
+    private static function initializeIncludeClosure()
+    {
+        if (self::$includeFile !== null) {
+            return;
+        }
+
+        /**
+         * Scope isolated include.
+         *
+         * Prevents access to $this/self from included files.
+         *
+         * @param  string $file
+         * @return void
+         */
+        self::$includeFile = \Closure::bind(static function($file) {
+            include $file;
+        }, null, null);
+    }
 }
--- a/datamodels/2.x/authent-cas/vendor/composer/InstalledVersions.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/InstalledVersions.php
@@ -21,11 +21,31 @@ use Composer\Semver\VersionParser;
 * See also https://getcomposer.org/doc/07-runtime.md#installed-versions
 *
 * To require its presence, you can require `composer-runtime-api ^2.0`
+ *
+ * @final
 */
 class InstalledVersions
 {
+    /**
+     * @var mixed[]|null
+     * @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
+     */
    private static $installed;
+
+    /**
+     * @var bool
+     */
+    private static $installedIsLocalDir;
+
+    /**
+     * @var bool|null
+     */
    private static $canGetVendors;
+
+    /**
+     * @var array[]
+     * @psalm-var array<string, array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
+     */
    private static $installedByVendor = array();

    /**
@@ -83,7 +103,7 @@ class InstalledVersions
    {
        foreach (self::getInstalled() as $installed) {
            if (isset($installed['versions'][$packageName])) {
-                return $includeDevRequirements || empty($installed['versions'][$packageName]['dev_requirement']);
+                return $includeDevRequirements || !isset($installed['versions'][$packageName]['dev_requirement']) || $installed['versions'][$packageName]['dev_requirement'] === false;
            }
        }

@@ -104,7 +124,7 @@ class InstalledVersions
     */
    public static function satisfies(VersionParser $parser, $packageName, $constraint)
    {
-        $constraint = $parser->parseConstraints($constraint);
+        $constraint = $parser->parseConstraints((string) $constraint);
        $provided = $parser->parseConstraints(self::getVersionRanges($packageName));

        return $provided->matches($constraint);
@@ -228,7 +248,7 @@ class InstalledVersions

    /**
     * @return array
-     * @psalm-return array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}
+     * @psalm-return array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}
     */
    public static function getRootPackage()
    {
@@ -242,7 +262,7 @@ class InstalledVersions
     *
     * @deprecated Use getAllRawData() instead which returns all datasets for all autoloaders present in the process. getRawData only returns the first dataset loaded, which may not be what you expect.
     * @return array[]
-     * @psalm-return array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}
+     * @psalm-return array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}
     */
    public static function getRawData()
    {
@@ -265,7 +285,7 @@ class InstalledVersions
     * Returns the raw data of all installed.php which are currently loaded for custom implementations
     *
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    public static function getAllRawData()
    {
@@ -288,17 +308,23 @@ class InstalledVersions
     * @param  array[] $data A vendor/composer/installed.php data set
     * @return void
     *
-     * @psalm-param array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>} $data
+     * @psalm-param array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $data
     */
    public static function reload($data)
    {
        self::$installed = $data;
        self::$installedByVendor = array();
+
+        // when using reload, we disable the duplicate protection to ensure that self::$installed data is
+        // always returned, but we cannot know whether it comes from the installed.php in __DIR__ or not,
+        // so we have to assume it does not, and that may result in duplicate data being returned when listing
+        // all installed packages for example
+        self::$installedIsLocalDir = false;
    }

    /**
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    private static function getInstalled()
    {
@@ -307,17 +333,27 @@ class InstalledVersions
        }

        $installed = array();
+        $copiedLocalDir = false;

        if (self::$canGetVendors) {
+            $selfDir = strtr(__DIR__, '\\', '/');
            foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
+                $vendorDir = strtr($vendorDir, '\\', '/');
                if (isset(self::$installedByVendor[$vendorDir])) {
                    $installed[] = self::$installedByVendor[$vendorDir];
                } elseif (is_file($vendorDir.'/composer/installed.php')) {
-                    $installed[] = self::$installedByVendor[$vendorDir] = require $vendorDir.'/composer/installed.php';
-                    if (null === self::$installed && strtr($vendorDir.'/composer', '\\', '/') === strtr(__DIR__, '\\', '/')) {
-                        self::$installed = $installed[count($installed) - 1];
+                    /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                    $required = require $vendorDir.'/composer/installed.php';
+                    self::$installedByVendor[$vendorDir] = $required;
+                    $installed[] = $required;
+                    if (self::$installed === null && $vendorDir.'/composer' === $selfDir) {
+                        self::$installed = $required;
+                        self::$installedIsLocalDir = true;
                    }
                }
+                if (self::$installedIsLocalDir && $vendorDir.'/composer' === $selfDir) {
+                    $copiedLocalDir = true;
+                }
            }
        }

@@ -325,12 +361,17 @@ class InstalledVersions
            // only require the installed.php file if this file is loaded from its dumped location,
            // and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
            if (substr(__DIR__, -8, 1) !== 'C') {
-                self::$installed = require __DIR__ . '/installed.php';
+                /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                $required = require __DIR__ . '/installed.php';
+                self::$installed = $required;
            } else {
                self::$installed = array();
            }
        }
-        $installed[] = self::$installed;
+
+        if (self::$installed !== array() && !$copiedLocalDir) {
+            $installed[] = self::$installed;
+        }

        return $installed;
    }
--- a/datamodels/2.x/authent-cas/vendor/composer/autoload_classmap.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/autoload_classmap.php
@@ -2,7 +2,7 @@

 // autoload_classmap.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/authent-cas/vendor/composer/autoload_namespaces.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/autoload_namespaces.php
@@ -2,7 +2,7 @@

 // autoload_namespaces.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/authent-cas/vendor/composer/autoload_psr4.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/autoload_psr4.php
@@ -2,7 +2,7 @@

 // autoload_psr4.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/authent-cas/vendor/composer/autoload_real.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInit1878ad96115c3aa0fa5e9fd9807f5db0
+class ComposerAutoloaderInit2f342cfe65023402c1e00d88698d52b9
 {
    private static $loader;

@@ -22,21 +22,12 @@ class ComposerAutoloaderInit1878ad96115c3aa0fa5e9fd9807f5db0
            return self::$loader;
        }

-        spl_autoload_register(array('ComposerAutoloaderInit1878ad96115c3aa0fa5e9fd9807f5db0', 'loadClassLoader'), true, true);
-        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(\dirname(__FILE__)));
-        spl_autoload_unregister(array('ComposerAutoloaderInit1878ad96115c3aa0fa5e9fd9807f5db0', 'loadClassLoader'));
+        spl_autoload_register(array('ComposerAutoloaderInit2f342cfe65023402c1e00d88698d52b9', 'loadClassLoader'), true, true);
+        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
+        spl_autoload_unregister(array('ComposerAutoloaderInit2f342cfe65023402c1e00d88698d52b9', 'loadClassLoader'));

-        $useStaticLoader = PHP_VERSION_ID >= 50600 && !defined('HHVM_VERSION') && (!function_exists('zend_loader_file_encoded') || !zend_loader_file_encoded());
-        if ($useStaticLoader) {
-            require __DIR__ . '/autoload_static.php';
-
-            call_user_func(\Composer\Autoload\ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0::getInitializer($loader));
-        } else {
-            $classMap = require __DIR__ . '/autoload_classmap.php';
-            if ($classMap) {
-                $loader->addClassMap($classMap);
-            }
-        }
+        require __DIR__ . '/autoload_static.php';
+        call_user_func(\Composer\Autoload\ComposerStaticInit2f342cfe65023402c1e00d88698d52b9::getInitializer($loader));

        $loader->setClassMapAuthoritative(true);
        $loader->register(true);
--- a/datamodels/2.x/authent-cas/vendor/composer/autoload_static.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace Composer\Autoload;

-class ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0
+class ComposerStaticInit2f342cfe65023402c1e00d88698d52b9
 {
    public static $prefixLengthsPsr4 = array (
        'C' => 
@@ -31,9 +31,9 @@ class ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0
    public static function getInitializer(ClassLoader $loader)
    {
        return \Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInit1878ad96115c3aa0fa5e9fd9807f5db0::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInit2f342cfe65023402c1e00d88698d52b9::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInit2f342cfe65023402c1e00d88698d52b9::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInit2f342cfe65023402c1e00d88698d52b9::$classMap;

        }, null, ClassLoader::class);
    }
--- a/datamodels/2.x/authent-cas/vendor/composer/installed.php
+++ b/datamodels/2.x/authent-cas/vendor/composer/installed.php
@@ -1,22 +1,22 @@
 <?php return array(
    'root' => array(
+        'name' => 'combodo/authent-cas',
        'pretty_version' => 'dev-develop',
        'version' => 'dev-develop',
+        'reference' => '567bdc4200f5edb335a39c4b48fbd18bacb6cfc7',
        'type' => 'library',
        'install_path' => __DIR__ . '/../../',
        'aliases' => array(),
-        'reference' => '5a1627632aa2e605996c1c556c60c2a2cddc0a05',
-        'name' => '__root__',
        'dev' => true,
    ),
    'versions' => array(
-        '__root__' => array(
+        'combodo/authent-cas' => array(
            'pretty_version' => 'dev-develop',
            'version' => 'dev-develop',
+            'reference' => '567bdc4200f5edb335a39c4b48fbd18bacb6cfc7',
            'type' => 'library',
            'install_path' => __DIR__ . '/../../',
            'aliases' => array(),
-            'reference' => '5a1627632aa2e605996c1c556c60c2a2cddc0a05',
            'dev_requirement' => false,
        ),
    ),
--- a/datamodels/2.x/itop-attachments/composer.json
+++ b/datamodels/2.x/itop-attachments/composer.json
@@ -1,4 +1,5 @@
 {
+  "name": "combodo/itop-attachments",
  "config" : {
    "classmap-authoritative" : true
  },
--- a/datamodels/2.x/itop-attachments/composer.lock
+++ b/datamodels/2.x/itop-attachments/composer.lock
@@ -4,15 +4,15 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "d751713988987e9331980363e24189ce",
+    "content-hash": "ee10bebff75617dbf9d929ac6e40c19f",
    "packages": [],
    "packages-dev": [],
    "aliases": [],
    "minimum-stability": "stable",
-    "stability-flags": [],
+    "stability-flags": {},
    "prefer-stable": false,
    "prefer-lowest": false,
-    "platform": [],
-    "platform-dev": [],
-    "plugin-api-version": "2.1.0"
+    "platform": {},
+    "platform-dev": {},
+    "plugin-api-version": "2.6.0"
 }
--- a/datamodels/2.x/itop-attachments/vendor/autoload.php
+++ b/datamodels/2.x/itop-attachments/vendor/autoload.php
@@ -2,6 +2,24 @@

 // autoload.php @generated by Composer

+if (PHP_VERSION_ID < 50600) {
+    if (!headers_sent()) {
+        header('HTTP/1.1 500 Internal Server Error');
+    }
+    $err = 'Composer 2.3.0 dropped support for autoloading on PHP <5.6 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;
+    if (!ini_get('display_errors')) {
+        if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
+            fwrite(STDERR, $err);
+        } elseif (!headers_sent()) {
+            echo $err;
+        }
+    }
+    trigger_error(
+        $err,
+        E_USER_ERROR
+    );
+}
+
 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInit478f6fa51842c80229f6a5c4f2ecbd50::getLoader();
+return ComposerAutoloaderInitee10bebff75617dbf9d929ac6e40c19f::getLoader();
--- a/datamodels/2.x/itop-attachments/vendor/composer/ClassLoader.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/ClassLoader.php
@@ -42,35 +42,37 @@ namespace Composer\Autoload;
 */
 class ClassLoader
 {
-    /** @var ?string */
+    /** @var \Closure(string):void */
+    private static $includeFile;
+
+    /** @var string|null */
    private $vendorDir;

    // PSR-4
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, int>>
+     * @var array<string, array<string, int>>
     */
    private $prefixLengthsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, array<int, string>>
+     * @var array<string, list<string>>
     */
    private $prefixDirsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr4 = array();

    // PSR-0
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, string[]>>
+     * List of PSR-0 prefixes
+     *
+     * Structured as array('F (first letter)' => array('Foo\Bar (full prefix)' => array('path', 'path2')))
+     *
+     * @var array<string, array<string, list<string>>>
     */
    private $prefixesPsr0 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr0 = array();

@@ -78,8 +80,7 @@ class ClassLoader
    private $useIncludePath = false;

    /**
-     * @var string[]
-     * @psalm-var array<string, string>
+     * @var array<string, string>
     */
    private $classMap = array();

@@ -87,29 +88,29 @@ class ClassLoader
    private $classMapAuthoritative = false;

    /**
-     * @var bool[]
-     * @psalm-var array<string, bool>
+     * @var array<string, bool>
     */
    private $missingClasses = array();

-    /** @var ?string */
+    /** @var string|null */
    private $apcuPrefix;

    /**
-     * @var self[]
+     * @var array<string, self>
     */
    private static $registeredLoaders = array();

    /**
-     * @param ?string $vendorDir
+     * @param string|null $vendorDir
     */
    public function __construct($vendorDir = null)
    {
        $this->vendorDir = $vendorDir;
+        self::initializeIncludeClosure();
    }

    /**
-     * @return string[]
+     * @return array<string, list<string>>
     */
    public function getPrefixes()
    {
@@ -121,8 +122,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, array<int, string>>
+     * @return array<string, list<string>>
     */
    public function getPrefixesPsr4()
    {
@@ -130,8 +130,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirs()
    {
@@ -139,8 +138,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirsPsr4()
    {
@@ -148,8 +146,7 @@ class ClassLoader
    }

    /**
-     * @return string[] Array of classname => path
-     * @psalm-var array<string, string>
+     * @return array<string, string> Array of classname => path
     */
    public function getClassMap()
    {
@@ -157,8 +154,7 @@ class ClassLoader
    }

    /**
-     * @param string[] $classMap Class to filename map
-     * @psalm-param array<string, string> $classMap
+     * @param array<string, string> $classMap Class to filename map
     *
     * @return void
     */
@@ -175,24 +171,25 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix, either
     * appending or prepending to the ones previously set for this prefix.
     *
-     * @param string          $prefix  The prefix
-     * @param string[]|string $paths   The PSR-0 root directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix
+     * @param list<string>|string $paths   The PSR-0 root directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @return void
     */
    public function add($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            if ($prepend) {
                $this->fallbackDirsPsr0 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr0
                );
            } else {
                $this->fallbackDirsPsr0 = array_merge(
                    $this->fallbackDirsPsr0,
-                    (array) $paths
+                    $paths
                );
            }

@@ -201,19 +198,19 @@ class ClassLoader

        $first = $prefix[0];
        if (!isset($this->prefixesPsr0[$first][$prefix])) {
-            $this->prefixesPsr0[$first][$prefix] = (array) $paths;
+            $this->prefixesPsr0[$first][$prefix] = $paths;

            return;
        }
        if ($prepend) {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixesPsr0[$first][$prefix]
            );
        } else {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
                $this->prefixesPsr0[$first][$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -222,9 +219,9 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace, either
     * appending or prepending to the ones previously set for this namespace.
     *
-     * @param string          $prefix  The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths   The PSR-4 base directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths   The PSR-4 base directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @throws \InvalidArgumentException
     *
@@ -232,17 +229,18 @@ class ClassLoader
     */
    public function addPsr4($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            // Register directories for the root namespace.
            if ($prepend) {
                $this->fallbackDirsPsr4 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr4
                );
            } else {
                $this->fallbackDirsPsr4 = array_merge(
                    $this->fallbackDirsPsr4,
-                    (array) $paths
+                    $paths
                );
            }
        } elseif (!isset($this->prefixDirsPsr4[$prefix])) {
@@ -252,18 +250,18 @@ class ClassLoader
                throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
            }
            $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
-            $this->prefixDirsPsr4[$prefix] = (array) $paths;
+            $this->prefixDirsPsr4[$prefix] = $paths;
        } elseif ($prepend) {
            // Prepend directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixDirsPsr4[$prefix]
            );
        } else {
            // Append directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
                $this->prefixDirsPsr4[$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -272,8 +270,8 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix,
     * replacing any others previously set for this prefix.
     *
-     * @param string          $prefix The prefix
-     * @param string[]|string $paths  The PSR-0 base directories
+     * @param string              $prefix The prefix
+     * @param list<string>|string $paths  The PSR-0 base directories
     *
     * @return void
     */
@@ -290,8 +288,8 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace,
     * replacing any others previously set for this namespace.
     *
-     * @param string          $prefix The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths  The PSR-4 base directories
+     * @param string              $prefix The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths  The PSR-4 base directories
     *
     * @throws \InvalidArgumentException
     *
@@ -425,7 +423,8 @@ class ClassLoader
    public function loadClass($class)
    {
        if ($file = $this->findFile($class)) {
-            includeFile($file);
+            $includeFile = self::$includeFile;
+            $includeFile($file);

            return true;
        }
@@ -476,9 +475,9 @@ class ClassLoader
    }

    /**
-     * Returns the currently registered loaders indexed by their corresponding vendor directories.
+     * Returns the currently registered loaders keyed by their corresponding vendor directories.
     *
-     * @return self[]
+     * @return array<string, self>
     */
    public static function getRegisteredLoaders()
    {
@@ -555,18 +554,26 @@ class ClassLoader

        return false;
    }
-}

-/**
- * Scope isolated include.
- *
- * Prevents access to $this/self from included files.
- *
- * @param  string $file
- * @return void
- * @private
- */
-function includeFile($file)
-{
-    include $file;
+    /**
+     * @return void
+     */
+    private static function initializeIncludeClosure()
+    {
+        if (self::$includeFile !== null) {
+            return;
+        }
+
+        /**
+         * Scope isolated include.
+         *
+         * Prevents access to $this/self from included files.
+         *
+         * @param  string $file
+         * @return void
+         */
+        self::$includeFile = \Closure::bind(static function($file) {
+            include $file;
+        }, null, null);
+    }
 }
--- a/datamodels/2.x/itop-attachments/vendor/composer/InstalledVersions.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/InstalledVersions.php
@@ -21,15 +21,22 @@ use Composer\Semver\VersionParser;
 * See also https://getcomposer.org/doc/07-runtime.md#installed-versions
 *
 * To require its presence, you can require `composer-runtime-api ^2.0`
+ *
+ * @final
 */
 class InstalledVersions
 {
    /**
     * @var mixed[]|null
-     * @psalm-var array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}|array{}|null
+     * @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
     */
    private static $installed;

+    /**
+     * @var bool
+     */
+    private static $installedIsLocalDir;
+
    /**
     * @var bool|null
     */
@@ -37,7 +44,7 @@ class InstalledVersions

    /**
     * @var array[]
-     * @psalm-var array<string, array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-var array<string, array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    private static $installedByVendor = array();

@@ -96,7 +103,7 @@ class InstalledVersions
    {
        foreach (self::getInstalled() as $installed) {
            if (isset($installed['versions'][$packageName])) {
-                return $includeDevRequirements || empty($installed['versions'][$packageName]['dev_requirement']);
+                return $includeDevRequirements || !isset($installed['versions'][$packageName]['dev_requirement']) || $installed['versions'][$packageName]['dev_requirement'] === false;
            }
        }

@@ -117,7 +124,7 @@ class InstalledVersions
     */
    public static function satisfies(VersionParser $parser, $packageName, $constraint)
    {
-        $constraint = $parser->parseConstraints($constraint);
+        $constraint = $parser->parseConstraints((string) $constraint);
        $provided = $parser->parseConstraints(self::getVersionRanges($packageName));

        return $provided->matches($constraint);
@@ -241,7 +248,7 @@ class InstalledVersions

    /**
     * @return array
-     * @psalm-return array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}
+     * @psalm-return array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}
     */
    public static function getRootPackage()
    {
@@ -255,7 +262,7 @@ class InstalledVersions
     *
     * @deprecated Use getAllRawData() instead which returns all datasets for all autoloaders present in the process. getRawData only returns the first dataset loaded, which may not be what you expect.
     * @return array[]
-     * @psalm-return array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}
+     * @psalm-return array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}
     */
    public static function getRawData()
    {
@@ -278,7 +285,7 @@ class InstalledVersions
     * Returns the raw data of all installed.php which are currently loaded for custom implementations
     *
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    public static function getAllRawData()
    {
@@ -301,17 +308,23 @@ class InstalledVersions
     * @param  array[] $data A vendor/composer/installed.php data set
     * @return void
     *
-     * @psalm-param array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>} $data
+     * @psalm-param array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $data
     */
    public static function reload($data)
    {
        self::$installed = $data;
        self::$installedByVendor = array();
+
+        // when using reload, we disable the duplicate protection to ensure that self::$installed data is
+        // always returned, but we cannot know whether it comes from the installed.php in __DIR__ or not,
+        // so we have to assume it does not, and that may result in duplicate data being returned when listing
+        // all installed packages for example
+        self::$installedIsLocalDir = false;
    }

    /**
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    private static function getInstalled()
    {
@@ -320,17 +333,27 @@ class InstalledVersions
        }

        $installed = array();
+        $copiedLocalDir = false;

        if (self::$canGetVendors) {
+            $selfDir = strtr(__DIR__, '\\', '/');
            foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
+                $vendorDir = strtr($vendorDir, '\\', '/');
                if (isset(self::$installedByVendor[$vendorDir])) {
                    $installed[] = self::$installedByVendor[$vendorDir];
                } elseif (is_file($vendorDir.'/composer/installed.php')) {
-                    $installed[] = self::$installedByVendor[$vendorDir] = require $vendorDir.'/composer/installed.php';
-                    if (null === self::$installed && strtr($vendorDir.'/composer', '\\', '/') === strtr(__DIR__, '\\', '/')) {
-                        self::$installed = $installed[count($installed) - 1];
+                    /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                    $required = require $vendorDir.'/composer/installed.php';
+                    self::$installedByVendor[$vendorDir] = $required;
+                    $installed[] = $required;
+                    if (self::$installed === null && $vendorDir.'/composer' === $selfDir) {
+                        self::$installed = $required;
+                        self::$installedIsLocalDir = true;
                    }
                }
+                if (self::$installedIsLocalDir && $vendorDir.'/composer' === $selfDir) {
+                    $copiedLocalDir = true;
+                }
            }
        }

@@ -338,12 +361,17 @@ class InstalledVersions
            // only require the installed.php file if this file is loaded from its dumped location,
            // and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
            if (substr(__DIR__, -8, 1) !== 'C') {
-                self::$installed = require __DIR__ . '/installed.php';
+                /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                $required = require __DIR__ . '/installed.php';
+                self::$installed = $required;
            } else {
                self::$installed = array();
            }
        }
-        $installed[] = self::$installed;
+
+        if (self::$installed !== array() && !$copiedLocalDir) {
+            $installed[] = self::$installed;
+        }

        return $installed;
    }
--- a/datamodels/2.x/itop-attachments/vendor/composer/autoload_classmap.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/autoload_classmap.php
@@ -2,7 +2,7 @@

 // autoload_classmap.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-attachments/vendor/composer/autoload_namespaces.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/autoload_namespaces.php
@@ -2,7 +2,7 @@

 // autoload_namespaces.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-attachments/vendor/composer/autoload_psr4.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/autoload_psr4.php
@@ -2,7 +2,7 @@

 // autoload_psr4.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-attachments/vendor/composer/autoload_real.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInit478f6fa51842c80229f6a5c4f2ecbd50
+class ComposerAutoloaderInitee10bebff75617dbf9d929ac6e40c19f
 {
    private static $loader;

@@ -22,21 +22,12 @@ class ComposerAutoloaderInit478f6fa51842c80229f6a5c4f2ecbd50
            return self::$loader;
        }

-        spl_autoload_register(array('ComposerAutoloaderInit478f6fa51842c80229f6a5c4f2ecbd50', 'loadClassLoader'), true, true);
-        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(\dirname(__FILE__)));
-        spl_autoload_unregister(array('ComposerAutoloaderInit478f6fa51842c80229f6a5c4f2ecbd50', 'loadClassLoader'));
+        spl_autoload_register(array('ComposerAutoloaderInitee10bebff75617dbf9d929ac6e40c19f', 'loadClassLoader'), true, true);
+        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
+        spl_autoload_unregister(array('ComposerAutoloaderInitee10bebff75617dbf9d929ac6e40c19f', 'loadClassLoader'));

-        $useStaticLoader = PHP_VERSION_ID >= 50600 && !defined('HHVM_VERSION') && (!function_exists('zend_loader_file_encoded') || !zend_loader_file_encoded());
-        if ($useStaticLoader) {
-            require __DIR__ . '/autoload_static.php';
-
-            call_user_func(\Composer\Autoload\ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50::getInitializer($loader));
-        } else {
-            $classMap = require __DIR__ . '/autoload_classmap.php';
-            if ($classMap) {
-                $loader->addClassMap($classMap);
-            }
-        }
+        require __DIR__ . '/autoload_static.php';
+        call_user_func(\Composer\Autoload\ComposerStaticInitee10bebff75617dbf9d929ac6e40c19f::getInitializer($loader));

        $loader->setClassMapAuthoritative(true);
        $loader->register(true);
--- a/datamodels/2.x/itop-attachments/vendor/composer/autoload_static.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace Composer\Autoload;

-class ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50
+class ComposerStaticInitee10bebff75617dbf9d929ac6e40c19f
 {
    public static $prefixLengthsPsr4 = array (
        'C' => 
@@ -28,9 +28,9 @@ class ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50
    public static function getInitializer(ClassLoader $loader)
    {
        return \Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInit478f6fa51842c80229f6a5c4f2ecbd50::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInitee10bebff75617dbf9d929ac6e40c19f::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInitee10bebff75617dbf9d929ac6e40c19f::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInitee10bebff75617dbf9d929ac6e40c19f::$classMap;

        }, null, ClassLoader::class);
    }
--- a/datamodels/2.x/itop-attachments/vendor/composer/installed.php
+++ b/datamodels/2.x/itop-attachments/vendor/composer/installed.php
@@ -1,22 +1,22 @@
 <?php return array(
    'root' => array(
+        'name' => 'combodo/itop-attachments',
        'pretty_version' => 'dev-develop',
        'version' => 'dev-develop',
+        'reference' => 'd9ea2d27026782c29be93eb9d14ebb636e8e2484',
        'type' => 'library',
        'install_path' => __DIR__ . '/../../',
        'aliases' => array(),
-        'reference' => 'cd585f68391ccb113ec98bf911ff6b5ebf979d8b',
-        'name' => '__root__',
        'dev' => true,
    ),
    'versions' => array(
-        '__root__' => array(
+        'combodo/itop-attachments' => array(
            'pretty_version' => 'dev-develop',
            'version' => 'dev-develop',
+            'reference' => 'd9ea2d27026782c29be93eb9d14ebb636e8e2484',
            'type' => 'library',
            'install_path' => __DIR__ . '/../../',
            'aliases' => array(),
-            'reference' => 'cd585f68391ccb113ec98bf911ff6b5ebf979d8b',
            'dev_requirement' => false,
        ),
    ),
--- a/datamodels/2.x/itop-backup/dbrestore.class.inc.php
+++ b/datamodels/2.x/itop-backup/dbrestore.class.inc.php
@@ -53,14 +53,7 @@ class DBRestore extends DBBackup
 		$sUser = self::EscapeShellArg($this->sDBUser);
 		$sPwd = self::EscapeShellArg($this->sDBPwd);
 		$sDBName = self::EscapeShellArg($this->sDBName);
-		if (empty($this->sMySQLBinDir))
-		{
-			$sMySQLExe = 'mysql';
-		}
-		else
-		{
-			$sMySQLExe = '"'.$this->sMySQLBinDir.'/mysql"';
-		}
+		$sMySQLExe = DBBackup::MakeSafeMySQLCommand($this->sMySQLBinDir, 'mysql');
 		if (is_null($this->iDBPort))
 		{
 			$sPortOption = '';
--- a/datamodels/2.x/itop-backup/status.php
+++ b/datamodels/2.x/itop-backup/status.php
@@ -95,12 +95,7 @@ try {
 	//
 	$sMySQLBinDir = MetaModel::GetConfig()->GetModuleSetting('itop-backup', 'mysql_bindir', '');
 	$sMySQLBinDir = utils::ReadParam('mysql_bindir', $sMySQLBinDir, true);
-	if (empty($sMySQLBinDir)) {
-		$sMySQLDump = 'mysqldump';
-	} else {
-		//echo 'Info - Found mysql_bindir: '.$sMySQLBinDir;
-		$sMySQLDump = '"'.$sMySQLBinDir.'/mysqldump"';
-	}
+	$sMySQLDump = DBBackup::MakeSafeMySQLCommand($sMySQLBinDir, 'mysqldump');
 	$sCommand = "$sMySQLDump -V 2>&1";

 	$aOutput = array();
--- a/datamodels/2.x/itop-oauth-client/vendor/autoload.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/autoload.php
@@ -2,6 +2,24 @@

 // autoload.php @generated by Composer

+if (PHP_VERSION_ID < 50600) {
+    if (!headers_sent()) {
+        header('HTTP/1.1 500 Internal Server Error');
+    }
+    $err = 'Composer 2.3.0 dropped support for autoloading on PHP <5.6 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;
+    if (!ini_get('display_errors')) {
+        if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
+            fwrite(STDERR, $err);
+        } elseif (!headers_sent()) {
+            echo $err;
+        }
+    }
+    trigger_error(
+        $err,
+        E_USER_ERROR
+    );
+}
+
 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInitd52424b43ff18219f2ec935428aff074::getLoader();
+return ComposerAutoloaderInit285a4d33f818950c151bb893193d2cce::getLoader();
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/ClassLoader.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/ClassLoader.php
@@ -42,35 +42,37 @@ namespace Composer\Autoload;
 */
 class ClassLoader
 {
-    /** @var ?string */
+    /** @var \Closure(string):void */
+    private static $includeFile;
+
+    /** @var string|null */
    private $vendorDir;

    // PSR-4
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, int>>
+     * @var array<string, array<string, int>>
     */
    private $prefixLengthsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, array<int, string>>
+     * @var array<string, list<string>>
     */
    private $prefixDirsPsr4 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr4 = array();

    // PSR-0
    /**
-     * @var array[]
-     * @psalm-var array<string, array<string, string[]>>
+     * List of PSR-0 prefixes
+     *
+     * Structured as array('F (first letter)' => array('Foo\Bar (full prefix)' => array('path', 'path2')))
+     *
+     * @var array<string, array<string, list<string>>>
     */
    private $prefixesPsr0 = array();
    /**
-     * @var array[]
-     * @psalm-var array<string, string>
+     * @var list<string>
     */
    private $fallbackDirsPsr0 = array();

@@ -78,8 +80,7 @@ class ClassLoader
    private $useIncludePath = false;

    /**
-     * @var string[]
-     * @psalm-var array<string, string>
+     * @var array<string, string>
     */
    private $classMap = array();

@@ -87,29 +88,29 @@ class ClassLoader
    private $classMapAuthoritative = false;

    /**
-     * @var bool[]
-     * @psalm-var array<string, bool>
+     * @var array<string, bool>
     */
    private $missingClasses = array();

-    /** @var ?string */
+    /** @var string|null */
    private $apcuPrefix;

    /**
-     * @var self[]
+     * @var array<string, self>
     */
    private static $registeredLoaders = array();

    /**
-     * @param ?string $vendorDir
+     * @param string|null $vendorDir
     */
    public function __construct($vendorDir = null)
    {
        $this->vendorDir = $vendorDir;
+        self::initializeIncludeClosure();
    }

    /**
-     * @return string[]
+     * @return array<string, list<string>>
     */
    public function getPrefixes()
    {
@@ -121,8 +122,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, array<int, string>>
+     * @return array<string, list<string>>
     */
    public function getPrefixesPsr4()
    {
@@ -130,8 +130,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirs()
    {
@@ -139,8 +138,7 @@ class ClassLoader
    }

    /**
-     * @return array[]
-     * @psalm-return array<string, string>
+     * @return list<string>
     */
    public function getFallbackDirsPsr4()
    {
@@ -148,8 +146,7 @@ class ClassLoader
    }

    /**
-     * @return string[] Array of classname => path
-     * @psalm-var array<string, string>
+     * @return array<string, string> Array of classname => path
     */
    public function getClassMap()
    {
@@ -157,8 +154,7 @@ class ClassLoader
    }

    /**
-     * @param string[] $classMap Class to filename map
-     * @psalm-param array<string, string> $classMap
+     * @param array<string, string> $classMap Class to filename map
     *
     * @return void
     */
@@ -175,24 +171,25 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix, either
     * appending or prepending to the ones previously set for this prefix.
     *
-     * @param string          $prefix  The prefix
-     * @param string[]|string $paths   The PSR-0 root directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix
+     * @param list<string>|string $paths   The PSR-0 root directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @return void
     */
    public function add($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            if ($prepend) {
                $this->fallbackDirsPsr0 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr0
                );
            } else {
                $this->fallbackDirsPsr0 = array_merge(
                    $this->fallbackDirsPsr0,
-                    (array) $paths
+                    $paths
                );
            }

@@ -201,19 +198,19 @@ class ClassLoader

        $first = $prefix[0];
        if (!isset($this->prefixesPsr0[$first][$prefix])) {
-            $this->prefixesPsr0[$first][$prefix] = (array) $paths;
+            $this->prefixesPsr0[$first][$prefix] = $paths;

            return;
        }
        if ($prepend) {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixesPsr0[$first][$prefix]
            );
        } else {
            $this->prefixesPsr0[$first][$prefix] = array_merge(
                $this->prefixesPsr0[$first][$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -222,9 +219,9 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace, either
     * appending or prepending to the ones previously set for this namespace.
     *
-     * @param string          $prefix  The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths   The PSR-4 base directories
-     * @param bool            $prepend Whether to prepend the directories
+     * @param string              $prefix  The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths   The PSR-4 base directories
+     * @param bool                $prepend Whether to prepend the directories
     *
     * @throws \InvalidArgumentException
     *
@@ -232,17 +229,18 @@ class ClassLoader
     */
    public function addPsr4($prefix, $paths, $prepend = false)
    {
+        $paths = (array) $paths;
        if (!$prefix) {
            // Register directories for the root namespace.
            if ($prepend) {
                $this->fallbackDirsPsr4 = array_merge(
-                    (array) $paths,
+                    $paths,
                    $this->fallbackDirsPsr4
                );
            } else {
                $this->fallbackDirsPsr4 = array_merge(
                    $this->fallbackDirsPsr4,
-                    (array) $paths
+                    $paths
                );
            }
        } elseif (!isset($this->prefixDirsPsr4[$prefix])) {
@@ -252,18 +250,18 @@ class ClassLoader
                throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
            }
            $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
-            $this->prefixDirsPsr4[$prefix] = (array) $paths;
+            $this->prefixDirsPsr4[$prefix] = $paths;
        } elseif ($prepend) {
            // Prepend directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
-                (array) $paths,
+                $paths,
                $this->prefixDirsPsr4[$prefix]
            );
        } else {
            // Append directories for an already registered namespace.
            $this->prefixDirsPsr4[$prefix] = array_merge(
                $this->prefixDirsPsr4[$prefix],
-                (array) $paths
+                $paths
            );
        }
    }
@@ -272,8 +270,8 @@ class ClassLoader
     * Registers a set of PSR-0 directories for a given prefix,
     * replacing any others previously set for this prefix.
     *
-     * @param string          $prefix The prefix
-     * @param string[]|string $paths  The PSR-0 base directories
+     * @param string              $prefix The prefix
+     * @param list<string>|string $paths  The PSR-0 base directories
     *
     * @return void
     */
@@ -290,8 +288,8 @@ class ClassLoader
     * Registers a set of PSR-4 directories for a given namespace,
     * replacing any others previously set for this namespace.
     *
-     * @param string          $prefix The prefix/namespace, with trailing '\\'
-     * @param string[]|string $paths  The PSR-4 base directories
+     * @param string              $prefix The prefix/namespace, with trailing '\\'
+     * @param list<string>|string $paths  The PSR-4 base directories
     *
     * @throws \InvalidArgumentException
     *
@@ -425,7 +423,8 @@ class ClassLoader
    public function loadClass($class)
    {
        if ($file = $this->findFile($class)) {
-            includeFile($file);
+            $includeFile = self::$includeFile;
+            $includeFile($file);

            return true;
        }
@@ -476,9 +475,9 @@ class ClassLoader
    }

    /**
-     * Returns the currently registered loaders indexed by their corresponding vendor directories.
+     * Returns the currently registered loaders keyed by their corresponding vendor directories.
     *
-     * @return self[]
+     * @return array<string, self>
     */
    public static function getRegisteredLoaders()
    {
@@ -555,18 +554,26 @@ class ClassLoader

        return false;
    }
-}

-/**
- * Scope isolated include.
- *
- * Prevents access to $this/self from included files.
- *
- * @param  string $file
- * @return void
- * @private
- */
-function includeFile($file)
-{
-    include $file;
+    /**
+     * @return void
+     */
+    private static function initializeIncludeClosure()
+    {
+        if (self::$includeFile !== null) {
+            return;
+        }
+
+        /**
+         * Scope isolated include.
+         *
+         * Prevents access to $this/self from included files.
+         *
+         * @param  string $file
+         * @return void
+         */
+        self::$includeFile = \Closure::bind(static function($file) {
+            include $file;
+        }, null, null);
+    }
 }
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/InstalledVersions.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/InstalledVersions.php
@@ -21,11 +21,31 @@ use Composer\Semver\VersionParser;
 * See also https://getcomposer.org/doc/07-runtime.md#installed-versions
 *
 * To require its presence, you can require `composer-runtime-api ^2.0`
+ *
+ * @final
 */
 class InstalledVersions
 {
+    /**
+     * @var mixed[]|null
+     * @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
+     */
    private static $installed;
+
+    /**
+     * @var bool
+     */
+    private static $installedIsLocalDir;
+
+    /**
+     * @var bool|null
+     */
    private static $canGetVendors;
+
+    /**
+     * @var array[]
+     * @psalm-var array<string, array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
+     */
    private static $installedByVendor = array();

    /**
@@ -83,7 +103,7 @@ class InstalledVersions
    {
        foreach (self::getInstalled() as $installed) {
            if (isset($installed['versions'][$packageName])) {
-                return $includeDevRequirements || empty($installed['versions'][$packageName]['dev_requirement']);
+                return $includeDevRequirements || !isset($installed['versions'][$packageName]['dev_requirement']) || $installed['versions'][$packageName]['dev_requirement'] === false;
            }
        }

@@ -104,7 +124,7 @@ class InstalledVersions
     */
    public static function satisfies(VersionParser $parser, $packageName, $constraint)
    {
-        $constraint = $parser->parseConstraints($constraint);
+        $constraint = $parser->parseConstraints((string) $constraint);
        $provided = $parser->parseConstraints(self::getVersionRanges($packageName));

        return $provided->matches($constraint);
@@ -228,7 +248,7 @@ class InstalledVersions

    /**
     * @return array
-     * @psalm-return array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}
+     * @psalm-return array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}
     */
    public static function getRootPackage()
    {
@@ -242,7 +262,7 @@ class InstalledVersions
     *
     * @deprecated Use getAllRawData() instead which returns all datasets for all autoloaders present in the process. getRawData only returns the first dataset loaded, which may not be what you expect.
     * @return array[]
-     * @psalm-return array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}
+     * @psalm-return array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}
     */
    public static function getRawData()
    {
@@ -265,7 +285,7 @@ class InstalledVersions
     * Returns the raw data of all installed.php which are currently loaded for custom implementations
     *
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    public static function getAllRawData()
    {
@@ -288,17 +308,23 @@ class InstalledVersions
     * @param  array[] $data A vendor/composer/installed.php data set
     * @return void
     *
-     * @psalm-param array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>} $data
+     * @psalm-param array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $data
     */
    public static function reload($data)
    {
        self::$installed = $data;
        self::$installedByVendor = array();
+
+        // when using reload, we disable the duplicate protection to ensure that self::$installed data is
+        // always returned, but we cannot know whether it comes from the installed.php in __DIR__ or not,
+        // so we have to assume it does not, and that may result in duplicate data being returned when listing
+        // all installed packages for example
+        self::$installedIsLocalDir = false;
    }

    /**
     * @return array[]
-     * @psalm-return list<array{root: array{name: string, version: string, reference: string, pretty_version: string, aliases: string[], dev: bool, install_path: string, type: string}, versions: array<string, array{dev_requirement: bool, pretty_version?: string, version?: string, aliases?: string[], reference?: string, replaced?: string[], provided?: string[], install_path?: string, type?: string}>}>
+     * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
     */
    private static function getInstalled()
    {
@@ -307,17 +333,27 @@ class InstalledVersions
        }

        $installed = array();
+        $copiedLocalDir = false;

        if (self::$canGetVendors) {
+            $selfDir = strtr(__DIR__, '\\', '/');
            foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
+                $vendorDir = strtr($vendorDir, '\\', '/');
                if (isset(self::$installedByVendor[$vendorDir])) {
                    $installed[] = self::$installedByVendor[$vendorDir];
                } elseif (is_file($vendorDir.'/composer/installed.php')) {
-                    $installed[] = self::$installedByVendor[$vendorDir] = require $vendorDir.'/composer/installed.php';
-                    if (null === self::$installed && strtr($vendorDir.'/composer', '\\', '/') === strtr(__DIR__, '\\', '/')) {
-                        self::$installed = $installed[count($installed) - 1];
+                    /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                    $required = require $vendorDir.'/composer/installed.php';
+                    self::$installedByVendor[$vendorDir] = $required;
+                    $installed[] = $required;
+                    if (self::$installed === null && $vendorDir.'/composer' === $selfDir) {
+                        self::$installed = $required;
+                        self::$installedIsLocalDir = true;
                    }
                }
+                if (self::$installedIsLocalDir && $vendorDir.'/composer' === $selfDir) {
+                    $copiedLocalDir = true;
+                }
            }
        }

@@ -325,12 +361,17 @@ class InstalledVersions
            // only require the installed.php file if this file is loaded from its dumped location,
            // and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
            if (substr(__DIR__, -8, 1) !== 'C') {
-                self::$installed = require __DIR__ . '/installed.php';
+                /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                $required = require __DIR__ . '/installed.php';
+                self::$installed = $required;
            } else {
                self::$installed = array();
            }
        }
-        $installed[] = self::$installed;
+
+        if (self::$installed !== array() && !$copiedLocalDir) {
+            $installed[] = self::$installed;
+        }

        return $installed;
    }
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_classmap.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_classmap.php
@@ -2,7 +2,7 @@

 // autoload_classmap.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_namespaces.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_namespaces.php
@@ -2,7 +2,7 @@

 // autoload_namespaces.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_psr4.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_psr4.php
@@ -2,7 +2,7 @@

 // autoload_psr4.php @generated by Composer

-$vendorDir = dirname(dirname(__FILE__));
+$vendorDir = dirname(__DIR__);
 $baseDir = dirname($vendorDir);

 return array(
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_real.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInitd52424b43ff18219f2ec935428aff074
+class ComposerAutoloaderInit285a4d33f818950c151bb893193d2cce
 {
    private static $loader;

@@ -22,21 +22,12 @@ class ComposerAutoloaderInitd52424b43ff18219f2ec935428aff074
            return self::$loader;
        }

-        spl_autoload_register(array('ComposerAutoloaderInitd52424b43ff18219f2ec935428aff074', 'loadClassLoader'), true, true);
-        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(\dirname(__FILE__)));
-        spl_autoload_unregister(array('ComposerAutoloaderInitd52424b43ff18219f2ec935428aff074', 'loadClassLoader'));
+        spl_autoload_register(array('ComposerAutoloaderInit285a4d33f818950c151bb893193d2cce', 'loadClassLoader'), true, true);
+        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
+        spl_autoload_unregister(array('ComposerAutoloaderInit285a4d33f818950c151bb893193d2cce', 'loadClassLoader'));

-        $useStaticLoader = PHP_VERSION_ID >= 50600 && !defined('HHVM_VERSION') && (!function_exists('zend_loader_file_encoded') || !zend_loader_file_encoded());
-        if ($useStaticLoader) {
-            require __DIR__ . '/autoload_static.php';
-
-            call_user_func(\Composer\Autoload\ComposerStaticInitd52424b43ff18219f2ec935428aff074::getInitializer($loader));
-        } else {
-            $classMap = require __DIR__ . '/autoload_classmap.php';
-            if ($classMap) {
-                $loader->addClassMap($classMap);
-            }
-        }
+        require __DIR__ . '/autoload_static.php';
+        call_user_func(\Composer\Autoload\ComposerStaticInit285a4d33f818950c151bb893193d2cce::getInitializer($loader));

        $loader->setClassMapAuthoritative(true);
        $loader->register(true);
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_static.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace Composer\Autoload;

-class ComposerStaticInitd52424b43ff18219f2ec935428aff074
+class ComposerStaticInit285a4d33f818950c151bb893193d2cce
 {
    public static $prefixLengthsPsr4 = array (
        'C' => 
@@ -31,9 +31,9 @@ class ComposerStaticInitd52424b43ff18219f2ec935428aff074
    public static function getInitializer(ClassLoader $loader)
    {
        return \Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInitd52424b43ff18219f2ec935428aff074::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInitd52424b43ff18219f2ec935428aff074::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInitd52424b43ff18219f2ec935428aff074::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInit285a4d33f818950c151bb893193d2cce::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInit285a4d33f818950c151bb893193d2cce::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInit285a4d33f818950c151bb893193d2cce::$classMap;

        }, null, ClassLoader::class);
    }
--- a/datamodels/2.x/itop-oauth-client/vendor/composer/installed.php
+++ b/datamodels/2.x/itop-oauth-client/vendor/composer/installed.php
@@ -1,22 +1,22 @@
 <?php return array(
    'root' => array(
+        'name' => 'combodo/itop-oauth-client',
        'pretty_version' => 'dev-develop',
        'version' => 'dev-develop',
+        'reference' => '567bdc4200f5edb335a39c4b48fbd18bacb6cfc7',
        'type' => 'itop-extension',
        'install_path' => __DIR__ . '/../../',
        'aliases' => array(),
-        'reference' => '8db89c3d5f5f88d80780db8acb5147ba0d95c42f',
-        'name' => 'combodo/itop-oauth-client',
        'dev' => true,
    ),
    'versions' => array(
        'combodo/itop-oauth-client' => array(
            'pretty_version' => 'dev-develop',
            'version' => 'dev-develop',
+            'reference' => '567bdc4200f5edb335a39c4b48fbd18bacb6cfc7',
            'type' => 'itop-extension',
            'install_path' => __DIR__ . '/../../',
            'aliases' => array(),
-            'reference' => '8db89c3d5f5f88d80780db8acb5147ba0d95c42f',
            'dev_requirement' => false,
        ),
    ),
--- a/datamodels/2.x/itop-portal-base/portal/composer.json
+++ b/datamodels/2.x/itop-portal-base/portal/composer.json
@@ -1,5 +1,8 @@
 {
-	"license": "AGPLv3",
+  "license": "AGPLv3",
+  "config" : {
+    "autoloader-suffix": "Combodo_ItopPortalBase_Portal"
+  },
 	"autoload": {
 		"psr-4": {
 			"Combodo\\iTop\\Portal\\": "src/"
--- a/datamodels/2.x/itop-portal-base/portal/public/js/bootstrap-portal-modal.js
+++ b/datamodels/2.x/itop-portal-base/portal/public/js/bootstrap-portal-modal.js
@@ -53,13 +53,21 @@ $(document).ready(function()
 	}, 1000);

 	// Hide tooltips when a modal is opening, otherwise it might be overlapping it
-	oBodyElem.on('show.bs.modal', function ()
+	oBodyElem.on('show.bs.modal', '.modal', function ()
 	{
 		$(this).find('.tooltip.in').tooltip('hide');
+
+		// Set the z-index of the modal and its backdrop in case we have several modals opened
+		let zIndex = 1050 + (10 * $('.modal:visible').length);
+		$(this).css('z-index', zIndex);
+		// Set the z-index of the backdrop later because it is created after the modal
+		setTimeout(function() {
+			$('.modal-backdrop').not('.modal-stack').css('z-index', zIndex - 1).addClass('modal-stack');
+		}, 10);
 	});

 	/*
-	 * Display a error message on modal if the content could not be loaded.
+	 * Display an error message on modal if the content could not be loaded.
 	 *
 	 * Note : As of now, we can't display a more detailed message based on the response because Bootstrap doesn't pass response data with the loaded event.
 	 */
--- a/datamodels/2.x/itop-portal-base/portal/public/js/toolbox.js
+++ b/datamodels/2.x/itop-portal-base/portal/public/js/toolbox.js
@@ -168,6 +168,13 @@ CombodoModal._InstantiateModal = function(oModalElem, oOptions) {

 	// Show modal
 	if (oOptions.auto_open) {
+
+		// Append modal to body if not already in DOM, this is also done when the modal is shown, but it happens after show.bs.modal event is triggered
+		// As we put this event listener on the body, it is not triggered when the modal is not in the DOM yet
+		if (oModalElem.parent().length === 0) {
+			$('body').append(oModalElem);
+		}
+		
 		oModalElem.modal('show');
 	}

--- a/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
+++ b/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
@@ -1238,15 +1238,17 @@ class ObjectFormManager extends FormManager

 		foreach ($aCurrentValues as $sAttCode => $value)
 		{
-			if (!array_key_exists($sAttCode, $this->aFieldsAtts)) {
-				continue;
-			}
-			$iAttributeFlags = $this->aFieldsAtts[$sAttCode];
-			if ($iAttributeFlags & OPT_ATT_HIDDEN) {
-				continue;
-			}
-			if ($iAttributeFlags & OPT_ATT_READONLY) {
-				continue;
+			if (count($this->aFieldsAtts) !== 0) {
+				if (!array_key_exists($sAttCode, $this->aFieldsAtts)) {
+					continue;
+				}
+				$iAttributeFlags = $this->aFieldsAtts[$sAttCode];
+				if ($iAttributeFlags & OPT_ATT_HIDDEN) {
+					continue;
+				}
+				if ($iAttributeFlags & OPT_ATT_READONLY) {
+					continue;
+				}
 			}

 			if (MetaModel::IsValidAttCode($sObjectClass, $sAttCode)) {
@@ -1399,55 +1401,56 @@ class ObjectFormManager extends FormManager
 		$this->aFieldsAtts = array();
 		$this->aExtraData = array();
 		$aFieldsDMOnlyAttCodes = array();
-		switch ($this->aFormProperties['type']) {
-			case 'custom_list':
-			case 'static':
-				foreach ($this->aFormProperties['fields'] as $sAttCode => $aOptions) {
-					// When in a transition and no flags are specified for the field, we will retrieve its flags from DM later
-					if ($this->IsTransitionForm() && empty($aOptions)) {
-						$aFieldsDMOnlyAttCodes[] = $sAttCode;
-						continue;
-					}
+		if (array_key_exists('type', $this->aFormProperties)) {
+			switch ($this->aFormProperties['type']) {
+				case 'custom_list':
+				case 'static':
+					foreach ($this->aFormProperties['fields'] as $sAttCode => $aOptions) {
+						// When in a transition and no flags are specified for the field, we will retrieve its flags from DM later
+						if ($this->IsTransitionForm() && empty($aOptions)) {
+							$aFieldsDMOnlyAttCodes[] = $sAttCode;
+							continue;
+						}

-					// Otherwise we proceed as usual
-					$iFieldFlags = OPT_ATT_NORMAL;
-					// Checking if field should be slave
-					if (isset($aOptions['slave']) && ($aOptions['slave'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_SLAVE;
+						// Otherwise we proceed as usual
+						$iFieldFlags = OPT_ATT_NORMAL;
+						// Checking if field should be slave
+						if (isset($aOptions['slave']) && ($aOptions['slave'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_SLAVE;
+						}
+						// Checking if field should be must_change
+						if (isset($aOptions['must_change']) && ($aOptions['must_change'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_MUSTCHANGE;
+						}
+						// Checking if field should be must prompt
+						if (isset($aOptions['must_prompt']) && ($aOptions['must_prompt'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_MUSTPROMPT;
+						}
+						// Checking if field should be hidden
+						if (isset($aOptions['hidden']) && ($aOptions['hidden'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_HIDDEN;
+						}
+						// Checking if field should be readonly
+						if (isset($aOptions['read_only']) && ($aOptions['read_only'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_READONLY;
+						}
+						// Checking if field should be mandatory
+						if (isset($aOptions['mandatory']) && ($aOptions['mandatory'] === true)) {
+							$iFieldFlags = $iFieldFlags | OPT_ATT_MANDATORY;
+						}
+						// Finally, adding the attribute and its flags
+						$this->aFieldsAtts[$sAttCode] = $iFieldFlags;
 					}
-					// Checking if field should be must_change
-					if (isset($aOptions['must_change']) && ($aOptions['must_change'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_MUSTCHANGE;
-					}
-					// Checking if field should be must prompt
-					if (isset($aOptions['must_prompt']) && ($aOptions['must_prompt'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_MUSTPROMPT;
-					}
-					// Checking if field should be hidden
-					if (isset($aOptions['hidden']) && ($aOptions['hidden'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_HIDDEN;
-					}
-					// Checking if field should be readonly
-					if (isset($aOptions['read_only']) && ($aOptions['read_only'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_READONLY;
-					}
-					// Checking if field should be mandatory
-					if (isset($aOptions['mandatory']) && ($aOptions['mandatory'] === true)) {
-						$iFieldFlags = $iFieldFlags | OPT_ATT_MANDATORY;
-					}
-					// Finally, adding the attribute and its flags
-					$this->aFieldsAtts[$sAttCode] = $iFieldFlags;
-				}
-				break;
+					break;

-			case 'zlist':
-				foreach (MetaModel::FlattenZList(MetaModel::GetZListItems($sObjectClass, $this->aFormProperties['fields'])) as $sAttCode) {
-					$this->aFieldsAtts[$sAttCode] = OPT_ATT_NORMAL;
-				}
-				break;
+				case 'zlist':
+					foreach (MetaModel::FlattenZList(MetaModel::GetZListItems($sObjectClass, $this->aFormProperties['fields'])) as $sAttCode) {
+						$this->aFieldsAtts[$sAttCode] = OPT_ATT_NORMAL;
+					}
+					break;
+			}
 		}
-
-		if ($this->aFormProperties['layout'] !== null) {
+		if (isset($this->aFormProperties['layout'])) {
 			$oXPath = new DOMXPath($this->oHtmlDocument);
 			/** @var \DOMElement $oFieldNode */
 			foreach ($oXPath->query('//div[contains(@class, "form_field")][@data-field-id]') as $oFieldNode) {
@@ -1510,7 +1513,7 @@ class ObjectFormManager extends FormManager
 		// Also, retrieving mandatory attributes from metamodel to be able to complete the form with them if necessary
 		//
 		// Note: When in a transition, we don't do this for fields that should be set from DM
-		if ($this->aFormProperties['type'] !== 'static') {
+		if (array_key_exists('type', $this->aFormProperties) && $this->aFormProperties['type'] !== 'static') {
 			if ($this->IsTransitionForm()) {
 				$aDatamodelAttCodes = $this->oObject->GetTransitionAttributes($this->aFormProperties['stimulus_code']);
 			}
@@ -1616,7 +1619,7 @@ class ObjectFormManager extends FormManager
 		}

 		$this->oHtmlDocument = new DOMDocument();
-		if ($this->aFormProperties['layout'] !== null) {
+		if (isset($this->aFormProperties['layout'])) {
 			// Checking if we need to render the template from twig to html in order to parse the fields
 			if ($this->aFormProperties['layout']['type'] === 'twig') {
 				if ($this->oFormHandlerHelper !== null) {
--- a/datamodels/2.x/itop-portal-base/portal/src/Helper/BrowseBrickHelper.php
+++ b/datamodels/2.x/itop-portal-base/portal/src/Helper/BrowseBrickHelper.php
@@ -335,7 +335,7 @@ class BrowseBrickHelper
 			$aRow[$key] = array(
 				'level_alias' => $key,
 				'id' => $sCurrentObjectId,
-				'name' => $value->Get($sNameAttCode),
+				'name' => utils::EscapeHtml($value->Get($sNameAttCode)),
 				'class' => $sCurrentObjectClass,
 				'action_rules_token' => $this->PrepareActionRulesForItems($aItems, $key, $aLevelsProperties),
 				'metadata' => array(
@@ -513,7 +513,7 @@ class BrowseBrickHelper
 			$aItems[$sCurrentIndex] = array(
 				'level_alias' => $aCurrentRowKeys[0],
 				'id' => $aCurrentRowValues[0]->GetKey(),
-				'name' => $aCurrentRowValues[0]->Get($aLevelsProperties[$aCurrentRowKeys[0]]['name_att']),
+				'name' => utils::EscapeHtml($aCurrentRowValues[0]->Get($aLevelsProperties[$aCurrentRowKeys[0]]['name_att'])),
 				'class' => get_class($aCurrentRowValues[0]),
 				'subitems' => array(),
 				'filter_data' => $this->GetFilterData($aLevelsProperties[$aCurrentRowKeys[0]], $aCurrentRowKeys[0], $aCurrentRowValues[0]),
--- a/datamodels/2.x/itop-portal-base/portal/templates/bricks/manage/layout-table.html.twig
+++ b/datamodels/2.x/itop-portal-base/portal/templates/bricks/manage/layout-table.html.twig
@@ -156,8 +156,17 @@
 		                        return row.attributes[attribute_code].sort_value;
 							},
 	                        filter: function (attribute_code, type, row) {
-                        		return $.text($.parseHTML(row.attributes[attribute_code]['value_html']));
-	                        },
+                                // Check if the attribute and value_html exist
+                                if (!row.attributes[attribute_code] || !row.attributes[attribute_code]['value_html']) {
+                                    return '';
+                                }
+
+                                // Create a temporary div outside the DOM to filter out XSS
+                                const tempDiv = document.createElement('div');
+                                tempDiv.textContent = row.attributes[attribute_code]['value_html'];
+
+                                return tempDiv.textContent;
+                            },
 						},
                    });
                }
--- a/datamodels/2.x/itop-portal-base/portal/vendor/autoload.php
+++ b/datamodels/2.x/itop-portal-base/portal/vendor/autoload.php
@@ -22,4 +22,4 @@ if (PHP_VERSION_ID < 50600) {

 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInitd751713988987e9331980363e24189ce::getLoader();
+return ComposerAutoloaderInitCombodo_ItopPortalBase_Portal::getLoader();
--- a/datamodels/2.x/itop-portal-base/portal/vendor/composer/autoload_real.php
+++ b/datamodels/2.x/itop-portal-base/portal/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInitd751713988987e9331980363e24189ce
+class ComposerAutoloaderInitCombodo_ItopPortalBase_Portal
 {
    private static $loader;

@@ -22,13 +22,14 @@ class ComposerAutoloaderInitd751713988987e9331980363e24189ce
            return self::$loader;
        }

-        spl_autoload_register(array('ComposerAutoloaderInitd751713988987e9331980363e24189ce', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInitCombodo_ItopPortalBase_Portal', 'loadClassLoader'), true, true);
        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInitd751713988987e9331980363e24189ce', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInitCombodo_ItopPortalBase_Portal', 'loadClassLoader'));

        require __DIR__ . '/autoload_static.php';
-        call_user_func(\Composer\Autoload\ComposerStaticInitd751713988987e9331980363e24189ce::getInitializer($loader));
+        call_user_func(\Composer\Autoload\ComposerStaticInitCombodo_ItopPortalBase_Portal::getInitializer($loader));

+        $loader->setClassMapAuthoritative(true);
        $loader->register(true);

        return $loader;
--- a/datamodels/2.x/itop-portal-base/portal/vendor/composer/autoload_static.php
+++ b/datamodels/2.x/itop-portal-base/portal/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace Composer\Autoload;

-class ComposerStaticInitd751713988987e9331980363e24189ce
+class ComposerStaticInitCombodo_ItopPortalBase_Portal
 {
    public static $prefixLengthsPsr4 = array (
        'C' => 
@@ -103,9 +103,9 @@ class ComposerStaticInitd751713988987e9331980363e24189ce
    public static function getInitializer(ClassLoader $loader)
    {
        return \Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInitd751713988987e9331980363e24189ce::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInitd751713988987e9331980363e24189ce::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInitd751713988987e9331980363e24189ce::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInitCombodo_ItopPortalBase_Portal::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInitCombodo_ItopPortalBase_Portal::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInitCombodo_ItopPortalBase_Portal::$classMap;

        }, null, ClassLoader::class);
    }
--- a/js/extkeywidget.js
+++ b/js/extkeywidget.js
@@ -717,8 +717,11 @@ function ExtKeyWidget(id, sTargetClass, sFilter, sTitle, bSelectMode, oWizHelper
 				window[sPromiseId].then(function () {
 					$('#ac_create_'+me.id).dialog('open');
 					$('#ac_create_'+me.id).dialog("option", "close", me.OnCloseCreateObject);
-					// Modify the action of the cancel button
-					$('#ac_create_'+me.id+' button.cancel').off('click').on('click', me.CloseCreateObject);
+					// Modify the action of the cancel button and the close button
+					$('#ac_create_'+me.id+' button.cancel').off('click.navigation.itop').on('click.navigation.itop', me.CloseCreateObject);
+					$('.ui-dialog-titlebar:has(+ #ac_create_'+me.id+') button.ui-dialog-titlebar-close').off('click').on('click', function() {
+						$('#ac_create_'+me.id+' button.cancel').trigger('click');
+					});
 					me.ajax_request = null;
 					me.sTargetClass = sLocalTargetClass;
 					// Adjust the dialog's size to fit into the screen
--- a/js/utils.js
+++ b/js/utils.js
@@ -369,6 +369,24 @@ function DashletCreationDlg(sOQL, sContext) {
 	return false;
 }

+function OpenOql(sOQL) {
+	sBaseUrl = GetAbsoluteUrlAppRoot() + 'pages/run_query.php';
+	var form = document.createElement("form");
+	form.setAttribute("method", "post");
+	form.setAttribute("action", sBaseUrl);
+	form.setAttribute("target", '_blank');
+	form.setAttribute("id", 'run_query_form');
+	var input = document.createElement('input');
+	input.type = 'hidden';
+	input.name = 'expression';
+	input.value = sOQL;
+	form.appendChild(input);
+	document.body.appendChild(form);
+	// form.submit() is blocked by the browser
+	$('#run_query_form').submit();
+	document.body.removeChild(form);
+}
+
 function ShortcutListDlg(sOQL, sDataTableId, sContext) {
 	var sDataTableName = 'datatable_'+sDataTableId;
 	var oTableSettings = {
--- a/lib/composer/autoload_classmap.php
+++ b/lib/composer/autoload_classmap.php
@@ -1560,6 +1560,7 @@ return array(
    'Sabberworm\\CSS\\Value\\URL' => $vendorDir . '/sabberworm/php-css-parser/src/Value/URL.php',
    'Sabberworm\\CSS\\Value\\Value' => $vendorDir . '/sabberworm/php-css-parser/src/Value/Value.php',
    'Sabberworm\\CSS\\Value\\ValueList' => $vendorDir . '/sabberworm/php-css-parser/src/Value/ValueList.php',
+    'SanitizeTrait' => $baseDir . '/core/restservices.class.inc.php',
    'ScalarExpression' => $baseDir . '/core/oql/expression.class.inc.php',
    'ScalarOqlExpression' => $baseDir . '/core/oql/oqlquery.class.inc.php',
    'ScssPhp\\ScssPhp\\Base\\Range' => $vendorDir . '/scssphp/scssphp/src/Base/Range.php',
@@ -3201,6 +3202,7 @@ return array(
    'iPreferencesExtension' => $baseDir . '/application/applicationextension.inc.php',
    'iProcess' => $baseDir . '/core/backgroundprocess.inc.php',
    'iQueryModifier' => $baseDir . '/core/querymodifier.class.inc.php',
+    'iRestInputSanitizer' => $baseDir . '/application/applicationextension.inc.php',
    'iRestServiceProvider' => $baseDir . '/application/applicationextension.inc.php',
    'iScheduledProcess' => $baseDir . '/core/backgroundprocess.inc.php',
    'iSelfRegister' => $baseDir . '/core/userrights.class.inc.php',
@@ -3228,5 +3230,5 @@ return array(
    'privUITransactionFile' => $baseDir . '/application/transaction.class.inc.php',
    'privUITransactionSession' => $baseDir . '/application/transaction.class.inc.php',
    'utils' => $baseDir . '/application/utils.inc.php',
-    '©' => $vendorDir . '/symfony/cache/Traits/ValueWrapper.php',
+    '<EFBFBD>' => $vendorDir . '/symfony/cache/Traits/ValueWrapper.php',
 );
--- a/lib/composer/autoload_static.php
+++ b/lib/composer/autoload_static.php
@@ -1950,6 +1950,7 @@ class ComposerStaticInit7f81b4a2a468a061c306af5e447a9a9f
        'Sabberworm\\CSS\\Value\\URL' => __DIR__ . '/..' . '/sabberworm/php-css-parser/src/Value/URL.php',
        'Sabberworm\\CSS\\Value\\Value' => __DIR__ . '/..' . '/sabberworm/php-css-parser/src/Value/Value.php',
        'Sabberworm\\CSS\\Value\\ValueList' => __DIR__ . '/..' . '/sabberworm/php-css-parser/src/Value/ValueList.php',
+        'SanitizeTrait' => __DIR__ . '/../..' . '/core/restservices.class.inc.php',
        'ScalarExpression' => __DIR__ . '/../..' . '/core/oql/expression.class.inc.php',
        'ScalarOqlExpression' => __DIR__ . '/../..' . '/core/oql/oqlquery.class.inc.php',
        'ScssPhp\\ScssPhp\\Base\\Range' => __DIR__ . '/..' . '/scssphp/scssphp/src/Base/Range.php',
@@ -3591,6 +3592,7 @@ class ComposerStaticInit7f81b4a2a468a061c306af5e447a9a9f
        'iPreferencesExtension' => __DIR__ . '/../..' . '/application/applicationextension.inc.php',
        'iProcess' => __DIR__ . '/../..' . '/core/backgroundprocess.inc.php',
        'iQueryModifier' => __DIR__ . '/../..' . '/core/querymodifier.class.inc.php',
+        'iRestInputSanitizer' => __DIR__ . '/../..' . '/application/applicationextension.inc.php',
        'iRestServiceProvider' => __DIR__ . '/../..' . '/application/applicationextension.inc.php',
        'iScheduledProcess' => __DIR__ . '/../..' . '/core/backgroundprocess.inc.php',
        'iSelfRegister' => __DIR__ . '/../..' . '/core/userrights.class.inc.php',
@@ -3618,7 +3620,7 @@ class ComposerStaticInit7f81b4a2a468a061c306af5e447a9a9f
        'privUITransactionFile' => __DIR__ . '/../..' . '/application/transaction.class.inc.php',
        'privUITransactionSession' => __DIR__ . '/../..' . '/application/transaction.class.inc.php',
        'utils' => __DIR__ . '/../..' . '/application/utils.inc.php',
-        '©' => __DIR__ . '/..' . '/symfony/cache/Traits/ValueWrapper.php',
+        '<EFBFBD>' => __DIR__ . '/..' . '/symfony/cache/Traits/ValueWrapper.php',
    );

    public static function getInitializer(ClassLoader $loader)
--- a/pages/UI.php
+++ b/pages/UI.php
@@ -1520,7 +1520,7 @@ catch (Exception $e) {
 		$oErrorPage->add("<h1>".Dict::S('UI:FatalErrorMessage')."</h1>\n");
 	}
 	$sErrorDetails = ($e instanceof CoreException) ? $e->getHtmlDesc() : $e->getMessage();
-	$oErrorPage->error(Dict::Format('UI:Error_Details', $sErrorDetails));
+	$oErrorPage->error(Dict::Format('UI:Error_Details', utils::EscapeHtml($sErrorDetails)));
 	$oErrorPage->output();

 	$sErrorStackTrace = ($e instanceof CoreException) ? $e->getFullStackTraceAsString() : $e->getTraceAsString();
--- a/pages/csvimport.php
+++ b/pages/csvimport.php
@@ -89,9 +89,9 @@ try {
 		$oOption = SelectOptionUIBlockFactory::MakeForSelectOption("", Dict::S('UI:CSVImport:ClassesSelectOne'), false);
 		$oSelectBlock->AddSubBlock($oOption);
 		$aValidClasses = array();
-		$aClassCategories = array('bizmodel', 'addon/authentication');
+		$aClassCategories = array('bizmodel', 'addon/authentication', 'grant_by_profile');
 		if (UserRights::IsAdministrator()) {
-			$aClassCategories = array('bizmodel', 'application', 'addon/authentication');
+			$aClassCategories = array('bizmodel', 'application', 'addon/authentication', 'grant_by_profile');
 		}
 		foreach ($aClassCategories as $sClassCategory) {
 			foreach (MetaModel::GetClasses($sClassCategory) as $sClassName) {
--- a/setup/backup.class.inc.php
+++ b/setup/backup.class.inc.php
@@ -106,6 +106,8 @@ class DBBackup
 	/** @var string */
 	protected $sDBName;
 	/** @var string */
+	protected $sMySQLBinDir = '';
+	/** @var string */
 	protected $sDBSubName;

 	/**
@@ -133,7 +135,6 @@ class DBBackup
 		$this->sDBSubName = $oConfig->get('db_subname');
 	}

-	protected $sMySQLBinDir = '';

 	/**
 	 * Create a normalized backup name, depending on the current date/time and Database
@@ -362,8 +363,9 @@ class DBBackup
 		}

 		$this->LogInfo("Starting backup of $this->sDBHost/$this->sDBName(suffix:'$this->sDBSubName')");
+		$sMySQLBinDir = utils::ReadParam('mysql_bindir', $this->sMySQLBinDir, true);

-		$sMySQLDump = $this->GetMysqldumpCommand();
+		$sMySQLDump = $this->MakeSafeMySQLCommand($sMySQLBinDir, 'mysqldump');

 		// Store the results in a temporary file
 		$sTmpFileName = self::EscapeShellArg($sBackupFileName);
@@ -624,20 +626,22 @@ EOF;

 	/**
 	 * @return string the command to launch mysqldump (without its params)
+	 * @throws \BackupException
 	 */
-	private function GetMysqldumpCommand()
+	public static function MakeSafeMySQLCommand($sMySQLBinDir, string $sCmd)
 	{
-		$sMySQLBinDir = utils::ReadParam('mysql_bindir', $this->sMySQLBinDir, true);
-		if (empty($sMySQLBinDir))
-		{
-			$sMysqldumpCommand = 'mysqldump';
+		if (empty($sMySQLBinDir)) {
+			$sMySQLCommand = $sCmd;
 		}
-		else
-		{
-			$sMysqldumpCommand = '"'.$sMySQLBinDir.'/mysqldump"';
+		else {
+			$sMySQLBinDir = escapeshellcmd($sMySQLBinDir);
+			$sMySQLCommand = '"'.$sMySQLBinDir.'/$sCmd"';
+			if (!file_exists($sMySQLCommand)) {
+				throw new BackupException("$sCmd not found in $sMySQLBinDir");
+			}
 		}

-		return $sMysqldumpCommand;
+		return $sMySQLCommand;
 	}
 }

--- a/setup/moduleinstallation.class.inc.php
+++ b/setup/moduleinstallation.class.inc.php
@@ -25,7 +25,7 @@
 * @license     http://opensource.org/licenses/AGPL-3.0
 */

-class ModuleInstallation extends cmdbAbstractObject
+class ModuleInstallation extends DBObject
 {
 	public static function Init()
 	{
--- a/setup/setuputils.class.inc.php
+++ b/setup/setuputils.class.inc.php
@@ -552,14 +552,15 @@ class SetupUtils
 		if (empty($sMySQLBinDir) && null != MetaModel::GetConfig()) {
 			$sMySQLBinDir = MetaModel::GetConfig()->GetModuleSetting('itop-backup', 'mysql_bindir', '');
 		}
-
-		if (empty($sMySQLBinDir)) {
-			$sMySQLDump = 'mysqldump';
-		}
-		else {
-			$aResult[] = new CheckResult(CheckResult::TRACE, 'Info - Found mysql_bindir: '.$sMySQLBinDir);
-			$sMySQLDump = '"'.$sMySQLBinDir.'/mysqldump"';
+		try {
+			$sMySQLDump = DBBackup::MakeSafeMySQLCommand($sMySQLBinDir, 'mysqldump');
+		} catch (Exception $e) {
+			$aResult[] = new CheckResult(CheckResult::ERROR, $e->getMessage());
+			return $aResult;
 		}
+        if (!empty($sMySQLBinDir)) {
+	        $aResult[] = new CheckResult(CheckResult::TRACE, 'Info - Found mysql_bindir: '.$sMySQLBinDir);
+        }
 		$sCommand = "$sMySQLDump -V 2>&1";

 		$aOutput = array();
--- a/setup/unattended-install/unattended-install.php
+++ b/setup/unattended-install/unattended-install.php
@@ -143,6 +143,8 @@ $sDBUser = $aDBXmlSettings['user'];
 $sDBPwd = $aDBXmlSettings['pwd'];
 $sDBName = $aDBXmlSettings['name'];
 $sDBPrefix = $aDBXmlSettings['prefix'];
+$bDBTlsEnabled = $aDBXmlSettings['db_tls_enabled'];
+$sDBTlsCa = $aDBXmlSettings['db_tls_ca'];

 if ($sMode == 'install')
 {
@@ -219,13 +221,10 @@ if ($sMode == 'install')
 			die("Cleanup not implemented for a partial database (prefix= '$sDBPrefix')\nExiting.");
 		}

-		$oMysqli = new mysqli($sDBServer, $sDBUser, $sDBPwd);
-		if ($oMysqli->connect_errno)
-		{
-		    die("Cannot connect to the MySQL server (".$oMysqli->connect_errno . ") ".$oMysqli->connect_error."\nExiting");
-		}
-		else
+		try
 		{
+			$oMysqli = CMDBSource::GetMysqliInstance($sDBServer, $sDBUser, $sDBPwd, null, $bDBTlsEnabled, $sDBTlsCa, true);
+
 			if ($oMysqli->select_db($sDBName))
 			{
 				echo "Deleting database '$sDBName'\n";
@@ -236,6 +235,10 @@ if ($sMode == 'install')
 				echo "The database '$sDBName' does not seem to exist. Nothing to cleanup.\n";
 			}
 		}
+		catch (MySQLException $e)
+		{
+		    die($e->getMessage()."\nExiting");
+		}
 	}
 }
 else
@@ -312,9 +315,9 @@ if ($bInstall)
 	}
 	else
 	{
-		$oMysqli = new mysqli($sDBServer, $sDBUser, $sDBPwd);
-		if (!$oMysqli->connect_errno)
+		try
 		{
+			$oMysqli = CMDBSource::GetMysqliInstance($sDBServer, $sDBUser, $sDBPwd, null, $bDBTlsEnabled, $sDBTlsCa, true);
 			if ($oMysqli->select_db($sDBName))
 			{
 				// Check the presence of a table to record information about the MTP (from the Designer)
@@ -357,6 +360,10 @@ if ($bInstall)
 				}
 			}
 		}
+		catch (MySQLException $e)
+		{
+		    // Continue anyway
+		}
 	}
 }
 else
--- a/sources/Controller/Base/Layout/ObjectController.php
+++ b/sources/Controller/Base/Layout/ObjectController.php
@@ -82,7 +82,9 @@ class ObjectController extends AbstractController
 		{
 			throw new ApplicationException(Dict::Format('UI:Error:1ParametersMissing', 'class'));
 		}
-		
+		if (!is_subclass_of($sClass, cmdbAbstractObject::class)) {
+			throw new SecurityException('The class "'.$sClass.'" is not a subclass of cmdbAbstractObject so it can\'t be created by the user');
+		}
 		// If the specified class has subclasses, ask the user an instance of which class to create
 		$aSubClasses = MetaModel::EnumChildClasses($sClass, ENUM_CHILD_CLASSES_ALL); // Including the specified class itself
 		$aPossibleClasses = array();
--- a/sources/Core/Email/EmailLaminas.php
+++ b/sources/Core/Email/EmailLaminas.php
@@ -435,7 +435,7 @@ class EMailLaminas extends Email

 		// Add body content to as a new part
 		$oNewPart = new Part($sBody);
-		$oNewPart->encoding = Mime::ENCODING_8BIT;
+		$oNewPart->encoding = Mime::ENCODING_BASE64;
 		$oNewPart->type = $sMimeType;
 		$oNewPart->charset = 'UTF-8';
 		$oBody->addPart($oNewPart);
@@ -463,7 +463,7 @@ class EMailLaminas extends Email
 		}
 		$this->m_aData['parts'][] = array('text' => $sText, 'mimeType' => $sMimeType);
 		$oNewPart = new Part($sText);
-		$oNewPart->encoding = Mime::ENCODING_8BIT;
+		$oNewPart->encoding = Mime::ENCODING_BASE64;
 		$oNewPart->type = $sMimeType;

 		// setBody called only to refresh Content-Type to multipart/mixed
--- a/sources/Renderer/Bootstrap/FieldRenderer/BsLinkedSetFieldRenderer.php
+++ b/sources/Renderer/Bootstrap/FieldRenderer/BsLinkedSetFieldRenderer.php
@@ -893,7 +893,7 @@ JS
 				} else if ($oAttDef->IsExternalKey()) {

 					/** @var \AttributeExternalKey $oAttDef */
-					$aAttProperties['value_html'] = $oItem->Get($sAttCode.'_friendlyname');
+					$aAttProperties['value_html'] = utils::EscapeHtml($oItem->Get($sAttCode.'_friendlyname'));

 					// Checking if user can access object's external key
 					$sObjectUrl = ApplicationContext::MakeObjectUrl($oAttDef->GetTargetClass(), $oItem->Get($sAttCode));
--- a/sources/Service/Base/ObjectRepository.php
+++ b/sources/Service/Base/ObjectRepository.php
@@ -213,7 +213,7 @@ class ObjectRepository
 				foreach ($aComplementAttributeSpec[1] as $sAdditionalField) {
 					$aArguments[] = $oDbObject->Get($sAdditionalField);
 				}
-				$aData['additional_field'] = vsprintf($aComplementAttributeSpec[0], $aArguments);
+				$aData['additional_field'] = utils::VSprintf($aComplementAttributeSpec[0], $aArguments);
 				$sAdditionalFieldForHtml = utils::EscapeHtml($aData['additional_field']);
 				$aData['full_description'] = "{$sFriendlyNameForHtml}<br><i><small>{$sAdditionalFieldForHtml}</small></i>";
 			} else {
--- a/synchro/synchro_import.php
+++ b/synchro/synchro_import.php
@@ -775,7 +775,7 @@ try
 			$oP->add_comment('Objects updated: '.$oStatLog->Get('stats_nb_obj_updated').' ('.$oStatLog->Get('stats_nb_obj_updated_warnings')." warnings)");
 			$oP->add_comment('Objects update errors: '.$oStatLog->Get('stats_nb_obj_updated_errors'));
 			$oP->add_comment('Objects reconciled (updated): '.$oStatLog->Get('stats_nb_obj_new_updated').' ('.$oStatLog->Get('stats_nb_obj_new_updated_warnings').' warnings)');
-			$oP->add_comment('Objects reconciled (unchanged): '.$oStatLog->Get('stats_nb_obj_new_unchanged').' ('.$oStatLog->Get('stats_nb_obj_new_updated_warnings').' warnings)');
+			$oP->add_comment('Objects reconciled (unchanged): '.$oStatLog->Get('stats_nb_obj_new_unchanged').' ('.$oStatLog->Get('stats_nb_obj_new_unchanged_warnings').' warnings)');
 			$oP->add_comment('Objects reconciliation errors: '.$oStatLog->Get('stats_nb_replica_reconciled_errors'));
 			$oP->add_comment('Replica disappeared, no action taken: '.$oStatLog->Get('stats_nb_replica_disappeared_no_action'));
 		}
--- a/synchro/synchrodatasource.class.inc.php
+++ b/synchro/synchrodatasource.class.inc.php
@@ -2440,7 +2440,9 @@ class SynchroReplica extends DBObject implements iDisplay
 			// Really modified ?
 			if ($oDestObj->IsModified())
 			{
-				$oDestObj::SetCurrentChange($oChange);
+				if(method_exists(get_class($oDestObj), "SetCurrentChange")){
+					$oDestObj::SetCurrentChange($oChange);
+				}
 				$oDestObj->DBUpdate();
 				$bModified = true;
 				$oStatLog->AddTrace('Updated object - Values: {'.implode(', ', $aValueTrace).'}', $this);
@@ -2499,7 +2501,11 @@ class SynchroReplica extends DBObject implements iDisplay
 					$aValueTrace[] = "$sAttCode: $value";
 				}
 			}
-			$oDestObj::SetCurrentChange($oChange);
+
+			if(method_exists(get_class($oDestObj), "SetCurrentChange")){
+				//N°8413 - Make data synchro work on DBObject
+				$oDestObj::SetCurrentChange($oChange);
+			}
 			$iNew = $oDestObj->DBInsert();

 			$this->Set('dest_id', $oDestObj->GetKey());
@@ -2552,7 +2558,10 @@ class SynchroReplica extends DBObject implements iDisplay
 					$oDestObj->Set($sAttCode, $value);
 				}
 				$this->Set('info_last_modified', date(AttributeDateTime::GetSQLFormat()));
-				$oDestObj::SetCurrentChange($oChange);
+				if(method_exists(get_class($oDestObj), "SetCurrentChange")){
+					//N°8413 - Make data synchro work on DBObject
+					$oDestObj::SetCurrentChange($oChange);
+				}
 				$oDestObj->DBUpdate();
 				$oStatLog->AddTrace('Replica marked as obsolete', $this);
 				$oStatLog->Inc('stats_nb_obj_obsoleted');
@@ -2590,7 +2599,10 @@ class SynchroReplica extends DBObject implements iDisplay
 				$oCheckDeletionPlan = new DeletionPlan();
 				if ($oDestObj->CheckToDelete($oCheckDeletionPlan))
 				{
-					$oDestObj::SetCurrentChange($oChange);
+					if(method_exists(get_class($oDestObj), "SetCurrentChange")){
+						//N°8413 - Make data synchro work on DBObject
+						$oDestObj::SetCurrentChange($oChange);
+					}
 					$oDestObj->DBDelete();
 					$this->DBDelete();
 					$oStatLog->Inc('stats_nb_obj_deleted');
@@ -2636,7 +2648,7 @@ class SynchroReplica extends DBObject implements iDisplay
 		}

 		// $sExtAttCode is a valid attribute code
-		// 
+		//
 		$sClass = $this->Get('base_class');

 		$oAttDef = MetaModel::GetAttributeDef($sClass, $sExtAttCode);
@@ -2745,7 +2757,7 @@ class SynchroReplica extends DBObject implements iDisplay
 	public function GetHilightClass()
 	{
 		// Possible return values are:
-		// HILIGHT_CLASS_CRITICAL, HILIGHT_CLASS_WARNING, HILIGHT_CLASS_OK, HILIGHT_CLASS_NONE	
+		// HILIGHT_CLASS_CRITICAL, HILIGHT_CLASS_WARNING, HILIGHT_CLASS_OK, HILIGHT_CLASS_NONE
 		return HILIGHT_CLASS_NONE; // Not hilighted by default
 	}

--- a/tests/php-unit-tests/integration-tests/DictionariesConsistencyAfterSetupTest.php
+++ b/tests/php-unit-tests/integration-tests/DictionariesConsistencyAfterSetupTest.php
@@ -41,7 +41,7 @@ class DictionariesConsistencyAfterSetupTest extends ItopTestCase
 			],
 			'traduction that breaks expected nb of arguments' => [
 				'sTemplate' => 'toto %1$s titi %2$s',
-				'sExpectedTraduction' => 'ITOP::DICT:FORMAT:BROKEN:KEY - 1',
+				'sExpectedTraduction' => 'toto 1 titi %2$s',
 			],
 			'traduction ok' => [
 				'sTemplate' => 'toto %1$s titi',
--- a/tests/php-unit-tests/src/BaseTestCase/ItopTestCase.php
+++ b/tests/php-unit-tests/src/BaseTestCase/ItopTestCase.php
@@ -9,7 +9,7 @@ namespace Combodo\iTop\Test\UnitTest;
 use CMDBSource;
 use DeprecatedCallsLog;
 use MySQLTransactionNotClosedException;
-use PHPUnit\Framework\TestCase;
+use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
 use ReflectionMethod;
 use SetupUtils;
 use Symfony\Component\HttpKernel\KernelInterface;
@@ -23,7 +23,7 @@ use const DEBUG_BACKTRACE_IGNORE_ARGS;
 *
 * @since 3.0.4 3.1.1 3.2.0 N°6658 move some setUp/tearDown code to the corresponding methods *BeforeClass to speed up tests process time.
 */
-abstract class ItopTestCase extends TestCase
+abstract class ItopTestCase extends KernelTestCase
 {
 	public const TEST_LOG_DIR = 'test';

--- a/tests/php-unit-tests/unitary-tests/application/utilsTest.php
+++ b/tests/php-unit-tests/unitary-tests/application/utilsTest.php
@@ -834,9 +834,10 @@ HTML,
 			'bad context_param'       => [utils::ENUM_SANITIZATION_FILTER_CONTEXT_PARAM, '%dssD,25_=%:+-', null],
 			'good element_identifier' => [utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER, 'AD05nb', 'AD05nb'],
 			'bad element_identifier' => [utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER, 'AD05nb+', 'AD05nb'],
+			'array' => [utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER, ['AD05nb+','apply_modify'], ['AD05nb','apply_modify']],
 			'good url' => [utils::ENUM_SANITIZATION_FILTER_URL, 'https://www.w3schools.com', 'https://www.w3schools.com'],
-			'bad url' => [utils::ENUM_SANITIZATION_FILTER_URL, 'https://www.w3schoo<EFBFBD><EFBFBD>ls.co<EFBFBD>m', null],
-			'url with injection' => [utils::ENUM_SANITIZATION_FILTER_URL, 'https://demo.combodo.com/simple/pages/UI.php?operation=full_text&text=<img zzz src=x onerror=alert(1) //>', null],
+			'bad url' => [utils::ENUM_SANITIZATION_FILTER_URL, 'https//www.w3schools.com', null],
+			'url with injection' => [utils::ENUM_SANITIZATION_FILTER_URL, 'https://demo.combodo.com/simple/pages/UI.php?operation=full_text&text=<img zzz src=x onerror=alert(1) //>', 'https://demo.combodo.com/simple/pages/UI.php?operation=full_text&text=<imgzzzsrc=xonerror=alert(1)//>'],
 			'raw_data' => ['raw_data', '<Test>\s😃😃😃', '<Test>\s😃😃😃'],
 		];
 	}
@@ -906,4 +907,94 @@ HTML,
 		$this->assertFalse(utils::GetDocumentFromSelfURL($sURL));
 	}

+	/**
+	 * @dataProvider VSprintfProvider
+	 */
+	public function testVSprintf($sFormat, $aArgs, $sExpected)
+	{
+		$sTested = utils::VSprintf($sFormat, $aArgs, false);
+		$this->assertEquals($sExpected, $sTested);
+	}
+
+	public function VSprintfProvider()
+	{
+		return [
+			// Basic positional specifier tests
+			'Basic positional with enough args' => [
+				'Format: %1$s, %2$d, %3$s',
+				['Hello', 42, 'World'],
+				'Format: Hello, 42, World'
+			],
+			'Basic positional with args in different order' => [
+				'Format: %2$s, %1$d, %3$s',
+				[42, 'Hello', 'World'],
+				'Format: Hello, 42, World'
+			],
+			'Positional with reused specifiers' => [
+				'Format: %1$s, %2$d, %1$s again',
+				['Hello', 42],
+				'Format: Hello, 42, Hello again'
+			],
+
+			// Missing arguments tests
+			'Missing one positional arg' => [
+				'Format: %1$s, %2$d, %3$s',
+				['Hello', 42],
+				'Format: Hello, 42, %3$s'
+			],
+			'Missing multiple positional args' => [
+				'Format: %1$s, %2$s, %3$s, %4$s',
+				['Hello'],
+				'Format: Hello, %2$s, %3$s, %4$s'
+			],
+			'Missing first positional arg' => [
+				'Format: %1$s, %2$s, %3$s',
+				[],
+				'Format: %1$s, %2$s, %3$s'
+			],
+			
+			// Edge cases
+			'Positional with larger numbers' => [
+				'Format: %2$s, %1$d, %3$s, %2$s again',
+				[123456, 'Hello', 'World'],
+				'Format: Hello, 123456, World, Hello again'
+			],
+			'Positional specifiers with non-sequential indexes' => [
+				'Format: %3$s then %1$s and %5$d',
+				['first', 'second', 'third', 'fourth', 42],
+				'Format: third then first and 42'
+			],
+
+			// More complex format specifiers
+			'Positional with format modifiers' => [
+				'Format: %1$\'*10s, %2$04d',
+				['Hello', 42],
+				'Format: *****Hello, 0042'
+			],
+			'Positional with various types' => [
+				'Format: String: %1$s, Integer: %2$d, Char: %3$c',
+				['Hello', 42, 65],
+				'Format: String: Hello, Integer: 42, Char: A'
+			],
+
+			// Testing with non-Latin characters
+			'Positional with UTF-8 characters' => [
+				'Format: %1$s %2$s %3$s',
+				['こんにちは', 'Здравствуйте', '你好'],
+				'Format: こんにちは Здравствуйте 你好'
+			],
+
+			// Mixed formats
+			'Mixed positional with complex specifiers' => [
+				'Format: %1$-10s | %2$+d',
+				['Hello', 42],
+				'Format: Hello      | +42'
+			],
+			'Reused positional indexes with some missing' => [
+				'Format: %1$s %2$d %1$s %3$s %2$d',
+				['Hello', 42],
+				'Format: Hello 42 Hello %3$s 42'
+			]
+		];
+	}
 }
--- a/tests/php-unit-tests/unitary-tests/core/Delta/delta_test_sanitize_output.xml
+++ b/tests/php-unit-tests/unitary-tests/core/Delta/delta_test_sanitize_output.xml
@@ -0,0 +1,116 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<itop_design xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="1.7">
+  <classes>
+    <class id="TestServer" _delta="define">
+      <parent>cmdbAbstractObject</parent>
+      <properties>
+        <category>bizmodel</category>
+        <abstract>false</abstract>
+        <key_type>autoincrement</key_type>
+        <db_table>test_server</db_table>
+        <db_key_field>id</db_key_field>
+      </properties>
+      <presentation/>
+      <methods/>
+      <fields>
+        <field id="contact_list" xsi:type="AttributeLinkedSetIndirect">
+          <linked_class>lnkContactTestToServer</linked_class>
+          <ext_key_to_me>test_server_id</ext_key_to_me>
+          <ext_key_to_remote>contact_test_id</ext_key_to_remote>
+          <is_null_allowed>true</is_null_allowed>
+        </field>
+        <field id="password_list" xsi:type="AttributeLinkedSet">
+          <linked_class>PasswordTest</linked_class>
+          <ext_key_to_me>server_test_id</ext_key_to_me>
+          <is_null_allowed>true</is_null_allowed>
+        </field>
+        <field id="name" xsi:type="AttributeString">
+          <sql>name</sql>
+          <default_value/>
+          <is_null_allowed>false</is_null_allowed>
+        </field>
+      </fields>
+    </class>
+
+
+    <class id="ContactTest" _delta="define">
+      <parent>cmdbAbstractObject</parent>
+      <properties>
+        <category>bizmodel</category>
+        <abstract>false</abstract>
+        <key_type>autoincrement</key_type>
+        <db_table>contact_test</db_table>
+        <db_key_field>id</db_key_field>
+      </properties>
+      <presentation/>
+      <methods/>
+      <fields>
+        <field id="password" xsi:type="AttributeEncryptedString">
+          <sql>password</sql>
+        </field>
+        <field id="server_test_list" xsi:type="AttributeLinkedSetIndirect">
+          <linked_class>lnkContactTestToServer</linked_class>
+          <ext_key_to_me>contact_test_id</ext_key_to_me>
+          <ext_key_to_remote>test_server_id</ext_key_to_remote>
+          <is_null_allowed>true</is_null_allowed>
+        </field>
+      </fields>
+    </class>
+
+
+    <class id="lnkContactTestToServer" _delta="define">
+      <parent>cmdbAbstractObject</parent>
+      <properties>
+        <category>bizmodel</category>
+        <abstract>false</abstract>
+        <key_type>autoincrement</key_type>
+        <db_table>lnk_contact_server_test</db_table>
+        <db_key_field>id</db_key_field>
+      </properties>
+      <presentation/>
+      <methods/>
+      <fields>
+        <field id="contact_test_password" xsi:type="AttributeExternalField" _delta="define">
+          <extkey_attcode>contact_test_id</extkey_attcode>
+          <target_attcode>password</target_attcode>
+        </field>
+        <field id="test_server_id" xsi:type="AttributeExternalKey" _delta="define">
+          <target_class>TestServer</target_class>
+          <on_target_delete>DEL_MANUAL</on_target_delete>
+          <sql>test_server</sql>
+          <is_null_allowed>false</is_null_allowed>
+
+        </field>
+        <field id="contact_test_id" xsi:type="AttributeExternalKey" _delta="define">
+          <target_class>ContactTest</target_class>
+          <on_target_delete>DEL_MANUAL</on_target_delete>
+          <sql>contact_test</sql>
+          <is_null_allowed>false</is_null_allowed>
+
+        </field>
+      </fields>
+    </class>
+    <class id="PasswordTest" _delta="define">
+      <parent>cmdbAbstractObject</parent>
+      <properties>
+        <category>bizmodel</category>
+        <abstract>false</abstract>
+        <key_type>autoincrement</key_type>
+        <db_table>password_test</db_table>
+        <db_key_field>id</db_key_field>
+      </properties>
+      <presentation/>
+      <methods/>
+      <fields>
+        <field id="server_test_id" xsi:type="AttributeExternalKey" _delta="define">
+          <target_class>TestServer</target_class>
+          <sql>server_test_id</sql>
+          <on_target_delete>DEL_MANUAL</on_target_delete>
+        </field>
+        <field id="password" xsi:type="AttributeEncryptedString" _delta="define">
+          <sql>password</sql>
+        </field>
+      </fields>
+    </class>
+  </classes>
+</itop_design>
--- a/tests/php-unit-tests/unitary-tests/core/RestServicesSanitizeOutputTest.php
+++ b/tests/php-unit-tests/unitary-tests/core/RestServicesSanitizeOutputTest.php
@@ -0,0 +1,167 @@
+<?php
+declare(strict_types=1);
+
+namespace Combodo\iTop\Test\UnitTest\Core;
+
+use ArchivedObjectException;
+use AttributeEncryptedString;
+use Combodo\iTop\Test\UnitTest\ItopCustomDatamodelTestCase;
+use CoreException;
+use CoreUnexpectedValue;
+use Exception;
+use MetaModel;
+use ormLinkSet;
+use PasswordTest;
+use RestResultWithObjects;
+
+/**
+ * @runTestsInSeparateProcesses
+ * @preserveGlobalState disabled
+ * @backupGlobals disabled
+ */
+class RestServicesSanitizeOutputTest extends ItopCustomDatamodelTestCase
+{
+	private const SIMPLE_PASSWORD = '123456';
+
+	/**
+	 * @throws Exception
+	 */
+	protected function setUp(): void
+	{
+		parent::setUp();
+	}
+
+	/**
+	 * @return void
+	 * @throws CoreException
+	 */
+	public function testSanitizeAttributeOnRequestedObject()
+	{
+		$oContactTest = MetaModel::NewObject('ContactTest', [
+				'password' => self::SIMPLE_PASSWORD
+			]
+		);
+		$oRestResultWithObject = new RestResultWithObjects();
+		$oRestResultWithObject->AddObject(0, 'ok', $oContactTest, ['ContactTest' => ['password']]);
+		$oRestResultWithObject->SanitizeContent();
+		static::assertJsonStringEqualsJsonString(
+			'{"objects":{"ContactTest::-1":{"code":0,"message":"ok","class":"ContactTest","key":-1,"fields":{"password":"*****"}}},"code":0,"message":null}',
+			json_encode($oRestResultWithObject));
+	}
+
+	/**
+	 * @return void
+	 * @throws Exception
+	 */
+	public function testSanitizeAttributeExternalFieldOnLink()
+	{
+		$oContactTest = $this->createObject('ContactTest', [
+				'password' => self::SIMPLE_PASSWORD
+			]
+		);
+
+		$oTestServer = $this->createObject('TestServer', [
+			'name' => 'test_server',
+		]);
+
+
+		// create lnkContactTestToServer
+		$oLnkContactTestToServer = $this->createObject('lnkContactTestToServer', [
+			'contact_test_id' => $oContactTest->GetKey(),
+			'test_server_id'  => $oTestServer->GetKey()
+		]);
+
+		$oRestResultWithObject = new RestResultWithObjects();
+		$oRestResultWithObject->AddObject(0, 'ok', $oLnkContactTestToServer,
+			['lnkContactTestToServer' => ['contact_test_password']]);
+
+		$oRestResultWithObject->SanitizeContent();
+
+		static::assertStringContainsString(
+			'*****',
+			json_encode($oRestResultWithObject));
+
+		static::assertStringNotContainsString(
+			self::SIMPLE_PASSWORD,
+			json_encode($oRestResultWithObject));
+	}
+
+	/**
+	 * @throws Exception
+	 */
+	public function testSanitizeAttributeOnObjectRelatedThroughNNRelation()
+	{
+		$oContactTest = $this->createObject('ContactTest', [
+			'password' => self::SIMPLE_PASSWORD
+		]);
+
+		$oTestServer = $this->createObject('TestServer', [
+			'name' => 'test_server',
+		]);
+
+		// create lnkContactTestToServer
+		$this->createObject('lnkContactTestToServer', [
+			'contact_test_id' => $oContactTest->GetKey(),
+			'test_server_id'  => $oTestServer->GetKey()
+		]);
+
+		$oTestServer->Reload();
+
+		$oRestResultWithObject = new RestResultWithObjects();
+		$oRestResultWithObject->AddObject(0, 'ok', $oTestServer,
+			['TestServer' => ['contact_list']]);
+
+		$oRestResultWithObject->SanitizeContent();
+		static::assertStringContainsString(
+			'*****',
+			json_encode($oRestResultWithObject));
+
+		static::assertStringNotContainsString(
+			self::SIMPLE_PASSWORD,
+			json_encode($oRestResultWithObject));
+	}
+
+
+	/**
+	 * @throws CoreException
+	 * @throws CoreUnexpectedValue
+	 * @throws ArchivedObjectException
+	 * @throws Exception
+	 */
+	public function testSanitizeOnObjectRelatedThrough1NRelation()
+	{
+		$oTestServer = $this->createObject('TestServer', [
+			'name' => 'my_server',
+		]);
+
+		$oPassword = new PasswordTest();
+		$oPassword->Set('password', self::SIMPLE_PASSWORD);
+		$oPassword->Set('server_test_id', $oTestServer->GetKey());
+
+		/** @var ormLinkSet $oContactList */
+		$oContactList = $oTestServer->Get('password_list');
+		$oContactList->AddItem($oPassword);
+		$oTestServer->Set('password_list', $oContactList);
+
+		$oRestResultWithObject = new RestResultWithObjects();
+		$oRestResultWithObject->AddObject(0, 'ok', $oTestServer, ['TestServer' => ['id', 'password_list']]);
+		$oRestResultWithObject->SanitizeContent();
+
+		static::assertStringContainsString(
+			'*****',
+			json_encode($oRestResultWithObject));
+
+		static::assertStringNotContainsString(
+			self::SIMPLE_PASSWORD,
+			json_encode($oRestResultWithObject));
+
+	}
+
+	/**
+	 * @return string Abs path to the XML delta to use for the tests of that class
+	 */
+	public function GetDatamodelDeltaAbsPath(): string
+	{
+		return __DIR__.'/Delta/delta_test_sanitize_output.xml';
+	}
+}
--- a/tests/php-unit-tests/unitary-tests/core/RestServicesTest.php
+++ b/tests/php-unit-tests/unitary-tests/core/RestServicesTest.php
@@ -0,0 +1,125 @@
+<?php
+declare(strict_types=1);
+
+namespace Combodo\iTop\Test\UnitTest\Core;
+
+use Combodo\iTop\Test\UnitTest\ItopDataTestCase;
+use CoreException;
+use CoreServices;
+use CoreUnexpectedValue;
+use RestResultWithObjects;
+use UserLocal;
+
+/**
+ * @runTestsInSeparateProcesses
+ * @preserveGlobalState disabled
+ * @backupGlobals disabled
+ */
+class RestServicesTest extends ItopDataTestCase
+{
+	/**
+	 * @return void
+	 * @dataProvider providerTestSanitizeJsonInput
+	 */
+	public function testSanitizeJsonInput($sJsonData, $sExpectedJsonDataSanitized)
+	{
+		$oRS = new CoreServices();
+		$sOutputJson = $oRS->SanitizeJsonInput($sJsonData);
+		static::assertJsonStringEqualsJsonString($sExpectedJsonDataSanitized, $sOutputJson);
+	}
+
+	/**
+	 * @return array[]
+	 */
+	public function providerTestSanitizeJsonInput(): array
+	{
+		return [
+			'core/check_credentials' => [
+				'{"operation": "core/check_credentials", "user": "admin", "password": "admin"}',
+				'{
+    "operation": "core/check_credentials",
+    "user": "admin",
+    "password": "*****"
+}'
+			],
+			'core/update' => [
+				'{"operation": "core/update", "comment": "Update user", "class": "UserLocal", "key": {"id":1}, "output_fields": "first_name, password", "fields": {"password" : "123456"}}',
+				'{
+    "operation": "core/update",
+    "comment": "Update user",
+    "class": "UserLocal",
+    "key": {
+        "id": 1
+    },
+    "output_fields": "first_name, password",
+    "fields": {
+        "password": "*****"
+    }
+}'
+			],
+			'core/create' => [
+				'{"operation": "core/create", "comment": "Create user", "class": "UserLocal", "fields": {"first_name": "John", "last_name": "Doe", "email": "jd@example/com", "password" : "123456"}}',
+				'{
+    "operation": "core/create",
+    "comment": "Create user",
+    "class": "UserLocal",
+    "fields": {
+        "first_name": "John",
+        "last_name": "Doe",
+        "email": "jd@example/com",
+        "password": "*****"
+    }
+}'
+			],
+		];
+	}
+
+	/**
+	 * @param $sOperation
+	 * @param $aJsonData
+	 * @param $sExpectedJsonDataSanitized
+	 * @return void
+	 * @throws CoreException
+	 * @throws CoreUnexpectedValue
+	 * @dataProvider providerTestSanitizeJsonOutput
+	 */
+	public function testSanitizeJsonOutput($sOperation, $aJsonData, $sExpectedJsonDataSanitized)
+	{
+		$oUser = new UserLocal();
+		$oUser->Set('password', '123456');
+		$oRestResultWithObject = new RestResultWithObjects();
+		$oRestResultWithObject->AddObject(0, 'ok', $oUser, ['UserLocal' => ['login', 'password']]);
+		$oRestResultWithObject->SanitizeContent();
+		static::assertJsonStringEqualsJsonString($sExpectedJsonDataSanitized, json_encode($oRestResultWithObject));
+	}
+
+	/**
+	 * @return array[]
+	 */
+	public function providerTestSanitizeJsonOutput(): array
+	{
+		return [
+
+			'core/update' => [
+				'core/update',
+				['comment' => 'Update user', 'class' => 'UserLocal', 'key' => ['login' => 'my_example'], 'output_fields' => 'password', 'fields' => ['password' => 'opkB!req57']],
+				'{"objects":{"UserLocal::-1":{"code":0,"message":"ok","class":"UserLocal","key":-1,"fields":{"login":"","password":"*****"}}},"code":0,"message":null}'
+			],
+			'core/create' => [
+				'core/create',
+				['comment' => 'Create user', 'class' => 'UserLocal', 'fields' => ['password' => 'Azertyuiiop*12', 'login' => 'toto', 'profile_list' => [1]]],
+				'{"objects":{"UserLocal::-1":{"code":0,"message":"ok","class":"UserLocal","key":-1,"fields":{"login":"","password":"*****"}}},"code":0,"message":null}'
+			],
+			'core/get' => [
+				'core/get',
+				['comment' => 'Get user', 'class' => 'UserLocal', 'key' => ['login' => 'my_example'], 'output_fields' => 'first_name, password'],
+				'{"objects":{"UserLocal::-1":{"code":0,"message":"ok","class":"UserLocal","key":-1,"fields":{"login":"","password":"*****"}}},"code":0,"message":null}'
+			],
+			'core/check_credentials' => [
+				'core/check_credentials',
+				['user' => 'admin', 'password' => 'admin'],
+				'{"objects":{"UserLocal::-1":{"code":0,"message":"ok","class":"UserLocal","key":-1,"fields":{"login":"","password":"*****"}}},"code":0,"message":null}'
+			],
+		];
+	}
+}
--- a/tests/php-unit-tests/unitary-tests/synchro/DBObjectDataSynchroTest.php
+++ b/tests/php-unit-tests/unitary-tests/synchro/DBObjectDataSynchroTest.php
@@ -0,0 +1,442 @@
+<?php
+/**
+ * Copyright (C) 2013-2024 Combodo SAS
+ * This file is part of iTop.
+ * iTop is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ * iTop is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ * You should have received a copy of the GNU Affero General Public License
+ */
+
+namespace Combodo\iTop\Test\UnitTest\Synchro;
+
+use CMDBObject;
+use Combodo\iTop\Test\UnitTest\ItopCustomDatamodelTestCase;
+use DBObject;
+use DBObjectSearch;
+use DBObjectSet;
+use DBSearch;
+use EventWithTitleAsReconciliationKey;
+use Exception;
+use MetaModel;
+use SynchroDataSource;
+use UserLocal;
+use utils;
+
+/**
+ * Class DataSynchroTest
+ *
+ * @package Combodo\iTop\Test\UnitTest\Synchro
+ * @group dataSynchro
+ * @group defaultProfiles
+ */
+class DBObjectDataSynchroTest extends ItopCustomDatamodelTestCase
+{
+	protected const AUTH_USER = 'DBObjectDataSynchroTest';
+	protected const AUTH_PWD = 'sdf234(-fgh;,dfgDFG';
+	const USE_TRANSACTION = false;
+
+	public function GetDatamodelDeltaAbsPath(): string
+	{
+		return __DIR__.'/add-dbobject-with-reconciliation-key.xml';
+	}
+
+	protected function setUp(): void
+	{
+		parent::setUp();
+
+		$oSearch = DBSearch::FromOQL('SELECT User WHERE login = "'.static::AUTH_USER.'"');
+		$oSet = new DBObjectSet($oSearch);
+		if ($oSet->Count() == 0)
+		{
+			$iProfileId = self::$aURP_Profiles['REST Services User'];
+			$oProfileSearch = DBSearch::FromOQL("SELECT URP_Profiles WHERE id = $iProfileId");
+			$oProfileSearch->AllowAllData();
+			$oProfileSet = new DBObjectSet($oProfileSearch);
+			$oAdminProfile = $oProfileSet->fetch();
+
+			$oUser = MetaModel::NewObject('UserLocal',  array(
+				'login' => static::AUTH_USER,
+				'password' => static::AUTH_PWD,
+				'expiration' => UserLocal::EXPIRE_NEVER,
+			));
+			$oProfiles = $oUser->Get('profile_list');
+			$oProfiles->AddItem(MetaModel::NewObject('URP_UserProfile', array(
+				'profileid' => $oAdminProfile->GetKey()
+			)));
+			$oUser->Set('profile_list', $oProfiles);
+			$oUser->DBInsertNoReload();
+		}
+	}
+
+	protected function ExecSynchroImport($aParams, $bSynchroByHttp)
+	{
+		if (!$bSynchroByHttp) {
+			return utils::ExecITopScript('synchro/synchro_import.php', $aParams, static::AUTH_USER, static::AUTH_PWD);
+		}
+
+		$aParams['auth_user'] = static::AUTH_USER;
+		$aParams['auth_pwd'] = static::AUTH_PWD;
+
+		//$aParams['output'] = 'details';
+		$aParams['csvdata'] = file_get_contents($aParams['csvfile']);
+
+
+		$sUrl = \MetaModel::GetConfig()->Get('app_root_url').'/synchro/synchro_import.php?login_mode=form';
+		$sResult = utils::DoPostRequest($sUrl, $aParams, null, $aResponseHeaders, [
+			CURLOPT_SSL_VERIFYPEER => false,
+			CURLOPT_SSL_VERIFYHOST => 0,
+		]);
+		// Read the status code from the last line
+		$aLines = explode("\n", trim(strip_tags($sResult)));
+		//$sLastLine = array_pop($aLines);
+
+		return array(0, $aLines);
+	}
+
+	/**
+	 * Run a series of data synchronization through the REST API
+	 * @throws \ArchivedObjectException
+	 * @throws \CoreCannotSaveObjectException
+	 * @throws \CoreException
+	 * @throws \CoreUnexpectedValue
+	 * @throws \CoreWarning
+	 * @throws \MySQLException
+	 * @throws \OQLException
+	 */
+	public function RunDataSynchroTest($aUserLoginUsecase)
+	{
+		$sDescription = $aUserLoginUsecase['desc'];
+		$sTargetClass = $aUserLoginUsecase['target_class'];
+		$aSourceProperties = $aUserLoginUsecase['source_properties'];
+		$aSourceData = $aUserLoginUsecase['source_data'];
+		$aTargetData = $aUserLoginUsecase['target_data'];
+		$aAttributes =$aUserLoginUsecase['attributes'];
+		$bSynchroByHttp = $aUserLoginUsecase['bSynchroByHttp'];
+
+		$sClass = $sTargetClass;
+
+		$aTargetAttributes = array_shift($aTargetData);
+		$aSourceAttributes = array_shift($aSourceData);
+
+		if (count($aSourceData) + 1 != count($aTargetData))
+		{
+			throw new Exception("Target data must contain exactly ".(count($aSourceData) + 1)." items, found ".count($aTargetData));
+		}
+
+		// Create the data source
+		//
+		$oDataSource = new SynchroDataSource();
+		$oDataSource->Set('name', 'Test data sync '.time());
+		$oDataSource->Set('description', 'unit test - created automatically');
+		$oDataSource->Set('status', 'production');
+		$oDataSource->Set('user_id', 0);
+		$oDataSource->Set('scope_class', $sClass);
+		foreach ($aSourceProperties as $sProperty => $value)
+		{
+			$oDataSource->Set($sProperty, $value);
+		}
+		$iDataSourceId = $oDataSource->DBInsert();
+
+		$oAttributeSet = $oDataSource->Get('attribute_list');
+		while ($oAttribute = $oAttributeSet->Fetch())
+		{
+			if (array_key_exists($oAttribute->Get('attcode'), $aAttributes))
+			{
+				$aAttribInfo = $aAttributes[$oAttribute->Get('attcode')];
+				if (array_key_exists('reconciliation_attcode', $aAttribInfo))
+				{
+					$oAttribute->Set('reconciliation_attcode', $aAttribInfo['reconciliation_attcode']);
+				}
+				$oAttribute->Set('update', $aAttribInfo['do_update']);
+				$oAttribute->Set('reconcile', $aAttribInfo['do_reconcile']);
+			}
+			else
+			{
+				$oAttribute->Set('update', false);
+				$oAttribute->Set('reconcile', false);
+			}
+			$oAttribute->DBUpdate();
+		}
+
+		// Prepare list of prefixes -> make sure objects are unique with regard to the reconciliation scheme
+		$aPrefixes = array(); // attcode => prefix
+		foreach($aSourceAttributes as $iDummy => $sAttCode)
+		{
+			$aPrefixes[$sAttCode] = ''; // init with something
+		}
+		foreach($aAttributes as $sAttCode => $aAttribInfo)
+		{
+			if (isset($aAttribInfo['automatic_prefix']) && $aAttribInfo['automatic_prefix'])
+			{
+				$aPrefixes[$sAttCode] = 'TEST_'.$iDataSourceId.'_';
+			}
+		}
+
+		// List existing objects (to be ignored in the analysis)
+		//
+		$oAllObjects = new DBObjectSet(new DBObjectSearch($sClass));
+		$aExisting = $oAllObjects->ToArray(true);
+		$sExistingIds = implode(', ', array_keys($aExisting));
+
+		// Create the initial object list
+		//
+		$aInitialTarget = $aTargetData[0];
+		foreach($aInitialTarget as $aObjFields)
+		{
+			$oNewTarget = MetaModel::NewObject($sClass);
+			foreach($aTargetAttributes as $iAtt => $sAttCode)
+			{
+				$oNewTarget->Set($sAttCode, $aPrefixes[$sAttCode].$aObjFields[$iAtt]);
+			}
+			$oNewTarget->DBInsertNoReload();
+		}
+
+		//add sleep to make sure expected objects will be found
+		usleep(10000);
+		foreach($aTargetData as $iRow => $aExpectedObjects)
+		{
+			// Check the status (while ignoring existing objects)
+			//
+			if (empty($sExistingIds))
+			{
+				$oObjects = new DBObjectSet(DBObjectSearch::FromOQL("SELECT $sClass"));
+			}
+			else
+			{
+				$oObjects = new DBObjectSet(DBObjectSearch::FromOQL("SELECT $sClass WHERE id NOT IN($sExistingIds)"));
+			}
+			$aFound = $oObjects->ToArray();
+			$aErrors_Unexpected = array();
+			foreach($aFound as $iObj => $oObj)
+			{
+				// Is this object in the expected objects list
+				$bFoundMatch = false;
+				foreach($aExpectedObjects as $iExp => $aValues)
+				{
+					$bDoesMatch = true;
+					foreach($aTargetAttributes as $iCol => $sAttCode)
+					{
+						if ($oObj->Get($sAttCode) != $aPrefixes[$sAttCode].$aValues[$iCol])
+						{
+							$bDoesMatch = false;
+							break;
+						}
+					}
+					if ($bDoesMatch)
+					{
+						$bFoundMatch = true;
+						unset($aExpectedObjects[$iExp]);
+						break;
+					}
+				}
+				if (!$bFoundMatch)
+				{
+					$aObjDesc = array();
+					foreach($aTargetAttributes as $iCol => $sAttCode)
+					{
+						$aObjDesc[$sAttCode] = $oObj->Get($sAttCode);
+					}
+					$aErrors_Unexpected[get_class($oObj).'::'.$oObj->GetKey()] = $aObjDesc;
+				}
+			}
+
+			// Display the current status
+			//
+			$aErrors = array();
+			if (count($aErrors_Unexpected) > 0) {
+				$aErrors[] = "Unexpected objects found in iTop DB after step $iRow (starting at 0):\n".print_r($aErrors_Unexpected, true);
+			}
+			if (count($aExpectedObjects) > 0) {
+				$aErrors[] = "Expected objects NOT found in iTop DB after step $iRow (starting at 0)\n".print_r($aExpectedObjects, true);
+			}
+			if (count($aErrors) > 0) {
+				$sAdditionalInfo = (isset($sResultsViewable)) ? $sResultsViewable : "";
+				static::fail(implode("\n", $aErrors) . "\n $sAdditionalInfo");
+			} else {
+				static::assertTrue(true);
+			}
+
+			// If not on the final row, run a data exchange sequence
+			//
+			if (array_key_exists($iRow, $aSourceData))
+			{
+				$aToBeLoaded = $aSourceData[$iRow];
+
+				// First line
+				$sCsvData = implode(';', $aSourceAttributes)."\n";
+
+				$sTextQualifier = '"';
+
+				foreach($aToBeLoaded as $aDataRow)
+				{
+					$aFinalData = array();
+					foreach($aDataRow as $iCol => $value)
+					{
+						$sAttCode = $aSourceAttributes[$iCol];
+						$sRawValue = $aPrefixes[$sAttCode].$value;
+
+						$sFrom = array("\r\n", $sTextQualifier);
+						$sTo = array("\n", $sTextQualifier.$sTextQualifier);
+						$sCSVValue = $sTextQualifier.str_replace($sFrom, $sTo, (string)$sRawValue).$sTextQualifier;
+
+						$aFinalData[] = $sCSVValue;
+					}
+					$sCsvData .= implode(';', $aFinalData)."\n";
+				}
+				$sCSVTmpFile = tempnam(sys_get_temp_dir(), "CSV");
+				file_put_contents($sCSVTmpFile, $sCsvData);
+
+				$aParams = array(
+					'csvfile' => $sCSVTmpFile,
+					'data_source_id' => $iDataSourceId,
+					'separator' => ';',
+					'simulate' => 0,
+					'output' => 'details',
+				);
+				list($iRetCode, $aOutputLines) = static::ExecSynchroImport($aParams, $bSynchroByHttp);
+
+				unlink($sCSVTmpFile);
+
+				// Report the load results
+				//
+				if (strlen($sCsvData) > 5000)
+				{
+					$sCsvDataViewable = 'INPUT TOO LONG TO BE DISPLAYED ('.strlen($sCsvData).")\n".substr($sCsvData, 0, 500)."\n... TO BE CONTINUED";
+				}
+				else
+				{
+					$sCsvDataViewable = $sCsvData;
+				}
+				echo "Input Data:\n";
+				echo $sCsvDataViewable;
+				echo "\n";
+
+				$sResultsViewable = '|   '.implode("\n|   ", $aOutputLines);
+
+				echo "Results:\n";
+				echo $sResultsViewable;
+				echo "\n";
+
+				if ($iRetCode != 0)
+				{
+					static::fail("Execution of synchro_import failing with code '$iRetCode', see error.log for more details");
+				}
+
+				if (stripos($sResultsViewable, 'exception') !== false)
+				{
+					self::fail('Encountered an Exception during the last import/synchro');
+				}
+
+				$aKeys = ["creation", "update", "deletion"];
+				foreach ($aKeys as $sKey){
+					$this->assertStringContainsString("$sKey errors: 0", $sResultsViewable, "step $iRow : below res should contain '$sKey errors: 0': " . $sResultsViewable);
+				}
+
+				//N°3805 : potential javascript returned like
+				/*
+				        Please wait...
+	var aListJsFiles = [];
+                $(document).ready(function () {
+                            setTimeout(function () {
+                                    }, 50);
+                    });
+				 */
+				$sLastExpectedLine = "#Replica disappeared, no action taken: 0";
+				$aSplittedRes = explode($sLastExpectedLine, $sResultsViewable);
+				$this->assertNotFalse($aSplittedRes);
+				if (count($aSplittedRes)>1){
+					$sPotentialIssuesWithWebApplication = $aSplittedRes[1];
+					$this->assertEquals("", $sPotentialIssuesWithWebApplication, 'when failed it means data synchro result is polluted with some web application stuff like html or js');
+				}
+			}
+		}
+
+		return $oDataSource;
+	}
+
+	public function testDataSynchroByCli_DBObjectUseCase(){
+		/**
+		 * <class id="Event" _delta="define">
+		 * <!-- Generated by toolkit/export-class-to-meta.php -->
+		 * <parent>DBObject</parent>
+		 * <properties>
+		 * <category>core/cmdb,view_in_gui</category>
+		 * </properties>
+		 * <fields>
+		 * <field id="message" xsi:type="AttributeText"/>
+		 * <field id="date" xsi:type="AttributeDateTime"/>
+		 * <field id="userinfo" xsi:type="AttributeString"/>
+		 * </fields>
+		 * </class>
+		 */
+
+		$DBObjectClass = EventWithTitleAsReconciliationKey::class;
+		$oEventNotification = new EventWithTitleAsReconciliationKey();
+		$this->assertTrue(is_a($oEventNotification, DBObject::class));
+		$this->assertFalse(is_a($oEventNotification, CMDBObject::class));
+
+		foreach (['A', 'C'] as $sKey) {
+			$oEventA = new EventWithTitleAsReconciliationKey();
+			$oEventA->Set('title', "title_$sKey");
+			$oEventA->Set('message', "message_$sKey");
+			$oEventA->Set('userinfo', "userinfo_$sKey");
+			$oEventA->DBWrite();
+		}
+
+		$aDbObjectSyncroUsecase = [
+			'desc' => 'Load EventNotification (DBObject)',
+			'target_class' => $DBObjectClass,
+			'source_properties' => [
+				'full_load_periodicity' => 3600, // should be ignored in this case
+				'reconciliation_policy' => 'use_attributes',
+				'action_on_zero' => 'create',
+				'action_on_one' => 'update',
+				'action_on_multiple' => 'error',
+				'delete_policy' => 'delete',
+				'delete_policy_update' => '',
+				'delete_policy_retention' => 0,
+			],
+			'source_data' => [
+				['primary_key', 'title', 'message', 'date','userinfo'],
+				[
+					['A', 'title_A', 'message_A', 'userinfo_AAA'],
+					['B', 'title_B', 'message_B', 'userinfo_B'],
+				],
+			],
+			'target_data' => [
+				['title'], //columns
+				[
+					// Initial state
+				],
+				[
+					['title_A'], //expected values
+					['title_B'], //expected values
+				],
+			],
+			'attributes' => [
+				'title' => [
+					'do_reconcile' => true,
+					'do_update' => true,
+					'automatic_prefix' => true, // unique id (for unit testing)
+				],
+				'message' => [
+					'do_reconcile' => false,
+					'do_update' => false,
+				],
+				'userinfo' => [
+					'do_reconcile' => false,
+					'do_update' => true,
+				],
+			],
+			'bSynchroByHttp' => false
+		];
+
+		$this->RunDataSynchroTest($aDbObjectSyncroUsecase);
+	}
+}
--- a/tests/php-unit-tests/unitary-tests/synchro/DataSynchroTest.php
+++ b/tests/php-unit-tests/unitary-tests/synchro/DataSynchroTest.php
@@ -15,13 +15,18 @@

 namespace Combodo\iTop\Test\UnitTest\Synchro;

+use CMDBObject;
 use CMDBSource;
 use Combodo\iTop\Test\UnitTest\ItopDataTestCase;
+use DBObject;
 use DBObjectSearch;
 use DBObjectSet;
 use DBSearch;
+use Event;
+use EventNotification;
 use Exception;
 use MetaModel;
+use ReflectionClass;
 use SynchroDataSource;
 use UserLocal;
 use utils;
--- a/tests/php-unit-tests/unitary-tests/synchro/add-dbobject-with-reconciliation-key.xml
+++ b/tests/php-unit-tests/unitary-tests/synchro/add-dbobject-with-reconciliation-key.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<itop_design xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="3.0">
+<classes>
+  <class id="EventWithTitleAsReconciliationKey" _delta="define">
+    <parent>Event</parent>
+    <properties>
+      <category>grant_by_profile,bizmodel,searchable</category>
+      <abstract>false</abstract>
+      <key_type>autoincrement</key_type>
+      <db_table>remoteapplicationconnection2</db_table>
+      <db_key_field>id</db_key_field>
+      <db_final_class_field/>
+      <naming>
+        <attributes>
+          <attribute id="title"/>
+        </attributes>
+      </naming>
+      <display_template/>
+      <reconciliation>
+        <attributes>
+          <attribute id="title"/>
+        </attributes>
+      </reconciliation>
+    </properties>
+    <fields>
+      <field id="title" xsi:type="AttributeString">
+        <sql>title</sql>
+        <is_null_allowed>false</is_null_allowed>
+      </field>
+    </fields>
+    <methods/>
+    <presentation/>
+  </class>
+</classes>
+</itop_design>
--- a/webservices/rest.php
+++ b/webservices/rest.php
@@ -227,7 +227,11 @@ try
 		/** @var iRestServiceProvider $oRS */
 		$oRS = $aOpToRestService[$sOperation]['service_provider'];
 		$sProvider = get_class($oRS);
-	
+
+		if ($oRS instanceof iRestInputSanitizer) {
+			$sSanitizedJsonInput = $oRS->SanitizeJsonInput($sJsonString);
+		}
+
 		CMDBObject::SetTrackOrigin('webservice-rest');
 		$oResult = $oRS->ExecOperation($sVersion, $sOperation, $aJsonData);
 	}
@@ -252,6 +256,7 @@ catch(Exception $e)
 //
 $sResponse = json_encode($oResult);

+
 if ($sResponse === false)
 {
 	$oJsonIssue = new RestResult();
@@ -283,7 +288,7 @@ if (MetaModel::GetConfig()->Get('log_rest_service'))
 	$oLog->SetTrim('userinfo', UserRights::GetUser());
 	$oLog->Set('version', $sVersion);
 	$oLog->Set('operation', $sOperation);
-	$oLog->SetTrim('json_input', $sJsonString);
+    $oLog->SetTrim('json_input', $sSanitizedJsonInput ?? $sJsonString);

 	$oLog->Set('provider', $sProvider);
 	$sMessage = $oResult->message;
@@ -293,7 +298,21 @@ if (MetaModel::GetConfig()->Get('log_rest_service'))
 	}
 	$oLog->SetTrim('message', $sMessage);
 	$oLog->Set('code', $oResult->code);
-	$oLog->SetTrim('json_output', $sResponse);
+	$oResult->SanitizeContent();
+	$iUnescapeSlashAndUnicode = JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE;
+	$sJsonOuputWithPrettyPrinting = json_encode($oResult, $iUnescapeSlashAndUnicode | JSON_PRETTY_PRINT);
+	$sJsonOutputWithoutPrettyPrinting = json_encode($oResult, $iUnescapeSlashAndUnicode);
+	!StringFitsInLogField( $sJsonOuputWithPrettyPrinting) ?
+		$oLog->SetTrim('json_output', $sJsonOutputWithoutPrettyPrinting) : // too long, we don't make it pretty
+		$oLog->SetTrim('json_output', $sJsonOuputWithPrettyPrinting);

 	$oLog->DBInsertNoReload();
+}
+
+/**
+ * @deprecated - will be removed in 3.3.0
+ */
+function StringFitsInLogField(string $sLog): bool
+{
+	return mb_strlen($sLog) <= 16383; // hardcoded value, see N°8260
 }
Author	SHA1	Message	Date
odain	e9699846f2	N°8413 - Make data synchro work on DBObject N°8413 - Make data synchro work on DBObject	2025-06-04 11:51:34 +02:00
bdalsass	3ff3dcba54	N°8308 - Broken URL in sending mail	2025-06-02 17:15:51 +02:00
jf-cbd	657fc912bf	N°8198 - ModuleInstallation now extends DBObject + better exception message	2025-06-02 16:09:29 +02:00
Anne-Catherine	5ae5221f6f	N°6925 - Enable on any search result edition of OQL (#711 )	2025-05-28 10:59:50 +02:00
jf-cbd	b15ca2fbc9	N°8260 - Change format of REST logs when they are close to the SQL field size limit	2025-05-27 10:41:05 +02:00
Stephen Abello	cb382eab4e	Fix CI following dict behavior change	2025-05-26 16:23:38 +02:00
Stephen Abello	9723cde24c	N°7960 - Add a wrapper to vsprintf to handle argument number disparities (#717 )	2025-05-26 15:41:25 +02:00
Stephen Abello	7ae49e2cf4	N°8076 - Fix cancel and close buttons in a modal blocking all buttons for the underlying object	2025-05-26 11:25:08 +02:00
v-dumas	cb13a7a5b4	N°2583 - Audit, User, Query classes can be Import with bulk_modify right	2025-05-23 17:37:47 +02:00
bdalsass	9618e47045	N°8201 - [CVE_Request]_Cross-Site-Script Reflected(XSS Reflected at the name="attr_installed" (Low or Medium)	2025-05-23 10:16:22 +02:00
bdalsass	d84506ea9e	Merge remote-tracking branch 'origin/support/2.7' into support/3.2 # Conflicts: # pages/UI.php	2025-05-23 10:14:50 +02:00
bdalsass	13239c2751	N°8201 - [CVE_Request]_Cross-Site-Script Reflected(XSS Reflected at the name="attr_installed" (Low or Medium)	2025-05-23 10:06:01 +02:00
bdalsass	8b30e36dd1	N°8168 - Stored XSS in portals lnk	2025-05-23 08:52:18 +02:00
bdalsass	80b290ab88	Merge remote-tracking branch 'origin/support/2.7' into support/3.2 # Conflicts: # sources/renderer/bootstrap/fieldrenderer/bslinkedsetfieldrenderer.class.inc.php	2025-05-23 08:49:52 +02:00
bdalsass	81b20ee583	N°8168 - Stored XSS in portals lnk	2025-05-23 08:42:56 +02:00
Stephen Abello	a5545b0084	N°8205 - Security hardening	2025-05-20 09:48:00 +02:00
Stephen Abello	d72e861dfe	N°8315 - Security hardening	2025-05-19 14:51:12 +02:00
Stephen Abello	92385273ff	N°8315 - Security hardening	2025-05-19 14:45:24 +02:00
bdalsass	61c25f85e7	N°8313 - edit dashboard (fix broken test 3.2)	2025-05-19 13:12:02 +02:00
bdalsass	b1cf2ec137	N°8313 - edit dashboard (fix broken test 3.2)	2025-05-16 14:35:39 +02:00
bdalsass	7549ded51d	Merge remote-tracking branch 'origin/support/2.7' into support/3.2 # Conflicts: # application/dashboard.class.inc.php # setup/setuputils.class.inc.php # tests/php-unit-tests/unitary-tests/application/utilsTest.php	2025-05-16 14:19:00 +02:00
bdalsass	38683c20b1	N°8313 - edit dashboard (fix broken test)	2025-05-16 14:05:55 +02:00
bdalsass	81791dd253	N°8313 - edit dashboard	2025-05-16 14:05:55 +02:00
bdalsass	e77e0eec9f	N°8355 - render_dashboard	2025-05-16 14:05:55 +02:00
jf-cbd	f5ddbbbe0e	Rollback typing parameter	2025-05-13 16:59:43 +02:00
jf-cbd	6811a82e1a	Merge remote-tracking branch 'origin/support/2.7' into support/3.2 # Conflicts: # datamodels/2.x/itop-backup/status.php # setup/setuputils.class.inc.php	2025-05-13 16:40:11 +02:00
jf-cbd	960133c0df	N°8379 - fix backup issue	2025-05-13 16:27:59 +02:00
jf-cbd	544c4ae888	N°8379 - fix backup issue	2025-05-13 16:05:39 +02:00
jbostoen	9ee18c2f36	Add helper method to create an ObjectResult from a DBObject. (#706 ) Author: Jeffrey Bostoen <support@jeffreybostoen.be>	2025-04-25 14:46:33 +02:00
jf-cbd	43a10e6944	Revert "N°8259 - Problem with GetMaxSize on AttributeText" This reverts commit `29c75f626b`.	2025-04-22 09:37:54 +02:00
Stephen Abello	bf8269fee1	N°8293 - Make multiple modal in portal correctly stack the backdrops	2025-03-26 09:26:04 +01:00
jf-cbd	c99995563e	Merge remote-tracking branch 'origin/support/3.2.1' into support/3.2 # Conflicts: # lib/composer/autoload_classmap.php # lib/composer/autoload_static.php	2025-03-24 11:31:25 +01:00
jf-cbd	7af1cdebfa	Workaround for N°4459 doesn't work on 3.2	2025-03-24 11:21:41 +01:00
jf-cbd	a9fb5cd182	N°7870 - Tests: access the symfony service container to instantiate services	2025-03-24 11:02:34 +01:00
jf-cbd	9010504902	Fix tests	2025-03-24 10:53:18 +01:00
jf-cbd	2625b1ab54	Update tests for 3.1	2025-03-24 10:52:47 +01:00
Molkobain	b967338c48	🐛 N°8278 - Avoid autoloaders class name conflict by ensuring all existing have a unique name (#704 ) * 🐛 Avoid autoloaders class name conflict by ensuring all existing have a unique name * 🐛 Redump itop-attachments autoloaders for correct suffix	2025-03-24 10:15:09 +01:00
jf-cbd	10fbea5f4d	Fix merge conflict	2025-03-24 10:09:33 +01:00
jf-cbd	e49b8fc480	Merge remote-tracking branch 'origin/support/2.7' into support/3.2.1 # Conflicts: # core/restservices.class.inc.php # datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php # lib/composer/autoload_classmap.php # lib/composer/autoload_static.php	2025-03-24 10:07:36 +01:00
jf-cbd	4a415fdb59	N°8215 - When PHP warning are enabled, Global Request doesn't work	2025-03-21 14:44:18 +01:00
jf-cbd	5232694c04	N°8281 - Unable to click search button in multiple request template	2025-03-21 11:20:37 +01:00
Eric Espie	2a87d0aa15	N°8242 - When editing a dashboard the parameters do not refresh as expected	2025-03-18 17:40:10 +01:00
Anne-Cath	a103c458cb	N°8272 - Portal : Unable to save a date in French format - rollback removed code for N°7145	2025-03-18 16:58:50 +01:00
Tommaso Rossi	9a895a7fbd	🐛 N°8115 - Unattended Install: unable to connect to MySQL with TLS (#694 ) 🐛 Support TLS connections to MySQL in unattended-install process	2025-03-13 15:59:04 +01:00
jf-cbd	f5011bb200	N°8260 - Change format of REST logs when they are close to the SQL field size limit	2025-03-13 15:39:00 +01:00
jf-cbd	29c75f626b	N°8259 - Problem with GetMaxSize on AttributeText	2025-03-13 15:29:00 +01:00
jf-cbd	0562563cbb	Dump autoloader	2025-03-12 11:51:59 +01:00
jf-cbd	40068bd913	Merge remote-tracking branch 'origin/support/2.7' into support/3.2 # Conflicts: # lib/composer/autoload_classmap.php # lib/composer/autoload_static.php	2025-03-12 11:47:33 +01:00
jf-cbd	874a5fd2ce	Dump autoloader	2025-03-12 11:36:06 +01:00
jf-cbd	1ec139782e	Merge remote-tracking branch 'origin/support/3.1' into support/3.2	2025-03-06 16:24:40 +01:00
jf-cbd	056dce4d78	Merge remote-tracking branch 'origin/support/2.7' into support/3.1 # Conflicts: # webservices/rest.php	2025-03-06 16:12:15 +01:00
jf-cbd	063bb9680e	N°8231 - Better variable fallback	2025-03-06 16:09:51 +01:00
jf-cbd	9b1395db03	Workaround for N°4459 doesn't work on 3.2	2025-03-06 15:23:38 +01:00
jf-cbd	8fd9eb6a84	Merge remote-tracking branch 'origin/support/3.1' into support/3.2	2025-03-06 14:58:24 +01:00
jf-cbd	1142bf327c	Fix tests	2025-03-06 14:54:18 +01:00
jf-cbd	278496eaf6	Update tests for 3.1	2025-03-06 14:40:39 +01:00
jf-cbd	77ba0b398f	Fix merge conflict	2025-03-06 12:11:20 +01:00
jf-cbd	04ca7bf603	Merge remote-tracking branch 'origin/support/2.7' into support/3.1 # Conflicts: # core/restservices.class.inc.php # datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php # tests/php-unit-tests/unitary-tests/core/Delta/delta_test_sanitize_output.xml # tests/php-unit-tests/unitary-tests/core/RestServicesSanitizeOutputTest.php # tests/php-unit-tests/unitary-tests/core/RestServicesTest.php # webservices/rest.php	2025-03-06 12:10:00 +01:00
jf-cbd	8f8ac46f55	N°8215 - When PHP warning are enabled, Global Request doesn't work	2025-03-06 11:59:08 +01:00
denis.flaven@combodo.com	07b904ee1b	N°8231 - making rest api logs more readable	2025-03-06 11:59:08 +01:00
Eric Espie	5aee7f4722	N°8242 - When editing a dashboard the parameters do not refresh as expected	2025-03-05 11:02:19 +01:00
Eric Espie	292701b71c	N°8242 - When editing a dashboard the parameters do not refresh as expected	2025-03-04 16:51:58 +01:00
jf-cbd	533b57ab99	Merge branch 'support/3.1' into support/3.2	2025-03-03 17:07:24 +01:00
jf-cbd	be8d348b25	N°8231 - Update tests	2025-03-03 16:49:27 +01:00
jf-cbd	6c7a98fe3d	Merge remote-tracking branch 'origin/support/2.7' into support/3.1	2025-03-03 16:38:32 +01:00
denis.flaven@combodo.com	ec2203229b	N°8231 - making rest api log more readable	2025-03-03 16:23:25 +01:00
jf-cbd	2f699d355a	Merge remote-tracking branch 'origin/support/3.1' into support/3.2	2025-03-03 14:37:57 +01:00
jf-cbd	da4457f5b4	Merge remote-tracking branch 'origin/support/2.7' into support/3.1	2025-03-03 14:36:50 +01:00
denis.flaven@combodo.com	97848cea4f	N°8231 - making rest api log more readable	2025-03-03 11:38:52 +01:00
jf-cbd	2ccd883c9a	👥 Update contributor list	2025-02-25 11:38:54 +01:00
jf-cbd	eabd68ff77	👥 Update contributor list	2025-02-25 11:38:14 +01:00
jf-cbd	2b493787b1	Update itop-version-history.md with 2.7.12, 3.1.3 and 3.2.1	2025-02-25 09:19:47 +01:00
jf-cbd	d74c850621	N°7870 - Tests: access the symfony service container to instantiate services	2025-02-21 15:28:38 +01:00
jf-cbd	4e575e17a3	Merge remote-tracking branch 'origin/support/3.1' into support/3.2	2025-02-21 13:23:57 +01:00
jf-cbd	94d6eca0c1	N°8215 - When PHP warning are enabled, Global Request doesn't work	2025-02-21 13:20:27 +01:00
jf-cbd	355da8ec0a	Merge remote-tracking branch 'origin/support/2.7' into support/3.1 # Conflicts: # datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php	2025-02-21 13:18:19 +01:00
jf-cbd	5f006c45db	N°8215 - When PHP warning are enabled, Global Request doesn't work	2025-02-21 13:16:07 +01:00