Faf Service Locator

* N°10006 - Incorrect display of audit errors in iTOP - fix export-v2 from audit

* N°10006 - Incorrect display of audit errors in iTOP - fix export-v2 from audit

* N°10006 - handle no class allowed in read corner case

* N°1006 - fix export-v2 with OQLRequest and without fields

.doc/itop-version-history.md

@@ -2,12 +2,17 @@
 
 ```mermaid
 %%{init: { 'logLevel': 'debug', 'theme': 'base', 'themeVariables': {
-              'git0': 'lawngreen',
-              'git3': 'dodgerblue',
-              'git4': 'grey',
-              'git5': 'grey',
-              'git6': 'grey',
-              'git7': 'grey'
+              'git0': '#7ccf00',
+              'git1': '#7ccf00',
+              'git2': '#99a1af',
+              'git3': '#99a1af',
+              'git4': '#99a1af',
+              'git5': '#99a1af',
+              'git6': '#99a1af',
+              'git7': '#99a1af',
+              'git8': '#99a1af',
+              'git9': '#99a1af',
+              'git10': '#99a1af'
        }, 'gitGraph': {'showBranches': true,'mainBranchName': 'develop','rotateCommitLabel': true}} }%%
 gitGraph
     commit id: "2016-07-06" tag: "2.3.0" type: HIGHLIGHT
@@ -86,24 +91,30 @@ gitGraph
     commit id: "2024-01-17a" tag: "2.7.10"
     checkout support/3.0
     commit id: "2024-01-17b" tag: "3.0.4"
+    checkout support/2.7
+    commit id: "2024-09-28" tag: "2.7.11"
+    checkout support/3.1
+    commit id: "2024-09-27" tag: "3.1.2"
     checkout support/3.2
     commit id: "2024-06-25" tag: "3.2.0-beta1" type: REVERSE
     commit id: "2024-08-07" tag: "3.2.0"
-    commit id: "2024-09-13" tag: "3.2.0-2"
-    checkout support/3.1
-    commit id: "2024-09-27" tag: "3.1.2"
     checkout support/2.7
-    commit id: "2024-09-28" tag: "2.7.11"
-    checkout support/2.7
-    commit id: "2025-02-25" tag: "2.7.12"
+    commit id: "2025-02-07a" tag: "2.7.12"
     checkout support/3.1
-    commit id: "2025-02-25 " tag: "3.1.3"
+    commit id: "2025-02-07b" tag: "3.1.3"
     checkout support/3.2
-    commit id: "2025-02-25  " tag: "3.2.1"
-    commit id: "2025-04-08" tag: "3.2.1-1"
-    commit id: "2025-08-19" tag: "3.2.2-1"
+    commit id: "2025-02-07c " tag: "3.2.1"
+    commit id: "2025-03-31 " tag: "3.2.1-1"
+    commit id: "2025-07-28 " tag: "3.2.2"
     checkout support/2.7
-    commit id: "2025-10-07" tag: "2.7.13"
+    commit id: "2025-09-25" tag: "2.7.13"
+    checkout support/3.2
+    commit id: "2026-04-27 " tag: "3.2.3"
+    checkout support/3.2.3
+    commit id: "2026-05-25 " tag: "3.2.3-1"
+    commit id: "2026-07-17 " tag: "3.2.3-2"
+    checkout develop
+    commit id: "2026-07-23" tag: "3.3.0-beta1"
 ```
 
 To learn more, check the [iTop community versions history on the official wiki](https://www.itophub.io/wiki/page?id=latest:release:start).

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,60 @@
+name: "Bug report"
+description: "Report a bug that you identified in iTop"
+type: bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please explain why you're creating this issue :
+        - Are you willing to create a PR for the bug fix ? If so, we'll indicate in the issue if we're interested in it.
+        - Then, please describe how to reproduce the issue.
+
+  - type: dropdown
+    id: willing_to_pr
+    attributes:
+      label: Are you willing to create (at a later stage) a PR for that?
+      options:
+        - 'Yes'
+        - 'No'
+    validations:
+      required: true
+
+  - type: input
+    id: itop_version
+    attributes:
+      label: iTop version
+      description: "Complete iTop version (e.g., 3.2.3)"
+    validations:
+      required: false
+
+  - type: input
+    id: php_version
+    attributes:
+      label: PHP version
+      description: "Complete PHP version (e.g., 8.4.20)"
+    validations:
+      required: false
+
+  - type: textarea
+    id: reproduction_steps
+    attributes:
+      label: Reproduction procedure
+      description: |
+        Please explain step by step how to reproduce the issue on a standard iTop Community.
+        If it requires a custom datamodel, provide the minimal XML delta to reproduce it.
+      placeholder: |
+        1. First go there
+        2. Then do that
+        3. ...
+        4. Finally, see that... (what is expected and what is actually happening)
+    validations:
+      required: false
+
+  - type: upload
+    id: additional_info
+    attributes:
+      label: Additional information (if needed)
+      description: "Add/drag and drop screenshots, logs or any files that can be relevant for your issue."
+    validations:
+      required: false
+      accept: ".png, .jpg, .jpeg, .gif, .webp, .log, .txt, .json, .csv, .xml, .zip"

.github/ISSUE_TEMPLATE/enhancement.yml

@@ -0,0 +1,48 @@
+name: "Enhancement suggestion"
+description: "Suggest an improvement to iTop"
+type: feature
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please explain why you're creating this issue :
+        - Please describe what's your improvement proposition.
+        - Then tell us if you're willing to create a PR for this enhancement ? If so, we'll indicate in the issue if we're interested in it.
+        - The more users are affected and the greater is the impact, the more likely this improvement will be accepted. If you identified a bug and have an improvement proposition, please use the 'Bug report' template instead."
+
+  - type: textarea
+    id: enhancement_details
+    attributes:
+      label: Enhancement details
+      description: |
+        Please explain what you want to improve, and your proposition to make it better.
+        If it requires a custom datamodel, provide the minimal XML delta to reproduce it.
+    validations:
+      required: false
+
+  - type: input
+    id: itop_version
+    attributes:
+      label: iTop version (if appropriate)
+      description: "Complete iTop version (e.g., 3.2.3)"
+    validations:
+      required: false
+
+  - type: dropdown
+    id: willing_to_pr
+    attributes:
+      label: Are you willing to create (at a later stage) a PR for that?
+      options:
+        - 'Yes'
+        - 'No'
+    validations:
+      required: true
+
+  - type: upload
+    id: additional_info
+    attributes:
+      label: Additional information (if needed)
+      description: "Add/drag and drop screenshots, logs or any files that can be relevant for your issue."
+    validations:
+      required: false
+      accept: ".png, .jpg, .jpeg, .gif, .webp, .log, .txt, .json, .csv, .xml, .zip"

.github/pull_request_template.md

@@ -1,83 +1,78 @@
 <!--
+IMPORTANT: Before creating your PR, please create an issue first to know if Combodo is interested in your contribution (not needed for translations PR).
+Since we may refuse a PR, it's preferable to create an issue first, to avoid spending time coding something that won't be accepted.
+PR that will benefit the most users and has a greater impact on the product are more likely to be accepted, so please explain your use case and why you think it would be useful for the community.
 
-IMPORTANT: Please follow the guidelines within this PR template before submitting it, it will greatly help us process your PR. 🙏
+Once you've done it, and we confirmed we're interested in it, please follow the guidelines within this PR template before submitting it, it will greatly help us process your PR. 🙏
 
 Any PRs not following the guidelines or with missing information will not be considered.
-
 -->
 
 ## Base information
-| Question                                                      | Answer 
-|---------------------------------------------------------------|--------
-| Related to a SourceForge thread / Another PR / Combodo ticket? | <!-- Put the URL -->
-| Type of change?                                               | Bug fix / Enhancement / Translations
 
+| Question                                                                        | Answer                                |
+|---------------------------------------------------------------------------------|---------------------------------------|
+| Related to a SourceForge thread / Another PR / A GitHub Issue / Combodo ticket? | <!-- Put the URL or ticket number --> |
+| Type of change?                                                                 | Bug fix / Enhancement / Translations  |
 
 ## Symptom (bug) / Objective (enhancement)
+
 <!--
 If it's a bug
   - Explain the symptom in details
   - If possible put error messages, logs or screenshots (you can paste image directly in this editor).
 
 If it's an enhancement
-  - Describe what is blocking you, what is the objective with as much details as possible.
+  - Describe what is blocking you, what is the objective with as many details as possible.
   - Add screenshots if it's related to UI.
 -->
 
-
 ## Reproduction procedure (bug)
+
 <!--
-Remove this section only if it's NOT a bug.
-
-Otherwise, explain step by step how to reproduce the issue on a standard iTop Community.
-
+Please explain step by step how to reproduce the issue on a standard iTop Community.
 If it requires a custom datamodel, provide the minimal XML delta to reproduce it on a standard iTop Community.
 -->
 
 1. On iTop x.y.z <!-- Put complete iTop version (eg. 3.1.0-2) -->
 2. With PHP x.y.z <!-- Put complete PHP version (eg. 8.1.24) -->
-2. First go there
-2. Then do that
-3. ...
-4. Finally, see that...
+3. First go there
+4. Then do that
+5. ...
+6. Finally, see that... (what is expected and what is actually happening)
 
+## Reproduction procedure (enhancement - if needed)
+
+<!--
+Please explain how we can reproduce the feature/behavior you want to improve, and what's your proposition to make it better.
+Add screenshots if it's related to UI.
+If it requires a custom datamodel, provide the minimal XML delta to reproduce it on a standard iTop Community.
+-->
 
 ## Cause (bug)
+
 <!--
 Remove this section only if it's NOT a bug.
 
 Otherwise, explain what is the cause of the issue (where in the code and why)
 -->
 
-
 ## Proposed solution (bug and enhancement)
+
 <!--
 Explain in details how you are proposing to solve this:
   - What did you do in the code and why
   - If you changed something in the UI, put before / after screenshots (you can paste image directly in this editor)
 -->
 
-
 ## Checklist before requesting a review
+
 <!--
 Don't remove these lines, check them once done.
 -->
+
+- [ ] If my PR is a bug fix or an enhancement, I opened an issue that got reviewed and approved by Combodo
 - [ ] I have performed a self-review of my code
 - [ ] I have tested all changes I made on an iTop instance
 - [ ] I have added a unit test, otherwise I have explained why I couldn't
-- [ ] Is the PR clear and detailed enough so anyone can understand digging in the code?
-
-## Checklist of things to do before PR is ready to merge
-<!--
-Things that needs to be done in the PR before it can be considered as ready to be merged
-
-Examples:
-- Changes requested in the review
-- Unit test to add
-- Dictionary entries to translate
-- ...
--->
-
-- [ ] ...
-- [ ] ...
-- [ ] ...
+- [ ] Is the PR clear and detailed enough so anyone can understand without digging in the code?

.github/workflows/action.yml

@@ -1,9 +1,13 @@
 name: Add PRs to Combodo PRs Dashboard
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
+  issues:
+    types:
+      - opened
+  workflow_call:
 
 jobs:
   add-to-project:
@@ -31,23 +35,22 @@ jobs:
         run: |
           curl -X POST -H "Authorization: token ${{ secrets.PR_AUTOMATICALLY_ADD_TO_PROJECT }}" \
             -H "Accept: application/vnd.github.v3+json" \
-            https://api.github.com/repos/Combodo/iTop/issues/${{ github.event.pull_request.number }}/labels \
+            https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels \
             -d '{"labels":["internal"]}'
 
       - name: Set PR author as assignee if member of the organization
-        if: env.is_member == 'true'
+        if: env.is_member == 'true' && github.event_name == 'pull_request'
         run: |
           curl -L \
             -X POST \
             -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${{ secrets.PR_AUTOMATICALLY_ADD_TO_PROJECT }}" \
-            https://api.github.com/repos/Combodo/iTop/issues/${{ github.event.pull_request.number }}/assignees \
+            https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/assignees \
             -d '{"assignees":["${{ github.event.pull_request.user.login }}"]}'
         env:
           is_member: ${{ env.is_member }}
-
       - name: Add PR to the appropriate project
-        uses: actions/add-to-project@v1.0.2
+        uses: actions/add-to-project@v2
         with:
           project-url: ${{ env.project_url }}
           github-token: ${{ secrets.PR_AUTOMATICALLY_ADD_TO_PROJECT }}

CONTRIBUTING.md

@@ -4,30 +4,33 @@ You want to contribute to iTop? Many thanks to you! 🎉 👍
 
 Here are some guidelines that will help us integrate your work!
 
-
-
+## Contributions
 
 ### Subjects
+
 You are welcome to create pull requests on any of those subjects:
 
 * 🐛 bug fix
 * 🌐 translation / i18n / l10n
+* 🚸 enhancement
 
-If you want to implement a **new feature**, please [create a corresponding ticket](https://sourceforge.net/p/itop/tickets/new/) for review.   
-If you ever want to begin implementation, do so in a fork, and add a link to the corresponding commits in the ticket.
+But before creating a PR, please [create a corresponding issue][itop-issues] for review.
+We should review within two weeks, and get back to you to indicate if we're interested in your proposal or not.
+If you don't create an issue, you won't know if we're interested in your contribution, and you may spend time coding something that won't be accepted.
+If you ever want to begin implementation, do so in a fork, and add a link to the corresponding commits in the issue.
 
 For all **security related subjects**, please see our [security policy](SECURITY.md).
 
-All **datamodel modification** should be done in an extension. Beware that such change would 
-impact all existing customers, and could prevent them from 
-upgrading!
-Combodo has a long experience of datamodel changes: they are very disruptive! 
+All **datamodel modification** should be done in an extension. Beware that such change would
+impact all existing customers, and could prevent them from upgrading!
+Combodo has a long experience of datamodel changes: they are very disruptive!
 This is why we avoid them in iTop core, especially the changes on existing objects/fields.   
-If you have an idea you're sure would benefit to all of iTop users, you may 
-[create a corresponding ticket](https://sourceforge.net/p/itop/tickets/new/) to submit it, but be warned that there are lots of good 
+If you have an idea you're sure would benefit to all of iTop users, you may
+[create a corresponding issue][itop-issues] to submit it, but be warned that there are lots of good
 reasons to refuse such changes.
 
 ### 📄 License and copyright
+
 iTop is distributed under the AGPL-3.0 license (see the [license.txt] file).
 
 The iTop repository is divided in three parts: iTop (mainly PHP/JS/XML sources and dictionaries), images, and third-party libraries.
@@ -37,48 +40,33 @@ Anyhow, you are encouraged to signal your contribution by the mean of `@author`
 If you want to use another license or keep the code ownership (copyright), you may [create an extension][wiki new ext].
 
 [license.txt]: https://github.com/Combodo/iTop/blob/develop/license.txt
-[wiki new ext]: https://www.itophub.io/wiki/page?id=latest%3Acustomization%3Astart#by_writing_your_own_extension
 
+[itop-issues]: https://github.com/Combodo/iTop/issues
+
+[wiki new ext]: https://www.itophub.io/wiki/page?id=latest%3Acustomization%3Astart#by_writing_your_own_extension
 
 ## 🔀 iTop branch model
 
 When we first start with Git, we were using the [GitFlow](https://nvie.com/posts/a-successful-git-branching-model/) branch model. As
- there was some confusions about branches to use for current developed release and previous maintained release, and also because we were
- using just a very few of the GitFlow commands, we decided to add just a little modification to this branch model : since april 2020
-  we don't have a `master` branch anymore.
+there was some confusions about branches to use for current developed release and previous maintained release, and also because we were
+using just a very few of the GitFlow commands, we decided to add just a little modification to this branch model : since April 2020
+we don't have a `master` branch anymore.
 
-Here are the branches we use and their meaning : 
+Here are the branches we use and their meaning :
 
 - `develop`: ongoing development version
-- `release/*`: if present, that means we are working on a alpha/beta/rc version for shipping
 - `support/*`: maintenance branches for older versions
 
 For example, if no version is currently prepared for shipping we could have:
 
-- `develop` containing future 3.1.0 version
-- `support/3.0`: 3.0.x maintenance version
-- `support/2.7`: 2.7.x maintenance version
-- `support/2.6`: 2.6.x maintenance version
+- `develop` containing future 3.3.0 version
+- `support/3.2`: 3.2.x maintenance version
 
-In this example, when 3.1.0-beta is shipped that will become:
-
-- `develop`: future 3.2.0 version
-- `release/3.1.0`: 3.1.0-beta
-- `support/3.0`: 3.0.x maintenance version
-- `support/2.7`: 2.7.x maintenance version
-- `support/2.6`: 2.6.x maintenance version
-
-And when 3.1.0 final will be out:
-
-- `develop`: future 3.2.0 version
-- `support/3.1`: 3.1.x maintenance version (will host developments for 3.1.1)
-- `support/3.0`: 3.0.x maintenance version
-- `support/2.7`: 2.7.x maintenance version
-- `support/2.6`: 2.6.x maintenance version
-
-Also note that we have a "micro-version" concept : each of those versions have a very small amount of modifications. They are made from
- `support/*` branches as well. For example 2.6.2-1 and 2.6.2-2 were made from the `support/2.6.2` branch. 
+And when 3.3.0 will be out:
 
+- `develop`: future 3.4.0 version
+- `support/3.3`: 3.3.x maintenance version (will host developments for 3.3.1)
+- `support/3.2`: 3.2.x maintenance version
 
 ## Coding
 
@@ -92,12 +80,11 @@ A [dedicated page](https://www.itophub.io/wiki/page?id=latest%3Acustomization%3A
 2. Create a branch in this fork, based on the develop branch
 3. Code !
 
-Do create a dedicated branch for each modification you want to propose : if you don't it will be very hard to merge back your work !
+Do create a dedicated branch for each modification you want to propose : if you don't, it will be very hard to merge back your work !
 
-Most of the time you should based your developments on the develop branch.    
+Most of the time you should base your developments on the develop branch.    
 That may be different if you want to fix a bug, please use develop anyway and ask in your PR if rebase is possible.
 
-
 ### 🎨 PHP styleguide
 
 Please follow [our guidelines](https://www.itophub.io/wiki/page?id=latest%3Acustomization%3Acoding_standards).
@@ -106,7 +93,7 @@ Please follow [our guidelines](https://www.itophub.io/wiki/page?id=latest%3Acust
 
 Please create tests that covers as much as possible the code you're submitting.
 
-Our tests are located in the `test/` directory, containing a PHPUnit config file : `phpunit.xml.dist`.
+Our tests are located in the `tests/` directory, containing a PHPUnit config file : `phpunit.xml.dist`.
 
 ### Git Commit Messages
 
@@ -138,14 +125,14 @@ When your code is working, please:
 * Rebase your branch on our repo last commit,
 * Create a pull request. _Detailed procedure to work on fork and create PR is available [in GitHub help pages](https://help.github.com/articles/creating-a-pull-request-from-a-fork/)_.
 * Pull request description: mind to add all the information useful to understand why you're suggesting this modification and anything necessary to dive into your work. Especially:
-  - Bugfixes: exact steps to reproduce the bug (given/when/then), description of the bug cause and what solution is implemented 
-  - Enhancements: use cases, implementation details if needed
-* Mind to check the "[Allow edits from maintainers](https://docs.github.com/en/github-ae@latest/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork)" option ! (note that if you are working with an org fork, this option [won't be available](https://github.com/orgs/community/discussions/5634))
-
+    - Bugfixes: exact steps to reproduce the bug (given/when/then), description of the bug cause and what solution is implemented
+    - Enhancements: use cases, implementation details if needed
+* Mind to check the "[Allow edits from maintainers](https://docs.github.com/en/github-ae@latest/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork)" option ! (note that if you are working with an org fork, this
+  option [won't be available](https://github.com/orgs/community/discussions/5634))
 
 ## 🙏 We are thankful
 
-We are thankful for all your contributions to the iTop universe! As a thank you gift, we will send stickers to every iTop (& extensions) contributors!
+We are thankful for all your contributions to the iTop universe! As a thank-you gift, we will send stickers to every iTop (& extensions) contributors!
 
 We have one sticker per contribution type. You might get multiple stickers with one contribution though :)
 
@@ -159,6 +146,6 @@ We have one sticker per contribution type. You might get multiple stickers with
 * Beta tester: Test and give feedback on beta releases
 * Extension developer: Develop and publish an extension
 
-Here is the design of each stickers for year 2024:
+Here is the design of each sticker:
 
-![iTop stickers 2025](.doc/contributing-guide/2025.contributing-stickers-side-by-side.png)
+![iTop stickers](.doc/contributing-guide/contributing-stickers-side-by-side.png)

README.md

@@ -53,7 +53,7 @@ iTop also offers mass import tools to help you become even more efficient.
 [4]: https://www.itophub.io/wiki/page?id=latest:install:requirements
 [5]: https://www.itophub.io/wiki
 [6]: https://store.itophub.io/en_US/
-[7]: itop-version-history.md
+[7]: .doc/itop-version-history.md
 
 [10]: https://www.itophub.io/wiki/page?id=latest%3Adatamodel%3Astart#configuration_management_cmdb
 [11]: https://www.itophub.io/wiki/page?id=latest%3Adatamodel%3Astart#ticketing

addons/userrights/userrightsprofile.class.inc.php

@@ -582,16 +582,30 @@ class UserRightsProfile extends UserRightsAddOnAPI
 	 */
 	public function ListProfiles($oUser)
 	{
-		$aRet = [];
-		$oSearch = new DBObjectSearch('URP_UserProfile');
-		$oSearch->AllowAllData();
-		$oSearch->NoContextParameters();
-		$oSearch->Addcondition('userid', $oUser->GetKey(), '=');
-		$oProfiles = new DBObjectSet($oSearch);
-		while ($oUserProfile = $oProfiles->Fetch()) {
-			$aRet[$oUserProfile->Get('profileid')] = $oUserProfile->Get('profileid_friendlyname');
+		if (!array_key_exists('profile_list', $oUser->ListChanges())) {
+			// Profiles list is not modified on the $oUser object, we can use DBObjectSearch with `all data` capabilities
+			// Note: This is the default behavior
+			$aRet = [];
+			$oSearch = new DBObjectSearch('URP_UserProfile');
+			$oSearch->AllowAllData();
+			$oSearch->NoContextParameters();
+			$oSearch->Addcondition('userid', $oUser->GetKey(), '=');
+			$oProfiles = new DBObjectSet($oSearch);
+			while ($oUserProfile = $oProfiles->Fetch()) {
+				$aRet[$oUserProfile->Get('profileid')] = $oUserProfile->Get('profileid_friendlyname');
+			}
+
+			return $aRet;
+		} else {
+			// Profiles list must be computed with memory changes.
+			// Note: this is a bit tricky because the user object may have been modified in memory (e.g. a profile added or removed) and we need to take that into account
+			$aRet = [];
+			$oProfilesSet = $oUser->Get('profile_list');
+			foreach ($oProfilesSet as $oUserProfile) {
+				$aRet[$oUserProfile->Get('profileid')] = $oUserProfile->Get('profileid_friendlyname');
+			}
+			return $aRet;
 		}
-		return $aRet;
 	}
 
 	public function GetSelectFilter($oUser, $sClass, $aSettings = [])
@@ -705,26 +719,23 @@ class UserRightsProfile extends UserRightsAddOnAPI
 	protected function GetUserActionGrant($oUser, $sClass, $iActionCode)
 	{
 		$this->LoadCache();
-
-		// load and cache permissions for the current user on the given class
-		//
-		$iUser = $oUser->GetKey();
-		if (isset($this->m_aObjectActionGrants[$iUser][$sClass][$iActionCode])) {
-			$aTest = $this->m_aObjectActionGrants[$iUser][$sClass][$iActionCode];
-			if (is_array($aTest)) {
-				return $aTest;
+		if (count($oUser->ListChanges()) === 0) {
+			// load and cache permissions for the current user on the given class
+			if (isset($this->m_aObjectActionGrants[$oUser->GetKey()][$sClass][$iActionCode])) {
+				$aTest = $this->m_aObjectActionGrants[$oUser->GetKey()][$sClass][$iActionCode];
+				if (is_array($aTest)) {
+					return $aTest;
+				}
 			}
 		}
 
 		$sAction = self::$m_aActionCodes[$iActionCode];
 
 		$bStatus = null;
-		// Cache user's profiles
-		if (false === array_key_exists($iUser, $this->aUsersProfilesList)) {
-			$this->aUsersProfilesList[$iUser] = UserRights::ListProfiles($oUser);
-		}
+
+		$aProfileList = $this->GetProfileList($oUser);
 		// Call the API of UserRights because it caches the list for us
-		foreach ($this->aUsersProfilesList[$iUser] as $iProfile => $oProfile) {
+		foreach ($aProfileList as $iProfile => $oProfile) {
 			$bGrant = $this->GetProfileActionGrant($iProfile, $sClass, $sAction);
 			if (!is_null($bGrant)) {
 				if ($bGrant) {
@@ -742,7 +753,9 @@ class UserRightsProfile extends UserRightsAddOnAPI
 		$aRes = [
 			'permission' => $iPermission,
 		];
-		$this->m_aObjectActionGrants[$iUser][$sClass][$iActionCode] = $aRes;
+		if (count($oUser->ListChanges()) === 0) {
+			$this->m_aObjectActionGrants[$oUser->GetKey()][$sClass][$iActionCode] = $aRes;
+		}
 		return $aRes;
 	}
 
@@ -824,18 +837,14 @@ class UserRightsProfile extends UserRightsAddOnAPI
 	{
 		$this->LoadCache();
 		// Note: this code is VERY close to the code of IsActionAllowed()
-		$iUser = $oUser->GetKey();
 
-		// Cache user's profiles
-		if (false === array_key_exists($iUser, $this->aUsersProfilesList)) {
-			$this->aUsersProfilesList[$iUser] = UserRights::ListProfiles($oUser);
-		}
+		$aProfileList  = $this->GetProfileList($oUser);
 
 		// Note: The object set is ignored because it was interesting to optimize for huge data sets
 		//       and acceptable to consider only the root class of the object set
 		$bStatus = null;
 		// Call the API of UserRights because it caches the list for us
-		foreach ($this->aUsersProfilesList[$iUser] as $iProfile => $oProfile) {
+		foreach ($aProfileList as $iProfile => $oProfile) {
 			$bGrant = $this->GetClassStimulusGrant($iProfile, $sClass, $sStimulusCode);
 			if (!is_null($bGrant)) {
 				if ($bGrant) {
@@ -893,6 +902,25 @@ class UserRightsProfile extends UserRightsAddOnAPI
 		}
 		return $bHasSharing;
 	}
+
+	/**
+	 * @param \User $oUser
+	 *
+	 * @return array
+	 * @throws \Exception
+	 */
+	public function GetProfileList(User $oUser): array
+	{
+		if (count($oUser->ListChanges()) === 0) { // if user is already in db and not changed
+			$iUser = $oUser->GetKey();
+			if (false === array_key_exists($iUser, $this->aUsersProfilesList)) {
+				$aProfiles = UserRights::ListProfiles($oUser);
+				$this->aUsersProfilesList[$iUser] = $aProfiles;
+			}
+			return $this->aUsersProfilesList[$iUser];
+		}
+		return UserRights::ListProfiles($oUser);
+	}
 }
 
 UserRights::SelectModule('UserRightsProfile');

application/application.inc.php

@@ -16,5 +16,5 @@ require_once(APPROOT.'/application/audit.category.class.inc.php');
 require_once(APPROOT.'/application/audit.domain.class.inc.php');
 require_once(APPROOT.'/application/audit.rule.class.inc.php');
 require_once(APPROOT.'/application/query.class.inc.php');
-require_once(APPROOT.'/setup/moduleinstallation.class.inc.php');
+require_once(APPROOT.'/setup/moduleinstallation/moduleinstallation.class.inc.php');
 require_once(APPROOT.'/application/utils.inc.php');

application/applicationextension.inc.php

@@ -30,6 +30,15 @@ require_once(APPROOT.'application/newsroomprovider.class.inc.php');
  * @license     http://opensource.org/licenses/AGPL-3.0
  * @since       2.7.0
  */
+
+require_once(APPROOT.'application/applicationextension/common/ApplicationPopupMenuItem.php');
+require_once(APPROOT.'application/applicationextension/common/iPopupMenuExtension.php');
+require_once(APPROOT.'application/applicationextension/common/JSButtonItem.php');
+require_once(APPROOT.'application/applicationextension/common/JSPopupMenuItem.php');
+require_once(APPROOT.'application/applicationextension/common/SeparatorPopupMenuItem.php');
+require_once(APPROOT.'application/applicationextension/common/URLButtonItem.php');
+require_once(APPROOT.'application/applicationextension/common/URLPopupMenuItem.php');
+
 require_once(APPROOT.'application/applicationextension/backoffice/iApplicationUIExtension.php');
 require_once(APPROOT.'application/applicationextension/backoffice/iBackofficeDictEntriesExtension.php');
 require_once(APPROOT.'application/applicationextension/backoffice/iBackofficeDictEntriesPrefixesExtension.php');
@@ -43,19 +52,12 @@ require_once(APPROOT.'application/applicationextension/backoffice/iBackofficeScr
 require_once(APPROOT.'application/applicationextension/backoffice/iBackofficeStyleExtension.php');
 require_once(APPROOT.'application/applicationextension/backoffice/iFieldRendererMappingsExtension.php');
 require_once(APPROOT.'application/applicationextension/backoffice/iPageUIBlockExtension.php');
-require_once(APPROOT.'application/applicationextension/backoffice/iPopupMenuExtension.php');
 require_once(APPROOT.'application/applicationextension/backoffice/iPreferencesExtension.php');
 require_once(APPROOT.'application/applicationextension/backoffice/iWelcomePopupExtension.php');
 require_once(APPROOT.'application/applicationextension/backoffice/AbstractApplicationUIExtension.php');
 require_once(APPROOT.'application/applicationextension/backoffice/AbstractPageUIBlockExtension.php');
 require_once(APPROOT.'application/applicationextension/backoffice/AbstractPreferencesExtension.php');
 require_once(APPROOT.'application/applicationextension/backoffice/AbstractWelcomePopupExtension.php');
-require_once(APPROOT.'application/applicationextension/backoffice/ApplicationPopupMenuItem.php');
-require_once(APPROOT.'application/applicationextension/backoffice/JSButtonItem.php');
-require_once(APPROOT.'application/applicationextension/backoffice/JSPopupMenuItem.php');
-require_once(APPROOT.'application/applicationextension/backoffice/SeparatorPopupMenuItem.php');
-require_once(APPROOT.'application/applicationextension/backoffice/URLButtonItem.php');
-require_once(APPROOT.'application/applicationextension/backoffice/URLPopupMenuItem.php');
 
 require_once(APPROOT.'application/applicationextension/iBackupExtraFilesExtension.php');
 require_once(APPROOT.'application/applicationextension/iKPILoggerExtension.php');

application/applicationextension/backoffice/iBackofficeSassExtension.php

@@ -1,7 +1,7 @@
 <?php
 
 /**
- * Implement this interface to add sass file (SCSS) to the backoffice pages.
+ * Implement this interface to add sass files (SCSS) to the backoffice pages.
  * example: return "css/setup.scss"
  *
  * @api
@@ -11,9 +11,9 @@
 interface iBackofficeSassExtension
 {
 	/**
-	 * @return string
-	 * @see \iTopWebPage::$a_styles
+	 * @return array An array of relative paths (from loaded import paths) to the files to compile and include
+	 * @see \iTopWebPage::$a_linked_stylesheets
 	 * @api
 	 */
-	public function GetSass(): string;
+	public function GetSassRelPaths(): array;
 }

application/applicationextension/common/ApplicationPopupMenuItem.php

@@ -1,5 +1,9 @@
 <?php
 
+use Combodo\iTop\Application\UI\Base\Common\Metadata\AriaAttributes;
+use Combodo\iTop\Application\UI\Base\Common\Metadata\DataAttributes;
+use Combodo\iTop\Application\UI\Base\Common\Metadata\Grouping;
+
 /**
  * Base class for the various types of custom menus
  *
@@ -7,7 +11,7 @@
  * @package     UIExtensibilityAPI
  * @since 2.0
  */
-abstract class ApplicationPopupMenuItem
+abstract class ApplicationPopupMenuItem implements iGroupingProvider, iDataAttributesProvider, iAriaAttributesProvider
 {
 	/** @ignore */
 	protected $sUID;
@@ -19,6 +23,12 @@ abstract class ApplicationPopupMenuItem
 	protected $sIconClass;
 	/** @ignore */
 	protected $aCssClasses;
+	/** @since 3.3.0 */
+	protected ?AriaAttributes $oAriaAttributes = null;
+	/** @since 3.3.0 */
+	protected ?DataAttributes $oDataAttributes = null;
+	/** @since 3.3.0 */
+	protected ?Grouping $oGrouping = null;
 
 	/**
 	 * Constructor
@@ -58,6 +68,17 @@ abstract class ApplicationPopupMenuItem
 		return $this->sLabel;
 	}
 
+	/**
+	 * @param string $sLabel
+	 *
+	 * @api
+	 * @since 3.3.0
+	 */
+	public function SetLabel(string $sLabel): void
+	{
+		$this->sLabel = $sLabel;
+	}
+
 	/**
 	 * Get the CSS classes
 	 *
@@ -141,9 +162,76 @@ abstract class ApplicationPopupMenuItem
 	 */
 	abstract public function GetMenuItem();
 
+	/**
+	 * Get additional data, child classes can use this without having to worry about this class interfaces
+	 * @return array<string, mixed>
+	 * @since 3.3.0
+	 */
+	protected function GetMenuItemAdditionalData(): array
+	{
+		$aAdditionalData = [];
+
+		$aDataAttributes = $this->GetDataAttributes()->GetAttributes();
+		if (!empty($aDataAttributes)) {
+			$aAdditionalData['data_attributes'] = $aDataAttributes;
+		}
+
+		$aAriaAttributes = $this->GetAriaAttributes()->GetAttributes();
+		if (!empty($aAriaAttributes)) {
+			$aAdditionalData['aria_attributes'] = $aAriaAttributes;
+		}
+
+		$oGrouping = $this->GetGrouping();
+		if ($oGrouping !== null) {
+			$aAdditionalData['grouping_uid'] = $oGrouping->GetUID();
+		}
+
+		return $aAdditionalData;
+	}
+
 	/** @ignore */
 	public function GetLinkedScripts()
 	{
 		return [];
 	}
+
+	/**
+	 * @api
+	 * @since 3.3.0
+	 */
+	public function GetAriaAttributes(): AriaAttributes
+	{
+		return $this->oAriaAttributes ??= new AriaAttributes();
+	}
+
+	/**
+	 * @api
+	 * @since 3.3.0
+	 */
+	public function GetDataAttributes(): DataAttributes
+	{
+		return $this->oDataAttributes ??= new DataAttributes();
+	}
+
+	/**
+	 * @api
+	 * @since 3.3.0
+	 */
+	public function GetGrouping(): ?Grouping
+	{
+		return $this->oGrouping;
+	}
+
+	/**
+	 * @param Grouping|null $oGrouping
+	 * @return static
+	 * @api
+	 * @since 3.3.0
+	 */
+	public function SetGrouping(?Grouping $oGrouping): static
+	{
+		$this->oGrouping = $oGrouping;
+
+		return $this;
+	}
 }

application/applicationextension/common/JSPopupMenuItem.php

@@ -3,7 +3,7 @@
 /**
  * Class for adding an item into a popup menu that triggers some Javascript code
  *
- * Note: This works only in the backoffice, {@see \JSButtonItem} for the end-user portal
+ * Note: This works only in the backoffice, {@see \common\JSButtonItem} for the end-user portal
  *
  * @api
  * @package     UIExtensibilityAPI
@@ -40,7 +40,7 @@ class JSPopupMenuItem extends ApplicationPopupMenuItem
 	public function GetMenuItem()
 	{
 		// Note: the semicolumn is a must here!
-		return [
+		$aData = [
 			'label' => $this->GetLabel(),
 			'onclick' => $this->GetJsCode().'; return false;',
 			'url' => $this->GetUrl(),
@@ -48,6 +48,8 @@ class JSPopupMenuItem extends ApplicationPopupMenuItem
 			'icon_class' => $this->sIconClass,
 			'tooltip' => $this->sTooltip,
 		];
+
+		return array_merge($aData, $this->GetMenuItemAdditionalData());
 	}
 
 	/** @ignore */

application/applicationextension/common/SeparatorPopupMenuItem.php

@@ -24,6 +24,12 @@ class SeparatorPopupMenuItem extends ApplicationPopupMenuItem
 	/** @ignore */
 	public function GetMenuItem()
 	{
-		return ['label' => '<hr class="menu-separator">', 'url' => '', 'css_classes' => $this->aCssClasses];
+		$aData = [
+			'label' => '<hr class="menu-separator">',
+			'url' => '',
+			'css_classes' => $this->aCssClasses,
+		];
+
+		return array_merge($aData, $this->GetMenuItemAdditionalData());
 	}
 }

application/applicationextension/common/URLPopupMenuItem.php

@@ -3,7 +3,7 @@
 /**
  * Class for adding an item into a popup menu that browses to the given URL
  *
- * Note: This works only in the backoffice, {@see \URLButtonItem} for the end-user portal
+ * Note: This works only in the backoffice, {@see \common\URLButtonItem} for the end-user portal
  *
  * @api
  * @package     UIExtensibilityAPI
@@ -35,13 +35,15 @@ class URLPopupMenuItem extends ApplicationPopupMenuItem
 	/** @ignore */
 	public function GetMenuItem()
 	{
-		return ['label' => $this->GetLabel(),
+		$aData = ['label' => $this->GetLabel(),
 			'url' => $this->GetUrl(),
 			'target' => $this->GetTarget(),
 			'css_classes' => $this->aCssClasses,
 			'icon_class' => $this->sIconClass,
 			'tooltip' => $this->sTooltip,
 		];
+
+		return array_merge($aData, $this->GetMenuItemAdditionalData());
 	}
 
 	/** @ignore */

application/applicationextension/common/iAriaAttributesProvider.php

@@ -0,0 +1,15 @@
+<?php
+
+use Combodo\iTop\Application\UI\Base\Common\Metadata\AriaAttributes;
+
+/**
+ * Allows to provide ARIA attributes to classes that implement this interface.
+ * The ARIA attributes will be used to improve accessibility of the UI components
+ *
+ * @api
+ * @since 3.3.0
+ */
+interface iAriaAttributesProvider
+{
+	public function GetAriaAttributes(): AriaAttributes;
+}

application/applicationextension/common/iDataAttributesProvider.php

@@ -0,0 +1,14 @@
+<?php
+
+use Combodo\iTop\Application\UI\Base\Common\Metadata\DataAttributes;
+
+/**
+ * Allows to provide data attributes to classes that implement this interface.
+ * The data attributes will be used to provide additional information to the UI components
+ * @api
+ * @since 3.3.0
+ */
+interface iDataAttributesProvider
+{
+	public function GetDataAttributes(): DataAttributes;
+}

application/applicationextension/common/iGroupingProvider.php

@@ -0,0 +1,13 @@
+<?php
+
+use Combodo\iTop\Application\UI\Base\Common\Metadata\Grouping;
+
+/**
+ * Allows to provide grouping information to classes that implement this interface.
+ * @api
+ * @since 3.3.0
+ */
+interface iGroupingProvider
+{
+	public function GetGrouping(): ?Grouping;
+}

application/applicationextension/common/iHtmlAttributesSource.php

@@ -0,0 +1,14 @@
+<?php
+
+/**
+ * Implemented by metadata value objects that flatten to HTML attributes.
+ * Ease the implementation of classes that need to provide HTML attributes to the UI components
+ *
+ * @api
+ * @since 3.3.0
+ */
+interface iHtmlAttributesSource
+{
+	/** @return array<string, string> Attribute name => value, ready to be escaped and printed */
+	public function GetHtmlAttributes(): array;
+}

application/applicationextension/common/iPopupMenuExtension.php

@@ -95,7 +95,24 @@ interface iPopupMenuExtension
 	 * @todo
 	 */
 	public const PORTAL_MENU_ACTIONS = 10;
-
+	/**
+	 * Get the list of items to be added to the backoffice top-bar items
+	 * $param is an array: [] for now, in a distant future we want to give a complete context
+	 * @since 3.3.0
+	 */
+	public const MENU_TOPBAR_ACTIONS = 11;
+	/**
+	 * Get the list of items to be added to the actions on a given form field (i.e. the attribute of an object)
+	 * $param is an array: ['object' => DBObject, att_code => attribute code , mode => edit/read]
+	 * @since 3.3.0
+	 */
+	public const MENU_OBJDETAILS_FIELD_ACTIONS = 12;
+	/**
+	 * Get the list of items to be added to the actions in the activity panel (read-only mode)
+	 * $param is an array: ['object' => DBObject, caselog_att_code =>  caselog attribute code or 'activity']
+	 * @since 3.3.0
+	 */
+	public const MENU_OBJDETAILS_ACTIVITY_PANEL_ACTIONS = 13;
 	/**
 	 * Get the list of items to be added to a menu.
 	 *

application/applicationextension/rest/RestUtils.php

@@ -97,33 +97,125 @@ class RestUtils
 	 * @throws Exception
 	 * @api
 	 */
-	public static function GetFieldList($sClass, $oData, $sParamName)
+	public static function GetFieldList($sClass, $oData, $sParamName, $bFailIfNotFound = true)
 	{
 		$sFields = self::GetOptionalParam($oData, $sParamName, '*');
-		$aShowFields = [];
-		if ($sFields == '*') {
-			foreach (MetaModel::ListAttributeDefs($sClass) as $sAttCode => $oAttDef) {
-				$aShowFields[$sClass][] = $sAttCode;
-			}
-		} elseif ($sFields == '*+') {
-			foreach (MetaModel::EnumChildClasses($sClass, ENUM_CHILD_CLASSES_ALL) as $sRefClass) {
-				foreach (MetaModel::ListAttributeDefs($sRefClass) as $sAttCode => $oAttDef) {
-					$aShowFields[$sRefClass][] = $sAttCode;
-				}
-			}
-		} else {
-			foreach (explode(',', $sFields) as $sAttCode) {
-				$sAttCode = trim($sAttCode);
-				if (($sAttCode != 'id') && (!MetaModel::IsValidAttCode($sClass, $sAttCode))) {
-					throw new Exception("$sParamName: invalid attribute code '$sAttCode'");
-				}
-				$aShowFields[$sClass][] = $sAttCode;
-			}
-		}
-
-		return $aShowFields;
+		return match($sFields) {
+			'*' => self::GetFieldListForClass($sClass),
+			'*+' => self::GetFieldListForParentClass($sClass),
+			default => self::GetLimitedFieldListForClass($sClass, $sFields, $sParamName, $bFailIfNotFound),
+		};
 	}
 
+	/**
+	 * Check if the requested field list asks for an extended output.
+	 *
+	 * Extended output is requested when using '*+' or class-scoped field definitions.
+	 *
+	 * @param string $sFields Requested field specification.
+	 *
+	 * @return bool
+	 */
+	public static function HasRequestedExtendedOutput(string $sFields): bool
+	{
+		return match($sFields) {
+			'*' => false,
+			'*+' => true,
+			default => substr_count($sFields, ':') > 1,
+		};
+	}
+
+	/**
+	 * Check if the requested field list asks for all output fields.
+	 *
+	 * @param string $sFields Requested field specification.
+	 *
+	 * @return bool
+	 */
+	public static function HasRequestedAllOutputFields(string $sFields): bool
+	{
+		return match($sFields) {
+			'*', '*+' => true,
+			default => false,
+		};
+	}
+
+	protected static function GetFieldListForClass(string $sClass): array
+	{
+		return [$sClass => array_keys(MetaModel::ListAttributeDefs($sClass))];
+	}
+
+	/**
+	 * Build a field list for all child classes of the given parent class.
+	 *
+	 * @param string $sClass Parent class name.
+	 *
+	 * @return array Array of class => list of attribute codes.
+	 */
+	protected static function GetFieldListForParentClass(string $sClass): array
+	{
+		$aFieldList = [];
+		foreach (MetaModel::EnumChildClasses($sClass, ENUM_CHILD_CLASSES_ALL) as $sRefClass) {
+			$aFieldList = array_merge($aFieldList, self::GetFieldListForClass($sRefClass));
+		}
+		return $aFieldList;
+	}
+
+	/**
+	 * Build a restricted field list for one class from a comma-separated attribute list.
+	 *
+	 * @param string $sClass Class name.
+	 * @param string $sFields Comma-separated list of requested attribute codes.
+	 * @param string $sParamName Input parameter name used in error messages.
+	 * @param bool $bFailIfNotFound If true, throws when an attribute code is invalid.
+	 *
+	 * @return array Array containing one class => list of attribute codes.
+	 * @throws Exception When an attribute code is invalid and $bFailIfNotFound is true.
+	 */
+	protected static function GetLimitedFieldListForSingleClass(string $sClass, string $sFields, string $sParamName, bool $bFailIfNotFound = true): array
+	{
+		$aFieldList = [$sClass => []];
+		foreach (explode(',', $sFields) as $sAttCode) {
+			$sAttCode = trim($sAttCode);
+			if (($sAttCode == 'id') || (MetaModel::IsValidAttCode($sClass, $sAttCode))) {
+				$aFieldList[$sClass][] = $sAttCode;
+			} else {
+				if ($bFailIfNotFound) {
+					throw new Exception("$sParamName: invalid attribute code '$sAttCode' for class '$sClass'");
+				}
+			}
+		}
+		return $aFieldList;
+	}
+
+	/**
+	 * Build a restricted field list for one or several classes.
+	 *
+	 * Accepted formats are either "att1,att2" for a single class, or
+	 * "ClassA:att1,att2;ClassB:att3" for class-scoped field definitions.
+	 *
+	 * @param string $sClass Default class name used when no class scope is specified.
+	 * @param string $sFields Requested field specification.
+	 * @param string $sParamName Input parameter name used in error messages.
+	 * @param bool $bFailIfNotFound If true, throws when an attribute code is invalid.
+	 *
+	 * @return array Array of class => list of attribute codes.
+	 * @throws Exception Propagated from GetLimitedFieldListForSingleClass.
+	 */
+	protected static function GetLimitedFieldListForClass(string $sClass, string $sFields, string $sParamName, bool $bFailIfNotFound = true): array
+	{
+		if (!str_contains($sFields, ':')) {
+			return self::GetLimitedFieldListForSingleClass($sClass, $sFields, $sParamName, $bFailIfNotFound);
+		}
+
+		$aFieldList = [];
+		$aFieldListParts = explode(';', $sFields);
+		foreach ($aFieldListParts as $sClassFields) {
+			list($sSubClass, $sSubClassFields) = explode(':', $sClassFields);
+			$aFieldList = array_merge($aFieldList, self::GetLimitedFieldListForSingleClass(trim($sSubClass), trim($sSubClassFields), $sParamName, $bFailIfNotFound));
+		}
+		return $aFieldList;
+	}
 	/**
 	 * Read and interpret object search criteria from a Rest/Json structure
 	 *

application/cmdbabstract.class.inc.php

@@ -49,6 +49,7 @@ use Combodo\iTop\Application\WebPage\WebPage;
 use Combodo\iTop\Renderer\BlockRenderer;
 use Combodo\iTop\Renderer\Console\ConsoleBlockRenderer;
 use Combodo\iTop\Renderer\Console\ConsoleFormRenderer;
+use Combodo\iTop\Service\InterfaceDiscovery\InterfaceDiscovery;
 use Combodo\iTop\Service\Links\LinkSetDataTransformer;
 use Combodo\iTop\Service\Links\LinkSetModel;
 use Combodo\iTop\Service\TemporaryObjects\TemporaryObjectHelper;
@@ -175,6 +176,11 @@ abstract class cmdbAbstractObject extends CMDBObject implements iDisplay
 	 */
 	protected $sDisplayMode;
 	protected $aFieldsMap;
+	/**
+	 * @var array Store posted values in order to be used in GetAttributeFlags
+	 * @since 3.3.0
+	 */
+	protected $aPostedValues = [];
 
 	/**
 	 * If true, bypass IsActionAllowedOnAttribute when writing this object
@@ -524,6 +530,12 @@ JS
 				$sLabel = Dict::S('Tag:Synchronized');
 				$sSynchroTagId = 'synchro_icon-'.$this->GetKey();
 				$aTags[$sSynchroTagId] = ['title' => $sTip, 'css_classes' => 'ibo-object-details--tag--synchronized', 'decoration_classes' => 'fas fa-lock', 'label' => $sLabel];
+				if (UserRights::IsActionAllowed(SynchroReplica::class, UR_ACTION_READ)) {
+					$oDBSearch = DBObjectSearch::FromOQL('SELECT SynchroReplica WHERE dest_class=:sClass AND dest_id=:id');
+					$sFilter = rawurlencode($oDBSearch->serialize(false, ['sClass' => get_class($this),'id' => $this->GetKey()]));
+					$sUrlSearchReplica = 'UI.php?operation=search&filter='.$sFilter;
+					$oPage->add_ready_script("$('#$sSynchroTagId').on('click',function() {window.location = '$sUrlSearchReplica' });");
+				}
 			}
 		}
 
@@ -1035,7 +1047,7 @@ HTML
 							// Add extra data for markup generation
 							// - Attribute code and AttributeDef. class
 							$val['attcode'] = $sAttCode;
-							$val['atttype'] = $sAttDefClass;
+							$val['atttype'] = $oAttDef->GetTypeShortClassName();
 							$val['attlabel'] = $sAttLabel;
 							$val['attflags'] = ($bEditMode) ? $this->GetFormAttributeFlags($sAttCode) : OPT_ATT_READONLY;
 
@@ -1054,6 +1066,14 @@ HTML
 								}
 							}
 							$val['value_raw'] = ($bExcludeRawValue === false) ? $this->Get($sAttCode) : '';
+							$val['actions'] = [];
+
+							/** @var \iPopupMenuExtension $oExtensionInstance */
+							foreach (InterfaceDiscovery::GetInstance()->FindItopClasses('iPopupMenuExtension') as $oExtensionInstance) {
+								foreach ($oExtensionInstance::EnumItems(iPopupMenuExtension::MENU_OBJDETAILS_FIELD_ACTIONS, ['object' => $this, 'att_code' => $sAttCode, 'mode' => $bEditMode ? 'edit' : 'read']) as $oMenuItem) {
+									$val['actions'][] = $oMenuItem;
+								}
+							}
 
 							// The field is visible, add it to the current column
 							$oField = FieldUIBlockFactory::MakeFromParams($val);
@@ -1524,190 +1544,6 @@ HTML
 		return $sHtml;
 	}
 
-	/**
-	 * @param WebPage $oPage
-	 * @param \CMDBObjectSet $oSet
-	 * @param array $aParams
-	 *
-	 * @throws \Exception
-	 *  only used in old and deprecated export.php
-	 *
-	 * @internal Only to be used by `/webservices/export.php` : this is a legacy method that produces wrong HTML (no TR on table body rows)
-	 */
-	public static function DisplaySetAsHTMLSpreadsheet(WebPage $oPage, CMDBObjectSet $oSet, $aParams = [])
-	{
-		$oPage->add(self::GetSetAsHTMLSpreadsheet($oSet, $aParams));
-	}
-
-	/**
-	 * Spreadsheet output: designed for end users doing some reporting
-	 * Then the ids are excluded and replaced by the corresponding friendlyname
-	 *
-	 * @param \DBObjectSet $oSet
-	 * @param array $aParams
-	 *
-	 * @return string
-	 * @throws \CoreException
-	 * @throws \CoreUnexpectedValue
-	 * @throws \MissingQueryArgument
-	 * @throws \MySQLException
-	 * @throws \MySQLHasGoneAwayException
-	 * @throws \Exception
-	 *
-	 * @internal Only to be used by `/webservices/export.php` : this is a legacy method that produces wrong HTML (no TR on table body rows)
-	 */
-	public static function GetSetAsHTMLSpreadsheet(DBObjectSet $oSet, $aParams = [])
-	{
-		$aFields = null;
-		if (isset($aParams['fields']) && (strlen($aParams['fields']) > 0)) {
-			$aFields = explode(',', $aParams['fields']);
-		}
-
-		$bFieldsAdvanced = false;
-		if (isset($aParams['fields_advanced'])) {
-			$bFieldsAdvanced = (bool)$aParams['fields_advanced'];
-		}
-
-		$bLocalize = true;
-		if (isset($aParams['localize_values'])) {
-			$bLocalize = (bool)$aParams['localize_values'];
-		}
-
-		$aList = [];
-
-		$aClasses = $oSet->GetFilter()->GetSelectedClasses();
-		$aAuthorizedClasses = [];
-		foreach ($aClasses as $sAlias => $sClassName) {
-			if (UserRights::IsActionAllowed($sClassName, UR_ACTION_READ, $oSet) != UR_ALLOWED_NO) {
-				$aAuthorizedClasses[$sAlias] = $sClassName;
-			}
-		}
-		$aHeader = [];
-		foreach ($aAuthorizedClasses as $sAlias => $sClassName) {
-			$aList[$sAlias] = [];
-
-			foreach (MetaModel::ListAttributeDefs($sClassName) as $sAttCode => $oAttDef) {
-				if (is_null($aFields) || (count($aFields) == 0)) {
-					// Standard list of attributes (no link sets)
-					if ($oAttDef->IsScalar() && ($oAttDef->IsWritable() || $oAttDef->IsExternalField())) {
-						$sAttCodeEx = $oAttDef->IsExternalField() ? $oAttDef->GetKeyAttCode().'->'.$oAttDef->GetExtAttCode() : $sAttCode;
-
-						$aList[$sAlias][$sAttCodeEx] = $oAttDef;
-
-						if ($bFieldsAdvanced && $oAttDef->IsExternalKey(EXTKEY_RELATIVE)) {
-							$sRemoteClass = $oAttDef->GetTargetClass();
-							foreach (MetaModel::GetReconcKeys($sRemoteClass) as $sRemoteAttCode) {
-								$aList[$sAlias][$sAttCode.'->'.$sRemoteAttCode] = MetaModel::GetAttributeDef(
-									$sRemoteClass,
-									$sRemoteAttCode
-								);
-							}
-						}
-					}
-				} else {
-					// User defined list of attributes
-					if (in_array($sAttCode, $aFields) || in_array($sAlias.'.'.$sAttCode, $aFields)) {
-						$aList[$sAlias][$sAttCode] = $oAttDef;
-					}
-				}
-			}
-			// Replace external key by the corresponding friendly name (if not already in the list)
-			foreach ($aList[$sAlias] as $sAttCode => $oAttDef) {
-				if ($oAttDef->IsExternalKey()) {
-					unset($aList[$sAlias][$sAttCode]);
-					$sFriendlyNameAttCode = $sAttCode.'_friendlyname';
-					if (!array_key_exists(
-						$sFriendlyNameAttCode,
-						$aList[$sAlias]
-					) && MetaModel::IsValidAttCode($sClassName, $sFriendlyNameAttCode)) {
-						$oFriendlyNameAtt = MetaModel::GetAttributeDef($sClassName, $sFriendlyNameAttCode);
-						$aList[$sAlias][$sFriendlyNameAttCode] = $oFriendlyNameAtt;
-					}
-				}
-			}
-
-			foreach ($aList[$sAlias] as $sAttCodeEx => $oAttDef) {
-				$sColLabel = $bLocalize ? MetaModel::GetLabel($sClassName, $sAttCodeEx) : $sAttCodeEx;
-
-				$oFinalAttDef = $oAttDef->GetFinalAttDef();
-				if (get_class($oFinalAttDef) == 'AttributeDateTime') {
-					$aHeader[] = $sColLabel.' ('.Dict::S('UI:SplitDateTime-Date').')';
-					$aHeader[] = $sColLabel.' ('.Dict::S('UI:SplitDateTime-Time').')';
-				} else {
-					$aHeader[] = $sColLabel;
-				}
-			}
-		}
-
-		$sHtml = "<table border=\"1\">\n";
-		$sHtml .= "<tr>\n";
-		$sHtml .= "<td>".implode("</td><td>", $aHeader)."</td>\n";
-		$sHtml .= "</tr>\n";
-		$oSet->Seek(0);
-		while ($aObjects = $oSet->FetchAssoc()) {
-			$aRow = [];
-			foreach ($aAuthorizedClasses as $sAlias => $sClassName) {
-				$oObj = $aObjects[$sAlias];
-				foreach ($aList[$sAlias] as $sAttCodeEx => $oAttDef) {
-					if (is_null($oObj)) {
-						$aRow[] = '<td></td>';
-					} else {
-						$oFinalAttDef = $oAttDef->GetFinalAttDef();
-						if (get_class($oFinalAttDef) == 'AttributeDateTime') {
-							$sDate = $oObj->Get($sAttCodeEx);
-							if ($sDate === null) {
-								$aRow[] = '<td></td>';
-								$aRow[] = '<td></td>';
-							} else {
-								$iDate = AttributeDateTime::GetAsUnixSeconds($sDate);
-								$aRow[] = '<td>'.date(
-									'Y-m-d',
-									$iDate
-								).'</td>'; // Format kept as-is for 100% backward compatibility of the exports
-								$aRow[] = '<td>'.date(
-									'H:i:s',
-									$iDate
-								).'</td>'; // Format kept as-is for 100% backward compatibility of the exports
-							}
-						} else {
-							if ($oAttDef instanceof AttributeCaseLog) {
-								$rawValue = $oObj->Get($sAttCodeEx);
-								$outputValue = str_replace(
-									"\n",
-									"<br/>",
-									utils::EscapeHtml($rawValue->__toString())
-								);
-								// Trick for Excel: treat the content as text even if it begins with an equal sign
-								$aRow[] = '<td x:str>'.$outputValue.'</td>';
-							} else {
-								$rawValue = $oObj->Get($sAttCodeEx);
-								// Due to custom formatting rules, empty friendlynames may be rendered as non-empty strings
-								// let's fix this and make sure we render an empty string if the key == 0
-								if ($oAttDef instanceof AttributeExternalField && $oAttDef->IsFriendlyName()) {
-									$sKeyAttCode = $oAttDef->GetKeyAttCode();
-									if ($oObj->Get($sKeyAttCode) == 0) {
-										$rawValue = '';
-									}
-								}
-								if ($bLocalize) {
-									$outputValue = utils::EscapeHtml($oFinalAttDef->GetEditValue($rawValue));
-								} else {
-									$outputValue = utils::EscapeHtml($rawValue);
-								}
-								$aRow[] = '<td>'.$outputValue.'</td>';
-							}
-						}
-					}
-				}
-			}
-			$sHtml .= implode("\n", $aRow);
-			$sHtml .= "</tr>\n";
-		}
-		$sHtml .= "</table>\n";
-
-		return $sHtml;
-	}
-
 	/**
 	 * @param WebPage $oPage
 	 * @param \CMDBObjectSet $oSet
@@ -3239,8 +3075,12 @@ EOF
 							}
 							$aAllowedValues = MetaModel::GetAllowedValues_att($sClass, $sAttCode, $aArgs);
 							if (is_array($aAllowedValues) && count($aAllowedValues) == 1) {
-								$aValues = array_keys($aAllowedValues);
-								$this->Set($sAttCode, $aValues[0]);
+								// linkset are ignored
+								// N°9622 - Error in the user story life cycle
+								if (!$oAttDef->IsLinkSet()) {
+									$aValues = array_keys($aAllowedValues);
+									$this->Set($sAttCode, $aValues[0]);
+								}
 							}
 						}
 					}
@@ -3986,6 +3826,7 @@ HTML;
 
 		$aErrors = [];
 		$aFinalValues = [];
+		$this->aPostedValues = $aValues; // Store the values for later use (e.g. in GetAttributeFlags)
 		foreach ($this->GetWriteableAttList(array_keys($aValues), $aErrors, $aAttFlags) as $sAttCode => $oAttDef) {
 			$aFinalValues[$sAttCode] = $aValues[$sAttCode];
 		}
@@ -4155,6 +3996,27 @@ HTML;
 				$sTagSetJson = utils::ReadPostedParam("attr_{$sFormPrefix}{$sAttCode}", null, 'raw_data');
 				if ($sTagSetJson !== null) { // bulk modify, direct linked set not handled
 					$value = json_decode($sTagSetJson, true);
+					if ($this->IsNew()) {
+						if (is_array($value['orig_value'])) {
+							foreach ($value['orig_value'] as $val) {
+								if (!in_array($val, $value['removed'])) {
+									$value['added'][] = $val;
+								}
+							}
+						}
+					} else {
+						$aCurrentValues = $this->Get($sAttCode)->GetValues();
+						foreach ($value['orig_value'] as $val) {
+							if (!in_array($val, $aCurrentValues) && !in_array($val, $value['removed']) && !in_array($val, $value['added'])) {
+								$value['added'][] = $val;
+							}
+						}
+						foreach ($aCurrentValues as $val) {
+							if (!in_array($val, $value['orig_value']) && !in_array($val, $value['removed']) && !in_array($val, $value['added'])) {
+								$value['removed'][] = $val;
+							}
+						}
+					}
 				}
 				break;
 
@@ -4495,7 +4357,7 @@ HTML;
 
 			$oDivField = FieldUIBlockFactory::MakeLarge("");
 			//	UIContentBlockUIBlockFactory::MakeStandard(null,["field_container field_large"]);
-			$oDivField->AddDataAttribute("attribute-type", $sAttDefClass);
+			$oDivField->AddDataAttribute("attribute-type", $oAttDef->GetTypeShortClassName());
 			$oDivField->AddDataAttribute("attribute-label", $sAttMetaDataLabel);
 			$oDivField->AddDataAttribute("attribute-flag-hidden", false);
 			$oDivField->AddDataAttribute("attribute-flag-read-only", false);
@@ -4798,7 +4660,7 @@ EOF
 			// Not in preview mode, do the update for real
 			$sTransactionId = utils::ReadPostedParam('transaction_id', '', 'transaction_id');
 			if (!utils::IsTransactionValid($sTransactionId, false)) {
-				throw new Exception(Dict::S('UI:Error:ObjectAlreadyUpdated'));
+				throw new Exception(Dict::S('UI:Error:InvalidToken'));
 			}
 			utils::RemoveTransaction($sTransactionId);
 		}
@@ -5064,10 +4926,10 @@ EOF
 			} else {
 				if (count($aObjects) == 1) {
 					$oObj = $aObjects[0];
-					$sSubtitle = Dict::Format('UI:Delect:Confirm_Object', $oObj->GetHyperLink());
+					$sSubtitle = Dict::Format('UI:Delete:Confirm_Object', $oObj->GetHyperLink());
 				} else {
 					$sSubtitle = Dict::Format(
-						'UI:Delect:Confirm_Count_ObjectsOf_Class',
+						'UI:Delete:Confirm_Count_ObjectsOf_Class',
 						count($aObjects),
 						MetaModel::GetName($sClass)
 					);

application/dashboard.class.inc.php

@@ -497,11 +497,11 @@ EOF
 	 * @param array $aExtraParams
 	 * @param bool $bCanEdit
 	 *
-	 * @return \Combodo\iTop\Application\UI\Base\Layout\Dashboard\DashboardLayout
+	 * @return null|\Combodo\iTop\Application\UI\Base\Layout\Dashboard\DashboardLayout
 	 */
 	public function Render($oPage, $bEditMode = false, $aExtraParams = [], $bCanEdit = true)
 	{
-		$aExtraParams['dashboard_div_id'] = utils::Sanitize($aExtraParams['dashboard_div_id'] ?? null, $this->GetId(), utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER);
+		$aExtraParams['dashboard_div_id'] = utils::Sanitize($aExtraParams['dashboard_div_id'] ?? $this->GetId(), $this->GetId(), utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER);
 
 		/** @var \DashboardLayoutMultiCol $oLayout */
 		$oLayout = new $this->sLayoutClass();
@@ -586,7 +586,7 @@ JS
 			/** @var \Dashlet $oDashlet */
 			foreach ($aCell as $oDashlet) {
 				if ($oDashlet->IsVisible()) {
-					$oPage->add('<div class="dashlet_properties" id="dashlet_properties_'.$oDashlet->GetID().'" style="display:none">');
+					$oPage->add('<div class="dashlet_properties" id="dashlet_properties_'.$oDashlet->GetID().'" data-role="ibo-dashlet-properties" data-dashlet-class="'.$oDashlet->GetDashletType().'" style="display:none">');
 					$oForm = $oDashlet->GetForm();
 					$this->SetFormParams($oForm, $aExtraParams);
 					$oForm->RenderAsPropertySheet($oPage, false, '.itop-dashboard');
@@ -1203,7 +1203,7 @@ EOF
 		}
 		$aRenderParams['dashboard_div_id'] = $aExtraParams['dashboard_div_id'];
 		$sJSExtraParams = json_encode($aExtraParams);
-		$oPage->add('<div id="dashboard_editor" class="ibo-dashboard-editor" data-role="ibo-dashboard-editor">');
+		$oPage->add('<div id="dashboard_editor" class="ibo-dashboard-editor" data-role="ibo-dashboard-editor" data-dashboard-id="'.$this->sId.'">');
 		$oPage->add('<div class="ui-layout-center">');
 		$this->SetCustomFlag(true);
 		$this->Render($oPage, true, $aRenderParams);

application/dashlet.class.inc.php

@@ -25,6 +25,20 @@ use Combodo\iTop\Application\UI\Base\Component\Panel\PanelUIBlockFactory;
 use Combodo\iTop\Application\UI\Base\iUIBlock;
 use Combodo\iTop\Application\UI\Base\UIBlock;
 use Combodo\iTop\Application\WebPage\WebPage;
+use Combodo\iTop\Core\AttributeDefinition\AttributeDateTime;
+use Combodo\iTop\Core\AttributeDefinition\AttributeDecimal;
+use Combodo\iTop\Core\AttributeDefinition\AttributeDuration;
+use Combodo\iTop\Core\AttributeDefinition\AttributeEncryptedString;
+use Combodo\iTop\Core\AttributeDefinition\AttributeEnum;
+use Combodo\iTop\Core\AttributeDefinition\AttributeExternalField;
+use Combodo\iTop\Core\AttributeDefinition\AttributeFriendlyName;
+use Combodo\iTop\Core\AttributeDefinition\AttributeInteger;
+use Combodo\iTop\Core\AttributeDefinition\AttributeLinkedSet;
+use Combodo\iTop\Core\AttributeDefinition\AttributeOneWayPassword;
+use Combodo\iTop\Core\AttributeDefinition\AttributePassword;
+use Combodo\iTop\Core\AttributeDefinition\AttributePercentage;
+use Combodo\iTop\Core\AttributeDefinition\AttributeSubItem;
+use Combodo\iTop\Core\AttributeDefinition\iAttributeNoGroupBy;
 
 require_once(APPROOT.'application/forms.class.inc.php');
 
@@ -440,7 +454,7 @@ EOF
 				// For external fields, find the real type of the target
 				$sExtFieldAttCode = $sAttCode;
 				$sTargetClass = $sClass;
-				while (is_a($sAttType, 'AttributeExternalField', true)) {
+				while (is_a($sAttType, AttributeExternalField::class, true)) {
 					$sExtKeyAttCode = $this->oModelReflection->GetAttributeProperty($sTargetClass, $sExtFieldAttCode, 'extkey_attcode');
 					$sTargetAttCode = $this->oModelReflection->GetAttributeProperty($sTargetClass, $sExtFieldAttCode, 'target_attcode');
 					$sTargetClass = $this->oModelReflection->GetAttributeProperty($sTargetClass, $sExtKeyAttCode, 'targetclass');
@@ -450,13 +464,13 @@ EOF
 				}
 
 				$aForbidenAttType = [
-					'AttributeLinkedSet',
-					'AttributeFriendlyName',
+					AttributeLinkedSet::class,
+					AttributeFriendlyName::class,
 
-					'iAttributeNoGroupBy', //we cannot only use iAttributeNoGroupBy since this method is also used by the designer who do not have access to the classes' PHP reflection API. So the known classes has to be listed altogether
-					'AttributeOneWayPassword',
-					'AttributeEncryptedString',
-					'AttributePassword',
+					iAttributeNoGroupBy::class, //we cannot only use iAttributeNoGroupBy since this method is also used by the designer who do not have access to the classes' PHP reflection API. So the known classes has to be listed altogether
+					AttributeOneWayPassword::class,
+					AttributeEncryptedString::class,
+					AttributePassword::class,
 				];
 				foreach ($aForbidenAttType as $sForbidenAttType) {
 					if (is_a($sAttType, $sForbidenAttType, true)) {
@@ -468,7 +482,7 @@ EOF
 				if (!in_array($sLabel, $aGroupBy)) {
 					$aGroupBy[$sAttCode] = $sLabel;
 
-					if (is_a($sAttType, 'AttributeDateTime', true)) {
+					if (is_a($sAttType, AttributeDateTime::class, true)) {
 						$aGroupBy[$sAttCode.':hour'] = Dict::Format('UI:DashletGroupBy:Prop-GroupBy:Select-Hour', $sLabel);
 						$aGroupBy[$sAttCode.':month'] = Dict::Format('UI:DashletGroupBy:Prop-GroupBy:Select-Month', $sLabel);
 						$aGroupBy[$sAttCode.':day_of_week'] = Dict::Format('UI:DashletGroupBy:Prop-GroupBy:Select-DayOfWeek', $sLabel);
@@ -1102,7 +1116,7 @@ abstract class DashletGroupBy extends Dashlet
 			$aAttributeTypes = $this->oModelReflection->ListAttributes($this->sClass);
 			if (isset($aAttributeTypes[$this->sGroupByAttCode])) {
 				$sAttributeType = $aAttributeTypes[$this->sGroupByAttCode];
-				if (is_subclass_of($sAttributeType, 'AttributeDateTime') || $sAttributeType == 'AttributeDateTime') {
+				if (is_subclass_of($sAttributeType, AttributeDateTime::class) || $sAttributeType == AttributeDateTime::class) {
 					$this->sOrderDirection = 'asc';
 				} else {
 					$this->sOrderDirection = 'desc';
@@ -1258,7 +1272,7 @@ abstract class DashletGroupBy extends Dashlet
 		if ($this->oModelReflection->IsValidAttCode($sClass, $this->sGroupByAttCode)) {
 			$aAttributeTypes = $this->oModelReflection->ListAttributes($sClass);
 			$sAttributeType = $aAttributeTypes[$this->sGroupByAttCode];
-			if (is_subclass_of($sAttributeType, 'AttributeDateTime') || $sAttributeType == 'AttributeDateTime') {
+			if (is_subclass_of($sAttributeType, AttributeDateTime::class) || $sAttributeType == AttributeDateTime::class) {
 				// Note: an alternative to this somewhat hardcoded way of doing things would be to implement...
 				//$oExpr = Expression::FromOQL($this->sGroupByExpr);
 				//$aTranslationData = array($oQuery->GetClassAlias() => array($this->sGroupByAttCode => new ScalarExpression(date('Y-m-d H:i:s', $iTime))));
@@ -1289,7 +1303,7 @@ abstract class DashletGroupBy extends Dashlet
 				foreach ($aValues as $sValue) {
 					$aDisplayValues[] = ['label' => $sValue, 'value' => (int)rand(1, 15)];
 				}
-			} elseif (is_subclass_of($sAttributeType, 'AttributeEnum') || $sAttributeType == 'AttributeEnum') {
+			} elseif (is_subclass_of($sAttributeType, AttributeEnum::class) || $sAttributeType == AttributeEnum::class) {
 				$aAllowed = $this->oModelReflection->GetAllowedValues_att($sClass, $this->sGroupByAttCode);
 				if ($aAllowed) { // null for non enums
 					foreach ($aAllowed as $sValue => $sValueLabel) {
@@ -1458,11 +1472,11 @@ abstract class DashletGroupBy extends Dashlet
 			}
 			foreach ($this->oModelReflection->ListAttributes($sClass) as $sAttCode => $sAttType) {
 				switch ($sAttType) {
-					case 'AttributeDecimal':
-					case 'AttributeDuration':
-					case 'AttributeInteger':
-					case 'AttributePercentage':
-					case 'AttributeSubItem': // TODO: Known limitation: no unit displayed (values in sec)
+					case AttributeDecimal::class:
+					case AttributeDuration::class:
+					case AttributeInteger::class:
+					case AttributePercentage::class:
+					case AttributeSubItem::class: // TODO: Known limitation: no unit displayed (values in sec)
 						$sLabel = $this->oModelReflection->GetLabel($sClass, $sAttCode);
 						$aFunctionAttributes[$sAttCode] = $sLabel;
 						break;

application/datamodel.application.xml

@@ -563,6 +563,17 @@ Call $this->AddInitialAttributeFlags($sAttCode, $iFlags) for all the initial att
         </event_datum>
       </event_data>
     </event>
+    <event id="EVENT_SERVICE_LOCATOR_INITIALIZED" _delta="define">
+    <name>Service Locator Initialized</name>
+    <internal>true</internal>
+    <description><![CDATA[Inform the listeners that Service Locator has been (re)initialized]]></description>
+    <event_data>
+      <event_datum id="file_name">
+        <description>The configuration file used to initialize Service Locator</description>
+        <type>string</type>
+      </event_datum>
+    </event_data>
+  </event>
   </events>
   <meta>
     <classes>

application/displayblock.class.inc.php

@@ -1078,7 +1078,6 @@ JS
 
 				if ($aCounts[$sStateValue] == 0) {
 					$aCounts[$sStateValue] = ['link' => '-', 'label' => $aCounts[$sStateValue]];
-					;
 				} else {
 					$oSingleGroupByValueFilter = $this->m_oFilter->DeepClone();
 					$oSingleGroupByValueFilter->AddCondition($sStateAttrCode, $sStateValue, '=');
@@ -1708,7 +1707,7 @@ JS
 		$oBlock->bAdvancedMode = utils::ReadParam('advanced', false);
 
 		$oBlock->sCsvFile = strtolower($this->m_oFilter->GetClass()).'.csv';
-		$oBlock->sDownloadLink = utils::GetAbsoluteUrlAppRoot().'webservices/export.php?expression='.urlencode($this->m_oFilter->ToOQL(true)).'&format=csv&filename='.urlencode($oBlock->sCsvFile);
+		$oBlock->sDownloadLink = utils::GetAbsoluteUrlAppRoot().'webservices/export-v2.php?expression='.urlencode($this->m_oFilter->ToOQL(true)).'&format=csv&filename='.urlencode($oBlock->sCsvFile);
 		$oBlock->sLinkToToggle = utils::GetAbsoluteUrlAppRoot().'pages/UI.php?operation=search'.$oAppContext->GetForLink(true).'&filter='.rawurlencode($this->m_oFilter->serialize()).'&format=csv';
 		// Pass the parameters via POST, since expression may be very long
 		$aParamsToPost = [
@@ -1725,7 +1724,7 @@ JS
 			$oBlock->sLinkToToggle = $oBlock->sLinkToToggle.'&advanced=1';
 			$oBlock->sChecked = '';
 		}
-		$oBlock->sAjaxLink = utils::GetAbsoluteUrlAppRoot().'webservices/export.php';
+		$oBlock->sAjaxLink = utils::GetAbsoluteUrlAppRoot().'webservices/export-v2.php';
 
 		$oBlock->sCharsetNotice = false;
 		$oBlock->sJsonParams = json_encode($aParamsToPost);
@@ -1947,8 +1946,8 @@ class MenuBlock extends DisplayBlock
 					$sSelectedClassName = MetaModel::GetName($sSelectedClass);
 
 					// Check rights on class
-					$bIsBulkModifyAllowed = (!MetaModel::IsAbstract($sSelectedClass)) && UserRights::IsActionAllowed($sSelectedClass, UR_ACTION_BULK_MODIFY) && ($oReflectionClass->IsSubclassOf('cmdbAbstractObject'));
-					$bIsBulkDeleteAllowed = (bool) UserRights::IsActionAllowed($sSelectedClass, UR_ACTION_BULK_DELETE);
+					$bIsBulkModifyAllowed = (!MetaModel::IsAbstract($sSelectedClass)) && UserRights::IsActionAllowed($sSelectedClass, UR_ACTION_BULK_MODIFY) && (($oReflectionClass->IsSubclassOf(cmdbAbstractObject::class) || $sSelectedClass === SynchroReplica::class));
+					$bIsBulkDeleteAllowed = (bool)UserRights::IsActionAllowed($sSelectedClass, UR_ACTION_BULK_DELETE);
 
 					// Refine filter on selected class so bullk actions occur on the right class
 					$oSelectedClassFilter = $this->GetFilter()->DeepClone();
@@ -1958,7 +1957,15 @@ class MenuBlock extends DisplayBlock
 					// Action label dict code has a specific suffix for "Link" / "Remote" aliases to allow dedicated labels in linksets.
 					$sActionLabelCodeSuffix = in_array($sSelectedAlias, ['Link', 'Remote']) ? $sSelectedAlias : 'Class';
 					if ($bIsBulkModifyAllowed) {
-						$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:ModifyAll:'.$sSelectedAlias, Dict::Format('UI:Menu:ModifyAll_'.$sActionLabelCodeSuffix, $sSelectedClassName));
+						if ($sSelectedClass === SynchroReplica::class) {
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:UnlinkAll:', Dict::S('Class:SynchroReplica/Action:unlink_all'), 'unlink');
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:UnLinkSynchroAll:', Dict::S('Class:SynchroReplica/Action:unlinksynchro_all'), 'unlinksynchro');
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:SynchroAll:', Dict::S('Class:SynchroReplica/Action:synchro_all'), 'synchro');
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:AllowDeleteAll:', Dict::S('Class:SynchroReplica/Action:allowdelete_all'), 'allowdelete');
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:DenyDeleteAll:', Dict::S('Class:SynchroReplica/Action:denydelete_all'), 'denydelete');
+						} else {
+							$this->AddBulkModifyObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:ModifyAll:'.$sSelectedAlias, Dict::Format('UI:Menu:ModifyAll_'.$sActionLabelCodeSuffix, $sSelectedClassName));
+						}
 					}
 					if ($bIsBulkDeleteAllowed) {
 						$this->AddBulkDeleteObjectsMenuAction($aRegularActions, $sSelectedClass, $oSelectedClassFilter->serialize(), 'UI:Menu:BulkDelete:'.$sSelectedAlias, Dict::Format('UI:Menu:BulkDelete_'.$sActionLabelCodeSuffix, $sSelectedClassName));
@@ -2285,6 +2292,17 @@ class MenuBlock extends DisplayBlock
 				}
 				// ResourceId should not be sanitized
 				$oActionButton->AddDataAttribute('resource-id', $sActionId);
+				if (isset($aAction['data_attributes']) && is_array($aAction['data_attributes'])) {
+					foreach ($aAction['data_attributes'] as $sName => $sValue) {
+						$sDataAttributeName = $sName;
+						$oActionButton->AddDataAttribute($sDataAttributeName, (string) $sValue);
+					}
+				}
+				if (isset($aAction['aria_attributes']) && is_array($aAction['aria_attributes'])) {
+					foreach ($aAction['aria_attributes'] as $sName => $sValue) {
+						$oActionButton->AddAriaAttribute((string) $sName, (string) $sValue);
+					}
+				}
 				$oActionButton->AddCSSClasses(['ibo-action-button', 'ibo-regular-action-button']);
 				if (empty($sLabel)) {
 					if (empty($aAction['tooltip'])) {
@@ -2478,11 +2496,11 @@ class MenuBlock extends DisplayBlock
 	 * @since 3.1.0
 	 * @internal
 	 */
-	protected function AddBulkModifyObjectsMenuAction(array &$aActions, string $sClass, string $sFilter, string $sActionIdentifier = 'UI:Menu:ModifyAll', $sActionLabel = 'UI:Menu:ModifyAll'): void
+	protected function AddBulkModifyObjectsMenuAction(array &$aActions, string $sClass, string $sFilter, string $sActionIdentifier = 'UI:Menu:ModifyAll', $sActionLabel = 'UI:Menu:ModifyAll', $sOperationName = 'modify'): void
 	{
 		$aActions[$sActionIdentifier] = [
-			'label' => Dict::S($sActionLabel),
-			'url' => $this->PrepareUrlForStandardMenuAction($sClass, "operation=select_for_modify_all&class=$sClass&filter=".urlencode($sFilter)),
+				'label' => Dict::S($sActionLabel),
+				'url'   => $this->PrepareUrlForStandardMenuAction($sClass, 'operation=select_for_'.$sOperationName.'_all&class='.$sClass.'&filter='.urlencode($sFilter)),
 		] + $this->GetDefaultParamsForMenuAction();
 	}
 

application/exceptions/CoreException.php

@@ -14,6 +14,8 @@ class CoreException extends Exception
 	/**
 	 * CoreException constructor.
 	 *
+	 * ATTENTION: Logging here will break the CI
+	 *
 	 * @param string $sIssue error message
 	 * @param array|null $aContextData key/value array, value MUST implements _toString
 	 * @param string $sImpact

application/forms.class.inc.php

@@ -220,10 +220,19 @@ class DesignerForm
 					$sValidationFields = '</td><td class="prop_icon prop_apply ibo-prop--apply" >'.$sValidation.'</td><td  class="prop_icon prop_cancel ibo-prop--cancel"><span><div class="ibo-button ibo-is-alternative ibo-is-neutral" data-tooltip-content="'.Dict::Format('UI:DashboardEdit:Revert').'"><i class="fas fa-undo"></i></div></span></td>'
 						.$this->EndRow();
 
+					$aPropertyFieldData = [
+						'code' => $oField->GetCode(),
+						'type' => $oField->GetInputType(),
+						'label' => $aRow['label'],
+						'raw-value' => $oField->GetRawValue(),
+					];
 					if (is_null($aRow['label'])) {
-						$sReturn .= $this->StartRow($sFieldId).'<td class="prop_value" colspan="2">'.$aRow['value'];
+						$sReturn .= $this->StartRow($sFieldId, $aPropertyFieldData).
+							'<td class="prop_value" data-role="ibo-property-field-value" colspan="2">'.$aRow['value'];
 					} else {
-						$sReturn .= $this->StartRow($sFieldId).'<td class="prop_label">'.$aRow['label'].'</td><td class="prop_value">'.$aRow['value'];
+						$sReturn .= $this->StartRow($sFieldId, $aPropertyFieldData).
+							'<td class="prop_label" data-role="ibo-property-field-label">'.$aRow['label'].
+							'</td><td class="prop_value" data-role="ibo-property-field-value">'.$aRow['value'];
 					}
 					if (!($oField instanceof DesignerFormSelectorField) && !($oField instanceof DesignerMultipleSubFormField)) {
 						$sReturn .= $sValidationFields;
@@ -294,12 +303,21 @@ EOF
 		}
 	}
 
-	public function StartRow($sFieldId = null)
+	public function StartRow($sFieldId = null, $aPropertyFieldData = [])
 	{
-		if ($sFieldId != null) {
-			return '<tr id="row_'.$sFieldId.'" data-path="'.$this->GetHierarchyPath().'" data-selector="'.$this->GetHierarchyParent().'">';
+		$sPropertyFieldAttributes = '';
+		foreach ($aPropertyFieldData as $sAttribute => $value) {
+			if (is_array($value)) {
+				$value = json_encode($value);
+			} elseif (is_null($value)) {
+				$value = '';
+			}
+			$sPropertyFieldAttributes .= ' data-property-field-'.$sAttribute.'="'.utils::EscapeHtml((string)$value).'"';
 		}
-		return '<tr data-path="'.$this->GetHierarchyPath().'" data-selector="'.$this->GetHierarchyParent().'">';
+		if ($sFieldId != null) {
+			return '<tr id="row_'.$sFieldId.'" data-path="'.$this->GetHierarchyPath().'" data-selector="'.$this->GetHierarchyParent().'"'.$sPropertyFieldAttributes.'>';
+		}
+		return '<tr data-path="'.$this->GetHierarchyPath().'" data-selector="'.$this->GetHierarchyParent().'"'.$sPropertyFieldAttributes.'>';
 	}
 
 	public function EndRow()
@@ -679,6 +697,14 @@ class DesignerFormField
 		return $this->sCode;
 	}
 
+	/**
+	 * @return mixed
+	 */
+	public function GetRawValue()
+	{
+		return $this->defaultValue;
+	}
+
 	/**
 	 * @param \DesignerForm $oForm
 	 */
@@ -1387,7 +1413,7 @@ class DesignerIconSelectionField extends DesignerFormField
 	public function AddAllowedValue($aValue)
 	{
 		// Add a null value to the list of allowed values
-		$this->aAllowedValues = array_merge([$aValue], $this->aAllowedValues);
+		$this->aAllowedValues = array_merge([$aValue], $this->aAllowedValues ?? [null]);
 	}
 	public function EnableUpload($sIconUploadUrl)
 	{
@@ -1629,6 +1655,11 @@ class DesignerFormSelectorField extends DesignerFormField
 		return 'selector_property_field';
 	}
 
+	public function GetRawValue()
+	{
+		return $this->defaultRealValue;
+	}
+
 	public function AddSubForm($oSubForm, $sLabel, $sValue)
 	{
 		$this->aSubForms[] = ['form' => $oSubForm, 'label' => $sLabel, 'value' => $sValue];

application/loginwebpage.class.inc.php

@@ -25,11 +25,11 @@
  */
 
 use Combodo\iTop\Application\Branding;
-use Combodo\iTop\Application\Helper\Session;
 use Combodo\iTop\Application\WebPage\ErrorPage;
 use Combodo\iTop\Application\WebPage\NiceWebPage;
 use Combodo\iTop\Service\Events\EventData;
 use Combodo\iTop\Service\Events\EventService;
+use Combodo\iTop\Service\Session\Session;
 
 /**
  * Web page used for displaying the login form
@@ -369,16 +369,7 @@ class LoginWebPage extends NiceWebPage
 	public static function ResetSession()
 	{
 		// Unset all of the session variables.
-		Session::Unset('auth_user');
-		Session::Unset('login_state');
-		Session::Unset('can_logoff');
-		Session::Unset('archive_mode');
-		Session::Unset('impersonate_user');
-		Session::Unset('PluginProperties');
-		Session::Unset('UrlMakerClass');
-		Session::Unset('itop_env');
-		Session::Unset('obj_messages');
-		Session::Unset('profile_list');
+		Session::UnsetAll();
 		UserRights::_ResetSessionCache();
 		// If it's desired to kill the session, also delete the session cookie.
 		// Note: This will destroy the session, and not just the session data!

application/query.class.inc.php

@@ -113,17 +113,43 @@ abstract class Query extends cmdbAbstractObject
 			]
 		));
 
+		MetaModel::Init_AddAttribute(new AttributeExternalKey(
+			"owner_id",
+			[
+				"targetclass" => 'Contact',
+				"allowed_values" => null,
+				"sql" => 'owner_id',
+				"is_null_allowed" => true,
+				"depends_on" => [],
+				"display_style" => 'select',
+				"always_load_in_tables" => false,
+				"on_target_delete" => DEL_AUTO,
+			]
+		));
+
+		MetaModel::Init_AddAttribute(new AttributeEnumSet(
+			"usages",
+			[
+				"allowed_values" => null,
+				"possible_values" => new ValueSetEnumPadded("export,reference,notif,draft,dashlet"),
+				"sql" => "usages",
+				"depends_on" => [],
+				"is_null_allowed" => true,
+				"max_items" => 12,
+			]
+		));
+
 		// Display lists
 		MetaModel::Init_SetZListItems(
 			'details',
-			['name', 'is_template', 'description']
+			['name', 'is_template', 'owner_id', 'usages', 'description']
 		); // Attributes to be displayed for the complete details
-		MetaModel::Init_SetZListItems('list', ['description']); // Attributes to be displayed for a list
+		MetaModel::Init_SetZListItems('list', ['description', 'usages']); // Attributes to be displayed for a list
 		// Search criteria
 		MetaModel::Init_SetZListItems('standard_search', ['name', 'description', 'is_template']); // Criteria of the std search form
 		MetaModel::Init_SetZListItems(
 			'default_search',
-			['name', 'description', 'is_template']
+			['name', 'description', 'is_template', 'owner_id', 'usages']
 		); // Criteria of the default search form
 		// MetaModel::Init_SetZListItems('advanced_search', array('name')); // Criteria of the advanced search form
 	}
@@ -143,6 +169,15 @@ abstract class Query extends cmdbAbstractObject
 		return parent::GetAttributeFlags($sAttCode, $aReasons, $sTargetState);
 	}
 
+	public function GetInitialStateAttributeFlags($sAttCode, &$aReasons = [])
+	{
+		// read only attribute
+		if (in_array($sAttCode, ['export_count', 'export_last_date', 'export_last_user_id'])) {
+			return OPT_ATT_READONLY;
+		}
+		return parent::GetInitialStateAttributeFlags($sAttCode, $aReasons);
+	}
+
 	/**
 	 * Return export url.
 	 *
@@ -214,15 +249,15 @@ class QueryOQL extends Query
 		MetaModel::Init_SetZListItems(
 			'details',
 			[
-				'col:col1' => ['fieldset:Query:baseinfo' => ['name', 'is_template', 'description', 'oql', 'fields']],
+				'col:col1' => ['fieldset:Query:baseinfo' => ['name', 'is_template', 'owner_id', 'usages', 'description', 'oql', 'fields']],
 				'col:col2' => ['fieldset:Query:exportInfo' => ['export_count', 'export_last_date', 'export_last_user_id', 'export_last_user_contact']],
 			]
 		); // Attributes to be displayed for the complete details
-		MetaModel::Init_SetZListItems('list', ['description']); // Attributes to be displayed for a list
+		MetaModel::Init_SetZListItems('list', ['description', 'usages']); // Attributes to be displayed for a list
 		// Search criteria
 		MetaModel::Init_SetZListItems(
 			'standard_search',
-			['name', 'description', 'is_template', 'fields', 'oql']
+			['name', 'description', 'is_template', 'owner_id', 'usages', 'oql']
 		); // Criteria of the std search form
 	}
 

application/startup.inc.php

@@ -17,6 +17,7 @@
 //   You should have received a copy of the GNU Affero General Public License
 //   along with iTop. If not, see <http://www.gnu.org/licenses/>
 use Combodo\iTop\Application\Helper\Session;
+use Combodo\iTop\Service\Startup\StartupService;
 
 require_once(APPROOT.'core/cmdbobject.class.inc.php');
 require_once(APPROOT.'application/utils.inc.php');
@@ -69,26 +70,7 @@ $oKPI->ComputeAndReport("Session Start");
 
 $sSwitchEnv = utils::ReadParam('switch_env', null);
 $bAllowCache = true;
-if (($sSwitchEnv != null) && file_exists(APPCONF.$sSwitchEnv.'/'.ITOP_CONFIG_FILE) && (Session::Get('itop_env') !== $sSwitchEnv)) {
-	Session::Set('itop_env', $sSwitchEnv);
-	$sEnv = $sSwitchEnv;
-	$bAllowCache = false;
-	// Reset the opcache since otherwise the PHP "model" files may still be cached !!
-	if (function_exists('opcache_reset')) {
-		// Zend opcode cache
-		opcache_reset();
-	}
-	if (function_exists('apc_clear_cache')) {
-		// APC(u) cache
-		apc_clear_cache();
-	}
-	// TODO: reset the credentials as well ??
-} elseif (Session::IsSet('itop_env')) {
-	$sEnv = Session::Get('itop_env');
-} else {
-	$sEnv = ITOP_DEFAULT_ENV;
-	Session::Set('itop_env', ITOP_DEFAULT_ENV);
-}
+$sEnv = (new StartupService())->SetItopEnvironment($sSwitchEnv, $bAllowCache);
 $sConfigFile = APPCONF.$sEnv.'/'.ITOP_CONFIG_FILE;
 try {
 	MetaModel::Startup($sConfigFile, false /* $bModelOnly */, $bAllowCache, false /* $bTraceSourceFiles */, $sEnv);

application/transaction.class.inc.php

@@ -115,7 +115,7 @@ class privUITransactionSession
 		// Strictly speaking, the two lines below should be grouped together
 		// by a critical section
 		// sem_acquire($rSemIdentified);
-		$id = static::GetUserPrefix().str_replace(['.', ' '], '', microtime());
+		$id = static::GetUserPrefix().str_replace(['.', ' '], '', microtime()).'-'.bin2hex(random_bytes(24));
 		Session::Set(['transactions', $id], true);
 		// sem_release($rSemIdentified);
 
@@ -236,7 +236,7 @@ class privUITransactionFile
 
 		self::CleanupOldTransactions();
 
-		$sTransactionIdFullPath = tempnam(utils::GetDataPath().'transactions', static::GetUserPrefix());
+		$sTransactionIdFullPath = static::CreateUniqueTransactionFilePath(utils::GetDataPath().'transactions', static::GetUserPrefix());
 		file_put_contents($sTransactionIdFullPath, $iCurrentUserId, LOCK_EX);
 
 		$sTransactionIdFileName = basename($sTransactionIdFullPath);
@@ -245,6 +245,33 @@ class privUITransactionFile
 		return $sTransactionIdFileName;
 	}
 
+	/**
+	 * Create a transaction file path with a longer random suffix and create it atomically.
+	 *
+	 * @param string $sDir
+	 * @param string $sPrefix
+	 *
+	 * @return string
+	 *
+	 * @throws CoreException
+	 */
+	private static function CreateUniqueTransactionFilePath(string $sDir, string $sPrefix): string
+	{
+		$iMaxAttempts = 10;
+		for ($i = 0; $i < $iMaxAttempts; $i++) {
+			$sFileName = $sPrefix.bin2hex(random_bytes(24)); // 48 random hex chars
+			$sFullPath = $sDir.'/'.$sFileName;
+
+			$hFile = @fopen($sFullPath, 'x');
+			if ($hFile !== false) {
+				fclose($hFile);
+				return $sFullPath;
+			}
+		}
+
+		throw new CoreException('Failed to allocate a unique transaction file name after multiple attempts.');
+	}
+
 	/**
 	 * Check whether a transaction is valid or not and (optionally) remove the valid transaction from
 	 * the session so that another call to IsTransactionValid for the same transaction id
@@ -281,6 +308,18 @@ class privUITransactionFile
 			return false;
 		}
 
+		$iTime = filemtime($sFilepath);
+		$iLifetime = (int) MetaModel::GetConfig()->Get('transactions_file_lifetime');
+		$iLimit = time() - $iLifetime;
+		if ($iTime < $iLimit) {
+			self::Info("IsTransactionValid: Transaction '$id' expired.");
+			if ($iLifetime < 3600) {
+				IssueLog::Warning("IsTransactionValid: Transaction '$id' expired after only $iLifetime seconds. Consider increasing the 'transactions_file_lifetime' configuration parameter.");
+			}
+			@unlink($sFilepath);
+			return false;
+		}
+
 		if ($bRemoveTransaction) {
 			$bResult = @unlink($sFilepath);
 			if (!$bResult) {
@@ -314,7 +353,7 @@ class privUITransactionFile
 	}
 
 	/**
-	 * Cleanup old transactions which have been pending since more than 24 hours
+	 * Cleanup old transactions which have been pending since more than the lifetime defined in the configuration parameter 'transactions_file_lifetime'.
 	 * Use filemtime instead of filectime since filectime may be affected by operations on the directory (like changing the access rights)
 	 */
 	protected static function CleanupOldTransactions($sTransactionDir = null)
@@ -327,7 +366,7 @@ class privUITransactionFile
 		}
 
 		clearstatcache();
-		$iLimit = time() - 24 * 3600;
+		$iLimit = time() - (int) MetaModel::GetConfig()->Get('transactions_file_lifetime');
 		$sPattern = $sTransactionDir ? "$sTransactionDir/*" : utils::GetDataPath().'transactions/*';
 		$aTransactions = glob($sPattern);
 		foreach ($aTransactions as $sFileName) {

application/utils.inc.php

@@ -284,9 +284,7 @@ class utils
 		}
 		// Read and record the value for switching the archive mode
 		$iCurrent = self::ReadParam('with-archive', $iDefault);
-		if (Session::IsInitialized()) {
-			Session::Set('archive_mode', $iCurrent);
-		}
+		Session::Set('archive_mode', $iCurrent);
 		// Read and use the value for the current page (web services)
 		$iCurrent = self::ReadParam('with_archive', $iCurrent, true);
 		self::$bPageMode = ($iCurrent == 1);
@@ -976,7 +974,7 @@ class utils
 			return self::$oConfig;
 		}
 
-		$sProductionEnvConfigPath = self::GetConfigFilePath('production');
+		$sProductionEnvConfigPath = self::GetConfigFilePath(ITOP_DEFAULT_ENV);
 		if (file_exists($sProductionEnvConfigPath)) {
 			$oProductionEnvDiskConfig = new Config($sProductionEnvConfigPath);
 			self::SetConfig($oProductionEnvDiskConfig);
@@ -1835,10 +1833,15 @@ SQL;
 	/**
 	 * Some characters cause troubles with jQuery when used inside DOM IDs, so let's replace them by the safe _ (underscore)
 	 * @param string $sId The ID to sanitize
+	 * @param bool $bForSelector Whether to apply strict CSS/jQuery selector-safe sanitization
 	 * @return string The sanitized ID
 	 */
-	public static function GetSafeId($sId)
+	public static function GetSafeId($sId, bool $bForSelector = false)
 	{
+		if ($bForSelector) {
+			return preg_replace('/[^a-zA-Z0-9_]/', '_', $sId);
+		}
+
 		return str_replace([':', '[', ']', '+', '-', ' '], '_', $sId);
 	}
 
@@ -1888,7 +1891,7 @@ SQL;
 			CURLOPT_HEADER         => false,    // don't return the headers in the output
 			CURLOPT_FOLLOWLOCATION => true,     // follow redirects
 			CURLOPT_ENCODING       => "",       // handle all encodings
-			CURLOPT_USERAGENT      => "spider", // who am i
+			CURLOPT_USERAGENT      => static::GetConfig()->Get('http.request.user_agent'), // who am i
 			CURLOPT_AUTOREFERER    => true,     // set referer on redirect
 			CURLOPT_CONNECTTIMEOUT => 120,      // timeout on connect
 			CURLOPT_TIMEOUT        => 120,      // timeout on response
@@ -1919,7 +1922,9 @@ SQL;
 				$aResponseHeaders[$sName] = $sValue;
 			}
 		}
-		curl_close($ch);
+		if (PHP_VERSION_ID < 80000) {
+			curl_close($ch);
+		}
 
 		return $response;
 	}
@@ -3022,7 +3027,6 @@ TXT
 	 * Note: Only works for backoffice URLs for now
 	 *
 	 * @param string $sText Text containing the mentioned objects to be found
-	 * @param string $sFormat {@uses static::ENUM_TEXT_FORMAT_HTML, ...}
 	 *
 	 * @return array Array of object classes / IDs for the ones found in $sText
 	 *
@@ -3037,13 +3041,45 @@ TXT
 	public static function GetMentionedObjectsFromText(string $sText): array
 	{
 		$aMentionedObjects = [];
-		$aMentionMatches = [];
-		$sText = html_entity_decode($sText);
+		$aMentionAllowedClasses = MetaModel::GetConfig()->Get('mentions.allowed_classes');
+		$oDom = new \DOMDocument();
+		$bPreviousUseInternalErrors = libxml_use_internal_errors(true); // to keep processing even in case of "invalid" HTML, cf. testGetMentionedObjectsFromText
 
-		preg_match_all('/<a\s*([^>]*)data-object-class="([^"]*)"\s.*data-object-key="([^"]*)"/Ui', $sText, $aMentionMatches);
-		foreach ($aMentionMatches[0] as $iMatchIdx => $sCompleteMatch) {
-			$sMatchedClass = $aMentionMatches[2][$iMatchIdx];
-			$sMatchedId = $aMentionMatches[3][$iMatchIdx];
+		try {
+			$oDom->loadHTML('<?xml encoding="UTF-8">'.$sText);
+		} finally {
+			libxml_clear_errors();
+			libxml_use_internal_errors($bPreviousUseInternalErrors);
+		}
+		$oXpath = new \DOMXPath($oDom);
+		$oNodes = $oXpath->query('//a[@data-object-class and @data-object-key]');
+
+		foreach ($oNodes as $oObjNode) {
+			$sMatchedClass = $oObjNode->getAttribute('data-object-class');
+			$sMatchedId = $oObjNode->getAttribute('data-object-key');
+			$sMatchedName = trim($oObjNode->textContent);
+
+			// Ensure that what we found is actually configured as a mention
+			$sMentionPrefix = array_search($sMatchedClass, $aMentionAllowedClasses);
+			// - No direct configuration for the matched class, let's look for a configuration on parent classes
+			if (false === $sMentionPrefix) {
+				$bHasMentionConfigurationForParentClass = false;
+				foreach (MetaModel::EnumParentClasses($sMatchedClass, ENUM_PARENT_CLASSES_EXCLUDELEAF, false) as $aMatchedParentClass) {
+					$sMentionPrefix = array_search($aMatchedParentClass, $aMentionAllowedClasses);
+					if (false !== $sMentionPrefix) {
+						$bHasMentionConfigurationForParentClass = true;
+						break;
+					}
+				}
+
+				if (false === $bHasMentionConfigurationForParentClass) {
+					continue;
+				}
+			}
+			// - Test if the name starts with $sMentionPrefix (e.g. '@' for 'Contact' class)
+			if (false === str_starts_with($sMatchedName, $sMentionPrefix)) {
+				continue;
+			}
 
 			// Prepare array for matched class if not already present
 			if (!array_key_exists($sMatchedClass, $aMentionedObjects)) {
@@ -3192,4 +3228,74 @@ TXT
 			}
 		}
 	}
+
+	/**
+	 * Read memory limit from the php.ini file
+	 *
+	 * @return int Memory limit in bytes
+	 */
+	public static function GetMemoryLimit(): int
+	{
+		$sLimit = ini_get('memory_limit');
+		if ($sLimit == '-1') {
+			return 128 * 1048576;
+		}
+		switch (substr($sLimit, -1)) {
+			case 'M':
+			case 'm':
+				return (int)$sLimit * 1048576;
+			case 'K':
+			case 'k':
+				return (int)$sLimit * 1024;
+			case 'G':
+			case 'g':
+				return (int)$sLimit * 1073741824;
+			default:
+				return (int)$sLimit;
+		}
+	}
+
+	/**
+	 * @since 3.3.0 N°9875
+	 * Open archive and raise appropriate exception.
+	 * Warning: do not forget to close archive afterwhile
+	 * @param string $sArchiveFilePath
+	 * @param int|null $flags
+	 * @return ZipArchive
+	 * @throws \Exception
+	 */
+	public static function ZipArchiveOpen(string $sArchiveFilePath, int|null $flags = null): ZipArchive
+	{
+		$oZip = new ZipArchive();
+		if (is_null($flags)) {
+			$code = $oZip->open($sArchiveFilePath);
+		} else {
+			$code = $oZip->open($sArchiveFilePath, $flags);
+		}
+		if (true !== $code) {
+			//ZipArchive::ZIP_ER_NOZIP : 19
+			if ($code === 19) {
+				throw new \Exception(sprintf('Cannot open zip file due to inconsistent or empty content'));
+			}
+
+			throw new \Exception(sprintf('Cannot open zip file due to error code %s', $code));
+		}
+		return $oZip;
+	}
+
+	/**
+	* @since 3.3.0 N°9875
+	* @param string $sDirectory
+	* @param string $sPrefix
+	* @return ZipArchive
+	* @throws \Exception
+	 */
+	public static function ZipArchiveCreateWithTempNam(string $sDirectory, string $sPrefix): ZipArchive
+	{
+		$sTempnam = tempnam($sDirectory, $sPrefix);
+		unlink($sTempnam);
+		$sArchiveName = $sTempnam.'.zip';
+
+		return self::ZipArchiveOpen($sArchiveName, ZipArchive::CREATE);
+	}
 }

composer.lock

@@ -5570,16 +5570,16 @@
         },
         {
             "name": "twig/twig",
-            "version": "v3.24.0",
+            "version": "v3.28.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/twigphp/Twig.git",
-                "reference": "a6769aefb305efef849dc25c9fd1653358c148f0"
+                "reference": "597c12ed286fb9d1701a36684ce6e0cbe28ebc8b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/twigphp/Twig/zipball/a6769aefb305efef849dc25c9fd1653358c148f0",
-                "reference": "a6769aefb305efef849dc25c9fd1653358c148f0",
+                "url": "https://api.github.com/repos/twigphp/Twig/zipball/597c12ed286fb9d1701a36684ce6e0cbe28ebc8b",
+                "reference": "597c12ed286fb9d1701a36684ce6e0cbe28ebc8b",
                 "shasum": ""
             },
             "require": {
@@ -5634,7 +5634,7 @@
             ],
             "support": {
                 "issues": "https://github.com/twigphp/Twig/issues",
-                "source": "https://github.com/twigphp/Twig/tree/v3.24.0"
+                "source": "https://github.com/twigphp/Twig/tree/v3.28.0"
             },
             "funding": [
                 {
@@ -5646,7 +5646,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-03-17T21:31:11+00:00"
+            "time": "2026-07-03T20:44:34+00:00"
         }
     ],
     "packages-dev": [

core/autoload.php

@@ -24,7 +24,7 @@ MetaModel::IncludeModule('application/user.dashboard.class.inc.php');
 MetaModel::IncludeModule('application/audit.rule.class.inc.php');
 MetaModel::IncludeModule('application/audit.domain.class.inc.php');
 MetaModel::IncludeModule('application/query.class.inc.php');
-MetaModel::IncludeModule('setup/moduleinstallation.class.inc.php');
+MetaModel::IncludeModule('setup/moduleinstallation/moduleinstallation.class.inc.php');
 
 MetaModel::IncludeModule('core/event.class.inc.php');
 MetaModel::IncludeModule('core/action.class.inc.php');

core/cmdbsource.class.inc.php

@@ -916,7 +916,9 @@ class CMDBSource
 		$aColumn = [];
 		$aData = self::QueryToArray($sSql);
 		foreach ($aData as $aRow) {
-			@$aColumn[] = $aRow[$col];
+			if ($aRow[$col] !== null) {
+				$aColumn[] = $aRow[$col];
+			}
 		}
 		return $aColumn;
 	}

core/config.class.inc.php

@@ -20,9 +20,6 @@
  *
  */
 
-use Combodo\iTop\Config\Validator\iTopConfigAstValidator;
-use Combodo\iTop\Config\Validator\iTopConfigSyntaxValidator;
-
 define('ITOP_APPLICATION', 'iTop');
 define('ITOP_APPLICATION_SHORT', 'iTop');
 
@@ -610,6 +607,14 @@ class Config
 			'source_of_value' => '',
 			'show_in_conf_sample' => false,
 		],
+		'attribute.max_actions_items' => [
+			'type' => 'integer',
+			'description' => 'Maximum number of actions to display before it\'s compacted into a single action (0 means no limit)',
+			'default' => 2,
+			'value' => 2,
+			'source_of_value' => '',
+			'show_in_conf_sample' => false,
+		],
 		'email_asynchronous' => [
 			'type' => 'bool',
 			'description' => 'If set, the emails are sent off line, which requires cron.php to be activated. Exception: some features like the email test utility will force the serialized mode',
@@ -1182,8 +1187,8 @@ class Config
 		'tracking_level_linked_set_default' => [
 			'type' => 'integer',
 			'description' => 'Default tracking level if not explicitly set at the attribute level, for AttributeLinkedSet (defaults to NONE in case of a fresh install, LIST otherwise - this to preserve backward compatibility while upgrading from a version older than 2.0.3 - see TRAC #936)',
-			'default' => LINKSET_TRACKING_LIST,
-			'value' => LINKSET_TRACKING_LIST,
+			'default' => LINKSET_TRACKING_NONE,
+			'value' => LINKSET_TRACKING_NONE,
 			'source_of_value' => '',
 			'show_in_conf_sample' => false,
 		],
@@ -1291,6 +1296,14 @@ class Config
 			'source_of_value'     => '',
 			'show_in_conf_sample' => false,
 		],
+		'transactions_file_lifetime' => [
+			'type'                => 'integer',
+			'description'         => 'Value in seconds for the lifetime of a transaction file (after this duration, the transaction will be invalid and the garbage collector could delete it). This only works if the "transaction_storage" parameter is set to "File".',
+			'default'             => 3600,
+			'value'               => '',
+			'source_of_value'     => '',
+			'show_in_conf_sample' => false,
+		],
 		'log_transactions' => [
 			'type'                => 'bool',
 			'description'         => 'Whether or not to enable the debug log for the transactions.',
@@ -2755,14 +2768,13 @@ class Config
 	 *
 	 * @param array $aParamValues
 	 * @param ?string $sModulesDir
-	 * @param bool $bPreserveModuleSettings
 	 *
 	 * @return void The current object is modified directly
 	 *
 	 * @throws \Exception
 	 * @throws \CoreException
 	 */
-	public function UpdateFromParams($aParamValues, $sModulesDir = null, $bPreserveModuleSettings = false)
+	public function UpdateFromParams($aParamValues, $sModulesDir = null)
 	{
 		if (isset($aParamValues['application_path'])) {
 			$this->Set('app_root_url', $aParamValues['application_path']);
@@ -2810,7 +2822,10 @@ class Config
 		} else {
 			$aSelectedModules = null;
 		}
-		$this->UpdateIncludes($sModulesDir, $aSelectedModules);
+
+		if (! is_null($sModulesDir)) {
+			$this->UpdateIncludes($sModulesDir, $aSelectedModules);
+		}
 
 		if (isset($aParamValues['source_dir'])) {
 			$this->Set('source_dir', $aParamValues['source_dir']);
@@ -2828,17 +2843,13 @@ class Config
 	 *
 	 * @throws Exception
 	 */
-	public function UpdateIncludes($sModulesDir, $aSelectedModules = null)
+	public function UpdateIncludes(string $sModulesDir, $aSelectedModules = null)
 	{
-		if ($sModulesDir === null) {
-			return;
-		}
-
 		// Initialize the arrays below with default values for the application...
 		$oEmptyConfig = new Config('dummy_file', false); // Do NOT load any config file, just set the default values
 		$aAddOns = $oEmptyConfig->GetAddOns();
 
-		$aModules = ModuleDiscovery::GetAvailableModules([APPROOT.$sModulesDir]);
+		$aModules = ModuleDiscovery::GetModulesOrderedByDependencies([APPROOT.$sModulesDir]);
 		foreach ($aModules as $sModuleId => $aModuleInfo) {
 			list($sModuleName, $sModuleVersion) = ModuleDiscovery::GetModuleName($sModuleId);
 			if (is_null($aSelectedModules) || in_array($sModuleName, $aSelectedModules)) {

core/dbobject.class.php

@@ -730,13 +730,8 @@ abstract class DBObject implements iDisplay
 	public function SetTrim($sAttCode, $sValue)
 	{
 		$oAttDef = MetaModel::GetAttributeDef(get_class($this), $sAttCode);
-		$iMaxSize = $oAttDef->GetMaxSize();
-		$sLength = mb_strlen($sValue);
-		if ($iMaxSize && ($sLength > $iMaxSize)) {
-			$sMessage = " -truncated ($sLength chars)";
-			$sValue = mb_substr($sValue, 0, $iMaxSize - mb_strlen($sMessage)).$sMessage;
-		}
-		$this->Set($sAttCode, $sValue);
+
+		$this->Set($sAttCode, $oAttDef->TrimValue($sValue));
 	}
 
 	/**
@@ -2038,7 +2033,7 @@ abstract class DBObject implements iDisplay
 				}
 			}
 			if (!is_null($iMaxSize = $oAtt->GetMaxSize())) {
-				$iLen = mb_strlen($toCheck);
+				$iLen = $oAtt->GetSize($toCheck);
 				if ($iLen > $iMaxSize) {
 					return "String too long (found $iLen, limited to $iMaxSize)";
 				}
@@ -5108,8 +5103,8 @@ abstract class DBObject implements iDisplay
 	protected function GetReferencingObjectsForDeletion($bAllowAllData = false)
 	{
 		$aDependentObjects = [];
-		$aRererencingMe = MetaModel::EnumReferencingClasses(get_class($this));
-		foreach ($aRererencingMe as $sRemoteClass => $aExtKeys) {
+		$aReferencingMe = MetaModel::EnumReferencingClasses(get_class($this));
+		foreach ($aReferencingMe as $sRemoteClass => $aExtKeys) {
 			/** @var \AttributeExternalKey $oExtKeyAttDef */
 			foreach ($aExtKeys as $sExtKeyAttCode => $oExtKeyAttDef) {
 				// skip if external key doesn't require the deletion cascading

core/dbobjectsearch.class.php

@@ -1935,9 +1935,8 @@ class DBObjectSearch extends DBSearch
 
 	/**
 	 * @inheritDoc
-	 * @return DBObjectSearch
 	 */
-	protected function ApplyDataFilters(): DBObjectSearch
+	protected function ApplyDataFilters(): DBSearch
 	{
 		if ($this->IsAllDataAllowed() || $this->IsDataFiltered()) {
 			return $this;

core/dbunionsearch.class.php

@@ -676,9 +676,8 @@ class DBUnionSearch extends DBSearch
 
 	/**
 	 * @inheritDoc
-	 * @return DBUnionSearch
 	 */
-	protected function ApplyDataFilters(): DBUnionSearch
+	protected function ApplyDataFilters(): DBSearch
 	{
 		if ($this->IsAllDataAllowed() || $this->IsDataFiltered()) {
 			return $this;

core/designdocument.class.inc.php

@@ -360,10 +360,10 @@ class DesignElement extends \DOMElement
 	 * @param string $sTagName
 	 * @param string|null $sDefault
 	 *
-	 * @return string
+	 * @return null|string
 	 * @throws \DOMFormatException
 	 */
-	public function GetChildText($sTagName, $sDefault = null)
+	public function GetChildText($sTagName, $sDefault = null): ?string
 	{
 		$sRet = $sDefault;
 		if ($oChild = $this->GetOptionalElement($sTagName)) {

core/event.class.inc.php

@@ -178,7 +178,7 @@ class EventNotificationEmail extends EventNotification
 
 		// Display lists
 		MetaModel::Init_SetZListItems('details', ['date', 'userinfo', 'message', 'trigger_id', 'action_id', 'object_class', 'object_id', 'to', 'cc', 'bcc', 'from', 'subject', 'body', 'attachments']); // Attributes to be displayed for the complete details
-		MetaModel::Init_SetZListItems('list', ['date', 'message', 'to', 'subject', 'attachments']); // Attributes to be displayed for a list
+		MetaModel::Init_SetZListItems('list', ['date', 'message', 'to', 'cc', 'bcc', 'subject', 'attachments']); // Attributes to be displayed for a list
 
 		// Search criteria
 		//		MetaModel::Init_SetZListItems('standard_search', array('name')); // Criteria of the std search form

core/inlineimage.class.inc.php

@@ -434,7 +434,7 @@ JS
 	 * Resize an image so that it fits the maximum width/height defined in the config file
 	 * @param ormDocument $oImage The original image stored as an array (content / mimetype / filename)
 	 * @return ormDocument The resampled image (or the original one if it already fit)
-	 * @deprecated since 3.3.0 Replaced by ormDocument::ResizeImageToFit
+	 * @deprecated 3.3.0 Use ormDocument::ResizeImageToFit instead
 	 */
 	public static function ResizeImageToFit(ormDocument $oImage, &$aDimensions = null)
 	{

core/log.class.inc.php

@@ -614,6 +614,13 @@ class LogChannels
 	 * @since 3.2.0
 	 */
 	public const SECURITY = 'Security';
+
+	/**
+	 * For Session parameters
+	 *
+	 * @Since 3.3.0
+	 */
+	public const SESSION_PARAMETERS = 'SessionParameters';
 }
 
 abstract class LogAPI

core/metamodel.class.php

@@ -20,8 +20,10 @@
 
 use Combodo\iTop\Application\EventRegister\ApplicationEvents;
 use Combodo\iTop\Core\MetaModel\FriendlyNameType;
+use Combodo\iTop\Service\DependencyInjection\ServiceLocator;
 use Combodo\iTop\Service\Events\EventData;
 use Combodo\iTop\Service\Events\EventService;
+use Combodo\iTop\Setup\ModuleDiscovery\ModuleFileReader;
 
 require_once APPROOT.'core/modulehandler.class.inc.php';
 require_once APPROOT.'core/querymodifier.class.inc.php';
@@ -128,7 +130,9 @@ abstract class MetaModel
 	/** @var array */
 	private static $m_aClassToFile = [];
 	/** @var string */
-	protected static $m_sEnvironment = 'production';
+	protected static $m_sEnvironment = ITOP_DEFAULT_ENV;
+	/** @var \Combodo\iTop\Service\DependencyInjection\ServiceLocator  */
+	private static ?ServiceLocator $oServiceLocator = null;
 
 	/**
 	 * Objects currently created/updated.
@@ -462,6 +466,43 @@ abstract class MetaModel
 		return call_user_func([$sClass, 'GetClassDescription'], $sClass);
 	}
 
+	/**
+	 * @param string $sClass
+	 *
+	 * @return string
+	 * @throws \CoreException
+	 */
+	final public static function GetModuleName($sClass)
+	{
+		try {
+			$oReflectionClass = new ReflectionClass($sClass);
+			$sDir = realpath(dirname($oReflectionClass->getFileName()));
+			$sApproot = realpath(APPROOT);
+			while (($sDir !== $sApproot) && (str_contains($sDir, $sApproot))) {
+				$aFiles = glob("$sDir/module.*.php");
+				if (count($aFiles) > 1) {
+					return 'core';
+				}
+
+				if (count($aFiles) == 0) {
+					$sDir = realpath(dirname($sDir));
+					continue;
+				}
+
+				$sModuleFilePath = $aFiles[0];
+				$aModuleInfo = ModuleFileReader::GetInstance()->ReadModuleFileInformation($sModuleFilePath);
+				$sModuleId = $aModuleInfo[ModuleFileReader::MODULE_INFO_ID];
+				list($sModuleName, ) = ModuleDiscovery::GetModuleName($sModuleId);
+
+				return $sModuleName;
+			}
+		} catch (\Exception $e) {
+			throw new CoreException("Cannot find class module", ['class' => $sClass], '', $e);
+		}
+
+		return 'core';
+	}
+
 	/**
 	 * @param string $sClass
 	 *
@@ -1604,10 +1645,10 @@ abstract class MetaModel
 		if ($sFilterCode == 'id') {
 			return true;
 		}
-		if (array_key_exists($sClass, self::$m_aMagicFields) && array_key_exists($sFilterCode, self::$m_aMagicFields[$sClass])) {
+		if (array_key_exists($sClass, self::$m_aMagicFields) && in_array($sFilterCode, self::$m_aMagicFields[$sClass])) {
 			return true;
 		}
-		if (array_key_exists($sClass, self::$m_aFilterForbiddenAttributes) && array_key_exists($sFilterCode, self::$m_aFilterForbiddenAttributes[$sClass])) {
+		if (array_key_exists($sClass, self::$m_aFilterForbiddenAttributes) && in_array($sFilterCode, self::$m_aFilterForbiddenAttributes[$sClass])) {
 			return false;
 		}
 		return self::IsValidAttCode($sClass, $sFilterCode);
@@ -2925,8 +2966,9 @@ abstract class MetaModel
 						self::$m_aMagicFields[] = $sClass;
 					}
 					self::$m_aMagicFields[$sClass][] = $sCode;
+					self::$m_aAttribOrigins[$sClass][$sCode] = self::$m_aAttribOrigins[$sClass][$sAttCode];
 				}
-				if (!$oAttDef->IsSearchable()) {
+				if (!$oAttDef->IsValidFilterAttribute()) {
 					if (!array_key_exists($sClass, self::$m_aFilterForbiddenAttributes)) {
 						self::$m_aFilterForbiddenAttributes[] = $sClass;
 					}
@@ -4621,12 +4663,15 @@ abstract class MetaModel
 	 * @throws \CoreException
 	 * @throws \MySQLException
 	 */
-	public static function DBExists($bMustBeComplete = true)
+	public static function DBExists($bMustBeComplete = true, ?string $sDBName = null)
 	{
-		if (!CMDBSource::IsDB(self::$m_sDBName)) {
+		if (is_null($sDBName)) {
+			$sDBName = self::$m_sDBName;
+		}
+		if (!CMDBSource::IsDB($sDBName)) {
 			return false;
 		}
-		CMDBSource::SelectDB(self::$m_sDBName);
+		CMDBSource::SelectDB($sDBName);
 
 		$aFound = [];
 		$aMissing = [];
@@ -5709,7 +5754,7 @@ abstract class MetaModel
 	 * @throws \DictExceptionUnknownLanguage
 	 * @throws \Exception
 	 */
-	public static function Startup($config, $bModelOnly = false, $bAllowCache = true, $bTraceSourceFiles = false, $sEnvironment = 'production')
+	public static function Startup($config, $bModelOnly = false, $bAllowCache = true, $bTraceSourceFiles = false, $sEnvironment = ITOP_DEFAULT_ENV)
 	{
 		// Startup on a new environment is not supported
 		static $bStarted = false;
@@ -5720,36 +5765,40 @@ abstract class MetaModel
 
 		self::$m_sEnvironment = $sEnvironment;
 
-		try {
-			if (!defined('MODULESROOT')) {
-				define('MODULESROOT', APPROOT.'env-'.self::$m_sEnvironment.'/');
+		if (!defined('MODULESROOT')) {
+			define('MODULESROOT', APPROOT.'env-'.self::$m_sEnvironment.'/');
 
-				self::$m_bTraceSourceFiles = $bTraceSourceFiles;
+			self::$m_bTraceSourceFiles = $bTraceSourceFiles;
 
-				// $config can be either a filename, or a Configuration object (volatile!)
-				if ($config instanceof Config) {
-					self::LoadConfig($config, $bAllowCache);
-				} else {
-					self::LoadConfig(new Config($config), $bAllowCache);
-				}
-
-				if ($bModelOnly) {
-					return;
-				}
+			// $config can be either a filename, or a Configuration object (volatile!)
+			if ($config instanceof Config) {
+				self::LoadConfig($config, $bAllowCache);
+			} else {
+				self::LoadConfig(new Config($config), $bAllowCache);
 			}
 
-			CMDBSource::SelectDB(self::$m_sDBName);
-
-			foreach (MetaModel::EnumPlugins('ModuleHandlerApiInterface') as $oPHPClass) {
-				$oPHPClass::OnMetaModelStarted();
+			if ($bModelOnly) {
+				// Event service must be initialized after the MetaModel startup, otherwise it cannot discover classes implementing the iEventServiceSetup interface
+				EventService::InitService();
+				EventService::FireEvent(new EventData(ApplicationEvents::APPLICATION_EVENT_METAMODEL_STARTED));
+				self::$oServiceLocator = new ServiceLocator(self::GetConfig());
+				return;
 			}
-
-			ExpressionCache::Warmup();
-		} finally {
-			// Event service must be initialized after the MetaModel startup, otherwise it cannot discover classes implementing the iEventServiceSetup interface
-			EventService::InitService();
-			EventService::FireEvent(new EventData(ApplicationEvents::APPLICATION_EVENT_METAMODEL_STARTED));
 		}
+
+		CMDBSource::SelectDB(self::$m_sDBName);
+
+		foreach (MetaModel::EnumPlugins('ModuleHandlerApiInterface') as $oPHPClass) {
+			$oPHPClass::OnMetaModelStarted();
+		}
+
+		ExpressionCache::Warmup();
+
+		// Event service must be initialized after the MetaModel startup, otherwise it cannot discover classes implementing the iEventServiceSetup interface
+		EventService::InitService();
+		EventService::FireEvent(new EventData(ApplicationEvents::APPLICATION_EVENT_METAMODEL_STARTED));
+		self::$oServiceLocator = new ServiceLocator();
+		self::$oServiceLocator->InitFromConfig(self::GetConfig());
 	}
 
 	/**
@@ -6823,10 +6872,24 @@ abstract class MetaModel
 		require_once(APPROOT.'/core/dict.class.inc.php');
 		Dict::ResetCache($sAppIdentity);
 
+		$iApcDeleteFailureCount = 0;
 		if (function_exists('apc_delete')) {
 			foreach (self::GetCacheEntries($sEnvironmentId) as $sKey => $aAPCInfo) {
 				$sAPCKey = $aAPCInfo['info'];
-				apc_delete($sAPCKey);
+				if (!apc_delete($sAPCKey)) {
+					$iApcDeleteFailureCount++;
+				}
+			}
+		}
+
+		if ($iApcDeleteFailureCount > 0) {
+			SetupLog::Warning("apc_delete failed for $iApcDeleteFailureCount entries for env $sEnvironment");
+		}
+
+		if (function_exists('apc_clear_cache')) {
+			// old style APC
+			if (!apc_clear_cache()) {
+				SetupLog::Warning("apc_clear_cache failed for env $sEnvironment");
 			}
 		}
 
@@ -6836,7 +6899,9 @@ abstract class MetaModel
 		// Reset the opcache since otherwise the PHP "model" files may still be cached !!
 		if (function_exists('opcache_reset')) {
 			// Zend opcode cache
-			opcache_reset();
+			if (!opcache_reset()) {
+				SetupLog::Warning("opcache_reset failed for env $sEnvironment");
+			}
 		}
 
 		require_once(APPROOT.'setup/setuputils.class.inc.php');
@@ -7026,6 +7091,11 @@ abstract class MetaModel
 			}
 		}
 	}
+
+	public static function GetServiceLocator(): ?ServiceLocator
+	{
+		return self::$oServiceLocator;
+	}
 }
 
 // Standard attribute lists

core/oqlactualclasstreeresolver.class.inc.php

@@ -60,15 +60,13 @@ class OQLActualClassTreeResolver
 		$aTranslateFields = [];
 		foreach ($aExpectedAttributes as $sAttCode => $oExpression) {
 			// 'id' is managed later
-			if ($sAttCode == 'id') {
+			if ($sAttCode === 'id') {
 				continue;
 			}
 			// Attributes can be stored in attributes list or for magic ones into filter codes list.
 			$sOriginClass = null;
-			if (MetaModel::IsValidAttCode($sClass, $sAttCode)) {
+			if (MetaModel::IsValidAttCode($sClass, $sAttCode) || MetaModel::IsValidFilterCode($sClass, $sAttCode)) {
 				$sOriginClass = MetaModel::GetAttributeOrigin($sClass, $sAttCode);
-			} elseif ($sAttCode == 'id') {
-				$sOriginClass = $sClass;
 			} else {
 				continue;
 			}

core/ormdocument.class.inc.php

@@ -340,13 +340,14 @@ class ormDocument
 	 * @param string $sContentDisposition Either 'inline' or 'attachment'
 	 * @param string $sSecretField The attcode of the field containing a "secret" to be provided in order to retrieve the file
 	 * @param string $sSecretValue The value of the secret to be compared with the value of the attribute $sSecretField
+	 * @param bool $bAllowAllData If true, no rights filtering is applied
 	 *
 	 * @return void
 	 */
-	public static function DownloadDocument(WebPage $oPage, $sClass, $id, $sAttCode, $sContentDisposition = 'attachment', $sSecretField = null, $sSecretValue = null)
+	public static function DownloadDocument(WebPage $oPage, $sClass, $id, $sAttCode, $sContentDisposition = 'attachment', $sSecretField = null, $sSecretValue = null, $bAllowAllData = false)
 	{
 		try {
-			$oObj = MetaModel::GetObject($sClass, $id, false, false);
+			$oObj = MetaModel::GetObject($sClass, $id, false, $bAllowAllData);
 			if (!is_object($oObj)) {
 				// If access to the document is not granted, check if the access to the host object is allowed
 				$oObj = MetaModel::GetObject($sClass, $id, false, true);
@@ -407,7 +408,7 @@ class ormDocument
 	 * @param int $iMaxImageHeight Maximum height for the resized image
 	 * @param array|null $aFinalDimensions Image dimensions after resizing or null if unable to read the image
 	 * @return ormDocument The resampled image
-	 *
+	 * @since 3.3.0 N°3124
 	 */
 	public function ResizeImageToFit(int $iMaxWidth, int $iMaxHeight, array|null &$aFinalDimensions = null): static
 	{

core/ormpassword.class.inc.php

@@ -52,7 +52,7 @@ class ormPassword
 	public function SetPassword($sClearTextPassword)
 	{
 		$iHashAlgo = MetaModel::GetConfig()->GetPasswordHashAlgo();
-		$this->m_sHashed = password_hash($sClearTextPassword, $iHashAlgo);
+		$this->m_sHashed = password_hash($sClearTextPassword ?? '', $iHashAlgo);
 	}
 
 	/**
@@ -99,10 +99,10 @@ class ormPassword
 		$aInfo = password_get_info($this->m_sHashed);
 		if (is_null($aInfo["algo"]) || $aInfo["algo"] === 0) {
 			// - Unknown algorithm, assume it's a legacy password
-			$sHashedPwd = $this->ComputeHash($sClearTextPassword);
+			$sHashedPwd = $this->ComputeHash($sClearTextPassword ?? '');
 			$bResult = hash_equals($this->m_sHashed, $sHashedPwd);
 		} else {
-			$bResult = password_verify($sClearTextPassword, $this->m_sHashed);
+			$bResult = password_verify($sClearTextPassword ?? '', $this->m_sHashed);
 		}
 		return $bResult;
 	}

core/ormtagset.class.inc.php

@@ -43,24 +43,24 @@ final class ormTagSet extends ormSet
 
 	/**
 	 *
-	 * @param array $aTagCodes
+	 * @param array|null $aItems
 	 *
 	 * @throws \CoreException
 	 * @throws \CoreUnexpectedValue when a code is invalid
 	 */
-	public function SetValues($aTagCodes)
+	public function SetValues($aItems)
 	{
-		if (is_null($aTagCodes)) {
-			$aTagCodes = [];
+		if (is_null($aItems)) {
+			$aItems = [];
 		}
-		if (!is_array($aTagCodes)) {
-			throw new CoreUnexpectedValue("Wrong value {$aTagCodes} for {$this->sClass}:{$this->sAttCode}");
+		if (!is_array($aItems)) {
+			throw new CoreUnexpectedValue("Wrong value {$aItems} for {$this->sClass}:{$this->sAttCode}");
 		}
 
 		$oTags = [];
 		$iCount = 0;
 		$bError = false;
-		foreach ($aTagCodes as $sTagCode) {
+		foreach ($aItems as $sTagCode) {
 			$iCount++;
 			if (($this->iLimit != 0) && ($iCount > $this->iLimit)) {
 				$bError = true;

core/restservices.class.inc.php

@@ -248,6 +248,45 @@ class RestResultWithObjects extends RestResult
 	}
 }
 
+/**
+ * @package RESTAPI
+ * @api
+ */
+class RestResultWithObjectSets extends RestResultWithObjects
+{
+	private $current_object = null;
+
+	public function MakeNewObjectSet()
+	{
+		$arr = [];
+		$this->current_object = &$arr;
+		$this->objects[] = &$arr;
+	}
+
+	/**
+	 * Report the given object
+	 *
+	 * @api
+	 * @param string $sObjectAlias Name of the subobject, usually the OQL class alias
+	 * @param int $iCode An error code (RestResult::OK is no issue has been found)
+	 * @param string $sMessage Description of the error if any, an empty string otherwise
+	 * @param DBObject $oObject The object being reported
+	 * @param array|null $aFieldSpec An array of class => attribute codes (Cf. RestUtils::GetFieldList). List of the attributes to be reported.
+	 * @param boolean $bExtendedOutput Output all of the link set attributes ?
+	 *
+	 * @return void
+	 * @throws \ArchivedObjectException
+	 * @throws \CoreException
+	 * @throws \CoreUnexpectedValue
+	 * @throws \MySQLException
+	 */
+	public function AppendSubObject($sObjectAlias, $iCode, $sMessage, $oObject, $aFieldSpec = null, $bExtendedOutput = false)
+	{
+		$oObjRes = ObjectResult::FromDBObject($oObject, $aFieldSpec, $bExtendedOutput, $iCode, $sMessage);
+		$this->current_object[$sObjectAlias] = $oObjRes;
+	}
+}
+
 /**
  * @package RESTAPI
  * @api
@@ -500,14 +539,21 @@ class CoreServices implements iRestServiceProvider, iRestInputSanitizer
 				break;
 
 			case 'core/get':
-				$sClass = RestUtils::GetClass($aParams, 'class');
+				$sClassParam =  RestUtils::GetMandatoryParam($aParams, 'class');
 				$key = RestUtils::GetMandatoryParam($aParams, 'key');
-				$aShowFields = RestUtils::GetFieldList($sClass, $aParams, 'output_fields');
-				$bExtendedOutput = (RestUtils::GetOptionalParam($aParams, 'output_fields', '*') == '*+');
+				$sShowFields = RestUtils::GetOptionalParam($aParams, 'output_fields', '*');
 				$iLimit = (int)RestUtils::GetOptionalParam($aParams, 'limit', 0);
 				$iPage = (int)RestUtils::GetOptionalParam($aParams, 'page', 1);
 
-				$oObjectSet = RestUtils::GetObjectSetFromKey($sClass, $key, $iLimit, self::getOffsetFromLimitAndPage($iLimit, $iPage));
+				// Validate the class(es)
+				$aClass = explode(',', $sClassParam);
+				foreach ($aClass as $sClass) {
+					if (!MetaModel::IsValidClass(trim($sClass))) {
+						throw new Exception("class '$sClass' is not valid");
+					}
+				}
+
+				$oObjectSet = RestUtils::GetObjectSetFromKey($sClassParam, $key, $iLimit, self::getOffsetFromLimitAndPage($iLimit, $iPage));
 				$sTargetClass = $oObjectSet->GetFilter()->GetClass();
 
 				if (UserRights::IsActionAllowed($sTargetClass, UR_ACTION_READ) != UR_ALLOWED_YES) {
@@ -519,8 +565,56 @@ class CoreServices implements iRestServiceProvider, iRestInputSanitizer
 				} elseif ($iPage < 1) {
 					$oResult->code = RestResult::INVALID_PAGE;
 					$oResult->message = "The request page number is not valid. It must be an integer greater than 0";
+				} elseif (count($oObjectSet->GetSelectedClasses()) > 1) {
+					$oResult = new RestResultWithObjectSets();
+					$aCache = [];
+					$aShowFields = [];
+					foreach ($oObjectSet->GetSelectedClasses() as $sSelectedClass) {
+						$aShowFields = array_merge($aShowFields, RestUtils::GetFieldList($sSelectedClass, $aParams, 'output_fields', false));
+					}
+
+					while ($oObjects = $oObjectSet->FetchAssoc()) {
+						$oResult->MakeNewObjectSet();
+
+						foreach ($oObjects as $sAlias => $oObject) {
+							if (!$oObject) {
+								continue;
+							}
+
+							if (!array_key_exists($sAlias, $aCache)) {
+								$sClass = get_class($oObject);
+								$bExtendedOutput = RestUtils::HasRequestedExtendedOutput($sShowFields);
+
+								if (!RestUtils::HasRequestedAllOutputFields($sShowFields)) {
+									$aFields = $aShowFields[$sClass];
+									//Id is not a valid attribute to optimize
+									if ($aFields && in_array('id', $aFields)) {
+										unset($aFields[array_search('id', $aFields)]);
+									}
+									$aAttToLoad = [$sAlias => $aFields];
+									$oObjectSet->OptimizeColumnLoad($aAttToLoad);
+								}
+								$aCache[$sAlias] = [
+									'aShowFields' => $aShowFields,
+									'bExtendedOutput' => $bExtendedOutput,
+								];
+							} else {
+								$aShowFields = $aCache[$sAlias]['aShowFields'];
+								$bExtendedOutput = $aCache[$sAlias]['bExtendedOutput'];
+							}
+
+							$oResult->AppendSubObject($sAlias, 0, '', $oObject, $aShowFields, $bExtendedOutput);
+						}
+					}
+					$oResult->message = "Found: ".$oObjectSet->Count();
 				} else {
-					if (!$bExtendedOutput && RestUtils::GetOptionalParam($aParams, 'output_fields', '*') != '*') {
+					$aShowFields = [];
+					foreach ($aClass as $sSelectedClass) {
+						$sSelectedClass = trim($sSelectedClass);
+						$aShowFields = array_merge($aShowFields, RestUtils::GetFieldList($sSelectedClass, $aParams, 'output_fields', false));
+					}
+
+					if (!RestUtils::HasRequestedAllOutputFields($sShowFields) && count($aShowFields) == 1) {
 						$aFields = $aShowFields[$sClass];
 						//Id is not a valid attribute to optimize
 						if (in_array('id', $aFields)) {
@@ -531,7 +625,7 @@ class CoreServices implements iRestServiceProvider, iRestInputSanitizer
 					}
 
 					while ($oObject = $oObjectSet->Fetch()) {
-						$oResult->AddObject(0, '', $oObject, $aShowFields, $bExtendedOutput);
+						$oResult->AddObject(0, '', $oObject, $aShowFields, RestUtils::HasRequestedExtendedOutput($sShowFields));
 					}
 					$oResult->message = "Found: ".$oObjectSet->Count();
 				}

core/tabularbulkexport.class.inc.php

@@ -8,6 +8,13 @@
 use Combodo\iTop\Application\UI\Base\Component\Input\InputUIBlockFactory;
 use Combodo\iTop\Application\UI\Base\Layout\UIContentBlockUIBlockFactory;
 use Combodo\iTop\Application\WebPage\WebPage;
+use Combodo\iTop\Core\AttributeDefinition\AttributeExternalField;
+use Combodo\iTop\Core\AttributeDefinition\AttributeExternalKey;
+use Combodo\iTop\Core\AttributeDefinition\AttributeFriendlyName;
+use Combodo\iTop\Core\AttributeDefinition\AttributeHierarchicalKey;
+use Combodo\iTop\Core\AttributeDefinition\AttributeLinkedSet;
+use Combodo\iTop\Core\AttributeDefinition\AttributeStopWatch;
+use Combodo\iTop\Core\AttributeDefinition\AttributeSubItem;
 
 /**
  * Bulk export: Tabular export: abstract base class for all "tabular" exports.
@@ -91,8 +98,8 @@ abstract class TabularBulkExport extends BulkExport
 	{
 		$aResult = [];
 		switch (get_class($oAttDef)) {
-			case 'AttributeExternalKey':
-			case 'AttributeHierarchicalKey':
+			case AttributeExternalKey::class:
+			case AttributeHierarchicalKey::class:
 
 				$bAddFriendlyName = true;
 				$oKeyAttDef = MetaModel::GetAttributeDef($sClass, $sAttCode);
@@ -142,7 +149,7 @@ abstract class TabularBulkExport extends BulkExport
 				}
 				break;
 
-			case 'AttributeStopWatch':
+			case AttributeStopWatch::class:
 				foreach (MetaModel::ListAttributeDefs($sClass) as $sSubAttCode => $oSubAttDef) {
 					if ($oSubAttDef instanceof AttributeSubItem) {
 						if ($oSubAttDef->GetParentAttCode() == $sAttCode) {
@@ -318,7 +325,7 @@ EOF
 		$sQueryId = utils::ReadParam('query', null, true);
 		$sFields = utils::ReadParam('fields', null, true, 'raw_data');
 		if ((($sFields === null) || ($sFields === '')) && ($sQueryId === null)) {
-			throw new BulkExportMissingParameterException('fields');
+			$sFields =  $this->GetFieldsFromQuery();
 		} else {
 			if (($sQueryId !== null) && ($sQueryId !== null)) {
 				$oSearch = DBObjectSearch::FromOQL('SELECT QueryOQL WHERE id = :query_id', ['query_id' => $sQueryId]);
@@ -329,11 +336,11 @@ EOF
 						// No 'fields' parameter supplied, take the fields from the query phrasebook definition
 						$sFields = trim($oQuery->Get('fields'));
 						if ($sFields === '') {
-							throw new BulkExportMissingParameterException('fields');
+							$sFields =  $this->GetFieldsFromQuery();
 						}
 					}
 				} else {
-					throw BulkExportException('Invalid value for the parameter: query. There is no Query Phrasebook with id = '.$sQueryId, Dict::Format('Core:BulkExport:InvalidParameter_Query', $sQueryId));
+					throw new BulkExportException('Invalid value for the parameter: query. There is no Query Phrasebook with id = '.$sQueryId, Dict::Format('Core:BulkExport:InvalidParameter_Query', $sQueryId));
 				}
 			}
 		}
@@ -341,6 +348,39 @@ EOF
 		$this->SetFields($sFields);
 	}
 
+	public function GetFieldsFromQuery(): string
+	{
+		if (is_null($this->oSearch)) {
+			throw new BulkExportMissingParameterException("fields");
+		}
+
+		$aSelectedClasses = $this->oSearch->GetSelectedClasses();
+		$aAuthorizedClasses = [];
+		$aFields = [];
+		foreach ($aSelectedClasses as $sAlias => $sClassName) {
+			if (UserRights::IsActionAllowed($sClassName, UR_ACTION_BULK_READ) == UR_ALLOWED_YES) {
+				$aAuthorizedClasses[$sAlias] = $sClassName;
+			}
+		}
+		foreach ($aAuthorizedClasses as $sAlias => $sClassName) {
+			foreach (MetaModel::ListAttributeDefs($sClassName) as $oAttribute) {
+				$sAttCode = $oAttribute->GetCode();
+				if (! $this->IsExportableField($sClassName, $sAttCode, $oAttribute)) {
+					continue;
+				}
+				$sCurrentAlias = utils::IsNullOrEmptyString($sAlias) ? "" : "$sAlias.";
+				$aFields[] = "{$sCurrentAlias}{$sAttCode}";
+			}
+		}
+
+		if (count($aFields) === 0) {
+			IssueLog::Error("User is not allowed to see any field for exported OQL");
+			throw new BulkExportMissingParameterException("fields");
+		}
+
+		return implode(',', $aFields);
+	}
+
 	public function SetFields($sFields)
 	{
 		// Interpret (and check) the list of fields

core/userrights.class.inc.php

@@ -658,6 +658,16 @@ abstract class User extends cmdbAbstractObject
 		}
 		return false;
 	}
+
+	/**
+	 * Allow a user to be impersonated by another one (generally an administrator) in order to troubleshoot rights issues.
+	 *
+	 * @return bool
+	 */
+	public function CanBeImpersonated(): bool
+	{
+		return true;
+	}
 }
 
 /**
@@ -1063,6 +1073,9 @@ class UserRights
 		$oUser = self::FindUser($sLogin);
 		if ($oUser) {
 			$bRet = true;
+			if (!$oUser->CanBeImpersonated()) {
+				throw new Exception($oUser->GetName().' cannot be impersonated');
+			}
 			if (is_null(self::$m_oRealUser)) {
 				// First impersonation
 				self::$m_oRealUser = self::$m_oUser;
@@ -1517,6 +1530,37 @@ class UserRights
 		}
 	}
 
+	/**
+	 * @param User $oUser
+	 * @param array $aExcludedProfilesId Administrator by default, but can also be other proofiles depending on needs (e.g. power portal user or REST profile)
+	 * @return bool
+	 * @throws ArchivedObjectException
+	 * @throws CoreException
+	 * @throws CoreUnexpectedValue
+	 * @throws MySQLException
+	 */
+	public static function IsUserReadOnly(User $oUser, array $aExcludedProfilesId = [1]): bool
+	{
+		$oUserProfiles = $oUser->Get('profile_list');
+		$oUserRights = UserRights::GetModuleInstance();
+		while ($oUserProfile = $oUserProfiles->Fetch()) {
+			$iProfileId = $oUserProfile->Get('profileid');
+			if (in_array($iProfileId, $aExcludedProfilesId)) {
+				return false;
+			}
+			foreach (MetaModel::GetClasses('bizmodel,grant_by_profile') as $sClass) {
+				foreach (['w', 'bw', 'd', 'bd'] as $sWriteActionCode) {
+					$bIsGranted = $oUserRights->GetProfileActionGrant($iProfileId, $sClass, $sWriteActionCode);
+					if ($bIsGranted === true) {
+						return false;
+					}
+				}
+			}
+		}
+
+		return true;
+	}
+
 	/**
 	 * @param string $sClass
 	 * @param int $iActionCode see UR_ACTION_* constants

css/backoffice/README.md

@@ -42,7 +42,7 @@ css/backoffice/
 |– vendors/                 # Third-party libs, should be either:
 |                           # - Overload of the lib SCSS variables (BEST way, but possible only if the lib exposes them. e.g. Bulma)
 |                           # - Overload of the lib necessary CSS classes only (not great as it duplicates some rules in the browser, which add weight and computation. e.g. dataTables)
-|                           # - Duplicate the lib CSS completly to insert SCSS variables (not great as it will be outdated when updating the lib itself. e.g. jQuery UI)
+|                           # - Duplicate the lib CSS completely to insert SCSS variables (not great as it will be outdated when updating the lib itself. e.g. jQuery UI)
 |   |– _bulma-variables-overload.scss   # Bulma CSS framework
 |   |– _jquery-ui.scss                  # jQuery UI
 |   ...                                 # Etc…

css/backoffice/application/_user-rights.scss

@@ -4,7 +4,7 @@
  */
 
 $ibo-user-rights--padding-x: $ibo-spacing-400 !default;
-$ibo-user-rights--padding-y: $ibo-spacing-200 !default;
+$ibo-user-rights--padding-y: $ibo-spacing-100 !default;
 $ibo-user-rights--border-radius: $ibo-border-radius-400 !default;
 
 $ibo-user-rights--is-success--background-color: $ibo-color-success-100 !default;
@@ -18,6 +18,8 @@ $ibo-user-rights--is-failure--border-color: $ibo-color-danger-500 !default;
 $ibo-user-rights--is-failure--border: 1px solid $ibo-user-rights--is-failure--border-color !default;
 
 .ibo-user-rights {
+  display: inline-flex;
+  align-items: baseline;
   padding: $ibo-user-rights--padding-y $ibo-user-rights--padding-x;
   border-radius: $ibo-user-rights--border-radius;
   &.ibo-is-success {

css/backoffice/blocks-integrations/_all.scss

@@ -22,4 +22,6 @@
 @import "medallion-with-blocklist";
 @import "field-badge-within-datatable";
 @import "jquery-blockui-within-dialog";
-@import "jquery-blockui-within-datatable";
+@import "jquery-blockui-within-datatable";
+@import "badge-with-badge";
+@import "extension-details-with-extension-details";

css/backoffice/blocks-integrations/_badge-with-badge.scss

@@ -0,0 +1,10 @@
+/*
+ * @copyright   Copyright (C) 2010-2026 Combodo SAS
+ * @license     http://opensource.org/licenses/AGPL-3.0
+ */
+
+$ibo-badge--spacing-left--with-same-block: $ibo-spacing-200 !default;
+
+.ibo-badge + .ibo-badge {
+  margin-left: $ibo-badge--spacing-left--with-same-block;
+}

css/backoffice/blocks-integrations/_extension-details-with-extension-details.scss

@@ -0,0 +1,11 @@
+/*
+ * @copyright   Copyright (C) 2010-2026 Combodo SAS
+ * @license     http://opensource.org/licenses/AGPL-3.0
+ */
+
+$ibo-extension-details--margin-top: $ibo-spacing-300 !default;
+
+.ibo-extension-details + .ibo-extension-details,
+.ibo-extension-details--information--description .ibo-extension-details {
+	margin-top: $ibo-extension-details--margin-top;
+}

css/backoffice/components/_all.scss

@@ -5,6 +5,8 @@
 
 @import "alert";
 @import "button";
+@import "button-bar";
+@import "button-separator";
 @import "button-group";
 @import "breadcrumbs";
 @import "quick-create";
@@ -33,4 +35,5 @@
 @import "field-badge";
 @import "file-select";
 @import "medallion-icon";
-@import "toast";
+@import "toast";
+@import "badge";

css/backoffice/components/_badge.scss

@@ -0,0 +1,43 @@
+$ibo-badge--padding-x : $ibo-spacing-200 !default;
+$ibo-badge--padding-y : $ibo-spacing-100 !default;
+$ibo-badge--border-radius : $ibo-border-radius-400 !default;
+
+$ibo-badge-colors: (
+		'primary': ($ibo-color-primary-100, $ibo-color-primary-900),
+		'secondary': ($ibo-color-secondary-100, $ibo-color-secondary-900),
+		'neutral': ($ibo-color-secondary-100, $ibo-color-secondary-900),
+		'information': ($ibo-color-information-100, $ibo-color-information-900),
+		'success': ($ibo-color-success-100, $ibo-color-success-900),
+		'failure': ($ibo-color-danger-100, $ibo-color-danger-900),
+		'warning': ($ibo-color-warning-100,$ibo-color-warning-900),
+		'danger': ($ibo-color-danger-100,$ibo-color-danger-900),
+		'grey' : ($ibo-color-grey-100, $ibo-color-grey-900),
+		'blue-grey': ($ibo-color-blue-grey-100, $ibo-color-blue-grey-900),
+		'blue': ($ibo-color-blue-100, $ibo-color-blue-900),
+		'cyan': ($ibo-color-cyan-100, $ibo-color-cyan-900),
+		'green': ($ibo-color-green-100, $ibo-color-green-900),
+		'orange' : ($ibo-color-orange-100, $ibo-color-orange-900),
+		'red': ($ibo-color-red-100, $ibo-color-red-900),
+		'pink': ($ibo-color-pink-100, $ibo-color-pink-900),
+		'purple': ($ibo-color-purple-100, $ibo-color-purple-900),
+		'yellow': ($ibo-color-yellow-200, $ibo-color-yellow-900),
+) !default;
+
+
+
+.ibo-badge {
+	display: inline-block;
+	white-space: nowrap;
+	padding : $ibo-badge--padding-y $ibo-badge--padding-x;
+	border-radius : $ibo-badge--border-radius;
+	@extend %ibo-font-ral-med-50;
+
+	@each $sColor, $aColorValues in $ibo-badge-colors {
+		$bg-color: nth($aColorValues, 1);
+		$text-color: nth($aColorValues, 2);
+		&.ibo-is-#{$sColor} {
+			background-color: $bg-color;
+			color: $text-color;
+		}
+	}
+}

css/backoffice/components/_button-bar.scss

@@ -0,0 +1,43 @@
+/*
+ * @copyright   Copyright (C) 2010-2024 Combodo SAS
+ * @license     http://opensource.org/licenses/AGPL-3.0
+ */
+
+$ibo-button-bar--gap: 2px !default;
+$ibo-button-bar--track--gap: 6px !default;
+
+/* button-bar.css */
+ibo-button-bar{
+  display: flex;
+  flex-wrap: nowrap;
+  align-items: center;
+  position: relative;
+  gap: $ibo-button-bar--gap;
+  overflow: hidden;
+}
+
+/* Keep content visible even if JS initialization is delayed. */
+
+ibo-button-bar .ibo-button-bar--track{
+  display: flex;
+  flex: 1 1 auto;
+  flex-wrap: nowrap;
+  overflow: hidden;
+  white-space: nowrap;
+  gap: $ibo-button-bar--track--gap;
+  align-items: center;
+}
+
+ibo-button-bar .ibo-button-bar--item{
+  flex: 0 0 auto;
+  white-space: nowrap;
+}
+
+ibo-button-bar .ibo-button-bar--item[hidden]{
+  display: none !important;
+}
+
+ibo-button-bar .ibo-button-bar--extra{
+  flex: 0 0 auto;
+  position: relative;
+}

css/backoffice/components/_button-separator.scss

@@ -0,0 +1,20 @@
+/*
+ * @copyright   Copyright (C) 2010-2026 Combodo SAS
+ * @license     http://opensource.org/licenses/AGPL-3.0
+ */
+
+$ibo-button-separator--width: 1px !default;
+$ibo-button-separator--height: 16px !default;
+$ibo-button-separator--margin-x: 0.75rem !default;
+$ibo-button-separator--margin-y: $ibo-spacing-0 !default;
+$ibo-button-separator--border-size: 1px !default;
+$ibo-button-separator--border-color: $ibo-color-grey-500 !default;
+
+.ibo-button-separator {
+	display: inline-flex;
+	border-right: $ibo-button-separator--border-size solid $ibo-button-separator--border-color;
+	width: $ibo-button-separator--width;
+	height: $ibo-button-separator--height;
+	margin: $ibo-button-separator--margin-y $ibo-button-separator--margin-x;
+}
+

css/backoffice/components/_field.scss

@@ -37,6 +37,12 @@ $ibo-field--enable-bulk--border-radius: $ibo-border-radius-500 !default;
 
 $ibo-field--enable-bulk--checkbox--margin-left: $ibo-spacing-300 !default;
 
+$ibo-field--label--action--margin-y: $ibo-spacing-0 !default;
+$ibo-field--label--action--margin-x: $ibo-spacing-100 !default;
+$ibo-field--label--action--size: $ibo-field--fullscreen-toggler--size !default;
+$ibo-field--label--action--padding: $ibo-spacing-0 !default;
+$ibo-field--label--action--font-size: $ibo-font-size-50 !default;
+
 /* SCSS rules */
 .ibo-field {
   @extend %ibo-font-size-150;
@@ -264,4 +270,32 @@ $ibo-field--enable-bulk--checkbox--margin-left: $ibo-spacing-300 !default;
 
 .ibo-input-select--action-buttons a  {
   @extend %ibo-hyperlink-inherited-colors;
+}
+
+.ibo-field--label {
+  .ibo-field--action:not(.ibo-button-separator) {
+    display: inline-flex;
+    align-content: center;
+    align-items: center;
+    justify-content: center;
+    vertical-align: middle;
+
+    width: $ibo-field--label--action--size;
+    height: $ibo-field--label--action--size;
+    padding: $ibo-field--label--action--padding;
+    border-radius: $ibo-field--fullscreen-toggler--border-radius;
+    font-size: $ibo-field--label--action--font-size;
+    ~ .ibo-field--action {
+      margin-left: $ibo-field--label--action--margin-x;
+    }
+  }
+  .ibo-field--action.ibo-button-separator {
+    margin:  $ibo-field--label--action--margin-y $ibo-field--label--action--margin-x;
+    vertical-align: middle;
+  }
+}
+
+// Specific rule to ensure that the grouped actions popover of a field is visible in fullscreen mode
+body.ibo-has-fullscreen-descendant .ibo-popover-menu.ibo-field--grouped-actions-popover {
+  z-index: 1060 !important;
 }

css/backoffice/components/_form.scss

@@ -8,70 +8,74 @@
   padding-bottom: 14px;
 }
 
-.help-text{
-  padding: 1px 5px;
-  background-color: #d7e3f8;
-  border: 1px solid #c6e7f5;
-  border-radius: 5px;
-  margin: 5px 0;
-  font-size: 0.9em;
-}
-
-.form-error ul{
-  padding: 1px 5px;
-  background-color: #f8d7da;
-  border: 1px solid #f5c6cb;
-  border-radius: 5px;
-  margin: 5px 0;
-  font-size: 0.9em;
-}
-
-.subform{
-  background-color: #efefef;
-  border-radius: 5px;
-  padding: 10px;
-}
-
-.form-buttons{
-  margin: 20px 0;
-}
-
-.form select{
-  padding: 0;
-  overflow-y: auto;
-}
-
-.form select option{
-  height: 30px;
-  display: flex;
-  align-items: center;
-}
-
-.turbo-refreshing{
-  opacity: .5;
-}
-
-.ibo-field legend{
-  margin-top: 24px;
-}
-
-collection-entry-element {
-  margin-top: 8px;
-  display: block;
-  padding: 10px 10px;
-  background-color: #f5f5f5;
-  border-radius: 5px;
-}
-.ts-control{
-  height: auto;
-  min-height: 30px;
-}
-
-.ibo-form-actions > .ibo-button > span{
-  margin-right: 5px;
-}
-
-.ibo-form textarea{
-  resize: vertical;
-}
-
+// WIP SDK Forms
+//form[is="itop-form-element"] {
+//
+//  .help-text{
+//    padding: 1px 5px;
+//    background-color: #d7e3f8;
+//    border: 1px solid #c6e7f5;
+//    border-radius: 5px;
+//    margin: 5px 0;
+//    font-size: 0.9em;
+//  }
+//
+//  .form-error ul{
+//    padding: 1px 5px;
+//    background-color: #f8d7da;
+//    border: 1px solid #f5c6cb;
+//    border-radius: 5px;
+//    margin: 5px 0;
+//    font-size: 0.9em;
+//  }
+//
+//  .subform{
+//    background-color: #efefef;
+//    border-radius: 5px;
+//    padding: 10px;
+//  }
+//
+//  .form-buttons{
+//    margin: 20px 0;
+//  }
+//
+//  .form select{
+//    padding: 0;
+//    overflow-y: auto;
+//  }
+//
+//  .form select option{
+//    height: 30px;
+//    display: flex;
+//    align-items: center;
+//  }
+//
+//  .turbo-refreshing{
+//    opacity: .5;
+//  }
+//
+//  .ibo-field legend{
+//    margin-top: 24px;
+//  }
+//
+//  collection-entry-element {
+//    margin-top: 8px;
+//    display: block;
+//    padding: 10px 10px;
+//    background-color: #f5f5f5;
+//    border-radius: 5px;
+//  }
+//  .ts-control{
+//    height: auto;
+//    min-height: 30px;
+//  }
+//
+//  .ibo-form-actions > .ibo-button > span{
+//    margin-right: 5px;
+//  }
+//
+//  .ibo-form textarea{
+//    resize: vertical;
+//  }
+//
+//}

css/backoffice/components/input/_input-select-icon.scss

@@ -3,9 +3,9 @@
  * @license     http://opensource.org/licenses/AGPL-3.0
  */
 
-$ibo-input-select-icon--menu--icon--max-height: 100% !default;
-$ibo-input-select-icon--menu--icon--max-width: 100% !default;
-$ibo-input-select-icon--icon--padding-right: $ibo-spacing-200 !default;
+$ibo-input-select-icon--max-height: 100% !default;
+$ibo-input-select-icon--max-width: 100% !default;
+$ibo-input-select-icon--padding-right: $ibo-spacing-200 !default;
 
 $ibo-input-select-icon--menu--z-index: 21 !default;
 $ibo-input-select-icon--menu--max-height: 300px !default;
@@ -18,9 +18,9 @@ $ibo-input-select-icon--menu--icon--margin-right: 10px !default;
   display: inline-flex;
   text-align: left;
 	>img{
-		max-height: $ibo-input-select-icon--menu--icon--max-height;
-		max-width: $ibo-input-select-icon--menu--icon--max-width;
-		padding-right: $ibo-input-select-icon--icon--padding-right;
+		max-height: $ibo-input-select-icon--max-height;
+		max-width: $ibo-input-select-icon--max-width;
+		padding-right: $ibo-input-select-icon--padding-right;
 	}
   >span{
     overflow: hidden;

css/backoffice/components/input/_input-set.scss

@@ -21,6 +21,7 @@ $ibo-input-set--item--padding-x: 6px !default;
 $ibo-input-set--item--padding-y: $ibo-spacing-200 !default;
 $ibo-input-set--item--max-width: 360px !default;
 $ibo-input-set--item--background-color: $ibo-color-white-100 !default;
+$ibo-input-set--item--color: $ibo-color-grey-900 !default;
 $ibo-input-set--item--border: none !default;
 $ibo-input-set--item--border-radius: $ibo-border-radius-300 !default;
 $ibo-input-set--item--box-shadow: 0 1px 1px rgba(0, 0, 0, 0.15), 0 0 1px 1px rgba(241, 241, 241, 0.7) !default;
@@ -59,7 +60,7 @@ $ibo-input-set--item--box-shadow: 0 1px 1px rgba(0, 0, 0, 0.15), 0 0 1px 1px rgb
   border-radius: $ibo-input-set--item--border-radius;
   box-shadow: $ibo-input-set--item--box-shadow;
 
-  color: $ibo-color-grey-900;
+  color: $ibo-input-set--item--color;
   text-shadow: none;
   @extend %ibo-text-truncated-with-ellipsis;
   /* - Guaranty that if a set item has html sub-node, they correctly display ellipsis (eg. Link set set items) */

css/backoffice/components/input/_input-toggler.scss

@@ -8,6 +8,7 @@ $ibo-toggler--wrapper--height: 20px !default;
 
 $ibo-toggler--slider--border-radius: $ibo-border-radius-900 !default;
 $ibo-toggler--slider--background-color: $ibo-color-secondary-600 !default;
+$ibo-toggler--slider--disabled--background-color: $ibo-color-secondary-200 !default;
 
 $ibo-toggler--slider--before--left: 3px !default;
 $ibo-toggler--slider--before--bottom: 3px !default;
@@ -17,6 +18,7 @@ $ibo-toggler--slider--before--border-radius: $ibo-border-radius-full !default;
 $ibo-toggler--slider--before--background-color: $ibo-color-grey-100 !default;
 
 $ibo-toggler--slider--checked--background-color: $ibo-color-primary-600 !default;
+$ibo-toggler--slider--checked-disabled--background-color: $ibo-color-primary-200 !default;
 $ibo-toggler--slider--focus--box-shadow: 0 0 1px $ibo-color-primary-600 !default;
 
 $ibo-toggler--label--margin-left: 4px !default;
@@ -61,6 +63,13 @@ $ibo-toggler--label--margin-left: 4px !default;
   background-color: $ibo-toggler--slider--checked--background-color;
 }
 
+.ibo-toggler--wrapper input:disabled + .ibo-toggler--slider {
+  background-color: $ibo-toggler--slider--disabled--background-color;
+}
+.ibo-toggler--wrapper input:checked:disabled + .ibo-toggler--slider {
+  background-color: $ibo-toggler--slider--checked-disabled--background-color;
+}
+
 input:focus + .ibo-toggler--slider {
   box-shadow: $ibo-toggler--slider--focus--box-shadow;
 }

css/backoffice/layout/_all.scss

@@ -4,7 +4,6 @@
  */
 
 @import "navigation-menu";
-@import "top-bar";
 @import "content";
 @import "details";
 @import "tab-container/tab-container";
@@ -15,3 +14,5 @@
 @import "wizard-container/wizard-container";
 @import "object/all";
 @import "activity-panel/all";
+@import "extension/all";
+@import "top-bar/all";

css/backoffice/layout/_navigation-menu.scss

@@ -793,8 +793,9 @@ $ibo-navigation-menu--user-info--height--is-expanded: 100% !default;
 			color: $ibo-navigation-menu--user--text-color;
 		}
 
-		.ibo-navigation-menu--user-notifications--toggler--icon {
-			padding-left: $ibo-navigation-menu--user-notifications--toggler--icon--padding-left;
+      .ibo-navigation-menu--user-notifications--toggler--icon {
+        position: relative;
+        padding-left: $ibo-navigation-menu--user-notifications--toggler--icon--padding-left;
 		}
 	}
 

css/backoffice/layout/activity-panel/_activity-action.scss

@@ -0,0 +1,78 @@
+$ibo-activity-panel--activity-actions--right: $ibo-activity-panel--add-caselog-entry-button--right !default;
+$ibo-activity-panel--activity-actions--top: 76px + $ibo-activity-panel--activity-actions--right !default;
+$ibo-activity-panel--activity-actions--gap: $ibo-spacing-300 !default;
+
+$ibo-activity-panel--activity-action--diameter: $ibo-activity-panel--add-caselog-entry-button--diameter !default;
+$ibo-activity-panel--activity-action--background-color: $ibo-activity-panel--add-caselog-entry-button--background-color !default;
+$ibo-activity-panel--activity-action--background-color--on-hover: $ibo-activity-panel--add-caselog-entry-button--background-color--on-hover !default;
+$ibo-activity-panel--activity-action--background-color--is-active: $ibo-activity-panel--add-caselog-entry-button--background-color--is-active !default;
+$ibo-activity-panel--activity-action--color: $ibo-activity-panel--add-caselog-entry-button--color !default;
+$ibo-activity-panel--activity-action--border-radius: $ibo-border-radius-full !default;
+$ibo-activity-panel--activity-action--box-shadow: $ibo-activity-panel--add-caselog-entry-button--box-shadow !default;
+$ibo-activity-panel--activity-action--hover--box-shadow: $ibo-activity-panel--add-caselog-entry-button--hover--box-shadow !default;
+
+$ibo-activity-panel--activity-action--icon--height: $ibo-activity-panel--add-caselog-entry-button--icon--height !default;
+$ibo-activity-panel--activity-action--icon--width: $ibo-activity-panel--activity-action--icon--height !default;
+$ibo-activity-panel--activity-action--icon--font-size: $ibo-activity-panel--add-caselog-entry-button--icon--font-size !default;
+$ibo-activity-panel--activity-action--icon--line-height: $ibo-activity-panel--add-caselog-entry-button--icon--line-height !default;
+$ibo-activity-panel--activity-action-separator--width: calc(#{$ibo-activity-panel--activity-action--diameter} / 1.5) !default;
+$ibo-activity-panel--activity-action-separator--height: 2px !default;
+$ibo-activity-panel--activity-action-separator--background-color: $ibo-color-grey-500 !default;
+
+
+.ibo-activity-panel--activity-actions {
+  display: flex;
+  flex-direction: column;
+  gap: $ibo-activity-panel--activity-actions--gap;
+  position: absolute;
+  z-index: 1;
+  right: $ibo-activity-panel--activity-actions--right;
+  top: $ibo-activity-panel--activity-actions--top;
+  &.ibo-is-hidden{
+    display: none;
+  }
+  &:has(+ .ibo-activity-panel--add-caselog-entry-button) {
+    top: calc(#{$ibo-activity-panel--activity-actions--top} + #{$ibo-activity-panel--activity-action--diameter} + #{$ibo-activity-panel--activity-actions--gap});
+  }
+}
+
+.ibo-activity-panel--activity-action {
+  @extend %ibo-baseline-centered-content;
+
+  width: $ibo-activity-panel--activity-action--diameter;
+  height: $ibo-activity-panel--activity-action--diameter;
+
+  background-color: $ibo-activity-panel--activity-action--background-color;
+  color: $ibo-activity-panel--activity-action--color;
+
+  border-radius: $ibo-activity-panel--activity-action--border-radius;
+  box-shadow: $ibo-activity-panel--activity-action--box-shadow;
+
+  > i{
+    text-align: center;
+    height: $ibo-activity-panel--activity-action--icon--height;
+    width: $ibo-activity-panel--activity-action--icon--width;
+    font-size: $ibo-activity-panel--activity-action--icon--font-size;
+    line-height: $ibo-activity-panel--activity-action--icon--line-height;
+  }
+  &:hover {
+    color: $ibo-activity-panel--activity-action--color;
+    background-color: $ibo-activity-panel--activity-action--background-color--on-hover;
+    box-shadow: $ibo-activity-panel--activity-action--hover--box-shadow;
+  }
+  &:active {
+    color: $ibo-activity-panel--activity-action--color;
+    background-color: $ibo-activity-panel--activity-action--background-color--is-active;
+  }
+  &.ibo-is-hidden{
+    display: none;
+  }
+}
+
+.ibo-activity-panel--activity-action-separator {
+  display: block;
+  width: $ibo-activity-panel--activity-action-separator--width;
+  height: $ibo-activity-panel--activity-action-separator--height;
+  margin: auto;
+  background-color: $ibo-activity-panel--activity-action-separator--background-color;
+}

css/backoffice/layout/activity-panel/_activity-panel.scss

@@ -137,7 +137,8 @@ $ibo-activity-panel--open-icon--margin-left: 0.75rem !default;
 
     .ibo-activity-panel--header,
     .ibo-activity-panel--body,
-    .ibo-activity-panel--add-caselog-entry-button {
+    .ibo-activity-panel--add-caselog-entry-button,
+    .ibo-activity-panel--activity-actions{
       display: none;
     }
 

css/backoffice/layout/activity-panel/_all.scss

@@ -10,3 +10,4 @@
 @import "transition-entry";
 @import "edits-entry";
 @import "notification-entry";
+@import "activity-action";

css/backoffice/layout/activity-panel/_caselog-entry-form.scss

@@ -59,4 +59,9 @@ $ibo-caselog-entry-form--lock-message--margin-left: 1rem !default;
 }
 .ibo-caselog-entry-form--action-buttons--main-actions > .ibo-popover-menu {
   z-index: 1;
+}
+
+.ibo-caselog-entry-form--action-buttons--extra-actions{
+  overflow: hidden;
+  flex-grow: 1;
 }

css/backoffice/layout/extension/_all.scss

@@ -0,0 +1 @@
+@import "extension-details";

css/backoffice/layout/extension/_extension-details.scss

@@ -0,0 +1,76 @@
+$ibo-extension-details--information--metadata--padding: $ibo-spacing-200 !default;
+$ibo-extension-details--information--metadata--delimiter: "-" !default;
+$ibo-extension-details--information--metadata--color: $ibo-color-grey-700 !default;
+$ibo-extension-details--actions--button--padding-y: 3px !default;
+$ibo-extension-details--actions--button--padding-x: $ibo-button--padding-x !default;
+
+.ibo-extension-details {
+	display: inline-flex;
+	flex-direction: row;
+	justify-content: space-between;
+	align-items: center;
+	width: 100%;
+}
+
+.ibo-extension-details--information {
+	flex-grow: 1;
+	display: flex;
+	flex-direction: column;
+}
+
+.ibo-extension-details--actions {
+	display: flex;
+}
+
+.ibo-extension-details--information--label {
+	@extend %ibo-font-ral-med-150;
+}
+
+.ibo-extension-details--information--metadata {
+	@extend %ibo-font-ral-med-100;
+	color: $ibo-extension-details--information--metadata--color;
+}
+
+.ibo-extension-details--information--description {
+	@extend %ibo-font-ral-med-100;
+}
+
+.ibo-extension-details--information--metadata span + span:before {
+	content: $ibo-extension-details--information--metadata--delimiter;
+	padding-left: $ibo-extension-details--information--metadata--padding;
+	padding-right: $ibo-extension-details--information--metadata--padding;
+}
+
+//ibo-extension-details can have other ibo-extension-details inside its ibo-extension-details--information--description in the setup. We need to only affect direct children
+.ibo-extension-details:has(>.ibo-extension-details--actions  input:is([type="checkbox"], [type="radio"]):checked){
+	&>.ibo-extension-details--information>.ibo-extension-details--information--label .ibo-badge.unchecked {
+		display: none;
+	}
+}
+//Merging the two lines below with :is([type="checkbox"], [type="radio"]) will generate a warning in scss compiler
+.ibo-extension-details:has(>.ibo-extension-details--actions input[type="checkbox"]:not(:checked)),
+.ibo-extension-details:has(>.ibo-extension-details--actions input[type="radio"]:not(:checked)) {
+	&>.ibo-extension-details--information>.ibo-extension-details--information--label .ibo-badge.checked {
+		display: none;
+	}
+}
+
+
+.ibo-extension-details--actions > button {
+	padding: $ibo-extension-details--actions--button--padding-y $ibo-extension-details--actions--button--padding-x;
+}
+
+.ibo-extension-details--actions:has(.toggler-install:not(:disabled)) .ibo-popover-menu--section a[data-resource-id="force_uninstall"] {
+	display: none;
+}
+
+.ibo-extension-details .ibo-popover-menu ~ .ibo-button{
+	visibility: hidden;
+}
+.ibo-extension-details .ibo-popover-menu:has(.ibo-popover-menu--item) ~ .ibo-button{
+	visibility: visible;
+}
+
+.ibo-extension-details .ibo-toggler--wrapper:has(.ibo-toggler.ibo-is-hidden){
+	visibility: hidden;
+}

css/backoffice/layout/top-bar/_all.scss

@@ -0,0 +1,2 @@
+@import "top-bar";
+@import "top-bar-action";

css/backoffice/layout/top-bar/_top-bar-action.scss

@@ -0,0 +1,40 @@
+$ibo-top-bar-quick-action--head--background-color: $ibo-color-white-100 !default;
+
+$ibo-top-bar-quick-action--icon-padding-x: $ibo-spacing-500 !default;
+$ibo-top-bar-quick-action--icon-padding-y: $ibo-spacing-0 !default;
+$ibo-top-bar-quick-action--icon--color: $ibo-color-primary-600 !default;
+$ibo-top-bar-quick-action--icon--color--on-hover: $ibo-color-primary-700 !default;
+$ibo-top-bar-quick-action--icon--color--on-active: $ibo-color-primary-800 !default;
+$ibo-top-bar-quick-action-separator--width: 2px !default;
+$ibo-top-bar-quick-action-separator--background-color: $ibo-color-grey-300 !default;
+$ibo-top-bar-quick-action-separator--margin-y: $ibo-spacing-0 !default;
+$ibo-top-bar-quick-action-separator--margin-x: $ibo-spacing-300 !default;
+
+.ibo-top-bar-quick-action{
+  position: relative;
+  @extend %ibo-full-height-content;
+}
+.ibo-top-bar-quick-action--head{
+  @extend %ibo-full-height-content;
+  height: 100%;
+  background-color: $ibo-top-bar-quick-action--head--background-color;
+}
+.ibo-top-bar-quick-action--icon{
+  color: $ibo-top-bar-quick-action--icon--color;
+  align-self: center;
+  padding: $ibo-top-bar-quick-action--icon-padding-y $ibo-top-bar-quick-action--icon-padding-x;
+  @extend %ibo-font-ral-nor-400;
+
+  &:hover{
+    color: $ibo-top-bar-quick-action--icon--color--on-hover;
+  }
+  &:active{
+    color: $ibo-top-bar-quick-action--icon--color--on-active;
+  }
+}
+
+.ibo-top-bar-quick-action-separator {
+  width: $ibo-top-bar-quick-action-separator--width;
+  background-color: $ibo-top-bar-quick-action-separator--background-color;
+  margin: $ibo-top-bar-quick-action-separator--margin-y $ibo-top-bar-quick-action-separator--margin-x;
+}

css/backoffice/pages/_data-synchro.scss

@@ -80,4 +80,14 @@ $ibo-data-synchro-source--synoptics--cell--arrow--border: 2px solid $ibo-data-sy
 }
 .ibo-data-synchro-source--replicas-status--warning{
   margin: $ibo-data-synchro-source--replicas-status--warning--margin;
+}
+
+.ibo-page-header--replica-title{
+  display: table;
+  width: 100%;
+
+  >.ibo-toolbar--button{
+    display: table-cell;
+    vertical-align: middle;
+  }
 }

css/backoffice/pages/_datamodel-viewer.scss

@@ -3,9 +3,29 @@
  * @license     http://opensource.org/licenses/AGPL-3.0
  */
 
+$ibo-datamodel-viewer--viewer-empty--width: max(20%, #{$ibo-size-700}) !default;
+
 $ibo-datamodel-viewer--parent--spacer--padding-y: $ibo-spacing-0 !default;
 $ibo-datamodel-viewer--parent--spacer--padding-x: $ibo-spacing-300 !default;
 
+$ibo-datamodel-viewer--breadcrumb--margin: $ibo-spacing-200 0 !default;
+
+$ibo-datamodel-viewer--classname--font-family: monospace !default;
+$ibo-datamodel-viewer--classname--color: $ibo-color-blue-grey-600 !default;
+
+$ibo-datamodel-viewer--tag--category--color: $ibo-color-blue-grey-800 !default;
+$ibo-datamodel-viewer--tag--category--icon--color: $ibo-color-blue-grey-600 !default;
+
+$ibo-datamodel-viewer--abstract-class-icon--margin-right: $ibo-spacing-300 !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--content: 'A' !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--width: 15px !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--height: 15px !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--line-height: 14px !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--border-radius: 50% !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--border: 1px solid $ibo-color-cyan-500 !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--color: $ibo-color-white-100 !default;
+$ibo-datamodel-viewer--abstract-class-icon--after--background-color: $ibo-color-cyan-500 !default;
+
 $ibo-datamodel-viewer--classes-list--selectize-input--background-color: $ibo-color-white-100 !default;
 $ibo-datamodel-viewer--classes-list--selectize-input--color: $ibo-color-grey-800 !default;
 $ibo-datamodel-viewer--classes-list--selectize-input--border-color: $ibo-color-grey-500 !default;
@@ -16,8 +36,9 @@ $ibo-datamodel-viewer--origin-cell--diameter: 8px !default;
 $ibo-datamodel-viewer--origin-cell--border-radius: $ibo-border-radius-full !default;
 
 $ibo-datamodel-viewer--classes-list--height: 100% !default;
-$ibo-datamodel-viewer--classes-list--width: 350px !default;
+$ibo-datamodel-viewer--classes-list--width: $ibo-size-700 !default;
 $ibo-datamodel-viewer--classes-list--padding-left: $ibo-spacing-600 !default;
+$ibo-datamodel-viewer--classes-list--padding-top: $ibo-spacing-300 !default;
 
 $ibo-datamodel-viewer--lifecycle--code--color: $ibo-color-grey-700 !default;
 $ibo-datamodel-viewer--lifecycle--stimuli--color: $ibo-color-blue-900 !default;
@@ -45,6 +66,56 @@ $ibo-datamodel-viewer--lifecycle-image--margin-bottom: $ibo-spacing-500 !default
   .ibo-panel--subtitle{
     @extend %ibo-font-ral-nor-150;
   }
+  .ibo-datamodel-viewer--empty{
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    svg{
+      width: $ibo-datamodel-viewer--viewer-empty--width;
+    }
+  }
+}
+
+.ibo-datamodel-viewer--empty--text {
+  @extend %ibo-font-ral-med-400
+}
+
+.ibo-datamodel-viewer--breadcrumb{
+  @extend %ibo-font-ral-med-150;
+  margin: $ibo-datamodel-viewer--breadcrumb--margin;
+  .ibo-button{
+    text-transform: none; // unset uppercase
+  }
+}
+
+.ibo-datamodel-viewer--classname{
+  color: $ibo-datamodel-viewer--classname--color;
+  @extend %ibo-font-code-100;
+}
+
+.ibo-datamodel-viewer--tag--category{
+  color: $ibo-datamodel-viewer--tag--category--color;
+  .ibo-object-details--tag-icon{
+    color:$ibo-datamodel-viewer--tag--category--icon--color;
+  }
+}
+
+.ibo-datamodel-viewer--icon--abstract{
+  &:after{
+    content: $ibo-datamodel-viewer--abstract-class-icon--after--content;
+    display: inline-flex;
+    justify-content: center;
+    align-items: center;
+    width: $ibo-datamodel-viewer--abstract-class-icon--after--width;
+    height: $ibo-datamodel-viewer--abstract-class-icon--after--height;
+    line-height: $ibo-datamodel-viewer--abstract-class-icon--after--line-height;
+    border-radius: $ibo-datamodel-viewer--abstract-class-icon--after--border-radius;
+    border: $ibo-datamodel-viewer--abstract-class-icon--after--border;
+    color: $ibo-datamodel-viewer--abstract-class-icon--after--color;
+    background-color: $ibo-datamodel-viewer--abstract-class-icon--after--background-color;
+
+    @extend %ibo-font-ral-bol-50;
+  }
 }
 
 .ibo-datamodel-viewer--parent--spacer{
@@ -80,6 +151,7 @@ $ibo-datamodel-viewer--lifecycle-image--margin-bottom: $ibo-spacing-500 !default
   height: $ibo-datamodel-viewer--classes-list--height;
   width: $ibo-datamodel-viewer--classes-list--width;
   padding-left: $ibo-datamodel-viewer--classes-list--padding-left;
+  padding-top: $ibo-datamodel-viewer--classes-list--padding-top;
   overflow-y: scroll;
 }
 

css/backoffice/vendors/ckeditor/_overloads.scss

@@ -28,6 +28,15 @@ $ibo-vendors-ckeditor--ck-mentions--item--padding-x: $ibo-spacing-300 !default;
 $ibo-vendors-ckeditor--ck-mentions--item--padding-y: $ibo-spacing-200 !default;
 
 /* CSS3 variables */
+:root {
+  --ck-content-font-family: inherit;
+  --ck-content-font-color: inherit;
+  --ck-content-font-size: inherit;
+  --ck-content-line-height: inherit;
+  --ck-content-word-break: inherit;
+  --ck-content-overflow-wrap: inherit;
+}
+
 .ck {
   --ck-color-list-button-on-background: #{$ibo-vendors-ckeditor--ck-color-list-button-on-background};
   --ck-color-list-button-on-background-focus: #{$ibo-vendors-ckeditor--ck-color-list-button-on-background-focus};
@@ -38,7 +47,6 @@ $ibo-vendors-ckeditor--ck-mentions--item--padding-y: $ibo-spacing-200 !default;
   --ck-text-small-font-size: #{$ibo-vendors-ckeditor--ck-text-small-font-size};
   --ck-text-big-font-size: #{$ibo-vendors-ckeditor--ck-text-big-font-size};
   --ck-text-huge-font-size: #{$ibo-vendors-ckeditor--ck-text-huge-font-size};
-  --ck-content-font-family: #{$ibo-font-family-base}, #{$ibo-font-family-fallbacks};
 
   --ck-color-image-caption-text: #{$ibo-vendors-ckeditor--ck-color-image-caption-text};
 }
@@ -62,7 +70,7 @@ $ibo-vendors-ckeditor--ck-mentions--item--padding-y: $ibo-spacing-200 !default;
   }
 }
 
-.ck-editor__editable_inline:not(.ck-comment__input *) {
+.ck-editor__editable_inline:not(.ck-comment__input *), .ck-source-editing-area {
   height: 200px;
 }
 
@@ -76,11 +84,6 @@ $ibo-vendors-ckeditor--ck-mentions--item--padding-y: $ibo-spacing-200 !default;
   }
 }
 
-// N°7552 Allow source editing area to be scrollable in full screen
-.ck-maximize_editor_main .ck-source-editing-area textarea{
-  overflow: auto !important;
-}
-
 /* Mentions */
 .ck-mentions {
   .ck-button {

css/common/utils/helpers/_text-decoration.scss

@@ -4,7 +4,7 @@
  */
 
 /* SCSS variables */
-$common-has-description--content: "\1F6C8" !default;
+$common-has-description--content: "?" !default;
 $common-has-description--padding-left: $common-spacing-200 !default;
 $common-has-description--color: $common-color-grey-600 !default;
 $common-has-description--font-size: 0.7em !default; /* Font size is em on purpose as we want it to be proportional to its context */

css/common/utils/helpers/_typography.scss

@@ -11,6 +11,9 @@
  *
  * Usage: @extend %common-font-size-XXX;
  */
+%common-font-size-20 {
+  font-size: $common-font-size-20;
+}
 %common-font-size-50 {
   font-size: $common-font-size-50;
 }

css/setup.scss

@@ -316,29 +316,34 @@ fieldset {
 	background-color: #F7FAFC;
 	padding: 10px;
 	.wiz-choice{
-		&:checked ~ .description {
-			#itop-ticket-mgmt-simple-ticket-enhanced-portal:not(:checked),
-			#itop-ticket-mgmt-itil-enhanced-portal:not(:checked) {
-				~ .description::after {
-					content: "Legacy portal is no longer part of iTop, by leaving this option unchecked your portal users won't be able to access iTop anymore.";
-					display: block;
-					margin-top: 0.5em;
-					font-weight: bold;
-					color: $legacy-portal-removal-text-color;
-				}
-			}
-		}
-		&:not(:checked) ~ label .setup-extension-tag.checked{
+		&:not(:checked) ~ label .checked{
 			display:none;
 		}
-		&:checked ~ label .setup-extension-tag.unchecked{
+		&:checked ~ label .unchecked{
 			display:none;
 		}
 	}
 }
 
+.ibo-extension-details:has(>.ibo-extension-details--actions>input:checked) {
+	.ibo-extension-details:has(#itop-ticket-mgmt-simple-ticket-enhanced-portal:not(:checked), #itop-ticket-mgmt-itil-enhanced-portal:not(:checked)) {
+		.ibo-extension-details--information--description::after {
+			content: "Legacy portal is no longer part of iTop, by leaving this option unchecked your portal users won't be able to access iTop anymore.";
+			display: block;
+			margin-top: 0.5em;
+			font-weight: bold;
+			color: $legacy-portal-removal-text-color;
+		}
+	}
+}
 
+.ibo-extension-details--information--metadata{
+	color: $ibo-color-grey-800;
+}
 
+.choice-disabled {
+	color: $ibo-color-grey-700;
+}
 
 body {
   font-size: 1.17rem;
@@ -522,10 +527,12 @@ body {
   }
 }
 
-.ibo-setup-summary-title {
-  font-size: $ibo-font-size-150;
+.ibo-setup-summary-title, .ibo-setup-summary-title:visited, .ibo-setup-summary-title:hover {
+	font-size: $ibo-font-size-150;
+	color: inherit;
 }
 
+
 #ibo-setup-licenses--components-list {
   background-color: $ibo-color-white-200;
   padding: 12px;
@@ -604,30 +611,20 @@ body {
 .setup-extension--missing .setup-extension--icon{
 	color:#a00000;
 }
-.setup-extension-tag {
-	background-color: grey;
-	border-radius: 8px;
-	padding-left: 3px;
-	padding-right: 3px;
-	margin-right: 3px;
-	&.installed{
-		background-color:#9eff9e
-	}
-	&.notinstalled{
-		background-color:#ed9eff
-	}
-	&.tobeinstalled{
-		background-color:#9ef0ff
-	}
-	&.tobeuninstalled{
-		background-color:#ff9e9e
-	}
-	&.notuninstallable{
-		background-color:#ffc98c
-	}
-	&.removed{
-		background-color: #969594
-	}
+
+.ibo-extension-details {
+	align-items: flex-start;
+}
+.ibo-extension-details--actions input{
+	margin:0.2em 0.5em;
+	width: 12px;
+}
+:not(.ibo-badge) ~ .ibo-badge{
+	margin-left:0.5em;
+}
+.ibo-extension-details--information--label i{
+	font-size : 0.9em;
+	margin-left:0.3em;
 }
 
 .setup--wizard-choice--label + .setup--wizard-choice--more-info {
@@ -676,14 +673,10 @@ body {
   }
 }
 
-  #progress_content {
-    height: 200px;
-    overflow: auto;
-    text-align: center;
-  }
-  #installation_progress {
-    display: none;
+  #progress_content *:not(.message) + .message {
+      margin-top: 1.5rem;
   }
+
   #fresh_content{
     border: 0;
     min-height: 300px;

datamodels/2.x/authent-cas/dictionaries/zh_cn.dict.authent-cas.php

@@ -6,8 +6,9 @@
  * @copyright Copyright (C) 2010-2024 Combodo SAS
  * @license    https://opensource.org/licenses/AGPL-3.0
  */
+
 Dict::Add('ZH CN', 'Chinese', '简体中文', [
 	'CAS:Error:UserNotAllowed' => '用户被禁止登录',
-	'CAS:Login:SignIn' => '使用CAS登录',
-	'CAS:Login:SignInTooltip' => '点击这里使用CAS服务器认证',
+	'CAS:Login:SignIn' => '使用 CAS 登录',
+	'CAS:Login:SignInTooltip' => '点击这里使用 CAS 服务器认证',
 ]);

datamodels/2.x/authent-external/dictionaries/zh_cn.dict.authent-external.php

@@ -5,10 +5,8 @@
  *
  * @copyright Copyright (C) 2010-2024 Combodo SAS
  * @license    https://opensource.org/licenses/AGPL-3.0
- *
- */
-/**
  * @author Robert Deng <denglx@gmail.com>
+ * This file is part of iTop.
  *
  * iTop is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as published by
@@ -23,6 +21,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with iTop. If not, see <http://www.gnu.org/licenses/>
  */
+
 // Dictionnay conventions
 // Class:<class_name>
 // Class:<class_name>+
@@ -32,9 +31,11 @@
 // Class:<class_name>/Attribute:<attribute_code>/Value:<value>+
 // Class:<class_name>/Stimulus:<stimulus_code>
 // Class:<class_name>/Stimulus:<stimulus_code>+
+
 //
 // Class: UserExternal
 //
+
 Dict::Add('ZH CN', 'Chinese', '简体中文', [
 	'Class:UserExternal' => '外部用户',
 	'Class:UserExternal+' => '用户在'.ITOP_APPLICATION_SHORT.'外部验证身份',

datamodels/2.x/authent-ldap/datamodel.authent-ldap.xml

@@ -97,18 +97,19 @@
 			$bDebug = isset($aServerParams['debug']) ? $aServerParams['debug'] : false;
 		}
 
+		if (array_key_exists(LDAP_OPT_DEBUG_LEVEL, $aOptions))
+		{
+			// Set debug level before trying to connect, so that debug info appear in the PHP error log if ldap_connect goes wrong
+			$bRet = ldap_set_option(null, LDAP_OPT_DEBUG_LEVEL, $aOptions[LDAP_OPT_DEBUG_LEVEL]);
+			$this->LogInfo($bDebug, "ldap_set_option('LDAP_OPT_DEBUG_LEVEL', '{$aOptions[LDAP_OPT_DEBUG_LEVEL]}') returned ".($bRet ? 'true' : 'false'));
+		}
+
 		$hDS = @ldap_connect($sURI);
 		if ($hDS === false)
 		{
 			$this->LogIssue($bDebug, "ldap_authentication: can not connect to the LDAP server '$sURI'. Check the configuration file config-itop.php.");
 			return false;
 		}
-		if (array_key_exists(LDAP_OPT_DEBUG_LEVEL, $aOptions))
-		{
-			// Set debug level before trying to connect, so that debug info appear in the PHP error log if ldap_connect goes wrong
-			$bRet = ldap_set_option($hDS, LDAP_OPT_DEBUG_LEVEL, $aOptions[LDAP_OPT_DEBUG_LEVEL]);
-			$this->LogInfo($bDebug, "ldap_set_option('LDAP_OPT_DEBUG_LEVEL', '{$aOptions[LDAP_OPT_DEBUG_LEVEL]}') returned ".($bRet ? 'true' : 'false'));
-		}
 		foreach($aOptions as $name => $value)
 		{
 			$bRet = ldap_set_option($hDS, $name, $value);

datamodels/2.x/authent-ldap/dictionaries/ru.dict.authent-ldap.php

@@ -14,7 +14,7 @@
 Dict::Add('RU RU', 'Russian', 'Русский', [
 	'Class:UserLDAP' => 'Пользователь LDAP',
 	'Class:UserLDAP+' => 'Пользователь, аутентифицируемый через LDAP',
-	'UserLDAP:server' => 'LDAP specifics~~',
+	'UserLDAP:server' => 'Особенности LDAP',
 ]);
 
 //
@@ -22,6 +22,6 @@ Dict::Add('RU RU', 'Russian', 'Русский', [
 //
 
 Dict::Add('RU RU', 'Russian', 'Русский', [
-	'Class:UserLDAP/Attribute:ldap_server' => 'Ldap server~~',
-	'Class:UserLDAP/Attribute:ldap_server+' => '~~',
+	'Class:UserLDAP/Attribute:ldap_server' => 'Сервер LDAP',
+	'Class:UserLDAP/Attribute:ldap_server+' => '',
 ]);

datamodels/2.x/authent-ldap/dictionaries/zh_cn.dict.authent-ldap.php

@@ -6,7 +6,6 @@
  * @copyright Copyright (C) 2010-2024 Combodo SAS
  * @license    https://opensource.org/licenses/AGPL-3.0
  * @author Robert Deng <denglx@gmail.com>
- *
  * This file is part of iTop.
  *
  * iTop is free software; you can redistribute it and/or modify
@@ -22,6 +21,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with iTop. If not, see <http://www.gnu.org/licenses/>
  */
+
 // Dictionnay conventions
 // Class:<class_name>
 // Class:<class_name>+
@@ -31,13 +31,15 @@
 // Class:<class_name>/Attribute:<attribute_code>/Value:<value>+
 // Class:<class_name>/Stimulus:<stimulus_code>
 // Class:<class_name>/Stimulus:<stimulus_code>+
+
 //
 // Class: UserLDAP
 //
+
 Dict::Add('ZH CN', 'Chinese', '简体中文', [
-	'Class:UserLDAP' => 'LDAP用户',
-	'Class:UserLDAP+' => '用户身份由LDAP认证',
-	'UserLDAP:server' => 'LDAP详情',
+	'Class:UserLDAP' => 'LDAP 用户',
+	'Class:UserLDAP+' => '用户身份由 LDAP 认证',
+	'UserLDAP:server' => 'LDAP 详情',
 ]);
 
 //
@@ -45,6 +47,6 @@ Dict::Add('ZH CN', 'Chinese', '简体中文', [
 //
 
 Dict::Add('ZH CN', 'Chinese', '简体中文', [
-	'Class:UserLDAP/Attribute:ldap_server' => 'Ldap server~~',
-	'Class:UserLDAP/Attribute:ldap_server+' => '~~',
+	'Class:UserLDAP/Attribute:ldap_server' => 'LDAP 服务器',
+	'Class:UserLDAP/Attribute:ldap_server+' => '',
 ]);