N°9908 - GetAllowedValues from AttributeClassAttCodeSet return no value

* update zh_cn translation

rebase on the latest develop branch

* update zh_cn translation

rebase on the latest develop branch

* update zh_cn translation

* Update zh_cn.dict.itop-oauth-client.php

* Update zh_cn.dictionary.itop.core.php

* Update zh_cn.dict.itop-request-mgmt.php

* update zh_cn translation

rebase on the latest develop branch

* update zh_cn translation

rebase on the latest develop branch

* update zh_cn translation

* Update zh_cn.dict.itop-oauth-client.php

* Update zh_cn.dict.itop-request-mgmt.php

* Update zh_cn.dict.itop-portal-base.php

* Update zh_cn.dictionary.itop.datatable.php

* Update zh_cn.dictionary.itop.welcome-popup.php

* Update zh_cn.dictionary.itop.ui.php

.doc/developers.md

@@ -0,0 +1,9 @@
+# Developers
+
+## PHP Code Styles
+We use `PHP CS Fixer` to ensure code formating consistency across PHP codebase.
+You can find the configuration and instructions to run it [here](../tests/php-code-style/README.md).
+
+## PHP Static Analysis
+We use `PHPStan` to ensure code quality and to detect potential bugs in our PHP codebase.
+You can find the configuration and instructions to run it [here](../tests/php-static-analysis/README.md).

.doc/itop-version-history.md

@@ -2,12 +2,17 @@
 
 ```mermaid
 %%{init: { 'logLevel': 'debug', 'theme': 'base', 'themeVariables': {
-              'git0': 'lawngreen',
-              'git3': 'dodgerblue',
-              'git4': 'grey',
-              'git5': 'grey',
-              'git6': 'grey',
-              'git7': 'grey'
+              'git0': '#7ccf00',
+              'git1': '#7ccf00',
+              'git2': '#99a1af',
+              'git3': '#99a1af',
+              'git4': '#99a1af',
+              'git5': '#99a1af',
+              'git6': '#99a1af',
+              'git7': '#99a1af',
+              'git8': '#99a1af',
+              'git9': '#99a1af',
+              'git10': '#99a1af'
        }, 'gitGraph': {'showBranches': true,'mainBranchName': 'develop','rotateCommitLabel': true}} }%%
 gitGraph
     commit id: "2016-07-06" tag: "2.3.0" type: HIGHLIGHT
@@ -86,24 +91,30 @@ gitGraph
     commit id: "2024-01-17a" tag: "2.7.10"
     checkout support/3.0
     commit id: "2024-01-17b" tag: "3.0.4"
+    checkout support/2.7
+    commit id: "2024-09-28" tag: "2.7.11"
+    checkout support/3.1
+    commit id: "2024-09-27" tag: "3.1.2"
     checkout support/3.2
     commit id: "2024-06-25" tag: "3.2.0-beta1" type: REVERSE
     commit id: "2024-08-07" tag: "3.2.0"
-    commit id: "2024-09-13" tag: "3.2.0-2"
-    checkout support/3.1
-    commit id: "2024-09-27" tag: "3.1.2"
     checkout support/2.7
-    commit id: "2024-09-28" tag: "2.7.11"
-    checkout support/2.7
-    commit id: "2025-02-25" tag: "2.7.12"
+    commit id: "2025-02-07a" tag: "2.7.12"
     checkout support/3.1
-    commit id: "2025-02-25 " tag: "3.1.3"
+    commit id: "2025-02-07b" tag: "3.1.3"
     checkout support/3.2
-    commit id: "2025-02-25  " tag: "3.2.1"
-    commit id: "2025-04-08" tag: "3.2.1-1"
-    commit id: "2025-08-19" tag: "3.2.2-1"
+    commit id: "2025-02-07c " tag: "3.2.1"
+    commit id: "2025-03-31 " tag: "3.2.1-1"
+    commit id: "2025-07-28 " tag: "3.2.2"
     checkout support/2.7
-    commit id: "2025-10-07" tag: "2.7.13"
+    commit id: "2025-09-25" tag: "2.7.13"
+    checkout support/3.2
+    commit id: "2026-04-27 " tag: "3.2.3"
+    checkout support/3.2.3
+    commit id: "2026-05-25 " tag: "3.2.3-1"
+    commit id: "2026-07-17 " tag: "3.2.3-2"
+    checkout develop
+    commit id: "2026-07-23" tag: "3.3.0-beta1"
 ```
 
 To learn more, check the [iTop community versions history on the official wiki](https://www.itophub.io/wiki/page?id=latest:release:start).

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,60 @@
+name: "Bug report"
+description: "Report a bug that you identified in iTop"
+type: bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please explain why you're creating this issue :
+        - Are you willing to create a PR for the bug fix ? If so, we'll indicate in the issue if we're interested in it.
+        - Then, please describe how to reproduce the issue.
+
+  - type: dropdown
+    id: willing_to_pr
+    attributes:
+      label: Are you willing to create (at a later stage) a PR for that?
+      options:
+        - 'Yes'
+        - 'No'
+    validations:
+      required: true
+
+  - type: input
+    id: itop_version
+    attributes:
+      label: iTop version
+      description: "Complete iTop version (e.g., 3.2.3)"
+    validations:
+      required: false
+
+  - type: input
+    id: php_version
+    attributes:
+      label: PHP version
+      description: "Complete PHP version (e.g., 8.4.20)"
+    validations:
+      required: false
+
+  - type: textarea
+    id: reproduction_steps
+    attributes:
+      label: Reproduction procedure
+      description: |
+        Please explain step by step how to reproduce the issue on a standard iTop Community.
+        If it requires a custom datamodel, provide the minimal XML delta to reproduce it.
+      placeholder: |
+        1. First go there
+        2. Then do that
+        3. ...
+        4. Finally, see that... (what is expected and what is actually happening)
+    validations:
+      required: false
+
+  - type: upload
+    id: additional_info
+    attributes:
+      label: Additional information (if needed)
+      description: "Add/drag and drop screenshots, logs or any files that can be relevant for your issue."
+    validations:
+      required: false
+      accept: ".png, .jpg, .jpeg, .gif, .webp, .log, .txt, .json, .csv, .xml, .zip"

.github/ISSUE_TEMPLATE/enhancement.yml

@@ -0,0 +1,47 @@
+name: "Enhancement suggestion"
+description: "Suggest an improvement to iTop"
+type: feature
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please explain why you're creating this issue :
+        - Please describe what's your improvement proposition.
+        - Then tell us if you're willing to create a PR for this enhancement ? If so, we'll indicate in the issue if we're interested in it.
+
+  - type: textarea
+    id: enhancement_details
+    attributes:
+      label: Enhancement details
+      description: |
+        Please explain what you want to improve, and your proposition to make it better.
+        If it requires a custom datamodel, provide the minimal XML delta to reproduce it.
+    validations:
+      required: false
+
+  - type: input
+    id: itop_version
+    attributes:
+      label: iTop version (if appropriate)
+      description: "Complete iTop version (e.g., 3.2.3)"
+    validations:
+      required: false
+
+  - type: dropdown
+    id: willing_to_pr
+    attributes:
+      label: Are you willing to create (at a later stage) a PR for that?
+      options:
+        - 'Yes'
+        - 'No'
+    validations:
+      required: true
+
+  - type: upload
+    id: additional_info
+    attributes:
+      label: Additional information (if needed)
+      description: "Add/drag and drop screenshots, logs or any files that can be relevant for your issue."
+    validations:
+      required: false
+      accept: ".png, .jpg, .jpeg, .gif, .webp, .log, .txt, .json, .csv, .xml, .zip"

.github/pull_request_template.md

@@ -1,83 +1,76 @@
 <!--
+IMPORTANT: Before creating your PR, please create an issue first to know if Combodo is interested in your contribution (not needed for translations PR).
+Since we may refuse a PR, it's preferable to create an issue first, to avoid spending time coding something that won't be accepted.
 
-IMPORTANT: Please follow the guidelines within this PR template before submitting it, it will greatly help us process your PR. 🙏
+Once you've done it, and we confirmed we're interested in it, please follow the guidelines within this PR template before submitting it, it will greatly help us process your PR. 🙏
 
 Any PRs not following the guidelines or with missing information will not be considered.
-
 -->
 
 ## Base information
-| Question                                                      | Answer 
-|---------------------------------------------------------------|--------
-| Related to a SourceForge thread / Another PR / Combodo ticket? | <!-- Put the URL -->
-| Type of change?                                               | Bug fix / Enhancement / Translations
 
+| Question                                                                        | Answer                               |
+|---------------------------------------------------------------------------------|--------------------------------------|
+| Related to a SourceForge thread / Another PR / A GitHub Issue / Combodo ticket? | <!-- Put the URL -->                 |
+| Type of change?                                                                 | Bug fix / Enhancement / Translations |
 
 ## Symptom (bug) / Objective (enhancement)
+
 <!--
 If it's a bug
   - Explain the symptom in details
   - If possible put error messages, logs or screenshots (you can paste image directly in this editor).
 
 If it's an enhancement
-  - Describe what is blocking you, what is the objective with as much details as possible.
+  - Describe what is blocking you, what is the objective with as many details as possible.
   - Add screenshots if it's related to UI.
 -->
 
-
 ## Reproduction procedure (bug)
+
 <!--
-Remove this section only if it's NOT a bug.
-
-Otherwise, explain step by step how to reproduce the issue on a standard iTop Community.
-
+Please explain step by step how to reproduce the issue on a standard iTop Community.
 If it requires a custom datamodel, provide the minimal XML delta to reproduce it on a standard iTop Community.
 -->
 
 1. On iTop x.y.z <!-- Put complete iTop version (eg. 3.1.0-2) -->
 2. With PHP x.y.z <!-- Put complete PHP version (eg. 8.1.24) -->
-2. First go there
-2. Then do that
-3. ...
-4. Finally, see that...
+3. First go there
+4. Then do that
+5. ...
+6. Finally, see that... (what is expected and what is actually happening)
 
+## Reproduction procedure (enhancement - if needed)
+
+<!--
+Please explain how we can reproduce the feature/behavior you want to improve, and what's your proposition to make it better.
+Add screenshots if it's related to UI.
+If it requires a custom datamodel, provide the minimal XML delta to reproduce it on a standard iTop Community.
+-->
 
 ## Cause (bug)
+
 <!--
 Remove this section only if it's NOT a bug.
 
 Otherwise, explain what is the cause of the issue (where in the code and why)
 -->
 
-
 ## Proposed solution (bug and enhancement)
+
 <!--
 Explain in details how you are proposing to solve this:
   - What did you do in the code and why
   - If you changed something in the UI, put before / after screenshots (you can paste image directly in this editor)
 -->
 
-
 ## Checklist before requesting a review
+
 <!--
 Don't remove these lines, check them once done.
 -->
+
 - [ ] I have performed a self-review of my code
 - [ ] I have tested all changes I made on an iTop instance
 - [ ] I have added a unit test, otherwise I have explained why I couldn't
-- [ ] Is the PR clear and detailed enough so anyone can understand digging in the code?
-
-## Checklist of things to do before PR is ready to merge
-<!--
-Things that needs to be done in the PR before it can be considered as ready to be merged
-
-Examples:
-- Changes requested in the review
-- Unit test to add
-- Dictionary entries to translate
-- ...
--->
-
-- [ ] ...
-- [ ] ...
-- [ ] ...
+- [ ] Is the PR clear and detailed enough so anyone can understand without digging in the code?

.github/workflows/action.yml

@@ -1,9 +1,13 @@
 name: Add PRs to Combodo PRs Dashboard
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
+  issues:
+    types:
+      - opened
+  workflow_call:
 
 jobs:
   add-to-project:
@@ -26,18 +30,27 @@ jobs:
 
           fi
 
-      - name: Add internal tag if member
+      - name: Add internal tag if member of the organization
         if: env.is_member == 'true'
         run: |
           curl -X POST -H "Authorization: token ${{ secrets.PR_AUTOMATICALLY_ADD_TO_PROJECT }}" \
             -H "Accept: application/vnd.github.v3+json" \
-            https://api.github.com/repos/Combodo/iTop/issues/${{ github.event.pull_request.number }}/labels \
+            https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels \
             -d '{"labels":["internal"]}'
+
+      - name: Set PR author as assignee if member of the organization
+        if: env.is_member == 'true' && github.event_name == 'pull_request'
+        run: |
+          curl -L \
+            -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.PR_AUTOMATICALLY_ADD_TO_PROJECT }}" \
+            https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/assignees \
+            -d '{"assignees":["${{ github.event.pull_request.user.login }}"]}'
         env:
           is_member: ${{ env.is_member }}
-
       - name: Add PR to the appropriate project
-        uses: actions/add-to-project@v1.0.2
+        uses: actions/add-to-project@v2
         with:
           project-url: ${{ env.project_url }}
-          github-token: ${{ secrets.PR_AUTOMATICALLY_ADD_TO_PROJECT }}
+          github-token: ${{ secrets.PR_AUTOMATICALLY_ADD_TO_PROJECT }}

.gitignore

@@ -58,6 +58,9 @@ tests/*/vendor/*
 /tests/php-unit-tests/phpunit.xml
 /tests/php-unit-tests/postbuild_integration.xml
 
+# PHP CS Fixer: Cache file
+/.php-cs-fixer.cache
+
 
 # Jetbrains
 /.idea/**

CONTRIBUTING.md

@@ -4,30 +4,33 @@ You want to contribute to iTop? Many thanks to you! 🎉 👍
 
 Here are some guidelines that will help us integrate your work!
 
-
-
+## Contributions
 
 ### Subjects
+
 You are welcome to create pull requests on any of those subjects:
 
 * 🐛 bug fix
 * 🌐 translation / i18n / l10n
+* 🚸 enhancement
 
-If you want to implement a **new feature**, please [create a corresponding ticket](https://sourceforge.net/p/itop/tickets/new/) for review.   
-If you ever want to begin implementation, do so in a fork, and add a link to the corresponding commits in the ticket.
+But before creating a PR, please [create a corresponding issue][itop-issues] for review.
+We should review within two weeks, and get back to you to indicate if we're interested in your proposal or not.
+If you don't create an issue, you won't know if we're interested in your contribution, and you may spend time coding something that won't be accepted.
+If you ever want to begin implementation, do so in a fork, and add a link to the corresponding commits in the issue.
 
 For all **security related subjects**, please see our [security policy](SECURITY.md).
 
-All **datamodel modification** should be done in an extension. Beware that such change would 
-impact all existing customers, and could prevent them from 
-upgrading!
-Combodo has a long experience of datamodel changes: they are very disruptive! 
+All **datamodel modification** should be done in an extension. Beware that such change would
+impact all existing customers, and could prevent them from upgrading!
+Combodo has a long experience of datamodel changes: they are very disruptive!
 This is why we avoid them in iTop core, especially the changes on existing objects/fields.   
-If you have an idea you're sure would benefit to all of iTop users, you may 
-[create a corresponding ticket](https://sourceforge.net/p/itop/tickets/new/) to submit it, but be warned that there are lots of good 
+If you have an idea you're sure would benefit to all of iTop users, you may
+[create a corresponding issue][itop-issues] to submit it, but be warned that there are lots of good
 reasons to refuse such changes.
 
 ### 📄 License and copyright
+
 iTop is distributed under the AGPL-3.0 license (see the [license.txt] file).
 
 The iTop repository is divided in three parts: iTop (mainly PHP/JS/XML sources and dictionaries), images, and third-party libraries.
@@ -37,48 +40,33 @@ Anyhow, you are encouraged to signal your contribution by the mean of `@author`
 If you want to use another license or keep the code ownership (copyright), you may [create an extension][wiki new ext].
 
 [license.txt]: https://github.com/Combodo/iTop/blob/develop/license.txt
-[wiki new ext]: https://www.itophub.io/wiki/page?id=latest%3Acustomization%3Astart#by_writing_your_own_extension
 
+[itop-issues]: https://github.com/Combodo/iTop/issues
+
+[wiki new ext]: https://www.itophub.io/wiki/page?id=latest%3Acustomization%3Astart#by_writing_your_own_extension
 
 ## 🔀 iTop branch model
 
 When we first start with Git, we were using the [GitFlow](https://nvie.com/posts/a-successful-git-branching-model/) branch model. As
- there was some confusions about branches to use for current developed release and previous maintained release, and also because we were
- using just a very few of the GitFlow commands, we decided to add just a little modification to this branch model : since april 2020
-  we don't have a `master` branch anymore.
+there was some confusions about branches to use for current developed release and previous maintained release, and also because we were
+using just a very few of the GitFlow commands, we decided to add just a little modification to this branch model : since April 2020
+we don't have a `master` branch anymore.
 
-Here are the branches we use and their meaning : 
+Here are the branches we use and their meaning :
 
 - `develop`: ongoing development version
-- `release/*`: if present, that means we are working on a alpha/beta/rc version for shipping
 - `support/*`: maintenance branches for older versions
 
 For example, if no version is currently prepared for shipping we could have:
 
-- `develop` containing future 3.1.0 version
-- `support/3.0`: 3.0.x maintenance version
-- `support/2.7`: 2.7.x maintenance version
-- `support/2.6`: 2.6.x maintenance version
+- `develop` containing future 3.3.0 version
+- `support/3.2`: 3.2.x maintenance version
 
-In this example, when 3.1.0-beta is shipped that will become:
-
-- `develop`: future 3.2.0 version
-- `release/3.1.0`: 3.1.0-beta
-- `support/3.0`: 3.0.x maintenance version
-- `support/2.7`: 2.7.x maintenance version
-- `support/2.6`: 2.6.x maintenance version
-
-And when 3.1.0 final will be out:
-
-- `develop`: future 3.2.0 version
-- `support/3.1`: 3.1.x maintenance version (will host developments for 3.1.1)
-- `support/3.0`: 3.0.x maintenance version
-- `support/2.7`: 2.7.x maintenance version
-- `support/2.6`: 2.6.x maintenance version
-
-Also note that we have a "micro-version" concept : each of those versions have a very small amount of modifications. They are made from
- `support/*` branches as well. For example 2.6.2-1 and 2.6.2-2 were made from the `support/2.6.2` branch. 
+And when 3.3.0 will be out:
 
+- `develop`: future 3.4.0 version
+- `support/3.3`: 3.3.x maintenance version (will host developments for 3.3.1)
+- `support/3.2`: 3.2.x maintenance version
 
 ## Coding
 
@@ -92,12 +80,11 @@ A [dedicated page](https://www.itophub.io/wiki/page?id=latest%3Acustomization%3A
 2. Create a branch in this fork, based on the develop branch
 3. Code !
 
-Do create a dedicated branch for each modification you want to propose : if you don't it will be very hard to merge back your work !
+Do create a dedicated branch for each modification you want to propose : if you don't, it will be very hard to merge back your work !
 
-Most of the time you should based your developments on the develop branch.    
+Most of the time you should base your developments on the develop branch.    
 That may be different if you want to fix a bug, please use develop anyway and ask in your PR if rebase is possible.
 
-
 ### 🎨 PHP styleguide
 
 Please follow [our guidelines](https://www.itophub.io/wiki/page?id=latest%3Acustomization%3Acoding_standards).
@@ -106,7 +93,7 @@ Please follow [our guidelines](https://www.itophub.io/wiki/page?id=latest%3Acust
 
 Please create tests that covers as much as possible the code you're submitting.
 
-Our tests are located in the `test/` directory, containing a PHPUnit config file : `phpunit.xml.dist`.
+Our tests are located in the `tests/` directory, containing a PHPUnit config file : `phpunit.xml.dist`.
 
 ### Git Commit Messages
 
@@ -138,14 +125,14 @@ When your code is working, please:
 * Rebase your branch on our repo last commit,
 * Create a pull request. _Detailed procedure to work on fork and create PR is available [in GitHub help pages](https://help.github.com/articles/creating-a-pull-request-from-a-fork/)_.
 * Pull request description: mind to add all the information useful to understand why you're suggesting this modification and anything necessary to dive into your work. Especially:
-  - Bugfixes: exact steps to reproduce the bug (given/when/then), description of the bug cause and what solution is implemented 
-  - Enhancements: use cases, implementation details if needed
-* Mind to check the "[Allow edits from maintainers](https://docs.github.com/en/github-ae@latest/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork)" option ! (note that if you are working with an org fork, this option [won't be available](https://github.com/orgs/community/discussions/5634))
-
+    - Bugfixes: exact steps to reproduce the bug (given/when/then), description of the bug cause and what solution is implemented
+    - Enhancements: use cases, implementation details if needed
+* Mind to check the "[Allow edits from maintainers](https://docs.github.com/en/github-ae@latest/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork)" option ! (note that if you are working with an org fork, this
+  option [won't be available](https://github.com/orgs/community/discussions/5634))
 
 ## 🙏 We are thankful
 
-We are thankful for all your contributions to the iTop universe! As a thank you gift, we will send stickers to every iTop (& extensions) contributors!
+We are thankful for all your contributions to the iTop universe! As a thank-you gift, we will send stickers to every iTop (& extensions) contributors!
 
 We have one sticker per contribution type. You might get multiple stickers with one contribution though :)
 
@@ -159,6 +146,6 @@ We have one sticker per contribution type. You might get multiple stickers with
 * Beta tester: Test and give feedback on beta releases
 * Extension developer: Develop and publish an extension
 
-Here is the design of each stickers for year 2024:
+Here is the design of each sticker:
 
-![iTop stickers 2025](.doc/contributing-guide/2025.contributing-stickers-side-by-side.png)
+![iTop stickers](.doc/contributing-guide/contributing-stickers-side-by-side.png)

README.md

@@ -53,7 +53,7 @@ iTop also offers mass import tools to help you become even more efficient.
 [4]: https://www.itophub.io/wiki/page?id=latest:install:requirements
 [5]: https://www.itophub.io/wiki
 [6]: https://store.itophub.io/en_US/
-[7]: itop-version-history.md
+[7]: .doc/itop-version-history.md
 
 [10]: https://www.itophub.io/wiki/page?id=latest%3Adatamodel%3Astart#configuration_management_cmdb
 [11]: https://www.itophub.io/wiki/page?id=latest%3Adatamodel%3Astart#ticketing
@@ -73,6 +73,9 @@ iTop development is sponsored, led, and supported by [Combodo][0].
 
 [0]: https://www.combodo.com
 
+## Developers
+
+You can find information and instructions about our quality tools and how to run them [here](.doc/developers.md).
 
 ## Contributors
 

addons/userrights/userrightsprofile.class.inc.php

@@ -582,16 +582,30 @@ class UserRightsProfile extends UserRightsAddOnAPI
 	 */
 	public function ListProfiles($oUser)
 	{
-		$aRet = [];
-		$oSearch = new DBObjectSearch('URP_UserProfile');
-		$oSearch->AllowAllData();
-		$oSearch->NoContextParameters();
-		$oSearch->Addcondition('userid', $oUser->GetKey(), '=');
-		$oProfiles = new DBObjectSet($oSearch);
-		while ($oUserProfile = $oProfiles->Fetch()) {
-			$aRet[$oUserProfile->Get('profileid')] = $oUserProfile->Get('profileid_friendlyname');
+		if (!array_key_exists('profile_list', $oUser->ListChanges())) {
+			// Profiles list is not modified on the $oUser object, we can use DBObjectSearch with `all data` capabilities
+			// Note: This is the default behavior
+			$aRet = [];
+			$oSearch = new DBObjectSearch('URP_UserProfile');
+			$oSearch->AllowAllData();
+			$oSearch->NoContextParameters();
+			$oSearch->Addcondition('userid', $oUser->GetKey(), '=');
+			$oProfiles = new DBObjectSet($oSearch);
+			while ($oUserProfile = $oProfiles->Fetch()) {
+				$aRet[$oUserProfile->Get('profileid')] = $oUserProfile->Get('profileid_friendlyname');
+			}
+
+			return $aRet;
+		} else {
+			// Profiles list must be computed with memory changes.
+			// Note: this is a bit tricky because the user object may have been modified in memory (e.g. a profile added or removed) and we need to take that into account
+			$aRet = [];
+			$oProfilesSet = $oUser->Get('profile_list');
+			foreach ($oProfilesSet as $oUserProfile) {
+				$aRet[$oUserProfile->Get('profileid')] = $oUserProfile->Get('profileid_friendlyname');
+			}
+			return $aRet;
 		}
-		return $aRet;
 	}
 
 	public function GetSelectFilter($oUser, $sClass, $aSettings = [])
@@ -705,26 +719,23 @@ class UserRightsProfile extends UserRightsAddOnAPI
 	protected function GetUserActionGrant($oUser, $sClass, $iActionCode)
 	{
 		$this->LoadCache();
-
-		// load and cache permissions for the current user on the given class
-		//
-		$iUser = $oUser->GetKey();
-		if (isset($this->m_aObjectActionGrants[$iUser][$sClass][$iActionCode])) {
-			$aTest = $this->m_aObjectActionGrants[$iUser][$sClass][$iActionCode];
-			if (is_array($aTest)) {
-				return $aTest;
+		if (count($oUser->ListChanges()) === 0) {
+			// load and cache permissions for the current user on the given class
+			if (isset($this->m_aObjectActionGrants[$oUser->GetKey()][$sClass][$iActionCode])) {
+				$aTest = $this->m_aObjectActionGrants[$oUser->GetKey()][$sClass][$iActionCode];
+				if (is_array($aTest)) {
+					return $aTest;
+				}
 			}
 		}
 
 		$sAction = self::$m_aActionCodes[$iActionCode];
 
 		$bStatus = null;
-		// Cache user's profiles
-		if (false === array_key_exists($iUser, $this->aUsersProfilesList)) {
-			$this->aUsersProfilesList[$iUser] = UserRights::ListProfiles($oUser);
-		}
+
+		$aProfileList = $this->GetProfileList($oUser);
 		// Call the API of UserRights because it caches the list for us
-		foreach ($this->aUsersProfilesList[$iUser] as $iProfile => $oProfile) {
+		foreach ($aProfileList as $iProfile => $oProfile) {
 			$bGrant = $this->GetProfileActionGrant($iProfile, $sClass, $sAction);
 			if (!is_null($bGrant)) {
 				if ($bGrant) {
@@ -742,7 +753,9 @@ class UserRightsProfile extends UserRightsAddOnAPI
 		$aRes = [
 			'permission' => $iPermission,
 		];
-		$this->m_aObjectActionGrants[$iUser][$sClass][$iActionCode] = $aRes;
+		if (count($oUser->ListChanges()) === 0) {
+			$this->m_aObjectActionGrants[$oUser->GetKey()][$sClass][$iActionCode] = $aRes;
+		}
 		return $aRes;
 	}
 
@@ -824,18 +837,14 @@ class UserRightsProfile extends UserRightsAddOnAPI
 	{
 		$this->LoadCache();
 		// Note: this code is VERY close to the code of IsActionAllowed()
-		$iUser = $oUser->GetKey();
 
-		// Cache user's profiles
-		if (false === array_key_exists($iUser, $this->aUsersProfilesList)) {
-			$this->aUsersProfilesList[$iUser] = UserRights::ListProfiles($oUser);
-		}
+		$aProfileList  = $this->GetProfileList($oUser);
 
 		// Note: The object set is ignored because it was interesting to optimize for huge data sets
 		//       and acceptable to consider only the root class of the object set
 		$bStatus = null;
 		// Call the API of UserRights because it caches the list for us
-		foreach ($this->aUsersProfilesList[$iUser] as $iProfile => $oProfile) {
+		foreach ($aProfileList as $iProfile => $oProfile) {
 			$bGrant = $this->GetClassStimulusGrant($iProfile, $sClass, $sStimulusCode);
 			if (!is_null($bGrant)) {
 				if ($bGrant) {
@@ -893,6 +902,25 @@ class UserRightsProfile extends UserRightsAddOnAPI
 		}
 		return $bHasSharing;
 	}
+
+	/**
+	 * @param \User $oUser
+	 *
+	 * @return array
+	 * @throws \Exception
+	 */
+	public function GetProfileList(User $oUser): array
+	{
+		if (count($oUser->ListChanges()) === 0) { // if user is already in db and not changed
+			$iUser = $oUser->GetKey();
+			if (false === array_key_exists($iUser, $this->aUsersProfilesList)) {
+				$aProfiles = UserRights::ListProfiles($oUser);
+				$this->aUsersProfilesList[$iUser] = $aProfiles;
+			}
+			return $this->aUsersProfilesList[$iUser];
+		}
+		return UserRights::ListProfiles($oUser);
+	}
 }
 
 UserRights::SelectModule('UserRightsProfile');

application/application.inc.php

@@ -16,5 +16,5 @@ require_once(APPROOT.'/application/audit.category.class.inc.php');
 require_once(APPROOT.'/application/audit.domain.class.inc.php');
 require_once(APPROOT.'/application/audit.rule.class.inc.php');
 require_once(APPROOT.'/application/query.class.inc.php');
-require_once(APPROOT.'/setup/moduleinstallation.class.inc.php');
+require_once(APPROOT.'/setup/moduleinstallation/moduleinstallation.class.inc.php');
 require_once(APPROOT.'/application/utils.inc.php');

application/applicationextension/backoffice/iBackofficeSassExtension.php

@@ -1,7 +1,7 @@
 <?php
 
 /**
- * Implement this interface to add sass file (SCSS) to the backoffice pages.
+ * Implement this interface to add sass files (SCSS) to the backoffice pages.
  * example: return "css/setup.scss"
  *
  * @api
@@ -11,9 +11,9 @@
 interface iBackofficeSassExtension
 {
 	/**
-	 * @return string
-	 * @see \iTopWebPage::$a_styles
+	 * @return array An array of relative paths (from loaded import paths) to the files to compile and include
+	 * @see \iTopWebPage::$a_linked_stylesheets
 	 * @api
 	 */
-	public function GetSass(): string;
+	public function GetSassRelPaths(): array;
 }

application/applicationextension/rest/RestUtils.php

@@ -97,33 +97,125 @@ class RestUtils
 	 * @throws Exception
 	 * @api
 	 */
-	public static function GetFieldList($sClass, $oData, $sParamName)
+	public static function GetFieldList($sClass, $oData, $sParamName, $bFailIfNotFound = true)
 	{
 		$sFields = self::GetOptionalParam($oData, $sParamName, '*');
-		$aShowFields = [];
-		if ($sFields == '*') {
-			foreach (MetaModel::ListAttributeDefs($sClass) as $sAttCode => $oAttDef) {
-				$aShowFields[$sClass][] = $sAttCode;
-			}
-		} elseif ($sFields == '*+') {
-			foreach (MetaModel::EnumChildClasses($sClass, ENUM_CHILD_CLASSES_ALL) as $sRefClass) {
-				foreach (MetaModel::ListAttributeDefs($sRefClass) as $sAttCode => $oAttDef) {
-					$aShowFields[$sRefClass][] = $sAttCode;
-				}
-			}
-		} else {
-			foreach (explode(',', $sFields) as $sAttCode) {
-				$sAttCode = trim($sAttCode);
-				if (($sAttCode != 'id') && (!MetaModel::IsValidAttCode($sClass, $sAttCode))) {
-					throw new Exception("$sParamName: invalid attribute code '$sAttCode'");
-				}
-				$aShowFields[$sClass][] = $sAttCode;
-			}
-		}
-
-		return $aShowFields;
+		return match($sFields) {
+			'*' => self::GetFieldListForClass($sClass),
+			'*+' => self::GetFieldListForParentClass($sClass),
+			default => self::GetLimitedFieldListForClass($sClass, $sFields, $sParamName, $bFailIfNotFound),
+		};
 	}
 
+	/**
+	 * Check if the requested field list asks for an extended output.
+	 *
+	 * Extended output is requested when using '*+' or class-scoped field definitions.
+	 *
+	 * @param string $sFields Requested field specification.
+	 *
+	 * @return bool
+	 */
+	public static function HasRequestedExtendedOutput(string $sFields): bool
+	{
+		return match($sFields) {
+			'*' => false,
+			'*+' => true,
+			default => substr_count($sFields, ':') > 1,
+		};
+	}
+
+	/**
+	 * Check if the requested field list asks for all output fields.
+	 *
+	 * @param string $sFields Requested field specification.
+	 *
+	 * @return bool
+	 */
+	public static function HasRequestedAllOutputFields(string $sFields): bool
+	{
+		return match($sFields) {
+			'*', '*+' => true,
+			default => false,
+		};
+	}
+
+	protected static function GetFieldListForClass(string $sClass): array
+	{
+		return [$sClass => array_keys(MetaModel::ListAttributeDefs($sClass))];
+	}
+
+	/**
+	 * Build a field list for all child classes of the given parent class.
+	 *
+	 * @param string $sClass Parent class name.
+	 *
+	 * @return array Array of class => list of attribute codes.
+	 */
+	protected static function GetFieldListForParentClass(string $sClass): array
+	{
+		$aFieldList = [];
+		foreach (MetaModel::EnumChildClasses($sClass, ENUM_CHILD_CLASSES_ALL) as $sRefClass) {
+			$aFieldList = array_merge($aFieldList, self::GetFieldListForClass($sRefClass));
+		}
+		return $aFieldList;
+	}
+
+	/**
+	 * Build a restricted field list for one class from a comma-separated attribute list.
+	 *
+	 * @param string $sClass Class name.
+	 * @param string $sFields Comma-separated list of requested attribute codes.
+	 * @param string $sParamName Input parameter name used in error messages.
+	 * @param bool $bFailIfNotFound If true, throws when an attribute code is invalid.
+	 *
+	 * @return array Array containing one class => list of attribute codes.
+	 * @throws Exception When an attribute code is invalid and $bFailIfNotFound is true.
+	 */
+	protected static function GetLimitedFieldListForSingleClass(string $sClass, string $sFields, string $sParamName, bool $bFailIfNotFound = true): array
+	{
+		$aFieldList = [$sClass => []];
+		foreach (explode(',', $sFields) as $sAttCode) {
+			$sAttCode = trim($sAttCode);
+			if (($sAttCode == 'id') || (MetaModel::IsValidAttCode($sClass, $sAttCode))) {
+				$aFieldList[$sClass][] = $sAttCode;
+			} else {
+				if ($bFailIfNotFound) {
+					throw new Exception("$sParamName: invalid attribute code '$sAttCode' for class '$sClass'");
+				}
+			}
+		}
+		return $aFieldList;
+	}
+
+	/**
+	 * Build a restricted field list for one or several classes.
+	 *
+	 * Accepted formats are either "att1,att2" for a single class, or
+	 * "ClassA:att1,att2;ClassB:att3" for class-scoped field definitions.
+	 *
+	 * @param string $sClass Default class name used when no class scope is specified.
+	 * @param string $sFields Requested field specification.
+	 * @param string $sParamName Input parameter name used in error messages.
+	 * @param bool $bFailIfNotFound If true, throws when an attribute code is invalid.
+	 *
+	 * @return array Array of class => list of attribute codes.
+	 * @throws Exception Propagated from GetLimitedFieldListForSingleClass.
+	 */
+	protected static function GetLimitedFieldListForClass(string $sClass, string $sFields, string $sParamName, bool $bFailIfNotFound = true): array
+	{
+		if (!str_contains($sFields, ':')) {
+			return self::GetLimitedFieldListForSingleClass($sClass, $sFields, $sParamName, $bFailIfNotFound);
+		}
+
+		$aFieldList = [];
+		$aFieldListParts = explode(';', $sFields);
+		foreach ($aFieldListParts as $sClassFields) {
+			list($sSubClass, $sSubClassFields) = explode(':', $sClassFields);
+			$aFieldList = array_merge($aFieldList, self::GetLimitedFieldListForSingleClass(trim($sSubClass), trim($sSubClassFields), $sParamName, $bFailIfNotFound));
+		}
+		return $aFieldList;
+	}
 	/**
 	 * Read and interpret object search criteria from a Rest/Json structure
 	 *

application/cmdbabstract.class.inc.php

@@ -175,6 +175,11 @@ abstract class cmdbAbstractObject extends CMDBObject implements iDisplay
 	 */
 	protected $sDisplayMode;
 	protected $aFieldsMap;
+	/**
+	 * @var array Store posted values in order to be used in GetAttributeFlags
+	 * @since 3.3.0
+	 */
+	protected $aPostedValues = [];
 
 	/**
 	 * If true, bypass IsActionAllowedOnAttribute when writing this object
@@ -524,6 +529,12 @@ JS
 				$sLabel = Dict::S('Tag:Synchronized');
 				$sSynchroTagId = 'synchro_icon-'.$this->GetKey();
 				$aTags[$sSynchroTagId] = ['title' => $sTip, 'css_classes' => 'ibo-object-details--tag--synchronized', 'decoration_classes' => 'fas fa-lock', 'label' => $sLabel];
+				if (UserRights::IsActionAllowed(SynchroReplica::class, UR_ACTION_READ)) {
+					$oDBSearch = DBObjectSearch::FromOQL('SELECT SynchroReplica WHERE dest_class=:sClass AND dest_id=:id');
+					$sFilter = rawurlencode($oDBSearch->serialize(false, ['sClass' => get_class($this),'id' => $this->GetKey()]));
+					$sUrlSearchReplica = 'UI.php?operation=search&filter='.$sFilter;
+					$oPage->add_ready_script("$('#$sSynchroTagId').on('click',function() {window.location = '$sUrlSearchReplica' });");
+				}
 			}
 		}
 
@@ -819,6 +830,7 @@ HTML
 				foreach ($aNotificationClasses as $sNotifClass) {
 					$aNotifSearches[$sNotifClass] = DBObjectSearch::FromOQL("SELECT $sNotifClass AS Ev WHERE Ev.object_id = :id AND Ev.object_class = :class");
 					$aNotifSearches[$sNotifClass]->SetInternalParams($aParams);
+					$aNotifSearches[$sNotifClass]->AllowAllData();
 					$oNotifSet = new DBObjectSet($aNotifSearches[$sNotifClass], []);
 					$iNotifsCount += $oNotifSet->Count();
 				}
@@ -832,6 +844,7 @@ HTML
 						'menu' => false,
 						'panel_title' => MetaModel::GetName($sNotifClass),
 						'panel_icon' => MetaModel::GetClassIcon($sNotifClass, false),
+						'display_unauthorized_objects' => true,
 					]);
 				}
 			}
@@ -1033,7 +1046,7 @@ HTML
 							// Add extra data for markup generation
 							// - Attribute code and AttributeDef. class
 							$val['attcode'] = $sAttCode;
-							$val['atttype'] = $sAttDefClass;
+							$val['atttype'] = $oAttDef->GetTypeShortClassName();
 							$val['attlabel'] = $sAttLabel;
 							$val['attflags'] = ($bEditMode) ? $this->GetFormAttributeFlags($sAttCode) : OPT_ATT_READONLY;
 
@@ -1522,190 +1535,6 @@ HTML
 		return $sHtml;
 	}
 
-	/**
-	 * @param WebPage $oPage
-	 * @param \CMDBObjectSet $oSet
-	 * @param array $aParams
-	 *
-	 * @throws \Exception
-	 *  only used in old and deprecated export.php
-	 *
-	 * @internal Only to be used by `/webservices/export.php` : this is a legacy method that produces wrong HTML (no TR on table body rows)
-	 */
-	public static function DisplaySetAsHTMLSpreadsheet(WebPage $oPage, CMDBObjectSet $oSet, $aParams = [])
-	{
-		$oPage->add(self::GetSetAsHTMLSpreadsheet($oSet, $aParams));
-	}
-
-	/**
-	 * Spreadsheet output: designed for end users doing some reporting
-	 * Then the ids are excluded and replaced by the corresponding friendlyname
-	 *
-	 * @param \DBObjectSet $oSet
-	 * @param array $aParams
-	 *
-	 * @return string
-	 * @throws \CoreException
-	 * @throws \CoreUnexpectedValue
-	 * @throws \MissingQueryArgument
-	 * @throws \MySQLException
-	 * @throws \MySQLHasGoneAwayException
-	 * @throws \Exception
-	 *
-	 * @internal Only to be used by `/webservices/export.php` : this is a legacy method that produces wrong HTML (no TR on table body rows)
-	 */
-	public static function GetSetAsHTMLSpreadsheet(DBObjectSet $oSet, $aParams = [])
-	{
-		$aFields = null;
-		if (isset($aParams['fields']) && (strlen($aParams['fields']) > 0)) {
-			$aFields = explode(',', $aParams['fields']);
-		}
-
-		$bFieldsAdvanced = false;
-		if (isset($aParams['fields_advanced'])) {
-			$bFieldsAdvanced = (bool)$aParams['fields_advanced'];
-		}
-
-		$bLocalize = true;
-		if (isset($aParams['localize_values'])) {
-			$bLocalize = (bool)$aParams['localize_values'];
-		}
-
-		$aList = [];
-
-		$aClasses = $oSet->GetFilter()->GetSelectedClasses();
-		$aAuthorizedClasses = [];
-		foreach ($aClasses as $sAlias => $sClassName) {
-			if (UserRights::IsActionAllowed($sClassName, UR_ACTION_READ, $oSet) != UR_ALLOWED_NO) {
-				$aAuthorizedClasses[$sAlias] = $sClassName;
-			}
-		}
-		$aHeader = [];
-		foreach ($aAuthorizedClasses as $sAlias => $sClassName) {
-			$aList[$sAlias] = [];
-
-			foreach (MetaModel::ListAttributeDefs($sClassName) as $sAttCode => $oAttDef) {
-				if (is_null($aFields) || (count($aFields) == 0)) {
-					// Standard list of attributes (no link sets)
-					if ($oAttDef->IsScalar() && ($oAttDef->IsWritable() || $oAttDef->IsExternalField())) {
-						$sAttCodeEx = $oAttDef->IsExternalField() ? $oAttDef->GetKeyAttCode().'->'.$oAttDef->GetExtAttCode() : $sAttCode;
-
-						$aList[$sAlias][$sAttCodeEx] = $oAttDef;
-
-						if ($bFieldsAdvanced && $oAttDef->IsExternalKey(EXTKEY_RELATIVE)) {
-							$sRemoteClass = $oAttDef->GetTargetClass();
-							foreach (MetaModel::GetReconcKeys($sRemoteClass) as $sRemoteAttCode) {
-								$aList[$sAlias][$sAttCode.'->'.$sRemoteAttCode] = MetaModel::GetAttributeDef(
-									$sRemoteClass,
-									$sRemoteAttCode
-								);
-							}
-						}
-					}
-				} else {
-					// User defined list of attributes
-					if (in_array($sAttCode, $aFields) || in_array($sAlias.'.'.$sAttCode, $aFields)) {
-						$aList[$sAlias][$sAttCode] = $oAttDef;
-					}
-				}
-			}
-			// Replace external key by the corresponding friendly name (if not already in the list)
-			foreach ($aList[$sAlias] as $sAttCode => $oAttDef) {
-				if ($oAttDef->IsExternalKey()) {
-					unset($aList[$sAlias][$sAttCode]);
-					$sFriendlyNameAttCode = $sAttCode.'_friendlyname';
-					if (!array_key_exists(
-						$sFriendlyNameAttCode,
-						$aList[$sAlias]
-					) && MetaModel::IsValidAttCode($sClassName, $sFriendlyNameAttCode)) {
-						$oFriendlyNameAtt = MetaModel::GetAttributeDef($sClassName, $sFriendlyNameAttCode);
-						$aList[$sAlias][$sFriendlyNameAttCode] = $oFriendlyNameAtt;
-					}
-				}
-			}
-
-			foreach ($aList[$sAlias] as $sAttCodeEx => $oAttDef) {
-				$sColLabel = $bLocalize ? MetaModel::GetLabel($sClassName, $sAttCodeEx) : $sAttCodeEx;
-
-				$oFinalAttDef = $oAttDef->GetFinalAttDef();
-				if (get_class($oFinalAttDef) == 'AttributeDateTime') {
-					$aHeader[] = $sColLabel.' ('.Dict::S('UI:SplitDateTime-Date').')';
-					$aHeader[] = $sColLabel.' ('.Dict::S('UI:SplitDateTime-Time').')';
-				} else {
-					$aHeader[] = $sColLabel;
-				}
-			}
-		}
-
-		$sHtml = "<table border=\"1\">\n";
-		$sHtml .= "<tr>\n";
-		$sHtml .= "<td>".implode("</td><td>", $aHeader)."</td>\n";
-		$sHtml .= "</tr>\n";
-		$oSet->Seek(0);
-		while ($aObjects = $oSet->FetchAssoc()) {
-			$aRow = [];
-			foreach ($aAuthorizedClasses as $sAlias => $sClassName) {
-				$oObj = $aObjects[$sAlias];
-				foreach ($aList[$sAlias] as $sAttCodeEx => $oAttDef) {
-					if (is_null($oObj)) {
-						$aRow[] = '<td></td>';
-					} else {
-						$oFinalAttDef = $oAttDef->GetFinalAttDef();
-						if (get_class($oFinalAttDef) == 'AttributeDateTime') {
-							$sDate = $oObj->Get($sAttCodeEx);
-							if ($sDate === null) {
-								$aRow[] = '<td></td>';
-								$aRow[] = '<td></td>';
-							} else {
-								$iDate = AttributeDateTime::GetAsUnixSeconds($sDate);
-								$aRow[] = '<td>'.date(
-									'Y-m-d',
-									$iDate
-								).'</td>'; // Format kept as-is for 100% backward compatibility of the exports
-								$aRow[] = '<td>'.date(
-									'H:i:s',
-									$iDate
-								).'</td>'; // Format kept as-is for 100% backward compatibility of the exports
-							}
-						} else {
-							if ($oAttDef instanceof AttributeCaseLog) {
-								$rawValue = $oObj->Get($sAttCodeEx);
-								$outputValue = str_replace(
-									"\n",
-									"<br/>",
-									utils::EscapeHtml($rawValue->__toString())
-								);
-								// Trick for Excel: treat the content as text even if it begins with an equal sign
-								$aRow[] = '<td x:str>'.$outputValue.'</td>';
-							} else {
-								$rawValue = $oObj->Get($sAttCodeEx);
-								// Due to custom formatting rules, empty friendlynames may be rendered as non-empty strings
-								// let's fix this and make sure we render an empty string if the key == 0
-								if ($oAttDef instanceof AttributeExternalField && $oAttDef->IsFriendlyName()) {
-									$sKeyAttCode = $oAttDef->GetKeyAttCode();
-									if ($oObj->Get($sKeyAttCode) == 0) {
-										$rawValue = '';
-									}
-								}
-								if ($bLocalize) {
-									$outputValue = utils::EscapeHtml($oFinalAttDef->GetEditValue($rawValue));
-								} else {
-									$outputValue = utils::EscapeHtml($rawValue);
-								}
-								$aRow[] = '<td>'.$outputValue.'</td>';
-							}
-						}
-					}
-				}
-			}
-			$sHtml .= implode("\n", $aRow);
-			$sHtml .= "</tr>\n";
-		}
-		$sHtml .= "</table>\n";
-
-		return $sHtml;
-	}
-
 	/**
 	 * @param WebPage $oPage
 	 * @param \CMDBObjectSet $oSet
@@ -3984,6 +3813,7 @@ HTML;
 
 		$aErrors = [];
 		$aFinalValues = [];
+		$this->aPostedValues = $aValues; // Store the values for later use (e.g. in GetAttributeFlags)
 		foreach ($this->GetWriteableAttList(array_keys($aValues), $aErrors, $aAttFlags) as $sAttCode => $oAttDef) {
 			$aFinalValues[$sAttCode] = $aValues[$sAttCode];
 		}
@@ -4493,7 +4323,7 @@ HTML;
 
 			$oDivField = FieldUIBlockFactory::MakeLarge("");
 			//	UIContentBlockUIBlockFactory::MakeStandard(null,["field_container field_large"]);
-			$oDivField->AddDataAttribute("attribute-type", $sAttDefClass);
+			$oDivField->AddDataAttribute("attribute-type", $oAttDef->GetTypeShortClassName());
 			$oDivField->AddDataAttribute("attribute-label", $sAttMetaDataLabel);
 			$oDivField->AddDataAttribute("attribute-flag-hidden", false);
 			$oDivField->AddDataAttribute("attribute-flag-read-only", false);
@@ -5062,10 +4892,10 @@ EOF
 			} else {
 				if (count($aObjects) == 1) {
 					$oObj = $aObjects[0];
-					$sSubtitle = Dict::Format('UI:Delect:Confirm_Object', $oObj->GetHyperLink());
+					$sSubtitle = Dict::Format('UI:Delete:Confirm_Object', $oObj->GetHyperLink());
 				} else {
 					$sSubtitle = Dict::Format(
-						'UI:Delect:Confirm_Count_ObjectsOf_Class',
+						'UI:Delete:Confirm_Count_ObjectsOf_Class',
 						count($aObjects),
 						MetaModel::GetName($sClass)
 					);
@@ -5632,7 +5462,7 @@ JS
 	 * @return void
 	 * @since 3.1.0
 	 */
-	final public function AddAttributeFlags(string $sAttCode, int $iFlags, string $sTargetState = '', string $sReason = null): void
+	final public function AddAttributeFlags(string $sAttCode, int $iFlags, string $sTargetState = '', ?string $sReason = null): void
 	{
 		if (!isset($this->aAttributesFlags[$sTargetState])) {
 			$this->aAttributesFlags[$sTargetState] = [];
@@ -5655,7 +5485,7 @@ JS
 	 * @return void
 	 * @since 3.1.0
 	 */
-	final public function ForceAttributeFlags(string $sAttCode, int $iFlags, string $sTargetState = '', string $sReason = null): void
+	final public function ForceAttributeFlags(string $sAttCode, int $iFlags, string $sTargetState = '', ?string $sReason = null): void
 	{
 		if (!isset($this->aAttributesFlags[$sTargetState])) {
 			$this->aAttributesFlags[$sTargetState] = [];
@@ -5696,7 +5526,7 @@ JS
 	 * @return void
 	 * @since 3.1.0
 	 */
-	final public function AddInitialAttributeFlags(string $sAttCode, int $iFlags, string $sReason = null)
+	final public function AddInitialAttributeFlags(string $sAttCode, int $iFlags, ?string $sReason = null)
 	{
 		if (!isset($this->aInitialAttributesFlags)) {
 			$this->aInitialAttributesFlags = [];
@@ -5718,7 +5548,7 @@ JS
 	 * @return void
 	 * @since 3.1.0
 	 */
-	final public function ForceInitialAttributeFlags(string $sAttCode, int $iFlags, string $sReason = null)
+	final public function ForceInitialAttributeFlags(string $sAttCode, int $iFlags, ?string $sReason = null)
 	{
 		if (!isset($this->aInitialAttributesFlags)) {
 			$this->aInitialAttributesFlags = [];

application/dashboard.class.inc.php

@@ -497,11 +497,11 @@ EOF
 	 * @param array $aExtraParams
 	 * @param bool $bCanEdit
 	 *
-	 * @return \Combodo\iTop\Application\UI\Base\Layout\Dashboard\DashboardLayout
+	 * @return null|\Combodo\iTop\Application\UI\Base\Layout\Dashboard\DashboardLayout
 	 */
 	public function Render($oPage, $bEditMode = false, $aExtraParams = [], $bCanEdit = true)
 	{
-		$aExtraParams['dashboard_div_id'] = utils::Sanitize($aExtraParams['dashboard_div_id'] ?? null, $this->GetId(), utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER);
+		$aExtraParams['dashboard_div_id'] = utils::Sanitize($aExtraParams['dashboard_div_id'] ?? $this->GetId(), $this->GetId(), utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER);
 
 		/** @var \DashboardLayoutMultiCol $oLayout */
 		$oLayout = new $this->sLayoutClass();
@@ -1029,7 +1029,7 @@ EOF
 			    var dashboard = $('.ibo-dashboard#$sDivId')
 				dashboard.block();
 				$.post(GetAbsoluteUrlAppRoot()+'pages/ajax.render.php',
-				   { operation: 'toggle_dashboard', dashboard_id: '$sId', file: '$sFile', extra_params: $sExtraParams, reload_url: '$sReloadURL' },
+				   { operation: 'toggle_dashboard', dashboard_id: '$sId', file: '$sFile', extra_params: $sExtraParams, reload_url: $sReloadURL },
 				   function(data) {
 					 dashboard.html(data);
 					 dashboard.unblock();

application/displayblock.class.inc.php

@@ -726,6 +726,10 @@ class DisplayBlock
 				}
 			}
 
+			if (!$this->m_oFilter->IsAllDataAllowed() && ($aExtraParams['display_unauthorized_objects'] ?? false) === true) {
+				$this->m_oFilter->AllowAllData();
+			}
+
 			$aExtraParams['query_params'] = $this->m_oFilter->GetInternalParams();
 			$this->m_oSet = new CMDBObjectSet($this->m_oFilter, $aOrderBy, $aQueryParams);
 		}
@@ -1074,7 +1078,6 @@ JS
 
 				if ($aCounts[$sStateValue] == 0) {
 					$aCounts[$sStateValue] = ['link' => '-', 'label' => $aCounts[$sStateValue]];
-					;
 				} else {
 					$oSingleGroupByValueFilter = $this->m_oFilter->DeepClone();
 					$oSingleGroupByValueFilter->AddCondition($sStateAttrCode, $sStateValue, '=');
@@ -1379,7 +1382,10 @@ JS
 
 		// Check the classes that can be read (i.e authorized) by this user...
 		foreach ($aClasses as $sAlias => $sClassName) {
-			if (UserRights::IsActionAllowed($sClassName, UR_ACTION_READ, $this->m_oSet) != UR_ALLOWED_NO) {
+			if (
+				(UserRights::IsActionAllowed($sClassName, UR_ACTION_READ, $this->m_oSet) !== UR_ALLOWED_NO)
+				|| ($aExtraParams['display_unauthorized_objects'] ?? false) === true
+			) {
 				$aAuthorizedClasses[$sAlias] = $sClassName;
 			}
 		}
@@ -1701,7 +1707,7 @@ JS
 		$oBlock->bAdvancedMode = utils::ReadParam('advanced', false);
 
 		$oBlock->sCsvFile = strtolower($this->m_oFilter->GetClass()).'.csv';
-		$oBlock->sDownloadLink = utils::GetAbsoluteUrlAppRoot().'webservices/export.php?expression='.urlencode($this->m_oFilter->ToOQL(true)).'&format=csv&filename='.urlencode($oBlock->sCsvFile);
+		$oBlock->sDownloadLink = utils::GetAbsoluteUrlAppRoot().'webservices/export-v2.php?expression='.urlencode($this->m_oFilter->ToOQL(true)).'&format=csv&filename='.urlencode($oBlock->sCsvFile);
 		$oBlock->sLinkToToggle = utils::GetAbsoluteUrlAppRoot().'pages/UI.php?operation=search'.$oAppContext->GetForLink(true).'&filter='.rawurlencode($this->m_oFilter->serialize()).'&format=csv';
 		// Pass the parameters via POST, since expression may be very long
 		$aParamsToPost = [
@@ -1718,7 +1724,7 @@ JS
 			$oBlock->sLinkToToggle = $oBlock->sLinkToToggle.'&advanced=1';
 			$oBlock->sChecked = '';
 		}
-		$oBlock->sAjaxLink = utils::GetAbsoluteUrlAppRoot().'webservices/export.php';
+		$oBlock->sAjaxLink = utils::GetAbsoluteUrlAppRoot().'webservices/export-v2.php';
 
 		$oBlock->sCharsetNotice = false;
 		$oBlock->sJsonParams = json_encode($aParamsToPost);
@@ -1940,8 +1946,8 @@ class MenuBlock extends DisplayBlock
 					$sSelectedClassName = MetaModel::GetName($sSelectedClass);
 
 					// Check rights on class
-					$bIsBulkModifyAllowed = (!MetaModel::IsAbstract($sSelectedClass)) && UserRights::IsActionAllowed($sSelectedClass, UR_ACTION_BULK_MODIFY) && ($oReflectionClass->IsSubclassOf('cmdbAbstractObject'));
-					$bIsBulkDeleteAllowed = (bool) UserRights::IsActionAllowed($sSelectedClass, UR_ACTION_BULK_DELETE);
+					$bIsBulkModifyAllowed = (!MetaModel::IsAbstract($sSelectedClass)) && UserRights::IsActionAllowed($sSelectedClass, UR_ACTION_BULK_MODIFY) && (($oReflectionClass->IsSubclassOf(cmdbAbstractObject::class) || $sSelectedClass === SynchroReplica::class));
+					$bIsBulkDeleteAllowed = (bool)UserRights::IsActionAllowed($sSelectedClass, UR_ACTION_BULK_DELETE);
 
 					// Refine filter on selected class so bullk actions occur on the right class
 					$oSelectedClassFilter = $this->GetFilter()->DeepClone();
@@ -1951,7 +1957,15 @@ class MenuBlock extends DisplayBlock
 					// Action label dict code has a specific suffix for "Link" / "Remote" aliases to allow dedicated labels in linksets.
 					$sActionLabelCodeSuffix = in_array($sSelectedAlias, ['Link', 'Remote']) ? $sSelectedAlias : 'Class';
 					if ($bIsBulkModifyAllowed) {
-						$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:ModifyAll:'.$sSelectedAlias, Dict::Format('UI:Menu:ModifyAll_'.$sActionLabelCodeSuffix, $sSelectedClassName));
+						if ($sSelectedClass === SynchroReplica::class) {
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:UnlinkAll:', Dict::S('Class:SynchroReplica/Action:unlink_all'), 'unlink');
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:UnLinkSynchroAll:', Dict::S('Class:SynchroReplica/Action:unlinksynchro_all'), 'unlinksynchro');
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:SynchroAll:', Dict::S('Class:SynchroReplica/Action:synchro_all'), 'synchro');
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:AllowDeleteAll:', Dict::S('Class:SynchroReplica/Action:allowdelete_all'), 'allowdelete');
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:DenyDeleteAll:', Dict::S('Class:SynchroReplica/Action:denydelete_all'), 'denydelete');
+						} else {
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:ModifyAll:'.$sSelectedAlias, Dict::Format('UI:Menu:ModifyAll_'.$sActionLabelCodeSuffix, $sSelectedClassName));
+						}
 					}
 					if ($bIsBulkDeleteAllowed) {
 						$this->AddBulkDeleteObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:BulkDelete:'.$sSelectedAlias, Dict::Format('UI:Menu:BulkDelete_'.$sActionLabelCodeSuffix, $sSelectedClassName));
@@ -2471,11 +2485,11 @@ class MenuBlock extends DisplayBlock
 	 * @since 3.1.0
 	 * @internal
 	 */
-	protected function AddBulkModifyObjectsMenuAction(array &$aActions, string $sClass, string $sFilter, string $sActionIdentifier = 'UI:Menu:ModifyAll', $sActionLabel = 'UI:Menu:ModifyAll'): void
+	protected function AddBulkModifyObjectsMenuAction(array &$aActions, string $sClass, string $sFilter, string $sActionIdentifier = 'UI:Menu:ModifyAll', $sActionLabel = 'UI:Menu:ModifyAll', $sOperationName = 'modify'): void
 	{
 		$aActions[$sActionIdentifier] = [
-			'label' => Dict::S($sActionLabel),
-			'url' => $this->PrepareUrlForStandardMenuAction($sClass, "operation=select_for_modify_all&class=$sClass&filter=".urlencode($sFilter)),
+				'label' => Dict::S($sActionLabel),
+				'url'   => $this->PrepareUrlForStandardMenuAction($sClass, 'operation=select_for_'.$sOperationName.'_all&class='.$sClass.'&filter='.urlencode($sFilter)),
 		] + $this->GetDefaultParamsForMenuAction();
 	}
 

application/exceptions/CoreException.php

@@ -14,6 +14,8 @@ class CoreException extends Exception
 	/**
 	 * CoreException constructor.
 	 *
+	 * ATTENTION: Logging here will break the CI
+	 *
 	 * @param string $sIssue error message
 	 * @param array|null $aContextData key/value array, value MUST implements _toString
 	 * @param string $sImpact

application/exceptions/ForgotPasswordApplicationException.php

@@ -0,0 +1,10 @@
+<?php
+
+/**
+ * @copyright   Copyright (C) 2010-2026 Combodo SAS
+ * @license     http://opensource.org/licenses/AGPL-3.0
+ */
+
+class ForgotPasswordApplicationException extends Exception
+{
+}

application/exceptions/ForgotPasswordUserInputException.php

@@ -0,0 +1,10 @@
+<?php
+
+/**
+ * @copyright   Copyright (C) 2010-2026 Combodo SAS
+ * @license     http://opensource.org/licenses/AGPL-3.0
+ */
+
+class ForgotPasswordUserInputException extends Exception
+{
+}

application/forms.class.inc.php

@@ -1387,7 +1387,7 @@ class DesignerIconSelectionField extends DesignerFormField
 	public function AddAllowedValue($aValue)
 	{
 		// Add a null value to the list of allowed values
-		$this->aAllowedValues = array_merge([$aValue], $this->aAllowedValues);
+		$this->aAllowedValues = array_merge([$aValue], $this->aAllowedValues ?? [null]);
 	}
 	public function EnableUpload($sIconUploadUrl)
 	{

application/loginexternal.class.inc.php

@@ -75,13 +75,10 @@ class LoginExternal extends AbstractLoginFSMExtension
 	}
 
 	/**
-	 * @return bool
+	 * @return bool|mixed
 	 */
 	private function GetAuthUser()
 	{
-		$sExtAuthVar = MetaModel::GetConfig()->GetExternalAuthenticationVariable(); // In which variable is the info passed ?
-		eval('$sAuthUser = isset('.$sExtAuthVar.') ? '.$sExtAuthVar.' : false;'); // Retrieve the value
-		/** @var string $sAuthUser */
-		return $sAuthUser; // Retrieve the value
+		return MetaModel::GetConfig()->GetExternalAuthenticationVariable();
 	}
 }

application/logintwig.class.inc.php

@@ -243,15 +243,12 @@ class LoginTwigRenderer
 
 	public function GetDefaultVars()
 	{
-		$sVersionShort = Dict::Format('UI:iTopVersion:Short', ITOP_APPLICATION, ITOP_VERSION);
 		$sIconUrl = Utils::GetConfig()->Get('app_icon_url');
 		$sDisplayIcon = Branding::GetLoginLogoAbsoluteUrl();
 
 		$aVars = [
 			'sAppRootUrl' => utils::GetAbsoluteUrlAppRoot(),
 			'aPluginFormData' => $this->GetPluginFormData(),
-			'sItopVersion' => ITOP_VERSION,
-			'sVersionShort' => $sVersionShort,
 			'sIconUrl' => $sIconUrl,
 			'sDisplayIcon' => $sDisplayIcon,
 		];

application/loginwebpage.class.inc.php

@@ -25,11 +25,11 @@
  */
 
 use Combodo\iTop\Application\Branding;
-use Combodo\iTop\Application\Helper\Session;
 use Combodo\iTop\Application\WebPage\ErrorPage;
 use Combodo\iTop\Application\WebPage\NiceWebPage;
 use Combodo\iTop\Service\Events\EventData;
 use Combodo\iTop\Service\Events\EventService;
+use Combodo\iTop\Service\Session\Session;
 
 /**
  * Web page used for displaying the login form
@@ -221,15 +221,15 @@ class LoginWebPage extends NiceWebPage
 
 			if ($oUser != null) {
 				if (!MetaModel::IsValidAttCode(get_class($oUser), 'reset_pwd_token')) {
-					throw new Exception(Dict::S('UI:ResetPwd-Error-NotPossible'));
+					throw new ForgotPasswordUserInputException('External accounts do not allow password reset');
 				}
 				if (!$oUser->CanChangePassword()) {
-					throw new Exception(Dict::S('UI:ResetPwd-Error-FixedPwd'));
+					throw new ForgotPasswordUserInputException('The account does not allow password reset');
 				}
 
 				$sTo = $oUser->GetResetPasswordEmail(); // throws Exceptions if not allowed
 				if ($sTo == '') {
-					throw new Exception(Dict::S('UI:ResetPwd-Error-NoEmail'));
+					throw new ForgotPasswordUserInputException('Missing email address for this account');
 				}
 
 				// This token allows the user to change the password without knowing the previous one
@@ -255,17 +255,21 @@ class LoginWebPage extends NiceWebPage
 
 					case EMAIL_SEND_ERROR:
 					default:
-						IssueLog::Error('Failed to send the email with the NEW password for '.$oUser->Get('friendlyname').': '.implode(', ', $aIssues));
-						throw new Exception(Dict::S('UI:ResetPwd-Error-Send'));
+						throw new ForgotPasswordApplicationException('Failed to send the password reset email for '.$oUser->Get('friendlyname').': '.implode(', ', $aIssues));
 				}
 			}
 
-			$oTwigContext = new LoginTwigRenderer();
-			$aVars = $oTwigContext->GetDefaultVars();
-			$oTwigContext->Render($this, 'forgotpwdsent.html.twig', $aVars);
-		} catch (Exception $e) {
-			$this->DisplayForgotPwdForm(true, $e->getMessage());
+		} catch (ForgotPasswordApplicationException $e) {
+			IssueLog::Error('Failed to process the forgot password request for user "'.$sAuthUser.'" [reason='.get_class($e).']: '.$e->getMessage());
+		} catch (ForgotPasswordUserInputException $e) {
+			IssueLog::Info('Failed to process the forgot password request for user "'.$sAuthUser.'" [reason='.get_class($e).']: '.$e->getMessage());
+		} catch (\Throwable $e) {
+			IssueLog::Error('Unexpected error while processing the forgot password request for user "'.$sAuthUser.'": '.$e->getMessage());
 		}
+
+		$oTwigContext = new LoginTwigRenderer();
+		$aVars = $oTwigContext->GetDefaultVars();
+		$oTwigContext->Render($this, 'forgotpwdsent.html.twig', $aVars);
 	}
 
 	public function DisplayResetPwdForm($sErrorMessage = null)
@@ -365,16 +369,7 @@ class LoginWebPage extends NiceWebPage
 	public static function ResetSession()
 	{
 		// Unset all of the session variables.
-		Session::Unset('auth_user');
-		Session::Unset('login_state');
-		Session::Unset('can_logoff');
-		Session::Unset('archive_mode');
-		Session::Unset('impersonate_user');
-		Session::Unset('PluginProperties');
-		Session::Unset('UrlMakerClass');
-		Session::Unset('itop_env');
-		Session::Unset('obj_messages');
-		Session::Unset('profile_list');
+		Session::UnsetAll();
 		UserRights::_ResetSessionCache();
 		// If it's desired to kill the session, also delete the session cookie.
 		// Note: This will destroy the session, and not just the session data!

application/menunode.class.inc.php

@@ -1423,12 +1423,21 @@ class ShortcutMenuNode extends MenuNode
 	public function GetHyperlink($aExtraParams)
 	{
 		$sContext = $this->oShortcut->Get('context');
-		$aContext = unserialize($sContext);
-		if (isset($aContext['menu'])) {
-			unset($aContext['menu']);
-		}
-		foreach ($aContext as $sArgName => $sArgValue) {
-			$aExtraParams[$sArgName] = $sArgValue;
+		try {
+			$aContext = utils::Unserialize($sContext);
+			if (isset($aContext['menu'])) {
+				unset($aContext['menu']);
+			}
+			foreach ($aContext as $sArgName => $sArgValue) {
+				$aExtraParams[$sArgName] = $sArgValue;
+			}
+		} catch (Exception $e) {
+			IssueLog::Warning("User shortcut corrupted, delete the shortcut", LogChannels::CONSOLE, [
+				'shortcut_name' => $this->oShortcut->GetName(),
+				'root_cause' => $e->getMessage(),
+			]);
+			// delete the shortcut
+			$this->oShortcut->DBDelete();
 		}
 		return parent::GetHyperlink($aExtraParams);
 	}

application/newsroomprovider.class.inc.php

@@ -34,7 +34,7 @@ interface iNewsroomProvider
 	 * @param User $oUser The user for who to check if the provider is applicable.
 	 * return bool
 	 */
-	public function IsApplicable(User $oUser = null);
+	public function IsApplicable(?User $oUser = null);
 
 	/**
 	 * The human readable (localized) label for this provider
@@ -139,7 +139,7 @@ abstract class NewsroomProviderBase implements iNewsroomProvider
 	 */
 	abstract public function GetViewAllURL();
 
-	public function IsApplicable(User $oUser = null)
+	public function IsApplicable(?User $oUser = null)
 	{
 		return false;
 	}

application/query.class.inc.php

@@ -113,17 +113,43 @@ abstract class Query extends cmdbAbstractObject
 			]
 		));
 
+		MetaModel::Init_AddAttribute(new AttributeExternalKey(
+			"owner_id",
+			[
+				"targetclass" => 'Contact',
+				"allowed_values" => null,
+				"sql" => 'owner_id',
+				"is_null_allowed" => true,
+				"depends_on" => [],
+				"display_style" => 'select',
+				"always_load_in_tables" => false,
+				"on_target_delete" => DEL_AUTO,
+			]
+		));
+
+		MetaModel::Init_AddAttribute(new AttributeEnumSet(
+			"usages",
+			[
+				"allowed_values" => null,
+				"possible_values" => new ValueSetEnumPadded("export,reference,notif,draft,dashlet"),
+				"sql" => "usages",
+				"depends_on" => [],
+				"is_null_allowed" => true,
+				"max_items" => 12,
+			]
+		));
+
 		// Display lists
 		MetaModel::Init_SetZListItems(
 			'details',
-			['name', 'is_template', 'description']
+			['name', 'is_template', 'owner_id', 'usages', 'description']
 		); // Attributes to be displayed for the complete details
-		MetaModel::Init_SetZListItems('list', ['description']); // Attributes to be displayed for a list
+		MetaModel::Init_SetZListItems('list', ['description', 'usages']); // Attributes to be displayed for a list
 		// Search criteria
 		MetaModel::Init_SetZListItems('standard_search', ['name', 'description', 'is_template']); // Criteria of the std search form
 		MetaModel::Init_SetZListItems(
 			'default_search',
-			['name', 'description', 'is_template']
+			['name', 'description', 'is_template', 'owner_id', 'usages']
 		); // Criteria of the default search form
 		// MetaModel::Init_SetZListItems('advanced_search', array('name')); // Criteria of the advanced search form
 	}
@@ -143,6 +169,15 @@ abstract class Query extends cmdbAbstractObject
 		return parent::GetAttributeFlags($sAttCode, $aReasons, $sTargetState);
 	}
 
+	public function GetInitialStateAttributeFlags($sAttCode, &$aReasons = [])
+	{
+		// read only attribute
+		if (in_array($sAttCode, ['export_count', 'export_last_date', 'export_last_user_id'])) {
+			return OPT_ATT_READONLY;
+		}
+		return parent::GetInitialStateAttributeFlags($sAttCode, $aReasons);
+	}
+
 	/**
 	 * Return export url.
 	 *
@@ -151,7 +186,7 @@ abstract class Query extends cmdbAbstractObject
 	 * @return string|null
 	 * @since 3.1.0
 	 */
-	abstract public function GetExportUrl(array $aValues = null): ?string;
+	abstract public function GetExportUrl(?array $aValues = null): ?string;
 
 	/**
 	 * Update last export information.
@@ -214,20 +249,20 @@ class QueryOQL extends Query
 		MetaModel::Init_SetZListItems(
 			'details',
 			[
-				'col:col1' => ['fieldset:Query:baseinfo' => ['name', 'is_template', 'description', 'oql', 'fields']],
+				'col:col1' => ['fieldset:Query:baseinfo' => ['name', 'is_template', 'owner_id', 'usages', 'description', 'oql', 'fields']],
 				'col:col2' => ['fieldset:Query:exportInfo' => ['export_count', 'export_last_date', 'export_last_user_id', 'export_last_user_contact']],
 			]
 		); // Attributes to be displayed for the complete details
-		MetaModel::Init_SetZListItems('list', ['description']); // Attributes to be displayed for a list
+		MetaModel::Init_SetZListItems('list', ['description', 'usages']); // Attributes to be displayed for a list
 		// Search criteria
 		MetaModel::Init_SetZListItems(
 			'standard_search',
-			['name', 'description', 'is_template', 'fields', 'oql']
+			['name', 'description', 'is_template', 'owner_id', 'usages', 'oql']
 		); // Criteria of the std search form
 	}
 
 	/** @inheritdoc */
-	public function GetExportUrl(array $aValues = null): ?string
+	public function GetExportUrl(?array $aValues = null): ?string
 	{
 		try {
 			// retrieve attributes

application/startup.inc.php

@@ -17,6 +17,7 @@
 //   You should have received a copy of the GNU Affero General Public License
 //   along with iTop. If not, see <http://www.gnu.org/licenses/>
 use Combodo\iTop\Application\Helper\Session;
+use Combodo\iTop\Service\Startup\StartupService;
 
 require_once(APPROOT.'core/cmdbobject.class.inc.php');
 require_once(APPROOT.'application/utils.inc.php');
@@ -69,26 +70,7 @@ $oKPI->ComputeAndReport("Session Start");
 
 $sSwitchEnv = utils::ReadParam('switch_env', null);
 $bAllowCache = true;
-if (($sSwitchEnv != null) && file_exists(APPCONF.$sSwitchEnv.'/'.ITOP_CONFIG_FILE) && (Session::Get('itop_env') !== $sSwitchEnv)) {
-	Session::Set('itop_env', $sSwitchEnv);
-	$sEnv = $sSwitchEnv;
-	$bAllowCache = false;
-	// Reset the opcache since otherwise the PHP "model" files may still be cached !!
-	if (function_exists('opcache_reset')) {
-		// Zend opcode cache
-		opcache_reset();
-	}
-	if (function_exists('apc_clear_cache')) {
-		// APC(u) cache
-		apc_clear_cache();
-	}
-	// TODO: reset the credentials as well ??
-} elseif (Session::IsSet('itop_env')) {
-	$sEnv = Session::Get('itop_env');
-} else {
-	$sEnv = ITOP_DEFAULT_ENV;
-	Session::Set('itop_env', ITOP_DEFAULT_ENV);
-}
+$sEnv = (new StartupService())->SetItopEnvironment($sSwitchEnv, $bAllowCache);
 $sConfigFile = APPCONF.$sEnv.'/'.ITOP_CONFIG_FILE;
 try {
 	MetaModel::Startup($sConfigFile, false /* $bModelOnly */, $bAllowCache, false /* $bTraceSourceFiles */, $sEnv);

application/themehandler.class.inc.php

@@ -924,11 +924,6 @@ CSS;
 	public static function CloneThemeParameterAndIncludeVersion($aThemeParameters, $bSetupCompilationTimestamp, $aImportsPaths)
 	{
 		$aThemeParametersVariable = [];
-		if (array_key_exists('variables', $aThemeParameters)) {
-			if (is_array($aThemeParameters['variables'])) {
-				$aThemeParametersVariable = array_merge([], $aThemeParameters['variables']);
-			}
-		}
 
 		if (array_key_exists('variable_imports', $aThemeParameters)) {
 			if (is_array($aThemeParameters['variable_imports'])) {
@@ -936,6 +931,14 @@ CSS;
 			}
 		}
 
+		// Variables defined in theme XML have the priority over variables defined in XML imports files
+		// They're defined after so they overwrite previous parameters
+		if (array_key_exists('variables', $aThemeParameters)) {
+			if (is_array($aThemeParameters['variables'])) {
+				$aThemeParametersVariable = array_merge($aThemeParametersVariable, $aThemeParameters['variables']);
+			}
+		}
+
 		$aThemeParametersVariable['$version'] = $bSetupCompilationTimestamp;
 		return $aThemeParametersVariable;
 	}
@@ -967,7 +970,9 @@ CSS;
 				}
 			}
 		}
-		array_map(function ($sVariableValue) { return ltrim($sVariableValue); }, $aVariablesResults);
+		array_map(function ($sVariableValue) {
+			return ltrim($sVariableValue);
+		}, $aVariablesResults);
 		return $aVariablesResults;
 	}
 

application/ui.linksdirectwidget.class.inc.php

@@ -228,7 +228,7 @@ JS
 			<<<HTML
 <form id="ObjectsAddForm_{$this->sInputid}">
     <div id="SearchResultsToAdd_{$this->sInputid}">
-        <div style="background: #fff; border:0; text-align:center; vertical-align:middle;"><p>{$sEmptyList}</p></div>
+        <div style="border:0; text-align:center; vertical-align:middle;"><p>{$sEmptyList}</p></div>
     </div>
     <input type="hidden" id="count_{$this->sInputid}" value="0"/>
 </form>

application/ui.searchformforeignkeys.class.inc.php

@@ -27,6 +27,9 @@ require_once(APPROOT.'/application/displayblock.class.inc.php');
 
 class UISearchFormForeignKeys
 {
+	private $m_sRemoteClass;
+	private $m_iInputId;
+
 	public function __construct($sTargetClass, $iInputId = null)
 	{
 		$this->m_sRemoteClass = $sTargetClass;
@@ -40,7 +43,7 @@ class UISearchFormForeignKeys
 	 *
 	 * @throws \Exception
 	 */
-	public function ShowModalSearchForeignKeys($oPage, $sTitle)
+	public function ShowModalSearchForeignKeys($oPage)
 	{
 
 		$oFilter = new DBObjectSearch($this->m_sRemoteClass);
@@ -60,52 +63,17 @@ class UISearchFormForeignKeys
 			]
 		));
 		$sEmptyList = Dict::S('UI:Message:EmptyList:UseSearchForm');
-		$sCancel = Dict::S('UI:Button:Cancel');
-		$sAdd = Dict::S('UI:Button:Add');
 
 		$oPage->add(
 			<<<HTML
 <form id="ObjectsAddForm_{$this->m_iInputId}">
     <div id="SearchResultsToAdd_{$this->m_iInputId}" style="vertical-align:top;height:100%;overflow:auto;padding:0;border:0;">
-        <div style="background: #fff; border:0; text-align:center; vertical-align:middle;"><p>{$sEmptyList}</p></div>
+        <div style="border:0; text-align:center; vertical-align:middle;"><p>{$sEmptyList}</p></div>
     </div>
     <input type="hidden" id="count_{$this->m_iInputId}" value="0"/>
 </form>
 HTML
 		);
-
-		$oPage->add_ready_script(
-			<<<JS
- $('#dlg_{$this->m_iInputId}').dialog({ 
- 			width: $(window).width()*0.8, 
- 			height: $(window).height()*0.8, 
- 			autoOpen: false, 
- 			modal: true, 
- 			resizeStop: oForeignKeysWidget{$this->m_iInputId}.UpdateSizes,
-            buttons: [
-				{
-					text: Dict.S('UI:Button:Cancel'),
-					class: "cancel ibo-is-alternative ibo-is-neutral",
-					click: function() {
-						$('#dlg_{$this->m_iInputId}').dialog('close');
-					}
-				},
-				{
-					text:  Dict.S('UI:Button:Add'),
-					id: 'btn_ok_{$this->m_iInputId}',
-					class: "ok ibo-is-regular ibo-is-primary",
-					click: function() {
-						oForeignKeysWidget{$this->m_iInputId}.DoAddObjects(this.id);							
-					}
-				},
-			],
-
- });
-$('#dlg_{$this->m_iInputId}').dialog('option', {title:'$sTitle'});
-$('#SearchFormToAdd_{$this->m_iInputId} form').on('submit.uilinksWizard', oForeignKeysWidget{$this->m_iInputId}.SearchObjectsToAdd);
-$('#SearchFormToAdd_{$this->m_iInputId}').on('resize', oForeignKeysWidget{$this->m_iInputId}.UpdateSizes);
-JS
-		);
 	}
 
 	public function GetFullListForeignKeysFromSelection($oPage, $oFullSetFilter)
@@ -119,31 +87,4 @@ JS
 			IssueLog::Error($e->getMessage()."\nDebug trace:\n".$e->getTraceAsString());
 		}
 	}
-
-	/**
-	 * Search for objects to be linked to the current object (i.e "remote" objects)
-	 *
-	 * @param WebPage $oP The page used for the output (usually an AjaxWebPage)
-	 * @param string $sRemoteClass Name of the "remote" class to perform the search on, must be a derived class of m_sRemoteClass
-	 *
-	 * @throws \Exception
-	 */
-	public function ListResultsSearchForeignKeys(WebPage $oP, $sRemoteClass = '')
-	{
-		if ($sRemoteClass != '') {
-			// assert(MetaModel::IsParentClass($this->m_sRemoteClass, $sRemoteClass));
-			$oFilter = new DBObjectSearch($sRemoteClass);
-		} else {
-			// No remote class specified use the one defined in the linkedset
-			$oFilter = new DBObjectSearch($this->m_sRemoteClass);
-		}
-
-		$oBlock = new DisplayBlock($oFilter, 'list', false);
-		$oBlock->Display(
-			$oP,
-			"ResultsToAdd_{$this->m_iInputId}",
-			['menu' => false, 'cssCount' => "#count_{$this->m_iInputId}", 'selection_mode' => true, 'table_id' => "add_{$this->m_iInputId}"]
-		);
-	}
-
 }

application/utils.inc.php

@@ -122,6 +122,11 @@ class utils
 	 * @since 3.0.0
 	 */
 	public const ENUM_SANITIZATION_FILTER_VARIABLE_NAME = 'variable_name';
+	/**
+	 * @var string For module codes (e.g. `itop-portal-base`, `combodo-webhook-integration`, `some-module-code-x.y`, ...)
+	 * @since 3.2.3 3.3.0 N°8554
+	 */
+	public const ENUM_SANITIZATION_FILTER_MODULE_CODE = 'module_code';
 	/**
 	 * @var string
 	 * @since 2.7.10 3.0.0
@@ -181,6 +186,9 @@ class utils
 
 	protected static function LoadParamFile($sParamFile)
 	{
+		if (utils::RealPath($sParamFile, APPROOT) !== false) {
+			throw new Exception("File '".utils::HtmlEntities($sParamFile)."' should be outside iTop");
+		}
 		if (!file_exists($sParamFile)) {
 			throw new Exception("Could not find the parameter file: '".utils::HtmlEntities($sParamFile)."'");
 		}
@@ -276,9 +284,7 @@ class utils
 		}
 		// Read and record the value for switching the archive mode
 		$iCurrent = self::ReadParam('with-archive', $iDefault);
-		if (Session::IsInitialized()) {
-			Session::Set('archive_mode', $iCurrent);
-		}
+		Session::Set('archive_mode', $iCurrent);
 		// Read and use the value for the current page (web services)
 		$iCurrent = self::ReadParam('with_archive', $iCurrent, true);
 		self::$bPageMode = ($iCurrent == 1);
@@ -390,6 +396,7 @@ class utils
 	 * @since 2.7.10 N°6606 use the utils::ENUM_SANITIZATION_* const
 	 * @since 2.7.10 N°6606 new case for ENUM_SANITIZATION_FILTER_PHP_CLASS
 	 * @since 3.2.1-1 N°8242 Allow value to be an array for every filter
+	 * @since 3.2.3 3.3.0 N°8554 new case for ENUM_SANITIZATION_FILTER_MODULE_CODE
 	 *
 	 * @link https://www.php.net/manual/en/filter.filters.sanitize.php PHP sanitization filters
 	 */
@@ -477,7 +484,7 @@ class utils
 				);
 				break;
 
-				// For XML / HTML node id selector
+				// For XML / HTML node selector
 			case static::ENUM_SANITIZATION_FILTER_ELEMENT_SELECTOR:
 				$retValue = filter_var(
 					$value,
@@ -490,6 +497,15 @@ class utils
 				$retValue = preg_replace('/[^a-zA-Z0-9_]/', '', $value);
 				break;
 
+			case static::ENUM_SANITIZATION_FILTER_MODULE_CODE:
+				// Module codes allow all alphabets letters, numbers, dash and dot characters
+				$retValue = filter_var(
+					$value,
+					FILTER_VALIDATE_REGEXP,
+					['options' => ['regexp' => '/^[\p{L}\d.-]+$/u']]
+				);
+				break;
+
 				// For URL
 			case static::ENUM_SANITIZATION_FILTER_URL:
 				$retValue = filter_var($value, FILTER_SANITIZE_URL);
@@ -958,7 +974,7 @@ class utils
 			return self::$oConfig;
 		}
 
-		$sProductionEnvConfigPath = self::GetConfigFilePath('production');
+		$sProductionEnvConfigPath = self::GetConfigFilePath(ITOP_DEFAULT_ENV);
 		if (file_exists($sProductionEnvConfigPath)) {
 			$oProductionEnvDiskConfig = new Config($sProductionEnvConfigPath);
 			self::SetConfig($oProductionEnvDiskConfig);
@@ -1284,7 +1300,7 @@ class utils
 	 * @throws \CoreException
 	 * @throws \Exception
 	 */
-	public static function ExecITopScript(string $sScriptName, array $aArguments, string $sAuthUser = null, string $sAuthPwd = null)
+	public static function ExecITopScript(string $sScriptName, array $aArguments, ?string $sAuthUser = null, ?string $sAuthPwd = null)
 	{
 		$aDisabled = explode(', ', ini_get('disable_functions'));
 		if (in_array('exec', $aDisabled)) {
@@ -1374,7 +1390,7 @@ class utils
 	 * @return string A path to a folder into which any module can store cache data
 	 * The corresponding folder is created or cleaned upon code compilation
 	 */
-	public static function GetCachePath(string $sEnvironment = null): string
+	public static function GetCachePath(?string $sEnvironment = null): string
 	{
 		if (is_null($sEnvironment)) {
 			$sEnvironment = MetaModel::GetEnvironment();
@@ -1437,6 +1453,12 @@ class utils
 
 			case iPopupMenuExtension::MENU_OBJLIST_TOOLKIT:
 				/** @var \DBObjectSet $param */
+
+				// Check if the user has the right to read the objects of this list, otherwise do not propose any action (eg. configure this list, export, etc.)
+				if (UserRights::IsActionAllowed($param->GetFilter()->GetClass(), UR_ACTION_READ, $param) !== UR_ALLOWED_YES) {
+					break;
+				}
+
 				$oAppContext = new ApplicationContext();
 				$sContext = $oAppContext->GetForLink(true);
 				$sDataTableId = is_null($sDataTableId) ? '' : $sDataTableId;
@@ -1895,7 +1917,9 @@ SQL;
 				$aResponseHeaders[$sName] = $sValue;
 			}
 		}
-		curl_close($ch);
+		if (PHP_VERSION_ID < 80000) {
+			curl_close($ch);
+		}
 
 		return $response;
 	}
@@ -2081,7 +2105,9 @@ SQL;
 			}
 
 			// Remove any remaining nulls (for positions that weren't referenced)
-			$aReplacements = array_filter($aReplacements, static function ($val) { return $val !== null; });
+			$aReplacements = array_filter($aReplacements, static function ($val) {
+				return $val !== null;
+			});
 		} else {
 			// For non-positional, we need to map each position
 			$aReplacements = [];
@@ -3120,4 +3146,76 @@ TXT
 
 		return $aTrace;
 	}
+
+	/**
+	 * PHP unserialize encapsulation, allow throwing exception when not allowed object class is detected (for security hardening)
+	 *
+	 * @param string $data data to unserialize
+	 * @param array $aOptions PHP @unserialise options
+	 * @param bool $bThrowNotAllowedObjectClassException flag to throw exception
+	 *
+	 * @return mixed PHP @unserialise return
+	 * @throws Exception
+	 */
+	public static function Unserialize(string $data, array $aOptions = ['allowed_classes' => false], bool $bThrowNotAllowedObjectClassException = true): mixed
+	{
+		$data = unserialize($data, $aOptions);
+
+		if ($bThrowNotAllowedObjectClassException) {
+			try {
+				self::AssertNoIncompleteClassDetected($data);
+			} catch (Exception $e) {
+				throw new CoreException('Unserialization failed because an incomplete class was detected.', [], '', $e);
+			}
+		}
+
+		return $data;
+	}
+
+	/**
+	 * Assert that data provided doesn't contain any incomplete class.
+	 *
+	 * @throws Exception
+	 */
+	public static function AssertNoIncompleteClassDetected(mixed $data): void
+	{
+		if (is_object($data)) {
+			if ($data instanceof __PHP_Incomplete_Class) {
+				throw new Exception('__PHP_Incomplete_Class_Name object detected');
+			}
+			foreach (get_object_vars($data) as $property) {
+				self::AssertNoIncompleteClassDetected($property);
+			}
+		} elseif (is_array($data)) {
+			foreach ($data as $value) {
+				self::AssertNoIncompleteClassDetected($value);
+			}
+		}
+	}
+
+	/**
+	 * Read memory limit from the php.ini file
+	 *
+	 * @return int Memory limit in bytes
+	 */
+	public static function GetMemoryLimit(): int
+	{
+		$sLimit = ini_get('memory_limit');
+		if ($sLimit == '-1') {
+			return 128 * 1048576;
+		}
+		switch (substr($sLimit, -1)) {
+			case 'M':
+			case 'm':
+				return (int)$sLimit * 1048576;
+			case 'K':
+			case 'k':
+				return (int)$sLimit * 1024;
+			case 'G':
+			case 'g':
+				return (int)$sLimit * 1073741824;
+			default:
+				return (int)$sLimit;
+		}
+	}
 }

composer.json

@@ -4,7 +4,7 @@
   "type": "project",
   "license": "AGPL-3.0-only",
   "require": {
-    "php": ">=8.1.0 <8.4.0",
+    "php": ">=8.2.0 <8.5.0",
     "ext-ctype": "*",
     "ext-dom": "*",
     "ext-gd": "*",
@@ -12,38 +12,50 @@
     "ext-json": "*",
     "ext-mysqli": "*",
     "ext-soap": "*",
-    "apereo/phpcas": "~1.6.0",
-    "firebase/php-jwt": "^6.4.0",
+    "apereo/phpcas": "dev-master",
     "guzzlehttp/guzzle": "^7.5.1",
     "league/oauth2-google": "^4.0.1",
     "nikic/php-parser": "dev-master",
     "pear/archive_tar": "~1.4.14",
     "pelago/emogrifier": "^7.2.0",
     "psr/log": "^3.0.0",
-    "scssphp/scssphp": "^1.12.1",
-    "soundasleep/html2text": "~2.1",
+    "scssphp/scssphp": "dev-combodo/1.x",
     "symfony/console": "~6.4.0",
     "symfony/dotenv": "~6.4.0",
     "symfony/form": "^6.4",
     "symfony/framework-bundle": "~6.4.0",
     "symfony/http-foundation": "~6.4.0",
     "symfony/http-kernel": "~6.4.0",
-    "symfony/mailer": "^6.4",
-    "symfony/security-csrf": "^6.4",
+    "symfony/runtime": "~6.4.0",
+    "symfony/security-csrf": "~6.4.0",
     "symfony/twig-bundle": "~6.4.0",
-    "symfony/validator" : "^6.4",
+    "symfony/validator" : "~6.4.0",
+    "symfony/var-dumper": "~6.4.0",
     "symfony/yaml": "~6.4.0",
+    "symfony/mailer": "~6.4.0",
     "tecnickcom/tcpdf": "^6.6.0",
-    "thenetworg/oauth2-azure": "^2.0"
+    "thenetworg/oauth2-azure": "^2.0",
+    "soundasleep/html2text": "~2.1"
   },
   "require-dev": {
+    "symfony/debug-bundle": "~6.4.0",
     "symfony/stopwatch": "~6.4.0",
     "symfony/web-profiler-bundle": "~6.4.0"
   },
-  "repositories": [{
-    "type": "vcs",
-    "url": "https://github.com/Combodo/PHP-Parser"
-  }],
+  "repositories": [
+    {
+      "type": "vcs",
+      "url": "https://github.com/Combodo/PHP-Parser"
+    },
+    {
+      "type": "vcs",
+      "url": "https://github.com/EsupPortail/phpCAS"
+    },
+    {
+      "type": "vcs",
+      "url": "https://github.com/combodo-itop-libs/scssphp"
+    }
+  ],
   "suggest": {
     "ext-libsodium": "Required to use the AttributeEncryptedString.",
     "ext-openssl": "Can be used as a polyfill if libsodium is not installed",
@@ -55,7 +67,7 @@
   },
   "config": {
     "platform": {
-      "php": "8.1.0"
+      "php": "8.2.0"
     },
     "vendor-dir": "lib",
     "preferred-install": {
@@ -63,7 +75,10 @@
     },
     "sort-packages": true,
     "classmap-authoritative": true,
-    "platform-check": true
+    "platform-check": true,
+    "allow-plugins": {
+      "symfony/runtime": true
+    }
   },
   "autoload": {
     "classmap": [

core/action.class.inc.php

@@ -234,10 +234,11 @@ abstract class Action extends cmdbAbstractObject
 		}
 
 		$oActionFilter = DBObjectSearch::FromOQL($sActionQueryOql, $aActionQueryParams);
+		$oActionFilter->AllowAllData();
 		$oSet = new DBObjectSet($oActionFilter, ['date' => false]);
 
 		$sPanelTitle = Dict::Format('Action:last_executions_tab_panel_title', $sActionQueryLimit);
-		$oExecutionsListBlock = DataTableUIBlockFactory::MakeForResult($oPage, 'action_executions_list', $oSet, ['panel_title' => $sPanelTitle]);
+		$oExecutionsListBlock = DataTableUIBlockFactory::MakeForResult($oPage, 'action_executions_list', $oSet, ['panel_title' => $sPanelTitle, 'display_unauthorized_objects' => true]);
 
 		$oPage->AddUiBlock($oExecutionsListBlock);
 	}

core/autoload.php

@@ -24,7 +24,7 @@ MetaModel::IncludeModule('application/user.dashboard.class.inc.php');
 MetaModel::IncludeModule('application/audit.rule.class.inc.php');
 MetaModel::IncludeModule('application/audit.domain.class.inc.php');
 MetaModel::IncludeModule('application/query.class.inc.php');
-MetaModel::IncludeModule('setup/moduleinstallation.class.inc.php');
+MetaModel::IncludeModule('setup/moduleinstallation/moduleinstallation.class.inc.php');
 
 MetaModel::IncludeModule('core/event.class.inc.php');
 MetaModel::IncludeModule('core/action.class.inc.php');

core/bulkchange.class.inc.php

@@ -199,7 +199,7 @@ class CellStatus_SearchIssue extends CellStatus_Issue
 	 * @param null $sAllowedValues : used for additional message that provides allowed values $sAllowedValues for current class
 	 * @param string|null $sAllowedValuesSearch : used to search all allowed values
 	 */
-	public function __construct($sSerializedSearch, $sReason, $sClass = null, $sAllowedValues = null, string $sAllowedValuesSearch = null)
+	public function __construct($sSerializedSearch, $sReason, $sClass = null, $sAllowedValues = null, ?string $sAllowedValuesSearch = null)
 	{
 		parent::__construct(null, null, $sReason);
 		$this->sSerializedSearch = $sSerializedSearch;
@@ -876,7 +876,7 @@ class BulkChange
 		return $aResults;
 	}
 
-	protected function CreateObject(&$aResult, $iRow, $aRowData, CMDBChange $oChange = null)
+	protected function CreateObject(&$aResult, $iRow, $aRowData, ?CMDBChange $oChange = null)
 	{
 		$oTargetObj = MetaModel::NewObject($this->m_sClass);
 
@@ -965,7 +965,7 @@ class BulkChange
 	 * @throws \MySQLException
 	 * @throws \MySQLHasGoneAwayException
 	 */
-	protected function UpdateObject(&$aResult, $iRow, $oTargetObj, $aRowData, CMDBChange $oChange = null)
+	protected function UpdateObject(&$aResult, $iRow, $oTargetObj, $aRowData, ?CMDBChange $oChange = null)
 	{
 		$aResult[$iRow] = $this->PrepareObject($oTargetObj, $aRowData, $aErrors);
 
@@ -1008,7 +1008,7 @@ class BulkChange
 	 *
 	 * @throws \BulkChangeException
 	 */
-	protected function UpdateMissingObject(&$aResult, $iRow, $oTargetObj, CMDBChange $oChange = null)
+	protected function UpdateMissingObject(&$aResult, $iRow, $oTargetObj, ?CMDBChange $oChange = null)
 	{
 		$aResult[$iRow] = $this->PrepareMissingObject($oTargetObj, $aErrors);
 
@@ -1043,7 +1043,7 @@ class BulkChange
 		}
 	}
 
-	public function Process(CMDBChange $oChange = null)
+	public function Process(?CMDBChange $oChange = null)
 	{
 		if ($oChange) {
 			CMDBObject::SetCurrentChange($oChange);

core/cmdbsource.class.inc.php

@@ -916,7 +916,9 @@ class CMDBSource
 		$aColumn = [];
 		$aData = self::QueryToArray($sSql);
 		foreach ($aData as $aRow) {
-			@$aColumn[] = $aRow[$col];
+			if ($aRow[$col] !== null) {
+				$aColumn[] = $aRow[$col];
+			}
 		}
 		return $aColumn;
 	}

core/config.class.inc.php

@@ -20,9 +20,6 @@
  *
  */
 
-use Combodo\iTop\Config\Validator\iTopConfigAstValidator;
-use Combodo\iTop\Config\Validator\iTopConfigSyntaxValidator;
-
 define('ITOP_APPLICATION', 'iTop');
 define('ITOP_APPLICATION_SHORT', 'iTop');
 
@@ -78,6 +75,7 @@ define('DEFAULT_EXT_AUTH_VARIABLE', '$_SERVER[\'REMOTE_USER\']');
 define('DEFAULT_ENCRYPTION_KEY', '@iT0pEncr1pti0n!'); // We'll use a random generated key later (if possible)
 define('DEFAULT_ENCRYPTION_LIB', 'Mcrypt'); // We'll define the best encryption available later
 define('DEFAULT_HASH_ALGO', PASSWORD_DEFAULT);
+
 /**
  * Config
  * configuration data (this class cannot not be localized, because it is responsible for loading the dictionaries)
@@ -871,6 +869,14 @@ class Config
 			'source_of_value' => '',
 			'show_in_conf_sample' => false,
 		],
+		'ext_auth_variable' => [
+			'type' => 'string',
+			'description' => 'External authentication expression (allowed: $_SERVER[\'key\'], $_COOKIE[\'key\'], $_REQUEST[\'key\'], getallheaders()[\'Header-Name\'])',
+			'default' => '$_SERVER[\'REMOTE_USER\']',
+			'value' => '$_SERVER[\'REMOTE_USER\']',
+			'source_of_value' => '',
+			'show_in_conf_sample' => false,
+		],
 		'login_debug' => [
 			'type' => 'bool',
 			'description' => 'Activate the login FSM debug',
@@ -928,7 +934,7 @@ class Config
 			'type' => 'string',
 			'description' => 'Actions that are available as direct buttons next to the "Actions" menu',
 			// examples... not used
-			'default' => 'UI:Menu:Modify,UI:Menu:New',
+			'default' => 'UI:Menu:Modify,UI:Menu:New,UI:Menu:impacts_down,UI:Menu:impacts_up',
 			'value' => 'UI:Menu:Modify',
 			'source_of_value' => '',
 			'show_in_conf_sample' => true,
@@ -1173,8 +1179,8 @@ class Config
 		'tracking_level_linked_set_default' => [
 			'type' => 'integer',
 			'description' => 'Default tracking level if not explicitly set at the attribute level, for AttributeLinkedSet (defaults to NONE in case of a fresh install, LIST otherwise - this to preserve backward compatibility while upgrading from a version older than 2.0.3 - see TRAC #936)',
-			'default' => LINKSET_TRACKING_LIST,
-			'value' => LINKSET_TRACKING_LIST,
+			'default' => LINKSET_TRACKING_NONE,
+			'value' => LINKSET_TRACKING_NONE,
 			'source_of_value' => '',
 			'show_in_conf_sample' => false,
 		],
@@ -1613,7 +1619,7 @@ class Config
 			'show_in_conf_sample' => false,
 		],
 		'search_manual_submit' => [
-			'type' => 'array',
+			'type' => 'bool',
 			'description' => 'Force manual submit of search all requests',
 			'default' => false,
 			'value' => true,
@@ -1740,6 +1746,14 @@ class Config
 			'source_of_value' => '',
 			'show_in_conf_sample' => false,
 		],
+		'security.disable_joined_classes_filter' => [
+			'type'                => 'bool',
+			'description'         => 'If true, scope filters aren\'t applied to joined classes or union classes not directly listed in the SELECT clause.',
+			'default'             => true,
+			'value'               => true,
+			'source_of_value'     => '',
+			'show_in_conf_sample' => false,
+		],
 		'security.hide_administrators' => [
 			'type'                => 'bool',
 			'description'         => 'If true, non-administrator users will not be able to see the administrator accounts, the Administrator profile and the links between the administrator accounts and their profiles.',
@@ -1748,6 +1762,14 @@ class Config
 			'source_of_value'     => '',
 			'show_in_conf_sample' => false,
 		],
+		'security.disable_exec_forced_login_for_all_enpoints' => [
+			'type'                => 'bool',
+			'description'         => 'If true, when no delegated authentication module is defined, no login will be forced on modules exec endpoints',
+			'default'             => true,
+			'value'               => true,
+			'source_of_value'     => '',
+			'show_in_conf_sample' => false,
+		],
 		'behind_reverse_proxy' => [
 			'type' => 'bool',
 			'description' => 'If true, then proxies custom header (X-Forwarded-*) are taken into account. Use only if the webserver is not publicly accessible (reachable only by the reverse proxy)',
@@ -1954,16 +1976,6 @@ class Config
 	 */
 	protected $m_sDefaultLanguage;
 
-	/**
-	 * @var string Type of login process allowed: form|basic|url|external
-	 */
-	protected $m_sAllowedLoginTypes;
-
-	/**
-	 * @var string Name of the PHP variable in which external authentication information is passed by the web server
-	 */
-	protected $m_sExtAuthVariable;
-
 	/**
 	 * @var string Encryption key used for all attributes of type "encrypted string". Can be set to a random value
 	 *             unless you want to import a database from another iTop instance, in which case you must use
@@ -2032,8 +2044,6 @@ class Config
 		$this->m_iFastReloadInterval = DEFAULT_FAST_RELOAD_INTERVAL;
 		$this->m_bSecureConnectionRequired = DEFAULT_SECURE_CONNECTION_REQUIRED;
 		$this->m_sDefaultLanguage = 'EN US';
-		$this->m_sAllowedLoginTypes = DEFAULT_ALLOWED_LOGIN_TYPES;
-		$this->m_sExtAuthVariable = DEFAULT_EXT_AUTH_VARIABLE;
 		$this->m_aCharsets = [];
 		$this->m_bQueryCacheEnabled = DEFAULT_QUERY_CACHE_ENABLED;
 		$this->m_iPasswordHashAlgo = DEFAULT_HASH_ALGO;
@@ -2179,8 +2189,6 @@ class Config
 		$this->m_aModuleSettings = isset($MyModuleSettings) ? $MyModuleSettings : [];
 
 		$this->m_sDefaultLanguage = isset($MySettings['default_language']) ? trim($MySettings['default_language']) : 'EN US';
-		$this->m_sAllowedLoginTypes = isset($MySettings['allowed_login_types']) ? trim($MySettings['allowed_login_types']) : DEFAULT_ALLOWED_LOGIN_TYPES;
-		$this->m_sExtAuthVariable = isset($MySettings['ext_auth_variable']) ? trim($MySettings['ext_auth_variable']) : DEFAULT_EXT_AUTH_VARIABLE;
 		$this->m_sEncryptionKey = isset($MySettings['encryption_key']) ? trim($MySettings['encryption_key']) : $this->m_sEncryptionKey;
 		$this->m_sEncryptionLibrary = isset($MySettings['encryption_library']) ? trim($MySettings['encryption_library']) : $this->m_sEncryptionLibrary;
 		$this->m_aCharsets = isset($MySettings['csv_import_charsets']) ? $MySettings['csv_import_charsets'] : [];
@@ -2339,12 +2347,76 @@ class Config
 
 	public function GetAllowedLoginTypes()
 	{
-		return explode('|', $this->m_sAllowedLoginTypes);
+		return explode('|', $this->m_aSettings['allowed_login_types']['value']);
 	}
 
+	/**
+	 * @return bool|mixed
+	 * @since 3.2.3 return the parsed value instead of an unsecured variable name
+	 */
 	public function GetExternalAuthenticationVariable()
 	{
-		return $this->m_sExtAuthVariable;
+		$sExpression = $this->Get('ext_auth_variable');
+		$aParsed = $this->ParseExternalAuthVariableExpression($sExpression);
+		if ($aParsed === null) {
+			return false;
+		}
+
+		$sKey = $aParsed['key'];
+		switch ($aParsed['type']) {
+			case 'server':
+				return $_SERVER[$sKey] ?? false;
+			case 'cookie':
+				return $_COOKIE[$sKey] ?? false;
+			case 'request':
+				return $_REQUEST[$sKey] ?? false;
+			case 'header':
+				if (!function_exists('getallheaders')) {
+					return false;
+				}
+				$aHeaders = getallheaders();
+				if (!is_array($aHeaders)) {
+					return false;
+				}
+				return $aHeaders[$sKey] ?? false;
+		}
+		return false;
+	}
+
+	/**
+	 * @param $sExpression
+	 * @return array|null
+	 */
+	private function ParseExternalAuthVariableExpression($sExpression)
+	{
+		// If it's a configuration parameter it's probably already trimmed, but just in case
+		$sExpression = trim((string) $sExpression);
+		if ($sExpression === '') {
+			return null;
+		}
+
+		// Match $_SERVER/$_COOKIE/$_REQUEST['key'] with optional whitespace and single/double quotes.
+		if (preg_match('/^\$_(SERVER|COOKIE|REQUEST)\s*\[\s*(["\'])\s*([^"\']+)\2\s*\]\s*$/', $sExpression, $aMatches) === 1) {
+			$sContext = strtoupper($aMatches[1]);
+			$sKey = $aMatches[3];
+			return [
+				'type' => strtolower($sContext),
+				'key' => $sKey,
+				'normalized' => '$_'.$sContext.'[\''.$sKey.'\']',
+			];
+		}
+
+		// Match getallheaders()['Header-Name'] in a case-insensitive way.
+		if (preg_match('/^getallheaders\(\)\s*\[\s*(["\'])\s*([^"\']+)\1\s*\]\s*$/i', $sExpression, $aMatches) === 1) {
+			$sKey = $aMatches[2];
+			return [
+				'type' => 'header',
+				'key' => $sKey,
+				'normalized' => 'getallheaders()[\''.$sKey.'\']',
+			];
+		}
+
+		return null;
 	}
 
 	public function GetCSVImportCharsets()
@@ -2417,7 +2489,6 @@ class Config
 
 	public function SetAllowedLoginTypes($aAllowedLoginTypes)
 	{
-		$this->m_sAllowedLoginTypes = implode('|', $aAllowedLoginTypes);
 		$this->Set('allowed_login_types', implode('|', $aAllowedLoginTypes));
 	}
 
@@ -2441,7 +2512,7 @@ class Config
 
 	public function SetExternalAuthenticationVariable($sExtAuthVariable)
 	{
-		$this->m_sExtAuthVariable = $sExtAuthVariable;
+		$this->Set('ext_auth_variable', $sExtAuthVariable);
 	}
 
 	public function SetEncryptionKey($sKey)
@@ -2495,8 +2566,6 @@ class Config
 		$aSettings['fast_reload_interval'] = $this->m_iFastReloadInterval;
 		$aSettings['secure_connection_required'] = $this->m_bSecureConnectionRequired;
 		$aSettings['default_language'] = $this->m_sDefaultLanguage;
-		$aSettings['allowed_login_types'] = $this->m_sAllowedLoginTypes;
-		$aSettings['ext_auth_variable'] = $this->m_sExtAuthVariable;
 		$aSettings['encryption_key'] = $this->m_sEncryptionKey;
 		$aSettings['encryption_library'] = $this->m_sEncryptionLibrary;
 		$aSettings['csv_import_charsets'] = $this->m_aCharsets;
@@ -2599,8 +2668,6 @@ class Config
 			// Old fashioned remaining values
 			$aOtherValues = [
 				'default_language' => $this->m_sDefaultLanguage,
-				'allowed_login_types' => $this->m_sAllowedLoginTypes,
-				'ext_auth_variable' => $this->m_sExtAuthVariable,
 				'encryption_key' => $this->m_sEncryptionKey,
 				'encryption_library' => $this->m_sEncryptionLibrary,
 				'csv_import_charsets' => $this->m_aCharsets,
@@ -2685,14 +2752,13 @@ class Config
 	 *
 	 * @param array $aParamValues
 	 * @param ?string $sModulesDir
-	 * @param bool $bPreserveModuleSettings
 	 *
 	 * @return void The current object is modified directly
 	 *
 	 * @throws \Exception
 	 * @throws \CoreException
 	 */
-	public function UpdateFromParams($aParamValues, $sModulesDir = null, $bPreserveModuleSettings = false)
+	public function UpdateFromParams($aParamValues, $sModulesDir = null)
 	{
 		if (isset($aParamValues['application_path'])) {
 			$this->Set('app_root_url', $aParamValues['application_path']);
@@ -2740,7 +2806,10 @@ class Config
 		} else {
 			$aSelectedModules = null;
 		}
-		$this->UpdateIncludes($sModulesDir, $aSelectedModules);
+
+		if (! is_null($sModulesDir)) {
+			$this->UpdateIncludes($sModulesDir, $aSelectedModules);
+		}
 
 		if (isset($aParamValues['source_dir'])) {
 			$this->Set('source_dir', $aParamValues['source_dir']);
@@ -2758,17 +2827,13 @@ class Config
 	 *
 	 * @throws Exception
 	 */
-	public function UpdateIncludes($sModulesDir, $aSelectedModules = null)
+	public function UpdateIncludes(string $sModulesDir, $aSelectedModules = null)
 	{
-		if ($sModulesDir === null) {
-			return;
-		}
-
 		// Initialize the arrays below with default values for the application...
 		$oEmptyConfig = new Config('dummy_file', false); // Do NOT load any config file, just set the default values
 		$aAddOns = $oEmptyConfig->GetAddOns();
 
-		$aModules = ModuleDiscovery::GetAvailableModules([APPROOT.$sModulesDir]);
+		$aModules = ModuleDiscovery::GetModulesOrderedByDependencies([APPROOT.$sModulesDir]);
 		foreach ($aModules as $sModuleId => $aModuleInfo) {
 			list($sModuleName, $sModuleVersion) = ModuleDiscovery::GetModuleName($sModuleId);
 			if (is_null($aSelectedModules) || in_array($sModuleName, $aSelectedModules)) {

core/csvbulkexport.class.inc.php

@@ -5,6 +5,7 @@
  * @license     http://opensource.org/licenses/AGPL-3.0
  */
 
+use Combodo\iTop\Application\Helper\ExportHelper;
 use Combodo\iTop\Application\UI\Base\Component\FieldSet\FieldSetUIBlockFactory;
 use Combodo\iTop\Application\UI\Base\Component\Html\Html;
 use Combodo\iTop\Application\UI\Base\Component\Input\InputUIBlockFactory;
@@ -13,7 +14,6 @@ use Combodo\iTop\Application\UI\Base\Component\Input\Select\SelectUIBlockFactory
 use Combodo\iTop\Application\UI\Base\Component\Panel\PanelUIBlockFactory;
 use Combodo\iTop\Application\UI\Base\Layout\MultiColumn\Column\ColumnUIBlockFactory;
 use Combodo\iTop\Application\UI\Base\Layout\MultiColumn\MultiColumnUIBlockFactory;
-use Combodo\iTop\Application\Helper\ExportHelper;
 use Combodo\iTop\Application\WebPage\Page;
 use Combodo\iTop\Application\WebPage\WebPage;
 
@@ -55,6 +55,8 @@ class CSVBulkExport extends TabularBulkExport
 		$this->aStatusInfo['charset'] = strtoupper(utils::ReadParam('charset', 'UTF-8', true, 'raw_data'));
 		$this->aStatusInfo['formatted_text'] = (bool)utils::ReadParam('formatted_text', 0, true);
 
+		$this->aStatusInfo['ignore_excel_sanitization'] = (bool)utils::ReadParam('ignore_excel_sanitization', 0, true, utils::ENUM_SANITIZATION_FILTER_INTEGER);
+
 		$sDateFormatRadio = utils::ReadParam('csv_date_format_radio', '');
 		switch ($sDateFormatRadio) {
 			case 'default':
@@ -223,6 +225,10 @@ class CSVBulkExport extends TabularBulkExport
 				$oRadioCustom->GetInput()->AddCSSClass('ibo-input-checkbox');
 				$oFieldSetDate->AddSubBlock($oRadioCustom);
 
+				$oFieldSetSecurity = FieldSetUIBlockFactory::MakeStandard(Dict::S('Core:BulkExport:Security'));
+				$oMulticolumn->AddColumn(ColumnUIBlockFactory::MakeForBlock($oFieldSetSecurity));
+				$oFieldSetSecurity->AddSubBlock(ExportHelper::GetInputForSanitizeExcelExport());
+
 				$oP->add_ready_script(
 					<<<EOF
 $('#form_part_csv_options').on('preview_updated', function() { FormatDatesInPreview('csv', 'csv'); });
@@ -264,6 +270,13 @@ EOF
 			default:
 				$sRet = trim($oObj->GetAsCSV($sAttCode), '"');
 		}
+
+		// If the option to ignore Excel sanitization is not set or explicitly set to false, apply sanitization
+		if (!(array_key_exists('ignore_excel_sanitization', $this->aStatusInfo)) || $this->aStatusInfo['ignore_excel_sanitization'] === false) {
+			return ExportHelper::SanitizeField($sRet, $this->aStatusInfo['text_qualifier'] ?? '');
+		}
+
+		// The option to ignore Excel sanitization is explicitly set to true: return the raw value without sanitization
 		return $sRet;
 	}
 
@@ -337,6 +350,12 @@ EOF
 							$sField = $oObj->GetAsCSV($sAttCode, $this->aStatusInfo['separator'], $this->aStatusInfo['text_qualifier'], $this->bLocalizeOutput, !$this->aStatusInfo['formatted_text']);
 					}
 				}
+
+				// If the option to ignore Excel sanitization is not set or absent, sanitize the field
+				if (!(array_key_exists('ignore_excel_sanitization', $this->aStatusInfo)) || $this->aStatusInfo['ignore_excel_sanitization'] === false) {
+					$sField = ExportHelper::SanitizeField($sField, $this->aStatusInfo['text_qualifier']);
+				}
+
 				if ($this->aStatusInfo['charset'] != 'UTF-8') {
 					// Note: due to bugs in the glibc library it's safer to call iconv on the smallest possible string
 					// and thus to convert field by field and not the whole row or file at once (see ticket N°991)

core/datamodel.core.xml

@@ -425,7 +425,7 @@
       </php_parent>
       <parent>cmdbAbstractObject</parent>
       <properties>
-        <category>core/cmdb,view_in_gui</category>
+        <category>core/cmdb,grant_by_profile,silo</category>
         <abstract>false</abstract>
         <key_type>autoincrement</key_type>
         <db_table>priv_event_newsroom</db_table>
@@ -904,7 +904,7 @@
         <!-- Generated by toolkit/export-class-to-meta.php -->
         <parent>Event</parent>
         <properties>
-          <category>core/cmdb,view_in_gui</category>
+          <category>core/cmdb,grant_by_profile,silo</category>
         </properties>
         <fields>
           <field id="message" xsi:type="AttributeText"/>

core/dbobject.class.php

@@ -730,13 +730,8 @@ abstract class DBObject implements iDisplay
 	public function SetTrim($sAttCode, $sValue)
 	{
 		$oAttDef = MetaModel::GetAttributeDef(get_class($this), $sAttCode);
-		$iMaxSize = $oAttDef->GetMaxSize();
-		$sLength = mb_strlen($sValue);
-		if ($iMaxSize && ($sLength > $iMaxSize)) {
-			$sMessage = " -truncated ($sLength chars)";
-			$sValue = mb_substr($sValue, 0, $iMaxSize - mb_strlen($sMessage)).$sMessage;
-		}
-		$this->Set($sAttCode, $sValue);
+
+		$this->Set($sAttCode, $oAttDef->TrimValue($sValue));
 	}
 
 	/**
@@ -2038,7 +2033,7 @@ abstract class DBObject implements iDisplay
 				}
 			}
 			if (!is_null($iMaxSize = $oAtt->GetMaxSize())) {
-				$iLen = mb_strlen($toCheck);
+				$iLen = $oAtt->GetSize($toCheck);
 				if ($iLen > $iMaxSize) {
 					return "String too long (found $iLen, limited to $iMaxSize)";
 				}
@@ -2567,7 +2562,7 @@ abstract class DBObject implements iDisplay
 	 *
 	 * @see \RestUtils::FindObjectFromKey for the same check in the REST endpoint
 	 */
-	final public function CheckChangedExtKeysValues(callable $oIsObjectLoadableCallback = null)
+	final public function CheckChangedExtKeysValues(?callable $oIsObjectLoadableCallback = null)
 	{
 		if (is_null($oIsObjectLoadableCallback)) {
 			$oIsObjectLoadableCallback = function ($sClass, $sId) {
@@ -3727,7 +3722,7 @@ abstract class DBObject implements iDisplay
 	 * @throws \MySQLException
 	 * @throws \OQLException
 	 */
-	private function ActivateOnObjectUpdateTriggers(?DBObject $oObject, array $aAttributes = null): void
+	private function ActivateOnObjectUpdateTriggers(?DBObject $oObject, ?array $aAttributes = null): void
 	{
 		if (is_null($oObject)) {
 			return;
@@ -5108,8 +5103,8 @@ abstract class DBObject implements iDisplay
 	protected function GetReferencingObjectsForDeletion($bAllowAllData = false)
 	{
 		$aDependentObjects = [];
-		$aRererencingMe = MetaModel::EnumReferencingClasses(get_class($this));
-		foreach ($aRererencingMe as $sRemoteClass => $aExtKeys) {
+		$aReferencingMe = MetaModel::EnumReferencingClasses(get_class($this));
+		foreach ($aReferencingMe as $sRemoteClass => $aExtKeys) {
 			/** @var \AttributeExternalKey $oExtKeyAttDef */
 			foreach ($aExtKeys as $sExtKeyAttCode => $oExtKeyAttDef) {
 				// skip if external key doesn't require the deletion cascading

core/dbobjectsearch.class.php

@@ -1932,4 +1932,36 @@ class DBObjectSearch extends DBSearch
 	{
 		return $this->GetCriteria()->ListParameters();
 	}
+
+	/**
+	 * @inheritDoc
+	 */
+	protected function ApplyDataFilters(): DBSearch
+	{
+		if ($this->IsAllDataAllowed() || $this->IsDataFiltered()) {
+			return $this;
+		}
+
+		$oSearch = $this;
+		$aClassesToFilter = $this->GetSelectedClasses();
+
+		// Opt-in for joined classes filtering, otherwise only filter the selected class(es)
+		if (MetaModel::GetConfig()->Get('security.disable_joined_classes_filter') === false) {
+			$aClassesToFilter = $this->GetJoinedClasses();
+		}
+
+		// Apply filter (this is similar to the one in DBSearch but the factorization could make it less readable)
+		foreach ($aClassesToFilter as $sClassAlias => $sClass) {
+			$oVisibleObjects = UserRights::GetSelectFilter($sClass, $this->GetModifierProperties('UserRightsGetSelectFilter'));
+			if ($oVisibleObjects === false) {
+				$oVisibleObjects = DBObjectSearch::FromEmptySet($sClass);
+			}
+			if (is_object($oVisibleObjects)) {
+				$oVisibleObjects->AllowAllData();
+				$oSearch = $oSearch->Filter($sClassAlias, $oVisibleObjects);
+				$oSearch->SetDataFiltered();
+			}
+		}
+		return $oSearch;
+	}
 }

core/dbsearch.class.php

@@ -650,7 +650,7 @@ abstract class DBSearch
 	 *
 	 * @throws OQLException
 	 */
-	public static function FromOQL($sQuery, $aParams = null, ModelReflection $oMetaModel = null)
+	public static function FromOQL($sQuery, $aParams = null, ?ModelReflection $oMetaModel = null)
 	{
 		if (empty($sQuery)) {
 			return null;
@@ -1048,21 +1048,7 @@ abstract class DBSearch
 	 */
 	protected function GetSQLQuery($aOrderBy, $aArgs, $aAttToLoad, $aExtendedDataSpec, $iLimitCount, $iLimitStart, $bGetCount, $aGroupByExpr = null, $aSelectExpr = null)
 	{
-		$oSearch = $this;
-		if (!$this->IsAllDataAllowed() && !$this->IsDataFiltered()) {
-			foreach ($this->GetSelectedClasses() as $sClassAlias => $sClass) {
-				$oVisibleObjects = UserRights::GetSelectFilter($sClass, $this->GetModifierProperties('UserRightsGetSelectFilter'));
-				if ($oVisibleObjects === false) {
-					// Make sure this is a valid search object, saying NO for all
-					$oVisibleObjects = DBObjectSearch::FromEmptySet($sClass);
-				}
-				if (is_object($oVisibleObjects)) {
-					$oVisibleObjects->AllowAllData();
-					$oSearch = $oSearch->Filter($sClassAlias, $oVisibleObjects);
-					$oSearch->SetDataFiltered();
-				}
-			}
-		}
+		$oSearch = $this->ApplyDataFilters();
 
 		if (is_array($aGroupByExpr)) {
 			foreach ($aGroupByExpr as $sAlias => $oGroupByExp) {
@@ -1524,4 +1510,33 @@ abstract class DBSearch
 	 * @return array{\VariableExpression}
 	 */
 	abstract public function GetExpectedArguments(): array;
+
+	/**
+	 * Apply data filters to the search, if needed
+	 *
+	 * @return DBSearch
+	 * @throws CoreException
+	 */
+	protected function ApplyDataFilters(): DBSearch
+	{
+		if ($this->IsAllDataAllowed() || $this->IsDataFiltered()) {
+			return $this;
+		}
+
+		$oSearch = $this;
+		$aClassesToFilter = $this->GetSelectedClasses();
+
+		foreach ($aClassesToFilter as $sClassAlias => $sClass) {
+			$oVisibleObjects = UserRights::GetSelectFilter($sClass, $this->GetModifierProperties('UserRightsGetSelectFilter'));
+			if ($oVisibleObjects === false) {
+				$oVisibleObjects = DBObjectSearch::FromEmptySet($sClass);
+			}
+			if (is_object($oVisibleObjects)) {
+				$oVisibleObjects->AllowAllData();
+				$oSearch = $oSearch->Filter($sClassAlias, $oVisibleObjects);
+				$oSearch->SetDataFiltered();
+			}
+		}
+		return $oSearch;
+	}
 }

core/dbunionsearch.class.php

@@ -59,7 +59,7 @@ class DBUnionSearch extends DBSearch
 	public function AllowAllData($bAllowAllData = true)
 	{
 		foreach ($this->aSearches as $oSearch) {
-			$oSearch->AllowAllData();
+			$oSearch->AllowAllData($bAllowAllData);
 		}
 	}
 
@@ -673,4 +673,29 @@ class DBUnionSearch extends DBSearch
 
 		return $aVariableCriteria;
 	}
+
+	/**
+	 * @inheritDoc
+	 */
+	protected function ApplyDataFilters(): DBSearch
+	{
+		if ($this->IsAllDataAllowed() || $this->IsDataFiltered()) {
+			return $this;
+		}
+
+		// Opt-in for joined classes filtering, otherwise fallback on DBSearch filtering
+		if (MetaModel::GetConfig()->Get('security.disable_joined_classes_filter') === true) {
+			return parent::ApplyDataFilters();
+		}
+
+		// Apply filters per sub-search
+		$aFilteredSearches = [];
+		foreach ($this->GetSearches() as $oSubSearch) {
+			// Recursively call ApplyDataFilters on sub-searches
+			$aFilteredSearches[] = $oSubSearch->ApplyDataFilters();
+		}
+
+		$oSearch = new DBUnionSearch($aFilteredSearches);
+		return $oSearch;
+	}
 }

core/designdocument.class.inc.php

@@ -360,10 +360,10 @@ class DesignElement extends \DOMElement
 	 * @param string $sTagName
 	 * @param string|null $sDefault
 	 *
-	 * @return string
+	 * @return null|string
 	 * @throws \DOMFormatException
 	 */
-	public function GetChildText($sTagName, $sDefault = null)
+	public function GetChildText($sTagName, $sDefault = null): ?string
 	{
 		$sRet = $sDefault;
 		if ($oChild = $this->GetOptionalElement($sTagName)) {
@@ -453,7 +453,7 @@ class DesignElement extends \DOMElement
 	 * @throws Exception
 	 * @since 3.1.2 3.2.0 N°6974
 	 */
-	public static function _FindNode(DOMNode $oParent, DesignElement $oRefNode, string $sSearchId = null): ?DesignElement
+	public static function _FindNode(DOMNode $oParent, DesignElement $oRefNode, ?string $sSearchId = null): ?DesignElement
 	{
 		$oNodes = self::_FindNodes($oParent, $oRefNode, $sSearchId);
 		if ($oNodes instanceof DOMNodeList) {
@@ -477,7 +477,7 @@ class DesignElement extends \DOMElement
 	 * @return \DOMNodeList|false|mixed
 	 * @since 3.1.2 3.2.0 N°6974
 	 */
-	public static function _FindNodes(DOMNode $oParent, DesignElement $oRefNode, string $sSearchId = null)
+	public static function _FindNodes(DOMNode $oParent, DesignElement $oRefNode, ?string $sSearchId = null)
 	{
 		if ($oParent instanceof DOMDocument) {
 			$oDoc = $oParent->firstChild->ownerDocument;

core/displayablegraph.class.inc.php

@@ -632,7 +632,7 @@ class DisplayableGroupNode extends DisplayableNode
 		$this->aObjects = [];
 	}
 
-	public function AddObject(DBObject $oObj = null)
+	public function AddObject(?DBObject $oObj = null)
 	{
 		if (is_object($oObj)) {
 			$sPrevClass = $this->GetObjectClass();

core/event.class.inc.php

@@ -26,7 +26,7 @@ class Event extends DBObject implements iDisplay
 	{
 		$aParams =
 		[
-			"category" => "core/cmdb,view_in_gui",
+			"category" => "core/cmdb,grant_by_profile,silo",
 			"key_type" => "autoincrement",
 			"name_attcode" => "",
 			"state_attcode" => "",
@@ -120,7 +120,7 @@ class EventNotification extends Event
 	{
 		$aParams =
 		[
-			"category" => "core/cmdb,view_in_gui",
+			"category" => "core/cmdb,grant_by_profile,silo",
 			"key_type" => "autoincrement",
 			"name_attcode" => "",
 			"state_attcode" => "",
@@ -156,7 +156,7 @@ class EventNotificationEmail extends EventNotification
 	{
 		$aParams =
 		[
-			"category" => "core/cmdb,view_in_gui",
+			"category" => "core/cmdb,grant_by_profile,silo",
 			"key_type" => "autoincrement",
 			"name_attcode" => "",
 			"state_attcode" => "",
@@ -178,7 +178,7 @@ class EventNotificationEmail extends EventNotification
 
 		// Display lists
 		MetaModel::Init_SetZListItems('details', ['date', 'userinfo', 'message', 'trigger_id', 'action_id', 'object_class', 'object_id', 'to', 'cc', 'bcc', 'from', 'subject', 'body', 'attachments']); // Attributes to be displayed for the complete details
-		MetaModel::Init_SetZListItems('list', ['date', 'message', 'to', 'subject', 'attachments']); // Attributes to be displayed for a list
+		MetaModel::Init_SetZListItems('list', ['date', 'message', 'to', 'cc', 'bcc', 'subject', 'attachments']); // Attributes to be displayed for a list
 
 		// Search criteria
 		//		MetaModel::Init_SetZListItems('standard_search', array('name')); // Criteria of the std search form
@@ -192,7 +192,7 @@ class EventIssue extends Event
 	{
 		$aParams =
 		[
-			"category" => "core/cmdb,view_in_gui",
+			"category" => "core/cmdb,grant_by_profile,silo",
 			"key_type" => "autoincrement",
 			"name_attcode" => "",
 			"state_attcode" => "",
@@ -286,7 +286,7 @@ class EventWebService extends Event
 	{
 		$aParams =
 		[
-			"category" => "core/cmdb,view_in_gui",
+			"category" => "core/cmdb,grant_by_profile,silo",
 			"key_type" => "autoincrement",
 			"name_attcode" => "",
 			"state_attcode" => "",
@@ -321,7 +321,7 @@ class EventRestService extends Event
 	{
 		$aParams =
 		[
-			"category" => "core/cmdb,view_in_gui",
+			"category" => "core/cmdb,grant_by_profile,silo",
 			"key_type" => "autoincrement",
 			"name_attcode" => "",
 			"state_attcode" => "",
@@ -356,7 +356,7 @@ class EventLoginUsage extends Event
 	{
 		$aParams =
 		[
-			"category" => "core/cmdb,view_in_gui",
+			"category" => "core/cmdb,grant_by_profile,silo",
 			"key_type" => "autoincrement",
 			"name_attcode" => "",
 			"state_attcode" => "",
@@ -394,7 +394,7 @@ class EventOnObject extends Event
 	{
 		$aParams =
 		[
-			"category" => "core/cmdb,view_in_gui",
+			"category" => "core/cmdb,grant_by_profile,silo",
 			"key_type" => "autoincrement",
 			"name_attcode" => "",
 			"state_attcode" => "",

core/excelbulkexport.class.inc.php

@@ -5,13 +5,13 @@
  * @license     http://opensource.org/licenses/AGPL-3.0
  */
 
+use Combodo\iTop\Application\Helper\ExportHelper;
 use Combodo\iTop\Application\UI\Base\Component\FieldSet\FieldSetUIBlockFactory;
 use Combodo\iTop\Application\UI\Base\Component\Html\Html;
 use Combodo\iTop\Application\UI\Base\Component\Input\InputUIBlockFactory;
 use Combodo\iTop\Application\UI\Base\Component\Panel\PanelUIBlockFactory;
 use Combodo\iTop\Application\UI\Base\Layout\MultiColumn\Column\ColumnUIBlockFactory;
 use Combodo\iTop\Application\UI\Base\Layout\MultiColumn\MultiColumnUIBlockFactory;
-use Combodo\iTop\Application\Helper\ExportHelper;
 use Combodo\iTop\Application\WebPage\Page;
 use Combodo\iTop\Application\WebPage\WebPage;
 
@@ -63,6 +63,8 @@ class ExcelBulkExport extends TabularBulkExport
 				// Export from the command line (or scripted) => default format is SQL, as in previous versions of iTop, unless specified otherwise
 				$this->aStatusInfo['date_format'] = utils::ReadParam('date_format', (string)AttributeDateTime::GetSQLFormat(), true, 'raw_data');
 		}
+
+		$this->aStatusInfo['ignore_excel_sanitization'] = (bool)utils::ReadParam('ignore_excel_sanitization', 0, true, utils::ENUM_SANITIZATION_FILTER_INTEGER);
 	}
 
 	public function EnumFormParts()
@@ -121,6 +123,10 @@ class ExcelBulkExport extends TabularBulkExport
 				$oRadioCustom->GetInput()->AddCSSClass('ibo-input-checkbox');
 				$oFieldSetDate->AddSubBlock($oRadioCustom);
 
+				$oFieldSetSecurity = FieldSetUIBlockFactory::MakeStandard(Dict::S('Core:BulkExport:Security'));
+				$oMulticolumn->AddColumn(ColumnUIBlockFactory::MakeForBlock($oFieldSetSecurity));
+				$oFieldSetSecurity->AddSubBlock(ExportHelper::GetInputForSanitizeExcelExport());
+
 				$oP->add_ready_script(
 					<<<EOF
 $('#form_part_xlsx_options').on('preview_updated', function() { FormatDatesInPreview('excel', 'xlsx'); });
@@ -216,6 +222,12 @@ EOF
 					}
 				}
 		}
+
+		// If the option to ignore Excel sanitization is not set or absent, sanitize the field
+		if (!(array_key_exists('ignore_excel_sanitization', $this->aStatusInfo)) || $this->aStatusInfo['ignore_excel_sanitization'] === false) {
+			return ExportHelper::SanitizeField($sRet, '');
+		}
+
 		return $sRet;
 	}
 

core/inlineimage.class.inc.php

@@ -259,13 +259,18 @@ class InlineImage extends DBObject
 	 * that refer to an InlineImage (detected via the attribute data-img-id="") so that
 	 * the URL is consistent with the current URL of the application.
 	 *
-	 * @param string $sHtml The HTML fragment to process
+N°8681	 * @param string|null $sHtml The HTML fragment to process
 	 *
 	 * @return string The modified HTML
 	 * @throws \Exception
+	 *
+	 * @since 3.3.0 N°8681 Add type hint for parameters and return value
 	 */
-	public static function FixUrls($sHtml)
+	public static function FixUrls(string|null $sHtml): string
 	{
+		// N°8681 - Ensure to have a string value
+		$sHtml = $sHtml ?? '';
+
 		$aNeedles = [];
 		$aReplacements = [];
 		// Find img tags with an attribute data-img-id
@@ -293,6 +298,46 @@ class InlineImage extends DBObject
 		return $sHtml;
 	}
 
+	/**
+	 * Replace <img> tags with a data-img-id attribute by the actual image in base64 representation
+	 * so that the image can be displayed even if the download URL is not accessible (e.g. in unauthenticated approval templates)
+	 *
+	 * @param string $sHtml The HTML fragment to process
+	 *
+	 * @return String The modified HTML
+	 * @since 3.2.3
+	 */
+	public static function ReplaceInlineImagesWithBase64Representation(string $sHtml): String
+	{
+		return preg_replace_callback(
+			'/<img\s+[^>]*'.static::DOM_ATTR_ID.'="(\d+)"[^>]*>/i',
+			function ($matches) {
+
+				// Extract inline image ID from the tag
+				$id = $matches[1];
+
+				try {
+					// Retrieve inline image
+					$oInline = MetaModel::GetObject(InlineImage::class, $id, true, true);
+					$oOrmDocument = $oInline->Get('contents');
+
+					// Replace src image by the base64 representation
+					$sInlineImageAsBase64 = base64_encode($oOrmDocument->GetData());
+					$sDataUri = 'data:'.$oOrmDocument->GetMimeType().';base64,'.$sInlineImageAsBase64;
+					$sImage = preg_replace('/src=["\'][^"\']+["\']/', 'src="'.$sDataUri.'"', $matches[0]);
+
+					// Remove sensitive information (the image ID and secret) from the tag
+					$sImage = preg_replace('/'.static::DOM_ATTR_ID.'="\d+"\s+'.static::DOM_ATTR_SECRET.'="\w+"/', '', $sImage);
+				} catch (Exception $e) {
+					$sImage = '<img src="" alt="'.Dict::S('UI:MissingInlineImage').'">';
+				}
+
+				return $sImage;
+			},
+			$sHtml
+		);
+	}
+
 	/**
 	 * Add an extra attribute data-img-id for images which are based on an actual InlineImage
 	 * so that we can later reconstruct the full "src" URL when needed
@@ -389,7 +434,7 @@ JS
 	 * Resize an image so that it fits the maximum width/height defined in the config file
 	 * @param ormDocument $oImage The original image stored as an array (content / mimetype / filename)
 	 * @return ormDocument The resampled image (or the original one if it already fit)
-	 * @deprecated Replaced by ormDocument::ResizeImageToFit
+	 * @deprecated 3.3.0 Use ormDocument::ResizeImageToFit instead
 	 */
 	public static function ResizeImageToFit(ormDocument $oImage, &$aDimensions = null)
 	{

core/kpi.class.inc.php

@@ -1,18 +1,20 @@
 <?php
 
 /**
- * @copyright   Copyright (C) 2010-2024 Combodo SAS
+ * @copyright   Copyright (C) 2010-2026 Combodo SAS
  * @license     http://opensource.org/licenses/AGPL-3.0
  */
 
+use Combodo\iTop\Application\EventRegister\ApplicationEvents;
 use Combodo\iTop\Core\Kpi\KpiLogData;
+use Combodo\iTop\Service\Events\EventService;
+use Combodo\iTop\Service\Events\iEventServiceSetup;
 use Combodo\iTop\Service\Module\ModuleService;
 
 /**
  * Measures operations duration, memory usage, etc. (and some other KPIs)
  */
-
-class ExecutionKPI
+class ExecutionKPI implements iEventServiceSetup
 {
 	protected static $m_bEnabled_Duration = false;
 	protected static $m_bEnabled_Memory = false;
@@ -23,15 +25,18 @@ class ExecutionKPI
 
 	protected static $m_aStats = []; // Recurrent operations
 	protected static $m_aExecData = []; // One shot operations
-	/**
-	 * @var array[ExecutionKPI]
-	 */
-	protected static $m_aExecutionStack = []; // embedded execution stats
+	/** @var true */
+	private static bool $bMetamodelStarted = false;
 
+	private static ?float $fLastReportTime = null;
+	private static ?float $iLastReportMemory = null;
+
+	// For stats
 	protected $m_fStarted = null;
-	protected $m_fChildrenDuration = 0; // Count embedded
 	protected $m_iInitialMemory = null;
 
+	private static array $aBootstrapOperations = [];
+
 	public static function EnableDuration($iLevel)
 	{
 		if ($iLevel > 0) {
@@ -71,6 +76,7 @@ class ExecutionKPI
 				return true;
 			}
 		}
+
 		return false;
 	}
 
@@ -97,7 +103,7 @@ class ExecutionKPI
 		$sFor = self::$m_sAllowedUser == '*' ? 'EVERYBODY' : "'".trim(self::$m_sAllowedUser)."'";
 		$sSlowQueries = '';
 		if (self::$m_fSlowQueries > 0) {
-			$sSlowQueries = ". Slow Queries: ".self::$m_fSlowQueries."s";
+			$sSlowQueries = '. Slow Queries: '.self::$m_fSlowQueries.'s';
 		}
 
 		$aExtensions = [];
@@ -127,7 +133,7 @@ class ExecutionKPI
 			$sRequest .= ' operation: '.$_POST['operation'];
 		}
 
-		$fStop = MyHelpers::getmicrotime();
+		$fStop = microtime(true);
 		if (($fStop - $fItopStarted) > self::$m_fSlowQueries) {
 			// Invoke extensions to log the KPI operation
 			/** @var \iKPILoggerExtension $oExtensionInstance */
@@ -151,17 +157,17 @@ class ExecutionKPI
 
 		$sTableStyle = 'background-color: #ccc; margin: 10px;';
 
-		$sHtml = "<hr/>";
+		$sHtml = '<hr/>';
 		$sHtml .= "<div style=\"background-color: grey; padding: 10px;\">";
 		$sHtml .= "<h3><a name=\"".md5($sExecId)."\">KPIs</a> - $sRequest</h3>";
 		$oStarted = DateTime::createFromFormat('U.u', $fItopStarted);
 		$sHtml .= '<p>'.$oStarted->format('Y-m-d H:i:s.u').'</p>';
-		$sHtml .= "<p>log_kpi_user_id: ".UserRights::GetUserId()."</p>";
-		$sHtml .= "<div>";
+		$sHtml .= '<p>log_kpi_user_id: '.UserRights::GetUserId().'</p>';
+		$sHtml .= '<div>';
 		$sHtml .= "<table border=\"1\" style=\"$sTableStyle\">";
-		$sHtml .= "<thead>";
-		$sHtml .= "   <th>Operation</th><th>Begin</th><th>End</th><th>Duration</th><th>Memory start</th><th>Memory end</th><th>Memory peak</th>";
-		$sHtml .= "</thead>";
+		$sHtml .= '<thead>';
+		$sHtml .= '   <th>Operation</th><th>Begin</th><th>End</th><th>Duration</th><th>Memory start</th><th>Memory end</th><th>Memory peak</th>';
+		$sHtml .= '</thead>';
 		foreach (self::$m_aExecData as $aOpStats) {
 			$sOperation = $aOpStats['op'];
 			$sBegin = round($aOpStats['time_begin'], 3);
@@ -180,12 +186,12 @@ class ExecutionKPI
 				}
 			}
 
-			$sHtml .= "<tr>";
+			$sHtml .= '<tr>';
 			$sHtml .= "   <td>$sOperation</td><td>$sBegin</td><td>$sEnd</td><td>$sDuration</td><td>$sMemBegin</td><td>$sMemEnd</td><td>$sMemPeak</td>";
-			$sHtml .= "</tr>";
+			$sHtml .= '</tr>';
 		}
-		$sHtml .= "</table>";
-		$sHtml .= "</div>";
+		$sHtml .= '</table>';
+		$sHtml .= '</div>';
 
 		$aConsolidatedStats = [];
 		foreach (self::$m_aStats as $sOperation => $aOpStats) {
@@ -208,20 +214,20 @@ class ExecutionKPI
 				}
 			}
 			$aConsolidatedStats[$sOperation] = [
-				'count' => $iTotalOp,
+				'count'    => $iTotalOp,
 				'duration' => $fTotalOp,
-				'min' => $fMinOp,
-				'max' => $fMaxOp,
-				'avg' => $fTotalOp / $iTotalOp,
+				'min'      => $fMinOp,
+				'max'      => $fMaxOp,
+				'avg'      => $fTotalOp / $iTotalOp,
 				'max_args' => $sMaxOpArguments,
 			];
 		}
 
-		$sHtml .= "<div>";
+		$sHtml .= '<div>';
 		$sHtml .= "<table border=\"1\" style=\"$sTableStyle\">";
-		$sHtml .= "<thead>";
-		$sHtml .= "   <th>Operation</th><th>Count</th><th>Duration</th><th>Min</th><th>Max</th><th>Avg</th>";
-		$sHtml .= "</thead>";
+		$sHtml .= '<thead>';
+		$sHtml .= '   <th>Operation</th><th>Count</th><th>Duration</th><th>Min</th><th>Max</th><th>Avg</th>';
+		$sHtml .= '</thead>';
 		foreach ($aConsolidatedStats as $sOperation => $aOpStats) {
 			$sOperation = '<a href="#'.md5($sExecId.$sOperation).'">'.$sOperation.'</a>';
 			$sCount = $aOpStats['count'];
@@ -230,14 +236,14 @@ class ExecutionKPI
 			$sMax = '<a href="#'.md5($sExecId.$aOpStats['max_args']).'">'.round($aOpStats['max'], 3).'</a>';
 			$sAvg = round($aOpStats['avg'], 3);
 
-			$sHtml .= "<tr>";
+			$sHtml .= '<tr>';
 			$sHtml .= "   <td>$sOperation</td><td>$sCount</td><td>$sDuration</td><td>$sMin</td><td>$sMax</td><td>$sAvg</td>";
-			$sHtml .= "</tr>";
+			$sHtml .= '</tr>';
 		}
-		$sHtml .= "</table>";
-		$sHtml .= "</div>";
+		$sHtml .= '</table>';
+		$sHtml .= '</div>';
 
-		$sHtml .= "</div>";
+		$sHtml .= '</div>';
 
 		$sHtml .= "<p><a href=\"#end-".md5($sExecId)."\">Next page stats</a></p>";
 
@@ -287,18 +293,18 @@ class ExecutionKPI
 						$sOperationHtml = '<a name="'.md5($sExecId.$sOperation).'">'.$sOperation.'</a>';
 						$sHtml .= "<h4>$sOperationHtml</h4>";
 						$sHtml .= "<table border=\"1\" style=\"$sTableStyle\">";
-						$sHtml .= "<thead>";
-						$sHtml .= "   <th>Operation details (+ blame caller if log_kpi_duration = 2)</th><th>Count</th><th>Duration</th><th>Min</th><th>Max</th>";
-						$sHtml .= "</thead>";
+						$sHtml .= '<thead>';
+						$sHtml .= '   <th>Operation details (+ blame caller if log_kpi_duration = 2)</th><th>Count</th><th>Duration</th><th>Min</th><th>Max</th>';
+						$sHtml .= '</thead>';
 						$bDisplayHeader = false;
 					}
-					$sHtml .= "<tr>";
+					$sHtml .= '<tr>';
 					$sHtml .= "   <td>$sHtmlArguments</td><td>$iCountInter</td><td>$sTotalInter</td><td>$sMinInter</td><td>$sMaxInter</td>";
-					$sHtml .= "</tr>";
+					$sHtml .= '</tr>';
 				}
 			}
 			if (!$bDisplayHeader) {
-				$sHtml .= "</table>";
+				$sHtml .= '</table>';
 				$sHtml .= "<p><a href=\"#".md5($sExecId)."\">Back to page stats</a></p>";
 			}
 			self::Report($sHtml);
@@ -333,39 +339,50 @@ class ExecutionKPI
 
 		$aNewEntry = null;
 
-		$fStarted = $this->m_fStarted;
-		$fStopped = $this->m_fStarted;
-		if (self::$m_bEnabled_Duration) {
-			$fStopped = MyHelpers::getmicrotime();
-			$aNewEntry = [
-				'op'         => $sOperationDesc,
-				'time_begin' => $this->m_fStarted - $fItopStarted,
-				'time_end'   => $fStopped - $fItopStarted,
-			];
-			// Reset for the next operation (if the object is recycled)
-			$this->m_fStarted = $fStopped;
+		if (is_null(static::$fLastReportTime)) {
+			static::$fLastReportTime = $fItopStarted;
 		}
 
-		$iInitialMemory = is_null($this->m_iInitialMemory) ? 0 : $this->m_iInitialMemory;
-		$iCurrentMemory = 0;
-		$iPeakMemory = 0;
+		if (is_null(static::$iLastReportMemory)) {
+			global $iItopInitialMemory;
+			static::$iLastReportMemory = $iItopInitialMemory;
+		}
+
+		$fStarted = static::$fLastReportTime;
+		$fStopped = microtime(true);
+		if (self::$m_bEnabled_Duration) {
+			$aNewEntry = [
+				'op'         => $sOperationDesc,
+				'time_begin' => $fStarted - $fItopStarted,
+				'time_end'   => $fStopped - $fItopStarted,
+			];
+		}
+		static::$fLastReportTime = $fStopped;
+
+		$iInitialMemory = static::$iLastReportMemory;
+		$iCurrentMemory = $iInitialMemory;
+		$iPeakMemory = $iInitialMemory;
 		if (self::$m_bEnabled_Memory) {
 			$iCurrentMemory = self::memory_get_usage();
 			if (is_null($aNewEntry)) {
 				$aNewEntry = ['op' => $sOperationDesc];
 			}
-			$aNewEntry['mem_begin'] = $this->m_iInitialMemory;
+			$aNewEntry['mem_begin'] = $iInitialMemory;
 			$aNewEntry['mem_end'] = $iCurrentMemory;
 			$iPeakMemory = self::memory_get_peak_usage();
 			$aNewEntry['mem_peak'] = $iPeakMemory;
 			// Reset for the next operation (if the object is recycled)
-			$this->m_iInitialMemory = $iCurrentMemory;
+			static::$iLastReportMemory = $iCurrentMemory;
 		}
 
 		if (self::$m_bEnabled_Duration || self::$m_bEnabled_Memory) {
-			// Invoke extensions to log the KPI operation
-			/** @var \iKPILoggerExtension $oExtensionInstance */
-			foreach (MetaModel::EnumPlugins('iKPILoggerExtension') as $oExtensionInstance) {
+			$aCallstack = ['callstack' => $this->GetCallStack()];
+			if (static::$bMetamodelStarted) {
+				foreach (static::$aBootstrapOperations as $oLog) {
+					$this->LogOperation($oLog);
+				}
+				static::$aBootstrapOperations = [];
+				// Invoke extensions to log the KPI operation
 				$sExtension = ModuleService::GetInstance()->GetModuleNameFromCallStack(1);
 				$oKPILogData = new KpiLogData(
 					KpiLogData::TYPE_REPORT,
@@ -376,9 +393,24 @@ class ExecutionKPI
 					$sExtension,
 					$iInitialMemory,
 					$iCurrentMemory,
-					$iPeakMemory
+					$iPeakMemory,
+					$aCallstack
 				);
-				$oExtensionInstance->LogOperation($oKPILogData);
+				$this->LogOperation($oKPILogData);
+			} else {
+				$oKPILogData = new KpiLogData(
+					KpiLogData::TYPE_REPORT,
+					'Step',
+					$sOperationDesc,
+					$fStarted,
+					$fStopped,
+					'',
+					$iInitialMemory,
+					$iCurrentMemory,
+					$iPeakMemory,
+					$aCallstack
+				);
+				static::$aBootstrapOperations[] = $oKPILogData;
 			}
 		}
 
@@ -388,13 +420,21 @@ class ExecutionKPI
 		$this->ResetCounters();
 	}
 
+	private function LogOperation(KpiLogData $oKPILogData): void
+	{
+		/** @var \iKPILoggerExtension $oExtensionInstance */
+		foreach (MetaModel::EnumPlugins('iKPILoggerExtension') as $oExtensionInstance) {
+			$oExtensionInstance->LogOperation($oKPILogData);
+		}
+	}
+
 	/**
 	 * Compute statistics for a call to an extension
 	 * Note: not working in dev mode (with links to env-production)
 	 *
 	 * @param object|string $object object called
-	 * @param string $sMethod       method called on the object
-	 * @param string $sMessage      additional message
+	 * @param string $sMethod method called on the object
+	 * @param string $sMessage additional message
 	 *
 	 * @return bool true if an extension was found for this object::method
 	 * @throws \ReflectionException
@@ -423,21 +463,23 @@ class ExecutionKPI
 
 		$fDuration = 0;
 		if (self::$m_bEnabled_Duration) {
-			$fStopped = MyHelpers::getmicrotime();
+			$fStopped = microtime(true);
 			$fDuration = $fStopped - $this->m_fStarted;
 			$aCallstack = [];
 			if (self::$m_bGenerateLegacyReport) {
 				if (self::$m_bBlameCaller) {
 					$aCallstack = MyHelpers::get_callstack(1);
 					self::$m_aStats[$sOperation][$sArguments][] = [
-							'time' => $fDuration,
-							'callers' => $aCallstack,
+						'time'    => $fDuration,
+						'callers' => $aCallstack,
 					];
 				} else {
 					self::$m_aStats[$sOperation][$sArguments][] = [
-							'time' => $fDuration,
+						'time' => $fDuration,
 					];
 				}
+			} else {
+				$aCallstack = ['callstack' => $this->GetCallStack()];
 			}
 
 			$iInitialMemory = is_null($this->m_iInitialMemory) ? 0 : $this->m_iInitialMemory;
@@ -448,33 +490,45 @@ class ExecutionKPI
 				$iPeakMemory = self::memory_get_peak_usage();
 			}
 
-			// Invoke extensions to log the KPI operation
-			/** @var \iKPILoggerExtension $oExtensionInstance */
-			foreach (MetaModel::EnumPlugins('iKPILoggerExtension') as $oExtensionInstance) {
-				//$sExtension = ModuleService::GetInstance()->GetModuleNameFromCallStack(1);
-				$sExtension = '';
+			if (static::$bMetamodelStarted) {
+				foreach (static::$aBootstrapOperations as $oLog) {
+					$this->LogOperation($oLog);
+				}
+				static::$aBootstrapOperations = [];
 				$oKPILogData = new KpiLogData(
 					KpiLogData::TYPE_STATS,
 					$sOperation,
 					$sArguments,
 					$this->m_fStarted,
 					$fStopped,
-					$sExtension,
+					'',
 					$iInitialMemory,
 					$iCurrentMemory,
 					$iPeakMemory,
 					$aCallstack
 				);
-				$oExtensionInstance->LogOperation($oKPILogData);
+				$this->LogOperation($oKPILogData);
+			} else {
+				$oKPILogData = new KpiLogData(
+					KpiLogData::TYPE_STATS,
+					$sOperation,
+					$sArguments,
+					$this->m_fStarted,
+					$fStopped,
+					'',
+					$iInitialMemory,
+					$iCurrentMemory,
+					$iPeakMemory,
+					$aCallstack
+				);
+				static::$aBootstrapOperations[] = $oKPILogData;
 			}
 		}
 	}
 
 	protected function ResetCounters()
 	{
-		if (self::$m_bEnabled_Duration) {
-			$this->m_fStarted = microtime(true);
-		}
+		$this->m_fStarted = microtime(true);
 
 		if (self::$m_bEnabled_Memory) {
 			$this->m_iInitialMemory = self::memory_get_usage();
@@ -503,7 +557,33 @@ class ExecutionKPI
 		if (function_exists('memory_get_peak_usage')) {
 			return memory_get_peak_usage($bRealUsage);
 		}
+
 		// PHP > 5.2.1 - this verb depends on a compilation option
 		return 0;
 	}
+
+	/*
+	 * ModuleHandlerApiInterface methods
+	 */
+
+	public static function OnMetaModelStarted()
+	{
+		static::$bMetamodelStarted = true;
+	}
+
+	public function RegisterEventsAndListeners()
+	{
+		EventService::RegisterListener(ApplicationEvents::APPLICATION_EVENT_METAMODEL_STARTED, [$this, 'OnMetaModelStarted']);
+	}
+
+	private function GetCallStack(): string
+	{
+		$aCallStack = MyHelpers::get_callstack(2);
+		$sCallStack = "Call stack:\n";
+		foreach ($aCallStack as $index => $aLine) {
+			$sCallStack .= "#$index ".$aLine['File'].'('.$aLine['Line'].'): '.$aLine['Function']."\n";
+		}
+
+		return $sCallStack;
+	}
 }

core/log.class.inc.php

@@ -614,6 +614,13 @@ class LogChannels
 	 * @since 3.2.0
 	 */
 	public const SECURITY = 'Security';
+
+	/**
+	 * For Session parameters
+	 *
+	 * @Since 3.3.0
+	 */
+	public const SESSION_PARAMETERS = 'SessionParameters';
 }
 
 abstract class LogAPI
@@ -691,7 +698,7 @@ abstract class LogAPI
 		static::$m_oMockMetaModelConfig = $oMetaModelConfig;
 	}
 
-	public static function Exception(string $sMessage, throwable $oException, string $sChannel = null, array $aContext = []): void
+	public static function Exception(string $sMessage, throwable $oException, ?string $sChannel = null, array $aContext = []): void
 	{
 		$aErrorLogs = [];
 		$aErrorLogs[] = static::PrepareErrorLog($sMessage, $oException, $aContext);

core/metamodel.class.php

@@ -22,6 +22,7 @@ use Combodo\iTop\Application\EventRegister\ApplicationEvents;
 use Combodo\iTop\Core\MetaModel\FriendlyNameType;
 use Combodo\iTop\Service\Events\EventData;
 use Combodo\iTop\Service\Events\EventService;
+use Combodo\iTop\Setup\ModuleDiscovery\ModuleFileReader;
 
 require_once APPROOT.'core/modulehandler.class.inc.php';
 require_once APPROOT.'core/querymodifier.class.inc.php';
@@ -128,7 +129,7 @@ abstract class MetaModel
 	/** @var array */
 	private static $m_aClassToFile = [];
 	/** @var string */
-	protected static $m_sEnvironment = 'production';
+	protected static $m_sEnvironment = ITOP_DEFAULT_ENV;
 
 	/**
 	 * Objects currently created/updated.
@@ -462,6 +463,43 @@ abstract class MetaModel
 		return call_user_func([$sClass, 'GetClassDescription'], $sClass);
 	}
 
+	/**
+	 * @param string $sClass
+	 *
+	 * @return string
+	 * @throws \CoreException
+	 */
+	final public static function GetModuleName($sClass)
+	{
+		try {
+			$oReflectionClass = new ReflectionClass($sClass);
+			$sDir = realpath(dirname($oReflectionClass->getFileName()));
+			$sApproot = realpath(APPROOT);
+			while (($sDir !== $sApproot) && (str_contains($sDir, $sApproot))) {
+				$aFiles = glob("$sDir/module.*.php");
+				if (count($aFiles) > 1) {
+					return 'core';
+				}
+
+				if (count($aFiles) == 0) {
+					$sDir = realpath(dirname($sDir));
+					continue;
+				}
+
+				$sModuleFilePath = $aFiles[0];
+				$aModuleInfo = ModuleFileReader::GetInstance()->ReadModuleFileInformation($sModuleFilePath);
+				$sModuleId = $aModuleInfo[ModuleFileReader::MODULE_INFO_ID];
+				list($sModuleName, ) = ModuleDiscovery::GetModuleName($sModuleId);
+
+				return $sModuleName;
+			}
+		} catch (\Exception $e) {
+			throw new CoreException("Cannot find class module", ['class' => $sClass], '', $e);
+		}
+
+		return 'core';
+	}
+
 	/**
 	 * @param string $sClass
 	 *
@@ -4621,12 +4659,15 @@ abstract class MetaModel
 	 * @throws \CoreException
 	 * @throws \MySQLException
 	 */
-	public static function DBExists($bMustBeComplete = true)
+	public static function DBExists($bMustBeComplete = true, ?string $sDBName = null)
 	{
-		if (!CMDBSource::IsDB(self::$m_sDBName)) {
+		if (is_null($sDBName)) {
+			$sDBName = self::$m_sDBName;
+		}
+		if (!CMDBSource::IsDB($sDBName)) {
 			return false;
 		}
-		CMDBSource::SelectDB(self::$m_sDBName);
+		CMDBSource::SelectDB($sDBName);
 
 		$aFound = [];
 		$aMissing = [];
@@ -5709,7 +5750,7 @@ abstract class MetaModel
 	 * @throws \DictExceptionUnknownLanguage
 	 * @throws \Exception
 	 */
-	public static function Startup($config, $bModelOnly = false, $bAllowCache = true, $bTraceSourceFiles = false, $sEnvironment = 'production')
+	public static function Startup($config, $bModelOnly = false, $bAllowCache = true, $bTraceSourceFiles = false, $sEnvironment = ITOP_DEFAULT_ENV)
 	{
 		// Startup on a new environment is not supported
 		static $bStarted = false;
@@ -5720,36 +5761,37 @@ abstract class MetaModel
 
 		self::$m_sEnvironment = $sEnvironment;
 
-		try {
-			if (!defined('MODULESROOT')) {
-				define('MODULESROOT', APPROOT.'env-'.self::$m_sEnvironment.'/');
+		if (!defined('MODULESROOT')) {
+			define('MODULESROOT', APPROOT.'env-'.self::$m_sEnvironment.'/');
 
-				self::$m_bTraceSourceFiles = $bTraceSourceFiles;
+			self::$m_bTraceSourceFiles = $bTraceSourceFiles;
 
-				// $config can be either a filename, or a Configuration object (volatile!)
-				if ($config instanceof Config) {
-					self::LoadConfig($config, $bAllowCache);
-				} else {
-					self::LoadConfig(new Config($config), $bAllowCache);
-				}
-
-				if ($bModelOnly) {
-					return;
-				}
+			// $config can be either a filename, or a Configuration object (volatile!)
+			if ($config instanceof Config) {
+				self::LoadConfig($config, $bAllowCache);
+			} else {
+				self::LoadConfig(new Config($config), $bAllowCache);
 			}
 
-			CMDBSource::SelectDB(self::$m_sDBName);
-
-			foreach (MetaModel::EnumPlugins('ModuleHandlerApiInterface') as $oPHPClass) {
-				$oPHPClass::OnMetaModelStarted();
+			if ($bModelOnly) {
+				// Event service must be initialized after the MetaModel startup, otherwise it cannot discover classes implementing the iEventServiceSetup interface
+				EventService::InitService();
+				EventService::FireEvent(new EventData(ApplicationEvents::APPLICATION_EVENT_METAMODEL_STARTED));
+				return;
 			}
-
-			ExpressionCache::Warmup();
-		} finally {
-			// Event service must be initialized after the MetaModel startup, otherwise it cannot discover classes implementing the iEventServiceSetup interface
-			EventService::InitService();
-			EventService::FireEvent(new EventData(ApplicationEvents::APPLICATION_EVENT_METAMODEL_STARTED));
 		}
+
+		CMDBSource::SelectDB(self::$m_sDBName);
+
+		foreach (MetaModel::EnumPlugins('ModuleHandlerApiInterface') as $oPHPClass) {
+			$oPHPClass::OnMetaModelStarted();
+		}
+
+		ExpressionCache::Warmup();
+
+		// Event service must be initialized after the MetaModel startup, otherwise it cannot discover classes implementing the iEventServiceSetup interface
+		EventService::InitService();
+		EventService::FireEvent(new EventData(ApplicationEvents::APPLICATION_EVENT_METAMODEL_STARTED));
 	}
 
 	/**

core/oql/build/PHP/ParserGenerator/Data.php

@@ -1656,7 +1656,7 @@ class PHP_ParserGenerator_Data
     function emit_code($out, PHP_ParserGenerator_Rule $rp, &$lineno)
     {
         $linecnt = 0;
-        
+
         /* Generate code to do the reduce action */
         if ($rp->code) {
             $this->tplt_linedir($out, $rp->line, $this->filename);

core/oql/oql-parser.php

@@ -1084,7 +1084,7 @@ static public $yy_action = array(
     function yy_find_shift_action($iLookAhead)
     {
         $stateno = $this->yystack[$this->yyidx]->stateno;
-     
+
         /* if ($this->yyidx < 0) return self::YY_NO_ACTION;  */
         if (!isset(self::$yy_shift_ofst[$stateno])) {
             // no shift actions
@@ -1767,7 +1767,7 @@ throw new OQLParserParseFailureException($this->m_sSourceQuery, $this->m_iLine,
     function yy_syntax_error($yymajor, $TOKEN)
     {
 #line 25 "..\oql-parser.y"
- 
+
 throw new OQLParserSyntaxErrorException($this->m_sSourceQuery, $this->m_iLine, $this->m_iCol, $this->tokenName($yymajor), $TOKEN);
 #line 1779 "..\oql-parser.php"
     }
@@ -1806,7 +1806,7 @@ throw new OQLParserSyntaxErrorException($this->m_sSourceQuery, $this->m_iLine, $
 //        $yyact;            /* The parser action. */
 //        $yyendofinput;     /* True if we are at the end of input */
         $yyerrorhit = 0;   /* True if yymajor has invoked an error */
-        
+
         /* (re)initialize the parser, if necessary */
         if ($this->yyidx === null || $this->yyidx < 0) {
             /* if ($yymajor == 0) return; // not sure why this was here... */
@@ -1819,7 +1819,7 @@ throw new OQLParserSyntaxErrorException($this->m_sSourceQuery, $this->m_iLine, $
             array_push($this->yystack, $x);
         }
         $yyendofinput = ($yymajor==0);
-        
+
         if (self::$yyTraceFILE) {
             fprintf(
                 self::$yyTraceFILE,
@@ -1828,7 +1828,7 @@ throw new OQLParserSyntaxErrorException($this->m_sSourceQuery, $this->m_iLine, $
                 self::$yyTokenName[$yymajor]
             );
         }
-        
+
         do {
             $yyact = $this->yy_find_shift_action($yymajor);
             if ($yymajor < self::YYERRORSYMBOL
@@ -2002,7 +2002,7 @@ class OQLParser extends OQLParserRaw
 		$this->m_sSourceQuery = $sQuery;
 		// no constructor - parent::__construct();
 	}
-	
+
 	public function doParse($token, $value, $iCurrPosition = 0)
 	{
 		$this->m_iColPrev = $this->m_iCol;
@@ -2016,7 +2016,7 @@ class OQLParser extends OQLParserRaw
 		$this->doParse(0, 0);
 		return $this->my_result;
 	}
-	
+
 	public function __destruct()
 	{
 		// Bug in the original destructor, causing an infinite loop !

core/ormcaselog.class.inc.php

@@ -370,7 +370,7 @@ class ormCaseLog
 	/**
 	 * Produces an HTML representation, aimed at being used within the iTop framework
 	 */
-	public function GetAsHTML(WebPage $oP = null, $bEditMode = false, $aTransfoHandler = null)
+	public function GetAsHTML(?WebPage $oP = null, $bEditMode = false, $aTransfoHandler = null)
 	{
 		$bPrintableVersion = (utils::ReadParam('printable', '0') == '1');
 

core/ormdocument.class.inc.php

@@ -340,30 +340,33 @@ class ormDocument
 	 * @param string $sContentDisposition Either 'inline' or 'attachment'
 	 * @param string $sSecretField The attcode of the field containing a "secret" to be provided in order to retrieve the file
 	 * @param string $sSecretValue The value of the secret to be compared with the value of the attribute $sSecretField
+	 * @param bool $bAllowAllData If true, no rights filtering is applied
 	 *
 	 * @return void
 	 */
-	public static function DownloadDocument(WebPage $oPage, $sClass, $id, $sAttCode, $sContentDisposition = 'attachment', $sSecretField = null, $sSecretValue = null)
+	public static function DownloadDocument(WebPage $oPage, $sClass, $id, $sAttCode, $sContentDisposition = 'attachment', $sSecretField = null, $sSecretValue = null, $bAllowAllData = false)
 	{
 		try {
-			$oObj = MetaModel::GetObject($sClass, $id, false, false);
+			$oObj = MetaModel::GetObject($sClass, $id, false, $bAllowAllData);
 			if (!is_object($oObj)) {
 				// If access to the document is not granted, check if the access to the host object is allowed
 				$oObj = MetaModel::GetObject($sClass, $id, false, true);
+				$bHasHostRights = false;
 				if ($oObj instanceof Attachment) {
 					$sItemClass = $oObj->Get('item_class');
 					$sItemId = $oObj->Get('item_id');
 					$oHost = MetaModel::GetObject($sItemClass, $sItemId, false, false);
-					if (!is_object($oHost)) {
-						$oObj = null;
+					if (is_object($oHost)) {
+						$bHasHostRights = true;
 					}
 				}
-				if (!is_object($oObj)) {
+
+				// We could neither read the object nor get a host object matching our rights
+				if ($bHasHostRights !== true) {
 					throw new Exception("Invalid id ($id) for class '$sClass' - the object does not exist or you are not allowed to view it");
 				}
 			}
-			if (($sSecretField != null) && ($oObj->Get($sSecretField) != $sSecretValue)) {
-				usleep(200);
+			if (($sSecretField != null) && !hash_equals($oObj->Get($sSecretField), $sSecretValue)) {
 				throw new Exception("Invalid secret for class '$sClass' - the object does not exist or you are not allowed to view it");
 			}
 			/** @var \ormDocument $oDocument */
@@ -405,7 +408,7 @@ class ormDocument
 	 * @param int $iMaxImageHeight Maximum height for the resized image
 	 * @param array|null $aFinalDimensions Image dimensions after resizing or null if unable to read the image
 	 * @return ormDocument The resampled image
-	 *
+	 * @since 3.3.0 N°3124
 	 */
 	public function ResizeImageToFit(int $iMaxWidth, int $iMaxHeight, array|null &$aFinalDimensions = null): static
 	{

core/ormlinkset.class.inc.php

@@ -93,7 +93,7 @@ class ormLinkSet implements iDBObjectSetIterator, Iterator, SeekableIterator
 	 * @param DBObjectSet|null $oOriginalSet
 	 * @throws Exception
 	 */
-	public function __construct($sHostClass, $sAttCode, DBObjectSet $oOriginalSet = null)
+	public function __construct($sHostClass, $sAttCode, ?DBObjectSet $oOriginalSet = null)
 	{
 		$this->sHostClass = $sHostClass;
 		$this->sAttCode = $sAttCode;
@@ -470,17 +470,6 @@ class ormLinkSet implements iDBObjectSetIterator, Iterator, SeekableIterator
 				|| ($this->oOriginalSet->GetFilter()->ToOQL() == $oFellow->oOriginalSet->GetFilter()->ToOQL())) {
 				$bUpdateFromDelta = true;
 			}
-		} else {
-			//@since 3.2.2 N°2364 - API : remove old linkedset persistance
-			/* Goo pattern to use:
-			* $oCISet = $oTicket->Get(‘functioncis_list’);
-			* $oCISet->AddItem(MetaModel::NewObject(‘lnkFunctionCIToTicket’, array(‘ci_id’=> 12345));
-			* $oCISet->RemoveItem(123456);
-			* $oTicket->Set(‘functionalcis_list’, $oCISet);
-			 */
-			if (!ContextTag::Check(ContextTag::TAG_SETUP)) {
-				DeprecatedCallsLog::NotifyDeprecatedPhpMethod('old pattern - please get previous value of the linked set, modify it and set it back to the host object');
-			}
 		}
 
 		if ($bUpdateFromDelta) {

core/ormpassword.class.inc.php

@@ -52,7 +52,7 @@ class ormPassword
 	public function SetPassword($sClearTextPassword)
 	{
 		$iHashAlgo = MetaModel::GetConfig()->GetPasswordHashAlgo();
-		$this->m_sHashed = password_hash($sClearTextPassword, $iHashAlgo);
+		$this->m_sHashed = password_hash($sClearTextPassword ?? '', $iHashAlgo);
 	}
 
 	/**
@@ -98,11 +98,11 @@ class ormPassword
 		$bResult = false;
 		$aInfo = password_get_info($this->m_sHashed);
 		if (is_null($aInfo["algo"]) || $aInfo["algo"] === 0) {
-			//unknown, assume it's a legacy password
-			$sHashedPwd = $this->ComputeHash($sClearTextPassword);
-			$bResult = ($this->m_sHashed == $sHashedPwd);
+			// - Unknown algorithm, assume it's a legacy password
+			$sHashedPwd = $this->ComputeHash($sClearTextPassword ?? '');
+			$bResult = hash_equals($this->m_sHashed, $sHashedPwd);
 		} else {
-			$bResult = password_verify($sClearTextPassword, $this->m_sHashed);
+			$bResult = password_verify($sClearTextPassword ?? '', $this->m_sHashed);
 		}
 		return $bResult;
 	}

core/ormtagset.class.inc.php

@@ -43,24 +43,24 @@ final class ormTagSet extends ormSet
 
 	/**
 	 *
-	 * @param array $aTagCodes
+	 * @param array|null $aItems
 	 *
 	 * @throws \CoreException
 	 * @throws \CoreUnexpectedValue when a code is invalid
 	 */
-	public function SetValues($aTagCodes)
+	public function SetValues($aItems)
 	{
-		if (is_null($aTagCodes)) {
-			$aTagCodes = [];
+		if (is_null($aItems)) {
+			$aItems = [];
 		}
-		if (!is_array($aTagCodes)) {
-			throw new CoreUnexpectedValue("Wrong value {$aTagCodes} for {$this->sClass}:{$this->sAttCode}");
+		if (!is_array($aItems)) {
+			throw new CoreUnexpectedValue("Wrong value {$aItems} for {$this->sClass}:{$this->sAttCode}");
 		}
 
 		$oTags = [];
 		$iCount = 0;
 		$bError = false;
-		foreach ($aTagCodes as $sTagCode) {
+		foreach ($aItems as $sTagCode) {
 			$iCount++;
 			if (($this->iLimit != 0) && ($iCount > $this->iLimit)) {
 				$bError = true;

core/restservices.class.inc.php

@@ -248,6 +248,45 @@ class RestResultWithObjects extends RestResult
 	}
 }
 
+/**
+ * @package RESTAPI
+ * @api
+ */
+class RestResultWithObjectSets extends RestResultWithObjects
+{
+	private $current_object = null;
+
+	public function MakeNewObjectSet()
+	{
+		$arr = [];
+		$this->current_object = &$arr;
+		$this->objects[] = &$arr;
+	}
+
+	/**
+	 * Report the given object
+	 *
+	 * @api
+	 * @param string $sObjectAlias Name of the subobject, usually the OQL class alias
+	 * @param int $iCode An error code (RestResult::OK is no issue has been found)
+	 * @param string $sMessage Description of the error if any, an empty string otherwise
+	 * @param DBObject $oObject The object being reported
+	 * @param array|null $aFieldSpec An array of class => attribute codes (Cf. RestUtils::GetFieldList). List of the attributes to be reported.
+	 * @param boolean $bExtendedOutput Output all of the link set attributes ?
+	 *
+	 * @return void
+	 * @throws \ArchivedObjectException
+	 * @throws \CoreException
+	 * @throws \CoreUnexpectedValue
+	 * @throws \MySQLException
+	 */
+	public function AppendSubObject($sObjectAlias, $iCode, $sMessage, $oObject, $aFieldSpec = null, $bExtendedOutput = false)
+	{
+		$oObjRes = ObjectResult::FromDBObject($oObject, $aFieldSpec, $bExtendedOutput, $iCode, $sMessage);
+		$this->current_object[$sObjectAlias] = $oObjRes;
+	}
+}
+
 /**
  * @package RESTAPI
  * @api
@@ -500,14 +539,21 @@ class CoreServices implements iRestServiceProvider, iRestInputSanitizer
 				break;
 
 			case 'core/get':
-				$sClass = RestUtils::GetClass($aParams, 'class');
+				$sClassParam =  RestUtils::GetMandatoryParam($aParams, 'class');
 				$key = RestUtils::GetMandatoryParam($aParams, 'key');
-				$aShowFields = RestUtils::GetFieldList($sClass, $aParams, 'output_fields');
-				$bExtendedOutput = (RestUtils::GetOptionalParam($aParams, 'output_fields', '*') == '*+');
+				$sShowFields = RestUtils::GetOptionalParam($aParams, 'output_fields', '*');
 				$iLimit = (int)RestUtils::GetOptionalParam($aParams, 'limit', 0);
 				$iPage = (int)RestUtils::GetOptionalParam($aParams, 'page', 1);
 
-				$oObjectSet = RestUtils::GetObjectSetFromKey($sClass, $key, $iLimit, self::getOffsetFromLimitAndPage($iLimit, $iPage));
+				// Validate the class(es)
+				$aClass = explode(',', $sClassParam);
+				foreach ($aClass as $sClass) {
+					if (!MetaModel::IsValidClass(trim($sClass))) {
+						throw new Exception("class '$sClass' is not valid");
+					}
+				}
+
+				$oObjectSet = RestUtils::GetObjectSetFromKey($sClassParam, $key, $iLimit, self::getOffsetFromLimitAndPage($iLimit, $iPage));
 				$sTargetClass = $oObjectSet->GetFilter()->GetClass();
 
 				if (UserRights::IsActionAllowed($sTargetClass, UR_ACTION_READ) != UR_ALLOWED_YES) {
@@ -519,8 +565,56 @@ class CoreServices implements iRestServiceProvider, iRestInputSanitizer
 				} elseif ($iPage < 1) {
 					$oResult->code = RestResult::INVALID_PAGE;
 					$oResult->message = "The request page number is not valid. It must be an integer greater than 0";
+				} elseif (count($oObjectSet->GetSelectedClasses()) > 1) {
+					$oResult = new RestResultWithObjectSets();
+					$aCache = [];
+					$aShowFields = [];
+					foreach ($oObjectSet->GetSelectedClasses() as $sSelectedClass) {
+						$aShowFields = array_merge($aShowFields, RestUtils::GetFieldList($sSelectedClass, $aParams, 'output_fields', false));
+					}
+
+					while ($oObjects = $oObjectSet->FetchAssoc()) {
+						$oResult->MakeNewObjectSet();
+
+						foreach ($oObjects as $sAlias => $oObject) {
+							if (!$oObject) {
+								continue;
+							}
+
+							if (!array_key_exists($sAlias, $aCache)) {
+								$sClass = get_class($oObject);
+								$bExtendedOutput = RestUtils::HasRequestedExtendedOutput($sShowFields);
+
+								if (!RestUtils::HasRequestedAllOutputFields($sShowFields)) {
+									$aFields = $aShowFields[$sClass];
+									//Id is not a valid attribute to optimize
+									if ($aFields && in_array('id', $aFields)) {
+										unset($aFields[array_search('id', $aFields)]);
+									}
+									$aAttToLoad = [$sAlias => $aFields];
+									$oObjectSet->OptimizeColumnLoad($aAttToLoad);
+								}
+								$aCache[$sAlias] = [
+									'aShowFields' => $aShowFields,
+									'bExtendedOutput' => $bExtendedOutput,
+								];
+							} else {
+								$aShowFields = $aCache[$sAlias]['aShowFields'];
+								$bExtendedOutput = $aCache[$sAlias]['bExtendedOutput'];
+							}
+
+							$oResult->AppendSubObject($sAlias, 0, '', $oObject, $aShowFields, $bExtendedOutput);
+						}
+					}
+					$oResult->message = "Found: ".$oObjectSet->Count();
 				} else {
-					if (!$bExtendedOutput && RestUtils::GetOptionalParam($aParams, 'output_fields', '*') != '*') {
+					$aShowFields = [];
+					foreach ($aClass as $sSelectedClass) {
+						$sSelectedClass = trim($sSelectedClass);
+						$aShowFields = array_merge($aShowFields, RestUtils::GetFieldList($sSelectedClass, $aParams, 'output_fields', false));
+					}
+
+					if (!RestUtils::HasRequestedAllOutputFields($sShowFields) && count($aShowFields) == 1) {
 						$aFields = $aShowFields[$sClass];
 						//Id is not a valid attribute to optimize
 						if (in_array('id', $aFields)) {
@@ -531,7 +625,7 @@ class CoreServices implements iRestServiceProvider, iRestInputSanitizer
 					}
 
 					while ($oObject = $oObjectSet->Fetch()) {
-						$oResult->AddObject(0, '', $oObject, $aShowFields, $bExtendedOutput);
+						$oResult->AddObject(0, '', $oObject, $aShowFields, RestUtils::HasRequestedExtendedOutput($sShowFields));
 					}
 					$oResult->message = "Found: ".$oObjectSet->Count();
 				}

core/tabularbulkexport.class.inc.php

@@ -8,6 +8,13 @@
 use Combodo\iTop\Application\UI\Base\Component\Input\InputUIBlockFactory;
 use Combodo\iTop\Application\UI\Base\Layout\UIContentBlockUIBlockFactory;
 use Combodo\iTop\Application\WebPage\WebPage;
+use Combodo\iTop\Core\AttributeDefinition\AttributeExternalField;
+use Combodo\iTop\Core\AttributeDefinition\AttributeExternalKey;
+use Combodo\iTop\Core\AttributeDefinition\AttributeFriendlyName;
+use Combodo\iTop\Core\AttributeDefinition\AttributeHierarchicalKey;
+use Combodo\iTop\Core\AttributeDefinition\AttributeLinkedSet;
+use Combodo\iTop\Core\AttributeDefinition\AttributeStopWatch;
+use Combodo\iTop\Core\AttributeDefinition\AttributeSubItem;
 
 /**
  * Bulk export: Tabular export: abstract base class for all "tabular" exports.
@@ -91,8 +98,8 @@ abstract class TabularBulkExport extends BulkExport
 	{
 		$aResult = [];
 		switch (get_class($oAttDef)) {
-			case 'AttributeExternalKey':
-			case 'AttributeHierarchicalKey':
+			case AttributeExternalKey::class:
+			case AttributeHierarchicalKey::class:
 
 				$bAddFriendlyName = true;
 				$oKeyAttDef = MetaModel::GetAttributeDef($sClass, $sAttCode);
@@ -142,7 +149,7 @@ abstract class TabularBulkExport extends BulkExport
 				}
 				break;
 
-			case 'AttributeStopWatch':
+			case AttributeStopWatch::class:
 				foreach (MetaModel::ListAttributeDefs($sClass) as $sSubAttCode => $oSubAttDef) {
 					if ($oSubAttDef instanceof AttributeSubItem) {
 						if ($oSubAttDef->GetParentAttCode() == $sAttCode) {

core/userrights.class.inc.php

@@ -658,6 +658,16 @@ abstract class User extends cmdbAbstractObject
 		}
 		return false;
 	}
+
+	/**
+	 * Allow a user to be impersonated by another one (generally an administrator) in order to troubleshoot rights issues.
+	 *
+	 * @return bool
+	 */
+	public function CanBeImpersonated(): bool
+	{
+		return true;
+	}
 }
 
 /**
@@ -1063,6 +1073,9 @@ class UserRights
 		$oUser = self::FindUser($sLogin);
 		if ($oUser) {
 			$bRet = true;
+			if (!$oUser->CanBeImpersonated()) {
+				throw new Exception($oUser->GetName().' cannot be impersonated');
+			}
 			if (is_null(self::$m_oRealUser)) {
 				// First impersonation
 				self::$m_oRealUser = self::$m_oUser;
@@ -1182,7 +1195,7 @@ class UserRights
 			return self::$m_oUser->GetKey();
 		} else {
 			// find the id out of the login string
-			$oUser = self::FindUser($sLogin);
+			$oUser = self::FindUser($sLogin, bAllowDisabledUsers: true);
 			if (is_null($oUser)) {
 				return null;
 			}
@@ -1375,7 +1388,7 @@ class UserRights
 		if (empty($sLogin)) {
 			$oUser = self::$m_oUser;
 		} else {
-			$oUser = self::FindUser($sLogin);
+			$oUser = self::FindUser($sLogin, bAllowDisabledUsers: true);
 		}
 		if (is_null($oUser)) {
 			return '';
@@ -1517,6 +1530,37 @@ class UserRights
 		}
 	}
 
+	/**
+	 * @param User $oUser
+	 * @param array $aExcludedProfilesId Administrator by default, but can also be other proofiles depending on needs (e.g. power portal user or REST profile)
+	 * @return bool
+	 * @throws ArchivedObjectException
+	 * @throws CoreException
+	 * @throws CoreUnexpectedValue
+	 * @throws MySQLException
+	 */
+	public static function IsUserReadOnly(User $oUser, array $aExcludedProfilesId = [1]): bool
+	{
+		$oUserProfiles = $oUser->Get('profile_list');
+		$oUserRights = UserRights::GetModuleInstance();
+		while ($oUserProfile = $oUserProfiles->Fetch()) {
+			$iProfileId = $oUserProfile->Get('profileid');
+			if (in_array($iProfileId, $aExcludedProfilesId)) {
+				return false;
+			}
+			foreach (MetaModel::GetClasses('bizmodel,grant_by_profile') as $sClass) {
+				foreach (['w', 'bw', 'd', 'bd'] as $sWriteActionCode) {
+					$bIsGranted = $oUserRights->GetProfileActionGrant($iProfileId, $sClass, $sWriteActionCode);
+					if ($bIsGranted === true) {
+						return false;
+					}
+				}
+			}
+		}
+
+		return true;
+	}
+
 	/**
 	 * @param string $sClass
 	 * @param int $iActionCode see UR_ACTION_* constants

css/backoffice/_shame.scss

@@ -56,6 +56,8 @@ $ibo-shame--slider--is-round--border-radius: 20px !default;
 $ibo-shame--slider--is-round--before--border-radius: 7px !default;
 
 
+$ibo-blockquote--color: $ibo-body-text-color !default;
+
 // N°2847 - Recolor svg illustrations with iTop's primary color
 .ibo-svg-illustration--container > svg *[fill="#6c63ff"]{
 	fill: $ibo-svg-illustration--fill;
@@ -126,3 +128,11 @@ input:checked + .slider:before {
 .slider.round:before {
   border-radius: $ibo-shame--slider--is-round--before--border-radius;
 }
+
+/*
+  Bulma sets blockquote background color through a variable, it affects ckeditor and html display.
+  This rule is needed harmonize the blockquote text color in both contexts.
+ */
+.ibo-is-html-content blockquote {
+  color: $ibo-blockquote--color;
+}

css/backoffice/application/_user-rights.scss

@@ -4,7 +4,7 @@
  */
 
 $ibo-user-rights--padding-x: $ibo-spacing-400 !default;
-$ibo-user-rights--padding-y: $ibo-spacing-200 !default;
+$ibo-user-rights--padding-y: $ibo-spacing-100 !default;
 $ibo-user-rights--border-radius: $ibo-border-radius-400 !default;
 
 $ibo-user-rights--is-success--background-color: $ibo-color-success-100 !default;
@@ -18,6 +18,8 @@ $ibo-user-rights--is-failure--border-color: $ibo-color-danger-500 !default;
 $ibo-user-rights--is-failure--border: 1px solid $ibo-user-rights--is-failure--border-color !default;
 
 .ibo-user-rights {
+  display: inline-flex;
+  align-items: baseline;
   padding: $ibo-user-rights--padding-y $ibo-user-rights--padding-x;
   border-radius: $ibo-user-rights--border-radius;
   &.ibo-is-success {

css/backoffice/application/bulk/_all.scss

@@ -4,3 +4,4 @@
  */
 
 @import "bulk-modify";
+@import "bulk-export";

css/backoffice/application/bulk/_bulk-export.scss

@@ -0,0 +1,10 @@
+/*
+ * @copyright   Copyright (C) 2010-2026 Combodo SAS
+ * @license     http://opensource.org/licenses/AGPL-3.0
+ */
+
+#form_part_csv_options:has(#ibo-sanitize-excel-export--input:checked), #form_part_xlsx_options:has(#ibo-sanitize-excel-export--input:checked){
+  #ibo-sanitize-excel-export--alert {
+    display: none;
+  }
+}

css/backoffice/blocks-integrations/_all.scss

@@ -22,4 +22,6 @@
 @import "medallion-with-blocklist";
 @import "field-badge-within-datatable";
 @import "jquery-blockui-within-dialog";
-@import "jquery-blockui-within-datatable";
+@import "jquery-blockui-within-datatable";
+@import "badge-with-badge";
+@import "extension-details-with-extension-details";

css/backoffice/blocks-integrations/_badge-with-badge.scss

@@ -0,0 +1,10 @@
+/*
+ * @copyright   Copyright (C) 2010-2026 Combodo SAS
+ * @license     http://opensource.org/licenses/AGPL-3.0
+ */
+
+$ibo-badge--spacing-left--with-same-block: $ibo-spacing-200 !default;
+
+.ibo-badge + .ibo-badge {
+  margin-left: $ibo-badge--spacing-left--with-same-block;
+}

css/backoffice/blocks-integrations/_extension-details-with-extension-details.scss

@@ -0,0 +1,11 @@
+/*
+ * @copyright   Copyright (C) 2010-2026 Combodo SAS
+ * @license     http://opensource.org/licenses/AGPL-3.0
+ */
+
+$ibo-extension-details--margin-top: $ibo-spacing-300 !default;
+
+.ibo-extension-details + .ibo-extension-details,
+.ibo-extension-details--information--description .ibo-extension-details {
+	margin-top: $ibo-extension-details--margin-top;
+}

css/backoffice/components/_all.scss

@@ -33,4 +33,5 @@
 @import "field-badge";
 @import "file-select";
 @import "medallion-icon";
-@import "toast";
+@import "toast";
+@import "badge";

css/backoffice/components/_badge.scss

@@ -0,0 +1,43 @@
+$ibo-badge--padding-x : $ibo-spacing-200 !default;
+$ibo-badge--padding-y : $ibo-spacing-100 !default;
+$ibo-badge--border-radius : $ibo-border-radius-400 !default;
+
+$ibo-badge-colors: (
+		'primary': ($ibo-color-primary-100, $ibo-color-primary-900),
+		'secondary': ($ibo-color-secondary-100, $ibo-color-secondary-900),
+		'neutral': ($ibo-color-secondary-100, $ibo-color-secondary-900),
+		'information': ($ibo-color-information-100, $ibo-color-information-900),
+		'success': ($ibo-color-success-100, $ibo-color-success-900),
+		'failure': ($ibo-color-danger-100, $ibo-color-danger-900),
+		'warning': ($ibo-color-warning-100,$ibo-color-warning-900),
+		'danger': ($ibo-color-danger-100,$ibo-color-danger-900),
+		'grey' : ($ibo-color-grey-100, $ibo-color-grey-900),
+		'blue-grey': ($ibo-color-blue-grey-100, $ibo-color-blue-grey-900),
+		'blue': ($ibo-color-blue-100, $ibo-color-blue-900),
+		'cyan': ($ibo-color-cyan-100, $ibo-color-cyan-900),
+		'green': ($ibo-color-green-100, $ibo-color-green-900),
+		'orange' : ($ibo-color-orange-100, $ibo-color-orange-900),
+		'red': ($ibo-color-red-100, $ibo-color-red-900),
+		'pink': ($ibo-color-pink-100, $ibo-color-pink-900),
+		'purple': ($ibo-color-purple-100, $ibo-color-purple-900),
+		'yellow': ($ibo-color-yellow-200, $ibo-color-yellow-900),
+) !default;
+
+
+
+.ibo-badge {
+	display: inline-block;
+	white-space: nowrap;
+	padding : $ibo-badge--padding-y $ibo-badge--padding-x;
+	border-radius : $ibo-badge--border-radius;
+	@extend %ibo-font-ral-med-50;
+
+	@each $sColor, $aColorValues in $ibo-badge-colors {
+		$bg-color: nth($aColorValues, 1);
+		$text-color: nth($aColorValues, 2);
+		&.ibo-is-#{$sColor} {
+			background-color: $bg-color;
+			color: $text-color;
+		}
+	}
+}

css/backoffice/components/_form.scss

@@ -8,70 +8,74 @@
   padding-bottom: 14px;
 }
 
-.help-text{
-  padding: 1px 5px;
-  background-color: #d7e3f8;
-  border: 1px solid #c6e7f5;
-  border-radius: 5px;
-  margin: 5px 0;
-  font-size: 0.9em;
-}
-
-.form-error ul{
-  padding: 1px 5px;
-  background-color: #f8d7da;
-  border: 1px solid #f5c6cb;
-  border-radius: 5px;
-  margin: 5px 0;
-  font-size: 0.9em;
-}
-
-.subform{
-  background-color: #efefef;
-  border-radius: 5px;
-  padding: 10px;
-}
-
-.form-buttons{
-  margin: 20px 0;
-}
-
-.form select{
-  padding: 0;
-  overflow-y: auto;
-}
-
-.form select option{
-  height: 30px;
-  display: flex;
-  align-items: center;
-}
-
-.turbo-refreshing{
-  opacity: .5;
-}
-
-.ibo-field legend{
-  margin-top: 24px;
-}
-
-collection-entry-element {
-  margin-top: 8px;
-  display: block;
-  padding: 10px 10px;
-  background-color: #f5f5f5;
-  border-radius: 5px;
-}
-.ts-control{
-  height: auto;
-  min-height: 30px;
-}
-
-.ibo-form-actions > .ibo-button > span{
-  margin-right: 5px;
-}
-
-.ibo-form textarea{
-  resize: vertical;
-}
-
+// WIP SDK Forms
+//form[is="itop-form-element"] {
+//
+//  .help-text{
+//    padding: 1px 5px;
+//    background-color: #d7e3f8;
+//    border: 1px solid #c6e7f5;
+//    border-radius: 5px;
+//    margin: 5px 0;
+//    font-size: 0.9em;
+//  }
+//
+//  .form-error ul{
+//    padding: 1px 5px;
+//    background-color: #f8d7da;
+//    border: 1px solid #f5c6cb;
+//    border-radius: 5px;
+//    margin: 5px 0;
+//    font-size: 0.9em;
+//  }
+//
+//  .subform{
+//    background-color: #efefef;
+//    border-radius: 5px;
+//    padding: 10px;
+//  }
+//
+//  .form-buttons{
+//    margin: 20px 0;
+//  }
+//
+//  .form select{
+//    padding: 0;
+//    overflow-y: auto;
+//  }
+//
+//  .form select option{
+//    height: 30px;
+//    display: flex;
+//    align-items: center;
+//  }
+//
+//  .turbo-refreshing{
+//    opacity: .5;
+//  }
+//
+//  .ibo-field legend{
+//    margin-top: 24px;
+//  }
+//
+//  collection-entry-element {
+//    margin-top: 8px;
+//    display: block;
+//    padding: 10px 10px;
+//    background-color: #f5f5f5;
+//    border-radius: 5px;
+//  }
+//  .ts-control{
+//    height: auto;
+//    min-height: 30px;
+//  }
+//
+//  .ibo-form-actions > .ibo-button > span{
+//    margin-right: 5px;
+//  }
+//
+//  .ibo-form textarea{
+//    resize: vertical;
+//  }
+//
+//}

css/backoffice/components/_panel.scss

@@ -72,9 +72,12 @@ $ibo-panel--icon--spacing--as-medallion--is-sticking: $ibo-panel--icon--spacing-
 $ibo-panel--icon--bottom--as-medallion--is-sticking: -12px !default;
 $ibo-panel--icon--border--as-medallion--is-sticking: 1px $ibo-panel--base-border-style $ibo-panel--base-border-color !default;
 
-$ibo-panel--icon-background--size--must-contain: contain !default;
-$ibo-panel--icon-background--size--must-cover: cover !default;
-$ibo-panel--icon-background--size--must-zoomout: 66.67% !default;
+$ibo-panel--icon-background--size--must-contain: contain !default; // deprecated, to be removed in favor of $ibo-panel--icon-img--size--must-contain
+$ibo-panel--icon-background--size--must-cover: cover !default; // deprecated, to be removed in favor of $ibo-panel--icon-img--size--must-cover
+$ibo-panel--icon-background--size--must-zoomout: 66.67% !default; // deprecated, to be removed in favor of $ibo-panel--icon-img--size--must-zoomout
+$ibo-panel--icon-img--size--must-contain: $ibo-panel--icon-background--size--must-contain !default; // TODO remove when dealing with N°9317
+$ibo-panel--icon-img--size--must-cover: $ibo-panel--icon-background--size--must-cover !default; // TODO remove when dealing with N°9317
+$ibo-panel--icon-img--size--must-zoomout: $ibo-panel--icon-background--size--must-zoomout !default; // TODO remove when dealing with N°9317
 
 $ibo-panel--title--font-size--is-sticking: $ibo-font-size-150 !default;
 $ibo-panel--title--color: $ibo-color-grey-900 !default;
@@ -179,24 +182,29 @@ $ibo-panel--is-selectable--body--after--font-size: $ibo-font-size-700 !default;
   min-height: $ibo-panel--icon--size;
 }
 
-.ibo-panel--icon-background {
+.ibo-panel--icon-img, .ibo-panel--icon-background { // second class is deprecated, remove it when dealing with N°9317
   width: 100%;
   height: 100%;
+  object-position: center;
+  object-fit: $ibo-panel--icon-img--size--must-contain;
   background-position: center;
   background-repeat: no-repeat;
-  background-size: $ibo-panel--icon-background--size--must-contain;
+  background-size: $ibo-panel--icon-img--size--must-contain;
 }
 
-.ibo-panel--icon-background--must-contain {
-  background-size: $ibo-panel--icon-background--size--must-contain;
+.ibo-panel--icon-img--must-contain, .ibo-panel--icon-background--must-contain { // second class is deprecated, remove it when dealing with N°9317
+  object-fit: $ibo-panel--icon-img--size--must-contain;
+  background-size: $ibo-panel--icon-img--size--must-contain;
 }
 
-.ibo-panel--icon-background--must-cover {
-  background-size: $ibo-panel--icon-background--size--must-cover;
+.ibo-panel--icon-img--must-cover, .ibo-panel--icon-background--must-cover { // second class is deprecated, remove it when dealing with N°9317
+  object-fit: $ibo-panel--icon-img--size--must-cover;
+  background-size: $ibo-panel--icon-img--size--must-cover;
 }
 
-.ibo-panel--icon-background--must-zoomout {
-  background-size: $ibo-panel--icon-background--size--must-zoomout;
+.ibo-panel--icon-img--must-zoomout, .ibo-panel--icon-background--must-zoomout { // second class is deprecated, remove it when dealing with N°9317
+  width: $ibo-panel--icon-img--size--must-zoomout;
+  height: $ibo-panel--icon-img--size--must-zoomout;
 }
 
 .ibo-panel--title {

css/backoffice/components/_quick-create.scss

@@ -247,7 +247,8 @@ $ibo-quick-create--compartment--placeholder-hint--text-color: $ibo-color-grey-70
 
     &:hover {
       cursor: pointer;
-      @extend a;
+      color: $ibo-hyperlink-color--on-hover;
+      text-decoration: $ibo-hyperlink-text-decoration--on-hover;
     }
 
     .highlight {

css/backoffice/components/_search-form.scss

@@ -21,6 +21,8 @@ $ibo-search-form-panel--more-criteria--color: $ibo-color-blue-grey-800 !default;
 $ibo-search-form-panel--more-criteria--background-color: $ibo-color-white-100 !default;
 $ibo-search-form-panel--more-criteria--icon--color: $ibo-color-primary-600 !default;
 $ibo-search-form-panel--more-criteria--border-color: $ibo-search-form-panel--criteria--border-color !default;
+// calc is redundant but avoid SCSS min() from being used instead of CSS min()
+$ibo-search-form-panel--criteria--max-height: calc(min(#{$ibo-size-750}, 50vh)) !default;
 
 $ibo-search-form-panel--items--hover--color: $ibo-color-grey-200 !default;
 
@@ -278,9 +280,10 @@ $ibo-search-results-area--datatable-scrollhead--border--is-sticking: $ibo-search
 				}
 
 				.sfc_form_group {
-          display: block;
-          margin-top: -1px;
-          z-index: -1;
+                  display: flex;
+                  flex-direction: column;
+                  margin-top: -1px;
+                  z-index: -1;
         }
 			}
 
@@ -346,11 +349,15 @@ $ibo-search-results-area--datatable-scrollhead--border--is-sticking: $ibo-search
         display: none;
         max-width: 450px;
         width: max-content;
-        max-height: 520px;
+        max-height: $ibo-search-form-panel--criteria--max-height;
         overflow-x: auto;
         overflow-y: hidden;
 
 				.sfc_fg_operators {
+                    display: flex;
+                    flex-direction: column;
+                    overflow: auto;
+                    min-height: 0;
 					font-size: 12px;
 
 					.sfc_fg_operator {
@@ -387,6 +394,9 @@ $ibo-search-results-area--datatable-scrollhead--border--is-sticking: $ibo-search
 						}
 
 						.sfc_opc_multichoices {
+                            display: flex;
+                            flex-direction: column;
+                            height: 100%;
 							label > input {
 								vertical-align: text-top;
 								margin-left: $ibo-spacing-0;
@@ -398,7 +408,6 @@ $ibo-search-results-area--datatable-scrollhead--border--is-sticking: $ibo-search
 							}
 
 							.sfc_opc_mc_items_wrapper {
-								max-height: 415px; /* Must be less than .sfc_form_group:max-height - .sfc_opc_mc_toggler:height - .sfc_opc_mc_filter:height */
 								overflow-y: auto;
 								margin: $ibo-spacing-0 -8px; /* Compensate .sfc_opc_multichoices side padding so the hover style can take the full with */
 
@@ -560,8 +569,14 @@ $ibo-search-results-area--datatable-scrollhead--border--is-sticking: $ibo-search
 			&.search_form_criteria_enum {
 				.sfc_form_group {
 					.sfc_fg_operator_in {
+                        display: flex;
+                        flex-direction: column;
+                        height: 100%;
+                        min-height: 0;
 						> label {
-							display: inline-block;
+							display: flex;
+                            height: 100%;
+                            min-height: 0;
 							width: 100%;
 							line-height: initial;
 							white-space: nowrap;

css/backoffice/components/_title.scss

@@ -11,9 +11,12 @@ $ibo-title--icon--size: 90px !default;
 $ibo-title--icon--size-2: 80px !default;
 $ibo-title--icon--size-3: 70px !default;
 
-$ibo-title--icon-background--size--must-contain: contain !default;
-$ibo-title--icon-background--size--must-cover: cover !default;
-$ibo-title--icon-background--size--must-zoomout: 66.67% !default;
+$ibo-title--icon-background--size--must-contain: contain !default; // deprecated, to be removed in favor of $ibo-title--icon-img--size--must-contain
+$ibo-title--icon-background--size--must-cover: cover !default; // deprecated, to be removed in favor of $ibo-title--icon-img--size--must-cover
+$ibo-title--icon-background--size--must-zoomout: 66.67% !default; // deprecated, to be removed in favor of $ibo-title--icon-img--size--must-zoomout
+$ibo-title--icon-img--size--must-contain: $ibo-title--icon-background--size--must-contain !default; // TODO remove when dealing with N°9317
+$ibo-title--icon-img--size--must-cover: $ibo-title--icon-background--size--must-cover !default; // TODO remove when dealing with N°9317
+$ibo-title--icon-img--size--must-zoomout: $ibo-title--icon-background--size--must-zoomout !default; // TODO remove when dealing with N°9317
 
 
 .ibo-title {
@@ -44,24 +47,27 @@ $ibo-title--icon-background--size--must-zoomout: 66.67% !default;
   min-height: $ibo-title--icon--size-3;
 }
 
-.ibo-title--icon-background {
+.ibo-title--icon-img, .ibo-title--icon-background { // second class is deprecated, remove it when dealing with N°9317
   width: 100%;
   height: 100%;
-  background-position: center;
-  background-repeat: no-repeat;
-  background-size: $ibo-title--icon-background--size--must-contain;
+  object-position: center;
+  object-fit: $ibo-title--icon-img--size--must-contain;
+  background-size: $ibo-title--icon-img--size--must-contain;
 }
 
-.ibo-title--icon-background--must-contain {
-  background-size: $ibo-title--icon-background--size--must-contain;
+.ibo-title--icon-img--must-contain, .ibo-title--icon-background--must-contain { // second class is deprecated, remove it when dealing with N°9317
+  object-fit: $ibo-title--icon-img--size--must-contain;
+  background-size: $ibo-title--icon-img--size--must-contain;
 }
 
-.ibo-title--icon-background--must-cover {
-  background-size: $ibo-title--icon-background--size--must-cover;
+.ibo-title--icon-img--must-cover, .ibo-title--icon-background--must-cover { // second class is deprecated, remove it when dealing with N°9317
+  object-fit: $ibo-title--icon-img--size--must-cover;
+  background-size: $ibo-title--icon-img--size--must-cover;
 }
 
-.ibo-title--icon-background--must-zoomout {
-  background-size: $ibo-title--icon-background--size--must-zoomout;
+.ibo-title--icon-img--must-zoomout, .ibo-title--icon-background--must-zoomout { // second class is deprecated, remove it when dealing with N°9317
+  width: $ibo-title--icon-img--size--must-zoomout;
+  height: $ibo-title--icon-img--size--must-zoomout;
 }
 
 .ibo-title--for-object-details {

css/backoffice/components/input/_input-select-icon.scss

@@ -3,9 +3,9 @@
  * @license     http://opensource.org/licenses/AGPL-3.0
  */
 
-$ibo-input-select-icon--menu--icon--max-height: 100% !default;
-$ibo-input-select-icon--menu--icon--max-width: 100% !default;
-$ibo-input-select-icon--icon--padding-right: $ibo-spacing-200 !default;
+$ibo-input-select-icon--max-height: 100% !default;
+$ibo-input-select-icon--max-width: 100% !default;
+$ibo-input-select-icon--padding-right: $ibo-spacing-200 !default;
 
 $ibo-input-select-icon--menu--z-index: 21 !default;
 $ibo-input-select-icon--menu--max-height: 300px !default;
@@ -18,9 +18,9 @@ $ibo-input-select-icon--menu--icon--margin-right: 10px !default;
   display: inline-flex;
   text-align: left;
 	>img{
-		max-height: $ibo-input-select-icon--menu--icon--max-height;
-		max-width: $ibo-input-select-icon--menu--icon--max-width;
-		padding-right: $ibo-input-select-icon--icon--padding-right;
+		max-height: $ibo-input-select-icon--max-height;
+		max-width: $ibo-input-select-icon--max-width;
+		padding-right: $ibo-input-select-icon--padding-right;
 	}
   >span{
     overflow: hidden;

css/backoffice/components/input/_input-select.scss

@@ -203,8 +203,9 @@ $ibo-input-select--autocomplete-item-image--border: 1px solid $ibo-color-grey-60
 }
 
 // N°7982 Default selectize stylesheet override
+// N°9468 Dropdown content needs to be a few pixel shorter than the dropdown itself to avoid double scrollbar
 .selectize-dropdown-content{
-  max-height: $ibo-input-select-selectize--dropdown--max-height;
+  max-height: calc(#{$ibo-input-select-selectize--dropdown--max-height} - 4px);
 }
 
 .selectize-dropdown.ui-menu .ui-state-active {

css/backoffice/components/input/_input-toggler.scss

@@ -8,6 +8,7 @@ $ibo-toggler--wrapper--height: 20px !default;
 
 $ibo-toggler--slider--border-radius: $ibo-border-radius-900 !default;
 $ibo-toggler--slider--background-color: $ibo-color-secondary-600 !default;
+$ibo-toggler--slider--disabled--background-color: $ibo-color-secondary-200 !default;
 
 $ibo-toggler--slider--before--left: 3px !default;
 $ibo-toggler--slider--before--bottom: 3px !default;
@@ -17,6 +18,7 @@ $ibo-toggler--slider--before--border-radius: $ibo-border-radius-full !default;
 $ibo-toggler--slider--before--background-color: $ibo-color-grey-100 !default;
 
 $ibo-toggler--slider--checked--background-color: $ibo-color-primary-600 !default;
+$ibo-toggler--slider--checked-disabled--background-color: $ibo-color-primary-200 !default;
 $ibo-toggler--slider--focus--box-shadow: 0 0 1px $ibo-color-primary-600 !default;
 
 $ibo-toggler--label--margin-left: 4px !default;
@@ -61,6 +63,13 @@ $ibo-toggler--label--margin-left: 4px !default;
   background-color: $ibo-toggler--slider--checked--background-color;
 }
 
+.ibo-toggler--wrapper input:disabled + .ibo-toggler--slider {
+  background-color: $ibo-toggler--slider--disabled--background-color;
+}
+.ibo-toggler--wrapper input:checked:disabled + .ibo-toggler--slider {
+  background-color: $ibo-toggler--slider--checked-disabled--background-color;
+}
+
 input:focus + .ibo-toggler--slider {
   box-shadow: $ibo-toggler--slider--focus--box-shadow;
 }

css/backoffice/layout/_all.scss

@@ -15,3 +15,4 @@
 @import "wizard-container/wizard-container";
 @import "object/all";
 @import "activity-panel/all";
+@import "extension/all";

css/backoffice/layout/extension/_all.scss

@@ -0,0 +1 @@
+@import "extension-details";

css/backoffice/layout/extension/_extension-details.scss

@@ -0,0 +1,76 @@
+$ibo-extension-details--information--metadata--padding: $ibo-spacing-200 !default;
+$ibo-extension-details--information--metadata--delimiter: "-" !default;
+$ibo-extension-details--information--metadata--color: $ibo-color-grey-700 !default;
+$ibo-extension-details--actions--button--padding-y: 3px !default;
+$ibo-extension-details--actions--button--padding-x: $ibo-button--padding-x !default;
+
+.ibo-extension-details {
+	display: inline-flex;
+	flex-direction: row;
+	justify-content: space-between;
+	align-items: center;
+	width: 100%;
+}
+
+.ibo-extension-details--information {
+	flex-grow: 1;
+	display: flex;
+	flex-direction: column;
+}
+
+.ibo-extension-details--actions {
+	display: flex;
+}
+
+.ibo-extension-details--information--label {
+	@extend %ibo-font-ral-med-150;
+}
+
+.ibo-extension-details--information--metadata {
+	@extend %ibo-font-ral-med-100;
+	color: $ibo-extension-details--information--metadata--color;
+}
+
+.ibo-extension-details--information--description {
+	@extend %ibo-font-ral-med-100;
+}
+
+.ibo-extension-details--information--metadata span + span:before {
+	content: $ibo-extension-details--information--metadata--delimiter;
+	padding-left: $ibo-extension-details--information--metadata--padding;
+	padding-right: $ibo-extension-details--information--metadata--padding;
+}
+
+//ibo-extension-details can have other ibo-extension-details inside its ibo-extension-details--information--description in the setup. We need to only affect direct children
+.ibo-extension-details:has(>.ibo-extension-details--actions  input:is([type="checkbox"], [type="radio"]):checked){
+	&>.ibo-extension-details--information>.ibo-extension-details--information--label .ibo-badge.unchecked {
+		display: none;
+	}
+}
+//Merging the two lines below with :is([type="checkbox"], [type="radio"]) will generate a warning in scss compiler
+.ibo-extension-details:has(>.ibo-extension-details--actions input[type="checkbox"]:not(:checked)),
+.ibo-extension-details:has(>.ibo-extension-details--actions input[type="radio"]:not(:checked)) {
+	&>.ibo-extension-details--information>.ibo-extension-details--information--label .ibo-badge.checked {
+		display: none;
+	}
+}
+
+
+.ibo-extension-details--actions > button {
+	padding: $ibo-extension-details--actions--button--padding-y $ibo-extension-details--actions--button--padding-x;
+}
+
+.ibo-extension-details--actions:has(.toggler-install:not(:disabled)) .ibo-popover-menu--section a[data-resource-id="force_uninstall"] {
+	display: none;
+}
+
+.ibo-extension-details .ibo-popover-menu ~ .ibo-button{
+	visibility: hidden;
+}
+.ibo-extension-details .ibo-popover-menu:has(.ibo-popover-menu--item) ~ .ibo-button{
+	visibility: visible;
+}
+
+.ibo-extension-details .ibo-toggler--wrapper:has(.ibo-toggler.ibo-is-hidden){
+	visibility: hidden;
+}

css/backoffice/layout/multi-column/_multi-column.scss

@@ -5,9 +5,11 @@
 
 $ibo-multi-column--margin-x: -$ibo-spacing-500 !default; /* This is to compensate columns padding and make the whole multicolumn align with the parent borders (cf. Bootstrap rows / cols) */
 $ibo-multi-column--margin-y: $ibo-spacing-0 !default;
+$ibo-multi-column--row-gap: $ibo-spacing-800 !default;
 
 .ibo-multi-column {
   display: flex;
   flex-wrap: wrap;
   margin: $ibo-multi-column--margin-y $ibo-multi-column--margin-x;
+  row-gap: $ibo-multi-column--row-gap;
 }

css/backoffice/pages/_data-synchro.scss

@@ -80,4 +80,14 @@ $ibo-data-synchro-source--synoptics--cell--arrow--border: 2px solid $ibo-data-sy
 }
 .ibo-data-synchro-source--replicas-status--warning{
   margin: $ibo-data-synchro-source--replicas-status--warning--margin;
+}
+
+.ibo-page-header--replica-title{
+  display: table;
+  width: 100%;
+
+  >.ibo-toolbar--button{
+    display: table-cell;
+    vertical-align: middle;
+  }
 }

css/backoffice/pages/_datamodel-viewer.scss

@@ -3,9 +3,29 @@
  * @license     http://opensource.org/licenses/AGPL-3.0
  */
 
+$ibo-datamodel-viewer--viewer-empty--width: max(20%, #{$ibo-size-700}) !default;
+
 $ibo-datamodel-viewer--parent--spacer--padding-y: $ibo-spacing-0 !default;
 $ibo-datamodel-viewer--parent--spacer--padding-x: $ibo-spacing-300 !default;
 
+$ibo-datamodel-viewer--breadcrumb--margin: $ibo-spacing-200 0 !default;
+
+$ibo-datamodel-viewer--classname--font-family: monospace !default;
+$ibo-datamodel-viewer--classname--color: $ibo-color-blue-grey-600 !default;
+
+$ibo-datamodel-viewer--tag--category--color: $ibo-color-blue-grey-800 !default;
+$ibo-datamodel-viewer--tag--category--icon--color: $ibo-color-blue-grey-600 !default;
+
+$ibo-datamodel-viewer--abstract-class-icon--margin-right: $ibo-spacing-300 !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--content: 'A' !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--width: 15px !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--height: 15px !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--line-height: 14px !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--border-radius: 50% !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--border: 1px solid $ibo-color-cyan-500 !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--color: $ibo-color-white-100 !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--background-color: $ibo-color-cyan-500 !default;
+
 $ibo-datamodel-viewer--classes-list--selectize-input--background-color: $ibo-color-white-100 !default;
 $ibo-datamodel-viewer--classes-list--selectize-input--color: $ibo-color-grey-800 !default;
 $ibo-datamodel-viewer--classes-list--selectize-input--border-color: $ibo-color-grey-500 !default;
@@ -16,8 +36,9 @@ $ibo-datamodel-viewer--origin-cell--diameter: 8px !default;
 $ibo-datamodel-viewer--origin-cell--border-radius: $ibo-border-radius-full !default;
 
 $ibo-datamodel-viewer--classes-list--height: 100% !default;
-$ibo-datamodel-viewer--classes-list--width: 350px !default;
+$ibo-datamodel-viewer--classes-list--width: $ibo-size-700 !default;
 $ibo-datamodel-viewer--classes-list--padding-left: $ibo-spacing-600 !default;
+$ibo-datamodel-viewer--classes-list--padding-top: $ibo-spacing-300 !default;
 
 $ibo-datamodel-viewer--lifecycle--code--color: $ibo-color-grey-700 !default;
 $ibo-datamodel-viewer--lifecycle--stimuli--color: $ibo-color-blue-900 !default;
@@ -45,6 +66,56 @@ $ibo-datamodel-viewer--lifecycle-image--margin-bottom: $ibo-spacing-500 !default
   .ibo-panel--subtitle{
     @extend %ibo-font-ral-nor-150;
   }
+  .ibo-datamodel-viewer--empty{
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    svg{
+      width: $ibo-datamodel-viewer--viewer-empty--width;
+    }
+  }
+}
+
+.ibo-datamodel-viewer--empty--text {
+  @extend %ibo-font-ral-med-400
+}
+
+.ibo-datamodel-viewer--breadcrumb{
+  @extend %ibo-font-ral-med-150;
+  margin: $ibo-datamodel-viewer--breadcrumb--margin;
+  .ibo-button{
+    text-transform: none; // unset uppercase
+  }
+}
+
+.ibo-datamodel-viewer--classname{
+  color: $ibo-datamodel-viewer--classname--color;
+  @extend %ibo-font-code-100;
+}
+
+.ibo-datamodel-viewer--tag--category{
+  color: $ibo-datamodel-viewer--tag--category--color;
+  .ibo-object-details--tag-icon{
+    color:$ibo-datamodel-viewer--tag--category--icon--color;
+  }
+}
+
+.ibo-datamodel-viewer--icon--abstract{
+  &:after{
+    content: $ibo-datamodel-viewer--abstract-class-icon--after--content;
+    display: inline-flex;
+    justify-content: center;
+    align-items: center;
+    width: $ibo-datamodel-viewer--abstract-class-icon--after--width;
+    height: $ibo-datamodel-viewer--abstract-class-icon--after--height;
+    line-height: $ibo-datamodel-viewer--abstract-class-icon--after--line-height;
+    border-radius: $ibo-datamodel-viewer--abstract-class-icon--after--border-radius;
+    border: $ibo-datamodel-viewer--abstract-class-icon--after--border;
+    color: $ibo-datamodel-viewer--abstract-class-icon--after--color;
+    background-color: $ibo-datamodel-viewer--abstract-class-icon--after--background-color;
+
+    @extend %ibo-font-ral-bol-50;
+  }
 }
 
 .ibo-datamodel-viewer--parent--spacer{
@@ -80,6 +151,7 @@ $ibo-datamodel-viewer--lifecycle-image--margin-bottom: $ibo-spacing-500 !default
   height: $ibo-datamodel-viewer--classes-list--height;
   width: $ibo-datamodel-viewer--classes-list--width;
   padding-left: $ibo-datamodel-viewer--classes-list--padding-left;
+  padding-top: $ibo-datamodel-viewer--classes-list--padding-top;
   overflow-y: scroll;
 }
 

css/backoffice/vendors/_bulma-variables-overload.scss

@@ -21,6 +21,7 @@ $text-strong: inherit !default;
  * See https://bulma.io/documentation/elements/content/
  */
 $content-block-margin-bottom: 0 !default;
+$content-blockquote-background-color: $ibo-color-grey-200 !default;
 
 /* Table: Reset style as much as possible to match rich text editor preview, which is the browser's default stylesheet.
  * As there is no way to avoid bulma rules, we simply make them invalid by setting an invalid variable value, the rules will then be ignored by the browser.

css/backoffice/vendors/_selectize.scss

@@ -29,7 +29,7 @@ $ibo-vendors-selectize--element--active--background: $ibo-color-blue-100 !defaul
 $ibo-vendors-selectize--element--active--color: $ibo-color-grey-900 !default;
 
 $ibo-vendors-selectize--dropdown--background-color: $ibo-vendors-selectize-input--background-color !default;
-$ibo-vendors-selectize--dropdown--color:  $ibo-vendors-selectize-input--color!default;
+$ibo-vendors-selectize--dropdown--color: $ibo-vendors-selectize-input--color !default;
 
 $ibo-vendors-selectize--header--padding-x: 8px !default;
 $ibo-vendors-selectize--header--padding-y: 5px !default;

css/backoffice/vendors/ckeditor/_overloads.scss

@@ -28,6 +28,15 @@ $ibo-vendors-ckeditor--ck-mentions--item--padding-x: $ibo-spacing-300 !default;
 $ibo-vendors-ckeditor--ck-mentions--item--padding-y: $ibo-spacing-200 !default;
 
 /* CSS3 variables */
+:root {
+  --ck-content-font-family: inherit;
+  --ck-content-font-color: inherit;
+  --ck-content-font-size: inherit;
+  --ck-content-line-height: inherit;
+  --ck-content-word-break: inherit;
+  --ck-content-overflow-wrap: inherit;
+}
+
 .ck {
   --ck-color-list-button-on-background: #{$ibo-vendors-ckeditor--ck-color-list-button-on-background};
   --ck-color-list-button-on-background-focus: #{$ibo-vendors-ckeditor--ck-color-list-button-on-background-focus};
@@ -61,7 +70,7 @@ $ibo-vendors-ckeditor--ck-mentions--item--padding-y: $ibo-spacing-200 !default;
   }
 }
 
-.ck-editor__editable_inline:not(.ck-comment__input *) {
+.ck-editor__editable_inline:not(.ck-comment__input *), .ck-source-editing-area {
   height: 200px;
 }
 
@@ -75,11 +84,6 @@ $ibo-vendors-ckeditor--ck-mentions--item--padding-y: $ibo-spacing-200 !default;
   }
 }
 
-// N°7552 Allow source editing area to be scrollable in full screen
-.ck-maximize_editor_main .ck-source-editing-area textarea{
-  overflow: auto !important;
-}
-
 /* Mentions */
 .ck-mentions {
   .ck-button {

css/common/utils/helpers/_text-decoration.scss

@@ -4,7 +4,7 @@
  */
 
 /* SCSS variables */
-$common-has-description--content: "\1F6C8" !default;
+$common-has-description--content: "?" !default;
 $common-has-description--padding-left: $common-spacing-200 !default;
 $common-has-description--color: $common-color-grey-600 !default;
 $common-has-description--font-size: 0.7em !default; /* Font size is em on purpose as we want it to be proportional to its context */

css/common/utils/helpers/_typography.scss

@@ -11,6 +11,9 @@
  *
  * Usage: @extend %common-font-size-XXX;
  */
+%common-font-size-20 {
+  font-size: $common-font-size-20;
+}
 %common-font-size-50 {
   font-size: $common-font-size-50;
 }