CVE-2023-29006: Deserialization of Untrusted Data (CWE-502)
value: The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 contain a patch for this issue. As a workaround, delete the `ajax/dropdownContact.php` file from the plugin.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 8.8
Published: 2023-04-05T18:15Z
Repository: https://github.com/pluginsGLPI/order
Language: PHP
Files changed: ajax/referencespecifications.php, front/bill.form.php, front/menu.php, front/order.form.php, front/order.php, front/reference.php, front/reference_supplier.form.php, front/surveysupplier.form.php, hook.php, inc/bill.class.php, inc/config.class.php, inc/link.class.php, inc/order.class.php, inc/order_item.class.php, inc/order_supplier.class.php, inc/orderinjection.class.php, inc/preference.class.php, inc/reception.class.php, inc/reference.class.php, inc/reference_supplier.class.php, inc/referencefree.class.php, inc/referenceinjection.class.php, setup.php
Commit date: 2023-02-02 12:08:34 +0100
Commit message: Clean-up code

Diff: diff --git a/ajax/detail.php b/ajax/detail.php
deleted file mode 100644
index fcc962e..0000000
--- a/ajax/detail.php
+++ /dev/null
@@ -1,69 +0,0 @@
-<?php
-
-/**
- * -------------------------------------------------------------------------
- * Order plugin for GLPI
- * -------------------------------------------------------------------------
- *
- * LICENSE
- *
- * This file is part of Order.
- *
- * Order is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * Order is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Order. If not, see <http://www.gnu.org/licenses/>.
- * -------------------------------------------------------------------------
- * @copyright Copyright (C) 2009-2022 by Order plugin team.
- * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
- * @link      https://github.com/pluginsGLPI/order
- * -------------------------------------------------------------------------
- */
-
-include ("../../../inc/includes.php");
-
-header("Content-Type: text/html; charset=UTF-8");
-
-Html::header_nocache();
-
-if (!defined('GLPI_ROOT')) {
-   die("Can not acces directly to this file");
-}
-
-Session::checkCentralAccess();
-
-$rand         = $_POST["rand"];
-$paramsaction = [
-   'plugin_order_references_id' => '__VALUE__',
-   'entity_restrict'            => $_POST["entity_restrict"],
-   'suppliers_id'               => $_POST["suppliers_id"],
-   'itemtype'                   => $_POST['itemtype'],
-];
-$fields = [
-   "quantity",
-   "priceht",
-   "pricediscounted",
-   "taxe",
-   "validate",
-];
-
-$order_url = Plugin::getWebDir('order');
-
-foreach ($fields as $field) {
-   $paramsaction['update'] = $field;
-   Ajax::updateItem("show_$field",
-                    "$order_url/ajax/referencedetail.php",
-                    $paramsaction, "dropdown_reference$rand");
-   Ajax::updateItemOnSelectEvent("dropdown_reference$rand",
-                                 "show_$field",
-                                 "$order_url/ajax/referencedetail.php",
-                                 $paramsaction);
-}
diff --git a/ajax/dropdownContact.php b/ajax/dropdownContact.php
deleted file mode 100644
index b6f6a2f..0000000
--- a/ajax/dropdownContact.php
+++ /dev/null
@@ -1,101 +0,0 @@
-<?php
-
-/**
- * -------------------------------------------------------------------------
- * Order plugin for GLPI
- * -------------------------------------------------------------------------
- *
- * LICENSE
- *
- * This file is part of Order.
- *
- * Order is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * Order is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Order. If not, see <http://www.gnu.org/licenses/>.
- * -------------------------------------------------------------------------
- * @copyright Copyright (C) 2009-2022 by Order plugin team.
- * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
- * @link      https://github.com/pluginsGLPI/order
- * -------------------------------------------------------------------------
- */
-
-if (strpos($_SERVER['PHP_SELF'], "dropdownContact.php")) {
-   include ("../../../inc/includes.php");
-   header("Content-Type: text/html; charset=UTF-8");
-   Html::header_nocache();
-}
-
-if (!defined('GLPI_ROOT')) {
-   die("Can not acces directly to this file");
-}
-
-Session::checkCentralAccess();
-
-// Make a select box with all glpi users
-$where = " WHERE `glpi_contacts_suppliers`.`contacts_id` = `glpi_contacts`.`id`
-           AND (`glpi_contacts_suppliers`.`suppliers_id` = '".$_POST['suppliers_id']."'
-           AND `glpi_contacts`.`is_deleted` = '0' ) ";
-
-
-if (isset($_POST["entity_restrict"])) {
-   if (!is_numeric($_POST["entity_restrict"]) && !is_array($_POST["entity_restrict"])) {
-      $_POST["entity_restrict"] = unserialize(Toolbox::stripslashes_deep($_POST["entity_restrict"]));
-   }
-   $where .= getEntitiesRestrictRequest("AND", "glpi_contacts", '', $_POST["entity_restrict"], true);
-} else {
-   $where .= getEntitiesRestrictRequest("AND", "glpi_contacts", '', '', true);
-}
-
-if ($_POST['searchText'] != $CFG_GLPI["ajax_wildcard"]) {
-   $where .= " AND `glpi_contacts`.`name` ".makeTextSearch($_POST['searchText']);
-}
-
-$LIMIT = "LIMIT 0, ".$CFG_GLPI["dropdown_max"];
-if ($_POST['searchText'] == $CFG_GLPI["ajax_wildcard"]) {
-   $LIMIT = "";
-}
-
-
-$query = "SELECT `glpi_contacts`.*
-          FROM `glpi_contacts`,`glpi_contacts_suppliers`
-          $where
-          ORDER BY `entities_id`, `name` $LIMIT";
-//error_log($query);
-$result = $DB->query($query);
-
-echo "<select name='contacts_id'>";
-
-echo "<option value='0'>".Dropdown::EMPTY_VALUE."</option>";
-
-if ($DB->numrows($result)) {
-   $prev = -1;
-   while ($data = $DB->fetchArray($result)) {
-      if ($data["entities_id"] != $prev) {
-         if ($prev > 0) {
-            echo "</optgroup>";
-         }
-         $prev = $data["entities_id"];
-         echo "<optgroup label=\"".Dropdown::getDropdownName("glpi_entities", $prev)."\">";
-      }
-      $output = formatUserName($data["id"], "", $data["name"], $data["firstname"]);
-      if ($_SESSION["glpiis_ids_visible"] || empty($output)) {
-         $output .= " (".$data["id"].")";
-      }
-      echo "<option value=\"".$data["id"]."\" title=\"$output\">"
-        .substr($output, 0, $CFG_GLPI["dropdown_chars_limit"])."</option>";
-   }
-   if ($prev >= 0) {
-      echo "</optgroup>";
-   }
-}
-
-echo "</select>";
diff --git a/ajax/referencedetail.php b/ajax/referencedetail.php
deleted file mode 100644
index 0b34226..0000000
--- a/ajax/referencedetail.php
+++ /dev/null
@@ -1,77 +0,0 @@
-<?php
-
-/**
- * -------------------------------------------------------------------------
- * Order plugin for GLPI
- * -------------------------------------------------------------------------
- *
- * LICENSE
- *
- * This file is part of Order.
- *
- * Order is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * Order is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Order. If not, see <http://www.gnu.org/licenses/>.
- * -------------------------------------------------------------------------
- * @copyright Copyright (C) 2009-2022 by Order plugin team.
- * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
- * @link      https://github.com/pluginsGLPI/order
- * -------------------------------------------------------------------------
- */
-
-include ("../../../inc/includes.php");
-
-header("Content-Type: text/html; charset=UTF-8");
-
-Html::header_nocache();
-
-if (!defined('GLPI_ROOT')) {
-   die("Can not acces directly to this file");
-}
-
-Session::checkCentralAccess();
-
-if ($_POST["plugin_order_references_id"] > 0) {
-   $reference_supplier = new PluginOrderReference_Supplier();
-   $price = $reference_supplier->getPriceByReferenceAndSupplier($_POST["plugin_order_references_id"],
-                                                                $_POST["suppliers_id"]);
-   switch ($_POST["update"]) {
-      case 'quantity':
-         echo "<input type='number' class='form-control' min='0' name='quantity' class='quantity'>";
-         break;
-      case 'priceht':
-         echo "<input type='number' class='form-control' min='0' step='".PLUGIN_ORDER_NUMBER_STEP."'
-                      name='price' value='".Html::formatNumber($price, true)."' class='decimal'>";
-         break;
-      case 'pricediscounted':
-         echo "<input type='number' class='form-control' min='0' step='".PLUGIN_ORDER_NUMBER_STEP."'
-                      name='discount' class='smalldecimal' value='0'>";
-         break;
-      case 'taxe':
-         $config = PluginOrderConfig::getConfig();
-         PluginOrderOrderTax::Dropdown([
-            'name'                => "plugin_order_ordertaxes_id",
-            'value'               => $config->getDefaultTaxes(),
-            'display_emptychoice' => true,
-            'emptylabel'          => __("No VAT", "order"),
-         ]);
-         break;
-      case 'validate':
-         echo Html::hidden('itemtype', ['value' => $_POST["itemtype"]]);
-         echo Html::hidden('plugin_order_references_id',
-                           ['value' => $_POST["plugin_order_references_id"]]);
-         echo "<input type='submit' name='add_item' value=\"". __("Add")."\" class='submit' >";
-         break;
-   }
-} else {
-   return "";
-}
diff --git a/ajax/referencespecifications.php b/ajax/referencespecifications.php
index c303d62..3e52928 100644
--- a/ajax/referencespecifications.php
+++ b/ajax/referencespecifications.php
@@ -43,15 +43,10 @@ Session::checkCentralAccess();
 $PluginOrderReference = new PluginOrderReference();
 
 if ($_POST["itemtype"]) {
    switch ($_POST["field"]) {
       case "types_id":
-         if ($_POST["itemtype"] == 'PluginOrderOther') {
-            $file = 'other';
-         } else {
-            $file = $_POST["itemtype"];
-         }
          if (class_exists($_POST["itemtype"].'Type')) {
             Dropdown::show($_POST["itemtype"]."Type", ['name' => "types_id"]);
          }
          break;
       case "models_id":
diff --git a/ajax/referencetree.php b/ajax/referencetree.php
deleted file mode 100644
index 26577e9..0000000
--- a/ajax/referencetree.php
+++ /dev/null
@@ -1,47 +0,0 @@
-<?php
-
-/**
- * -------------------------------------------------------------------------
- * Order plugin for GLPI
- * -------------------------------------------------------------------------
- *
- * LICENSE
- *
- * This file is part of Order.
- *
- * Order is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * Order is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Order. If not, see <http://www.gnu.org/licenses/>.
- * -------------------------------------------------------------------------
- * @copyright Copyright (C) 2009-2022 by Order plugin team.
- * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
- * @link      https://github.com/pluginsGLPI/order
- * -------------------------------------------------------------------------
- */
-
-$AJAX_INCLUDE = 1;
-
-include ("../../../inc/includes.php");
-
-header("Content-Type: text/html; charset=UTF-8");
-
-Html::header_nocache();
-
-Session::checkLoginUser();
-
-if (!isset($_GET['target'])) {
-   $_GET['target'] = Plugin::getWebDir('order')."/front/reference.php";
-}
-
-PluginOrderReference::showSelector($_GET['target']);
-
-Html::ajaxFooter();
diff --git a/ajax/referencetreetypes.php b/ajax/referencetreetypes.php
deleted file mode 100644
index 083809e..0000000
--- a/ajax/referencetreetypes.php
+++ /dev/null
@@ -1,91 +0,0 @@
-<?php
-
-/**
- * -------------------------------------------------------------------------
- * Order plugin for GLPI
- * -------------------------------------------------------------------------
- *
- * LICENSE
- *
- * This file is part of Order.
- *
- * Order is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * Order is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Order. If not, see <http://www.gnu.org/licenses/>.
- * -------------------------------------------------------------------------
- * @copyright Copyright (C) 2009-2022 by Order plugin team.
- * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
- * @link      https://github.com/pluginsGLPI/order
- * -------------------------------------------------------------------------
- */
-
-$AJAX_INCLUDE = 1;
-
-include ("../../../inc/includes.php");
-
-header("Content-Type: text/html; charset=UTF-8");
-
-Html::header_nocache();
-
-Session::checkLoginUser();
-
-if (isset($_REQUEST['node'])) {
-   $target = "reference.php";
-   $nodes  = [];
-
-   // Root node
-   if ($_REQUEST['node'] == -1) {
-      $pos      = 0;
-      $entity   = $_SESSION['glpiactive_entity'];
-      $entities = getEntitiesRestrictRequest("AND", "glpi_plugin_order_references");
-
-      $query = "SELECT DISTINCT `itemtype`
-                FROM `glpi_plugin_order_references`
-                WHERE `glpi_plugin_order_references`.`is_deleted` = '0'
-                $entities
-                GROUP BY `itemtype`
-                ORDER BY `itemtype`";
-
-      if ($result = $DB->query($query)) {
-         if ($DB->numrows($result)) {
-            $pos = 0;
-
-            while ($row = $DB->fetchArray($result)) {
-               $class             = $row['itemtype'];
-               $item              = new $class();
-               $path['text']      = $item->getTypeName();
-               $path['position']  = $pos;
-               $pos++;
-               $path['draggable'] = false;
-
-               if ($entity == 0) {
-                  $link = "&link[1]=AND&searchtype[1]=contains&contains[1]=NULL&field[1]=80";
-               } else {
-                  $link = "&link[1]=AND&searchtype[1]=contains&contains[1]=".
-                          Dropdown::getDropdownName("glpi_entities", $entity)."&field[1]=80";
-               }
-
-               $path['href'] = Plugin::getWebDir('order').
-                  "/front/$target?is_deleted=0&field[0]=3&searchtype[0]=equals&contains[0]=".
-                  rawurlencode($class)."&$link&itemtype=PluginOrderReference&start=0";
-
-               // Check if node is a leaf or a folder.
-               $path['leaf'] = true;
-               $path['cls']  = 'file';
-               $nodes[]      = $path;
-            }
-         }
-      }
-   }
-
-   print json_encode($nodes);
-}
diff --git a/front/bill.form.php b/front/bill.form.php
index 68c1a96..116fe75 100644
--- a/front/bill.form.php
+++ b/front/bill.form.php
@@ -81,11 +81,10 @@ if (isset($_POST['action'])) {
          break;
    }
    PluginOrderOrder::updateBillState($order_item->fields['plugin_order_orders_id']);
    Html::back();
 }
-$dropdown = new PluginOrderBill();
 
 Session::checkRight("plugin_order_bill", READ);
 
 Html::header(PluginOrderBill::getTypeName(), $_SERVER['PHP_SELF'], "management", "PluginOrderMenu", "bill");
 if (isset($_REQUEST['id'])) {
diff --git a/front/menu.php b/front/menu.php
index bbcad13..a35e5e8 100644
--- a/front/menu.php
+++ b/front/menu.php
@@ -35,14 +35,10 @@ Html::header(
    $_SERVER['PHP_SELF'],
    "management",
    "PluginOrderMenu"
 );
 
-$PluginOrderOrder     = new PluginOrderOrder();
-$PluginOrderReference = new PluginOrderReference();
-$PluginOrderBill      = new PluginOrderBill();
-
 //If there's only one possibility, do not display menu!
 if (PluginOrderOrder::canView() && !PluginOrderReference::canView() && !PluginOrderBill::canView()) {
    Html::redirect(Toolbox::getItemTypeSearchURL('PluginOrderOrder'));
 
 } else if (!PluginOrderOrder::canView() && PluginOrderReference::canView() && !PluginOrderBill::canView()) {
diff --git a/front/order.form.php b/front/order.form.php
index b65ec7b..d4db8cf 100644
--- a/front/order.form.php
+++ b/front/order.form.php
@@ -38,11 +38,10 @@ if (!isset ($_GET["withtemplate"])) {
 }
 
 $pluginOrderOrder          = new PluginOrderOrder();
 $config                    = new PluginOrderConfig();
 $pluginOrderOrder_Item     = new PluginOrderOrder_Item();
-$pluginOrderOrder_Supplier = new PluginOrderOrder_Supplier();
 
 /* add order */
 if (isset ($_POST["add"])) {
    $pluginOrderOrder->check(-1, CREATE, $_POST);
 
diff --git a/front/order.php b/front/order.php
index 9b56d07..3a3e8eb 100644
--- a/front/order.php
+++ b/front/order.php
@@ -36,12 +36,10 @@ Html::header(
    "management",
    "PluginOrderMenu",
    "order"
 );
 
-$order = new PluginOrderOrder();
-
 if (PluginOrderOrder::canView() || Session::haveRight("config", UPDATE)) {
    Search::show("PluginOrderOrder");
 } else {
    echo "<div class='center'><br><br><img src=\""
       . $CFG_GLPI["root_doc"] . "/pics/warning.png\" alt=\"warning\"><br><br>";
diff --git a/front/reference.php b/front/reference.php
index 3813d97..39d429c 100644
--- a/front/reference.php
+++ b/front/reference.php
@@ -36,12 +36,10 @@ Html::header(
    "management",
    "PluginOrderMenu",
    "references"
 );
 
-$reference = new PluginOrderReference();
-
 if (PluginOrderReference::canView()) {
    Search::show("PluginOrderReference");
 } else {
    echo "<div class='center'><br><br><img src=\""
       . $CFG_GLPI["root_doc"] . "/pics/warning.png\" alt=\"warning\"><br><br>";
diff --git a/front/reference_supplier.form.php b/front/reference_supplier.form.php
index bcbcd09..d2b0033 100644
--- a/front/reference_supplier.form.php
+++ b/front/reference_supplier.form.php
@@ -43,11 +43,11 @@ if (!isset($_GET["plugin_order_references_id"])) {
 $PluginOrderReference_Supplier = new PluginOrderReference_Supplier();
 
 if (isset($_POST["add"])) {
    if (PluginOrderReference_Supplier::canCreate()) {
       if (isset($_POST["suppliers_id"]) && $_POST["suppliers_id"] > 0) {
-         $newID = $PluginOrderReference_Supplier->add($_POST);
+         $PluginOrderReference_Supplier->add($_POST);
       }
    }
    Html::redirect($_SERVER['HTTP_REFERER']);
 
 } else if (isset($_POST["update"])) {
diff --git a/front/surveysupplier.form.php b/front/surveysupplier.form.php
index af1aec4..475b323 100644
--- a/front/surveysupplier.form.php
+++ b/front/surveysupplier.form.php
@@ -43,11 +43,11 @@ if (!isset($_GET["plugin_order_orders_id"])) {
 $PluginOrderSurveySupplier = new PluginOrderSurveySupplier();
 
 if (isset($_POST["add"])) {
    if (PluginOrderSurveySupplier::canCreate()) {
       if (isset($_POST["plugin_order_orders_id"]) && $_POST["plugin_order_orders_id"] > 0) {
-         $newID = $PluginOrderSurveySupplier->add($_POST);
+         $PluginOrderSurveySupplier->add($_POST);
       }
    }
    Html::redirect($_SERVER['HTTP_REFERER']);
 
 } else if (isset($_POST["delete"])) {
diff --git a/hook.php b/hook.php
index 9ec8fc4..52c646a 100644
--- a/hook.php
+++ b/hook.php
@@ -324,12 +324,10 @@ function plugin_order_giveItem($type, $ID, $data, $num) {
    return "";
 }
 
 
 function plugin_order_displayConfigItem($type, $ID, $data, $num) {
-   global $CFG_GLPI;
-
    $searchopt = &Search::getOptions($type);
    $table = $searchopt[$ID]["table"];
    $field = $searchopt[$ID]["field"];
    switch ($table.'.'.$field) {
       case "glpi_plugin_order_orders.is_late":
diff --git a/inc/bill.class.php b/inc/bill.class.php
index f0c992c..f64204a 100644
--- a/inc/bill.class.php
+++ b/inc/bill.class.php
@@ -274,31 +274,18 @@ class PluginOrderBill extends CommonDropdown
          echo "<th>".__("Entity")."</th>";
          echo "<th>".__("Reference")."</th>";
          echo "<th>".__("Status")."</th>";
          echo "</tr>";
 
-         $old_itemtype = '';
-         $num          = 0;
-
          while ($data = $DB->fetchArray($result)) {
             if (!class_exists($data['itemtype'])) {
                continue;
             }
             $item = new $data['itemtype']();
-            if ($data['itemtype']::canView()) {
+            if ($data['itemtype']::canView() && $item->getFromDB($data["id"])) {
                echo "<tr class='tab_bg_1'>";
 
-               $ID = "";
-               if ($_SESSION["glpiis_ids_visible"]
-                   || empty($data["name"])) {
-                    $ID = " (".$data["id"].")";
-               }
-               $name = NOT_AVAILABLE;
-               if ($item->getFromDB($data["id"])) {
-                  $name = $item->getLink();
-               }
-
                echo "<td class='center top'>".$item->getTypeName()."</td>";
                echo "<td class='center top'>";
                echo Dropdown::getDropdownName('glpi_entities', $item->getEntityID())."</td>";
 
                if ($data['itemtype'] == 'PluginOrderReferenceFree') {
diff --git a/inc/config.class.php b/inc/config.class.php
index 3d54bd7..9c82369 100644
--- a/inc/config.class.php
+++ b/inc/config.class.php
@@ -77,12 +77,10 @@ class PluginOrderConfig extends CommonDBTM {
       return __("Orders management", "order");
    }
 
 
    public static function getMenuContent() {
-      global $CFG_GLPI;
-
       $menu  = parent::getMenuContent();
       $menu['page']   = PluginOrderMenu::getSearchURL(false);
       $menu['links']['add']    = null;
       $menu['links']['search'] = null;
       $menu['links']['config'] = self::getFormURL(false);
@@ -766,11 +764,11 @@ class PluginOrderConfig extends CommonDBTM {
          }
 
          //version 2.0.1
          $migration->addField($table, "use_free_reference", "bool");
 
-   
+
       }
 
       $migration->displayMessage("Add default order state workflow");
       $new_states = ['order_status_draft'               => 1,
                      'order_status_waiting_approval'    => 2,
diff --git a/inc/link.class.php b/inc/link.class.php
index e4b9de5..4b16b9c 100644
--- a/inc/link.class.php
+++ b/inc/link.class.php
@@ -114,19 +114,17 @@ class PluginOrderLink extends CommonDBChild {
             if ($templateID) {
                $item = new $itemtype();
                $item->getFromDB($templateID);
 
                $name         = $item->fields["name"] ?? "";
-               $serial       = $item->fields["serial"] ?? "";
                $otherserial  = $item->fields["otherserial"] ?? "";
                $states_id    = $item->fields["states_id"] ?? "";
                $locations_id = $item->fields["locations_id"] ?? "";
                $groups_id    = $item->fields["groups_id"] ?? "";
                $immo_number  = $item->fields["immo_number"] ?? "";
             } else {
                $name         = false;
-               $serial       = false;
                $otherserial  = false;
                $states_id    = false;
                $locations_id = false;
                $groups_id    = false;
                $immo_number  = false;
@@ -145,11 +143,11 @@ class PluginOrderLink extends CommonDBChild {
                echo "<td align='center'>".Dropdown::EMPTY_VALUE."</td>";
                echo Html::hidden("id[$i][otherserial]", ['value' => '']);
             } else {
                echo "<td><input type='text' size='20' name='id[$i][otherserial]'></td>";
             }
-			
+
             if ($config->canAddImmobilizationNumber()) {
                 if ($immo_number) {
                    echo "<td align='center'>".Dropdown::EMPTY_VALUE."</td>";
                    echo Html::hidden("id[$i][immo_number]", ['value' => '']);
                 } else {
@@ -517,11 +515,10 @@ class PluginOrderLink extends CommonDBChild {
       return $forbidden;
    }
 
 
    function getSpecificMassiveActions($checkitem = null) {
-      $isadmin = static::canUpdate();
       $actions = parent::getSpecificMassiveActions($checkitem);
       $sep     = __CLASS__.MassiveAction::CLASS_ACTION_SEPARATOR;
 
       $actions[$sep.'generation'] = __("Generate item", "order");
       $actions[$sep.'createLink'] = __("Link to an existing item", "order");
@@ -635,95 +632,10 @@ class PluginOrderLink extends CommonDBChild {
       }
       parent::processMassiveActionsForOneItemtype($ma, $item, $ids);
    }
 
 
-   public function getLinkedItemDetails($itemtype, $items_id) {
-      $comments = "";
-
-      switch ($itemtype) {
-         case 'ConsumableItem' :
-            $ci = new Consumable();
-            if ($ci->getFromDB($items_id)) {
-               $ct = new ConsumableItem();
-               $ct->getFromDB($ci->fields['consumableitems_id']);
-
-               $comments .= "<strong>".__("Entity").":</strong> ";
-               $comments .= Dropdown::getDropdownName("glpi_entities", $ct->fields["entities_id"]);
-               $comments .= '<br><strong>'.__("Consumable").' : </strong> #'.$items_id;
-               $comments .= '<br><strong>'.__("Consumable type").' : </strong>';
-               $comments .= $ct->fields['name'];
-               $comments .= '<br><strong>'.__("Manufacturer").' : </strong>';
-               $comments .= Dropdown::getDropdownName('glpi_manufacturers', $ct->fields['manufacturers_id']);
-               $comments .= '<br><strong>'.__("State").' : </strong>';
-               $comments .= (!$ci->fields['users_id'] ? __("In stock") : __("Used"));
-               if ($ci->fields['users_id']) {
-                  $comments .= '<br><strong>'.__("User").' : </strong>';
-                  $comments .= Dropdown::getDropdownName('glpi_users', $ci->fields['users_id']);
-               }
-            }
-            break;
-         case 'CartridgeItem' :
-            $ci = new Cartridge();
-            if ($ci->getFromDB($items_id)) {
-               $ct = new CartridgeItem();
-               $ct->getFromDB($ci->fields['cartridgeitems_id']);
-
-               $comments .= "<strong>".__("Entity").":</strong> ";
-               $comments .= Dropdown::getDropdownName("glpi_entities", $ct->fields["entities_id"]);
-               $comments .= '<br><strong>'.__("Cartridge").' : </strong> #'.$items_id;
-               $comments .= '<br><strong>'._n("New", "New", 2).' : </strong>';
-               $comments .= $ct->fields['name'];
-               $comments .= '<br><strong>'.__("Manufacturer").' : </strong>';
-               $comments .= Dropdown::getDropdownName('glpi_manufacturers', $ct->fields['manufacturers_id']);
-            }
-            break;
-         // case 'Computer' :
-         // case 'Monitor' :
-         // case 'NetworkEquipment' :
-         // case 'Peripheral' :
-         // case 'Phone' :
-         // case 'Printer' :
-         default :
-            $item = new $itemtype();
-            $item->getFromDB($items_id);
-
-            if ($item->getField("name")) {
-               $comments .= "<strong>".__("Name").":</strong> ";
-               $comments .= $item->getField("name");
-            }
-
-            if ($item->getField("entities_id")) {
-               $comments .= "<strong>".__("Entity").":</strong> ";
-               $comments .= Dropdown::getDropdownName("glpi_entities", $item->getField("entities_id"));
-            }
-
-            if ($item->getField("serial") != '') {
-               $comments .= "<br><strong>".__("Serial number").":</strong> ";
-               $comments .= $item->getField("serial");
-            }
-
-            if ($item->getField("otherserial") != '') {
-               $comments .= "<br><strong>".__("Inventory number").":</strong> ";
-               $comments .= $item->getField("otherserial");
-            }
-            if ($item->getField("locations_id")) {
-               $comments .= "<br><strong>".__("Location").":</strong> ";
-               $comments .= Dropdown::getDropdownName('glpi_locations', $item->getField("locations_id"));
-            }
-
-            if ($item->getField("users_id")) {
-               $comments .= "<br><strong>".__("User").":</strong> ";
-               $comments .= Dropdown::getDropdownName('glpi_users', $item->getField("users_id"));
-            }
-            break;
-      }
-
-      return ($comments);
-   }
-
-
    public function getReceptionItemName($items_id, $itemtype) {
       if ($items_id == 0) {
          return (__("No associated item", "order"));
       } else {
          switch ($itemtype) {
@@ -745,39 +657,10 @@ class PluginOrderLink extends CommonDBChild {
                return $item->getLink(['comments' => 1]);
          }
       }
    }
 
-
-   /*public function dropdownLinkActions($itemtype, $plugin_order_references_id,
-                                       $plugin_order_orders_id, $entities_id) {
-      global $CFG_GLPI;
-
-      $rand       = mt_rand();
-      $reception  = new PluginOrderReception();
-      $actions[0] = Dropdown::EMPTY_VALUE;
-      if ($reception->checkItemStatus($plugin_order_orders_id, $plugin_order_references_id,
-                                      PluginOrderOrder::ORDER_DEVICE_DELIVRED)) {
-         if (!in_array($itemtype, self::getTypesThanCannotBeGenerared())) {
-            $actions['generation'] = __("Generate item", "order");
-         }
-         if ($itemtype::canView()) {
-            $actions['createLink'] = __("Link to an existing item", "order");
-            $actions['deleteLink'] = __("Delete item link", "order");
-         }
-      }
-      $rand   = Dropdown::showFromArray('generationActions', $actions);
-      Ajax::updateItemOnSelectEvent("dropdown_generationActions$rand", "show_generationActions$rand",
-                                  Plugin::getWebDir('order')."/ajax/linkactions.php",
-                                  ['action'                     => '__VALUE__',
-                                   'itemtype'                   => $itemtype,
-                                   'plugin_order_references_id' => $plugin_order_references_id,
-                                   'plugin_order_orders_id'     => $plugin_order_orders_id,
-                                   'entities_id'                => $entities_id]);
-      echo "<span id='show_generationActions$rand'>&nbsp;</span>";
-   }*/
-
    public function itemAlreadyLinkedToAnOrder($itemtype, $items_id, $plugin_order_orders_id,
                                               $detailID = 0) {
       global $DB;
       if (!in_array($itemtype, self::getTypesThanCannotBeGenerared())) {
          $query = "SELECT COUNT(*) AS cpt
@@ -1065,11 +948,11 @@ class PluginOrderLink extends CommonDBChild {
          $detail  = new PluginOrderOrder_Item();
          $detail->getFromDB($detailID);
          $license = $detail->fields["items_id"];
 
          $this->removeInfoComRelatedToOrder($itemtype, $license);
-         $result = $PluginOrderOrder_Item->queryRef($detail->fields["plugin_order_orders_id"],
+         $result = $detail->queryRef($detail->fields["plugin_order_orders_id"],
                                                     $detail->fields["plugin_order_references_id"],
                                                     $detail->fields["price_taxfree"],
                                                     $detail->fields["discount"],
                                                     PluginOrderOrder::ORDER_DEVICE_DELIVRED);
          if ($nb = $DB->numrows($result)) {
@@ -1158,14 +1041,14 @@ class PluginOrderLink extends CommonDBChild {
 
          $item  = new $add_item["itemtype"]();
          if ($add_item['itemtype']) {
             $order = new PluginOrderOrder();
          }
-   
+
          $order->getFromDB($params["plugin_order_orders_id"]);
          $reference->getFromDB($add_item["plugin_order_references_id"]);
-   
+
 		 //Update immo_number in details to fill Infocom later
          if ($config->canAddImmobilizationNumber()) {
     		 $detail = new PluginOrderOrder_Item();
     		 $detail->update(['id' => $add_item["id"], 'immo_number' => $values["immo_number"]]);
          }
@@ -1285,16 +1168,16 @@ class PluginOrderLink extends CommonDBChild {
                $input['_users_id_requester'] = empty($order->fields['users_id']) ? Session::getLoginUserID() : $order->fields['users_id'];
                $input['items_id']            = $newID;
                $input['itemtype']            = $add_item["itemtype"];
 
                $ticket = new Ticket();
-               $ticketID = $ticket->add($input);
+               $ticket->add($input);
             }
          }
 
          //-------------- End template management ---------------------------------//
-         $result = $this->createLinkWithItem($values["id"], $newID, $add_item["itemtype"],
+         $this->createLinkWithItem($values["id"], $newID, $add_item["itemtype"],
                                              $params["plugin_order_orders_id"], $entity, $templateID,
                                              false, false);
 
          //Add item's history
          $new_value = __("Item generated by using order", "order").' : '.$order->fields["name"];
@@ -1346,14 +1229,14 @@ class PluginOrderLink extends CommonDBChild {
 
 
    /**
     * Copy order documents into the newly generated item
     * @since 1.5.3
-    * @param unknown_type $itemtype
-    * @param unknown_type $items_id
-    * @param unknown_type $orders_id
-    * @param unknown_type $entity
+    * @param $itemtype
+    * @param $items_id
+    * @param $orders_id
+    * @param $entity
     */
    public static function copyDocuments($itemtype, $items_id, $orders_id, $entity) {
       global $CFG_GLPI;
 
       $config = PluginOrderConfig::getConfig();
diff --git a/inc/order.class.php b/inc/order.class.php
index fe044ea..923fcb1 100644
--- a/inc/order.class.php
+++ b/inc/order.class.php
@@ -1361,107 +1361,10 @@ class PluginOrderOrder extends CommonDBTM {
 
       return true;
    }
 
 
-   public function dropdownSuppliers($myname, $value = 0, $entity_restrict = '') {
-      global $DB, $CFG_GLPI;
-
-      $rand     = mt_rand();
-      $entities = getEntitiesRestrictRequest("AND", "glpi_suppliers", '', $entity_restrict, true);
-
-      $query = "SELECT `glpi_suppliers`.*
-                FROM `glpi_suppliers`
-                LEFT JOIN `glpi_contacts_suppliers`
-                   ON (`glpi_contacts_suppliers`.`suppliers_id` = `glpi_suppliers`.`id`)
-                WHERE `glpi_suppliers`.`is_deleted` = '0'
-                $entities
-                GROUP BY `glpi_suppliers`.`id`
-                ORDER BY `entities_id`, `name`";
-      $result = $DB->query($query);
-
-      echo "<select name='suppliers_id' id='suppliers_id'>\n";
-      echo "<option value='0'>".Dropdown::EMPTY_VALUE."</option>\n";
-
-      $prev = -1;
-      while ($data = $DB->fetchArray($result)) {
-         if ($data["entities_id"] != $prev) {
-            if ($prev >= 0) {
-               echo "</optgroup>";
-            }
-            $prev = $data["entities_id"];
-            echo "<optgroup label=\"".Dropdown::getDropdownName("glpi_entities", $prev)."\">";
-         }
-         $output = $data["name"];
-         if ($_SESSION["glpiis_ids_visible"] || empty($output)) {
-            $output .= " (".$data["id"].")";
-         }
-         echo "<option value='".$data["id"]."' ".($value == $data["id"] ? " selected " : "").
-               " title=\"".Html::cleanInputText($output)."\">".
-               substr($output, 0, $CFG_GLPI["dropdown_chars_limit"])."</option>";
-      }
-      if ($prev >= 0) {
-         echo "</optgroup>";
-      }
-      echo "</select>";
-      Ajax::updateItemOnSelectEvent("suppliers_id", "show_contacts_id",
-                                    Plugin::getWebDir('order')."/ajax/dropdownSupplier.php",
-                                    [
-                                       'suppliers_id'    => '__VALUE__',
-                                       'entity_restrict' => $entity_restrict,
-                                       'rand'            => $rand,
-                                       'myname'          => $myname,
-                                    ]);
-
-      return $rand;
-   }
-
-
-   public function dropdownContacts($suppliers_id, $value = 0, $entity_restrict = '') {
-      global $DB, $CFG_GLPI;
-
-      $rand     = mt_rand();
-      $entities = getEntitiesRestrictRequest("AND", "glpi_contacts", '', $entity_restrict, true);
-
-      $query = "SELECT `glpi_contacts`.*
-                FROM `glpi_contacts`,`glpi_contacts_suppliers`
-                WHERE `glpi_contacts_suppliers`.`contacts_id` = `glpi_contacts`.`id`
-                AND `glpi_contacts_suppliers`.`suppliers_id` = '$suppliers_id'
-                AND `glpi_contacts`.`is_deleted` = '0'
-                $entities
-                ORDER BY `entities_id`, `name`";
-      $result = $DB->query($query);
-
-      echo "<select name='contacts_id'>";
-      echo "<option value='0'>".Dropdown::EMPTY_VALUE."</option>";
-
-      if ($DB->numrows($result)) {
-         $prev = -1;
-         while ($data = $DB->fetchArray($result)) {
-            if ($data["entities_id"] != $prev) {
-               if ($prev >= 0) {
-                  echo "</optgroup>";
-               }
-               $prev = $data["entities_id"];
-               echo "<optgroup label=\"".Dropdown::getDropdownName("glpi_entities", $prev)."\">";
-            }
-            $output = formatUserName($data["id"], "", $data["name"], $data["firstname"]);
-            if ($_SESSION["glpiis_ids_visible"] || empty($output)) {
-               $output .= " (".$data["id"].")";
-            }
-            echo "<option value='".$data["id"]."' ".($value == $data["id"] ? " selected " : "")
-              ." title=\"".Html::cleanInputText($output)."\">"
-              .substr($output, 0, $CFG_GLPI["dropdown_chars_limit"])."</option>";
-         }
-         if ($prev >= 0) {
-            echo "</optgroup>";
-         }
-      }
-      echo "</select>";
-   }
-
-
    public function addStatusLog($orders_id, $status, $comments = '') {
       $changes = Dropdown::getDropdownName("glpi_plugin_order_orderstates", $status);
 
       if ($comments != '') {
          $changes .= " : ".$comments;
@@ -1528,30 +1431,20 @@ class PluginOrderOrder extends CommonDBTM {
       $changes[2] = $new_value;
       Log::history($ID, $type, $changes, 0, Log::HISTORY_LOG_SIMPLE_MESSAGE);
    }
 
 
-   public function needValidation($ID) {
-      if ($ID > 0 && $this->getFromDB($ID)) {
-         return $this->isDraft() || $this->isWaitingForApproval();
-      } else {
-         return false;
-      }
-   }
-
-
    public function deleteAllLinkWithItem($orders_id) {
       $detail  = new PluginOrderOrder_Item();
       $detail->deleteByCriteria([
          'plugin_order_orders_id' => $orders_id
       ]);
    }
 
 
    public function checkIfDetailExists($orders_id, $only_delivered = false) {
       if ($orders_id) {
-         $detail = new PluginOrderOrder_Item();
          $where  = ['plugin_order_orders_id' => $orders_id];
          if ($only_delivered) {
             $where['states_id'] = ['>', 0];
          }
          return (countElementsInTable("glpi_plugin_order_orders_items", $where));
@@ -1791,11 +1684,10 @@ class PluginOrderOrder extends CommonDBTM {
             $values['ATIPriceTotal_item'] = __("Price ATI", "order");
 
             $listeArticles = [];
 
             $result = $PluginOrderOrder_Item->queryDetail($ID, 'glpi_plugin_order_references');
-            $num    = $DB->numrows($result);
 
             while ($data = $DB->fetchArray($result)) {
                $quantity = $PluginOrderOrder_Item->getTotalQuantityByRefAndDiscount($ID, $data["id"],
                                                                              $data["price_taxfree"],
                                                                              $data["discount"]);
@@ -1816,11 +1708,10 @@ class PluginOrderOrder extends CommonDBTM {
                   'price_ati'        => $data["price_ati"]
                ];
             }
 
             $result = $PluginOrderOrder_Item->queryDetail($ID, 'glpi_plugin_order_referencefrees');
-            $num    = $DB->numrows($result);
 
             while ($data = $DB->fetchArray($result)) {
                $quantity = $PluginOrderOrder_Item->getTotalQuantityByRefAndDiscount($ID, $data["id"],
                                                                                     $data["price_taxfree"],
                                                                                     $data["discount"]);
@@ -1969,11 +1860,11 @@ class PluginOrderOrder extends CommonDBTM {
                 WHERE `plugin_order_orders_id` = '$ID'
                 GROUP BY plugin_order_references_id";
       $result = $DB->query($query);
       if ($DB->numrows($result)) {
          while ($detail = $DB->fetchArray($result)) {
-            $ref = $reference->transfer($detail["plugin_order_references_id"], $entity);
+            $reference->transfer($detail["plugin_order_references_id"], $entity);
          }
       }
    }
 
 
@@ -2217,11 +2108,10 @@ class PluginOrderOrder extends CommonDBTM {
             $nblate++;
          }
       }
       $task->addVolume($nblate);
 
-      $cron_status = 1;
       if ($CFG_GLPI["use_notifications"]) {
          $message = __("Order is late", "order");
          $alert   = new Alert();
          $config  = PluginOrderConfig::getConfig();
 
@@ -2334,17 +2224,10 @@ class PluginOrderOrder extends CommonDBTM {
          }
       }
    }
 
 
-   /**
-    * Get the standard massive actions which are forbidden
-    *
-    * @since version 0.84
-    *
-    * @return an array of massive actions
-    **/
    public function getForbiddenStandardMassiveAction() {
 
       $forbidden = parent::getForbiddenStandardMassiveAction();
       $forbidden[] = 'update';
       return $forbidden;
@@ -2355,12 +2238,10 @@ class PluginOrderOrder extends CommonDBTM {
     * @since version 0.85
     *
     * @see CommonDBTM::showMassiveActionsSubForm()
     **/
    static function showMassiveActionsSubForm(MassiveAction $ma) {
-      global $UNINSTALL_TYPES;
-
       switch ($ma->getAction()) {
          case 'transfert':
             Entity::dropdown();
             echo "&nbsp;".
                   Html::submit(_x('button', 'Post'), ['name' => 'massiveaction']);
@@ -2390,12 +2271,10 @@ class PluginOrderOrder extends CommonDBTM {
     * @since version 0.85
     *
     * @see CommonDBTM::processMassiveActionsForOneItemtype()
     **/
    static function processMassiveActionsForOneItemtype(MassiveAction $ma, CommonDBTM $item, array $ids) {
-      global $CFG_GLPI;
-
       switch ($ma->getAction()) {
          case "transfert":
             $input = $ma->getInput();
             $entities_id = $input['entities_id'];
 
@@ -2605,11 +2484,10 @@ class PluginOrderOrder extends CommonDBTM {
                'entities_id' => 'entities_id',
                'is_deleted'  => 'is_deleted'
             ];
             foreach (getAllDataFromTable("glpi_plugin_order_budgets") as $data) {
                $tmp    = [];
-               $id     = false;
                foreach ($matchings as $old => $new) {
                   if (!is_null($data[$old])) {
                      $tmp[$new] = $data[$old];
                   }
                }
@@ -2617,15 +2495,14 @@ class PluginOrderOrder extends CommonDBTM {
                $tmp['comment'] = Toolbox::addslashes_deep($tmp['comment']);
 
                //Budget already exists in the core: update it
                if ($budget->getFromDB($data['budgets_id'])) {
                   $budget->update($tmp);
-                  $id = $tmp['id'];
                } else {
                   //Budget doesn't exists in the core: create it
                   unset($tmp['id']);
-                  $id = $budget->add($tmp);
+                  $budget->add($tmp);
                }
             }
 
             $DB->query("DROP TABLE `glpi_plugin_order_budgets`");
 
diff --git a/inc/order_item.class.php b/inc/order_item.class.php
index 601f858..cf476fd 100644
--- a/inc/order_item.class.php
+++ b/inc/order_item.class.php
@@ -292,21 +292,10 @@ class PluginOrderOrder_Item extends CommonDBRelation {
    public function getPricesATI($priceHT, $taxes) {
       return (!$priceHT ? 0 : $priceHT + (($priceHT * $taxes) / 100));
    }
 
 
-   public function checkIFReferenceExistsInOrder($orders_id, $ref_id) {
-      return (countElementsInTable(
-         $this->getTable(),
-         [
-            'plugin_order_orders_id' => $orders_id,
-            'plugin_order_references_id' => $ref_id,
-         ]
-      ));
-   }
-
-
    public function addDetails($ref_id, $itemtype, $orders_id, $quantity, $price, $discounted_price, $taxes_id, $analytic_nature_id) {
 
       $order = new PluginOrderOrder();
       if ($quantity > 0 && $order->getFromDB($orders_id)) {
          $tax = new PluginOrderOrderTax();
@@ -1050,11 +1039,10 @@ class PluginOrderOrder_Item extends CommonDBRelation {
 
          }
          $query .= " ORDER BY `$table_ref`.`name` ";
 
          $result = $DB->query($query);
-         $num    = $DB->numrows($result);
 
          // Initialize for detail_hideForm javascript function
          $hideForm = "";
 
          while ($data = $DB->fetchArray($result)) {
@@ -1229,22 +1217,10 @@ class PluginOrderOrder_Item extends CommonDBRelation {
       $result = $DB->query($query);
       return ($DB->result($result, 0, 'quantity'));
    }
 
 
-   public function getTotalQuantityByRef($orders_id, $references_id) {
-      global $DB;
-
-      $query = "SELECT COUNT(*) AS quantity
-                FROM `".self::getTable()."`
-                WHERE `plugin_order_orders_id` = '$orders_id'
-                   AND `plugin_order_references_id` = '$references_id' ";
-      $result = $DB->query($query);
-      return ($DB->result($result, 0, 'quantity'));
-   }
-
-
    public function getDeliveredQuantity($orders_id, $references_id, $price_taxfree, $discount) {
       return countElementsInTable(
          self::getTable(),
          [
             'plugin_order_orders_id'     => $orders_id,
@@ -1716,22 +1692,18 @@ class PluginOrderOrder_Item extends CommonDBRelation {
                            $this->fields['plugin_order_analyticnatures_id']);
       }
    }
 
    public function updateAnalyticNature($post) {
-      global $DB;
-
       $this->getFromDB($post['item_id']);
 
       $input = $this->fields;
       $input['plugin_order_analyticnatures_id'] = $post['plugin_order_analyticnatures_id'];
       $this->update($input);
    }
 
    public function updatePrice_taxfree($post) {
-      global $DB;
-
       $this->getFromDB($post['item_id']);
 
       $input = $this->fields;
       $discount                   = $input['discount'];
       $plugin_order_ordertaxes_id = $input['plugin_order_ordertaxes_id'];
@@ -1860,11 +1832,11 @@ class PluginOrderOrder_Item extends CommonDBRelation {
          /* Migrate VAT */
          foreach ($DB->request("glpi_plugin_order_orders") as $data) {
             $query  = "UPDATE `glpi_plugin_order_orders_items`
                        SET `plugin_order_ordertaxes_id` = '".$data["plugin_order_ordertaxes_id"]."'
                        WHERE `plugin_order_orders_id` = '".$data["id"]."'";
-            $result = $DB->query($query) or die($DB->error());
+            $DB->query($query) or die($DB->error());
          }
           //1.5.0
          $migration->addField($table, "entities_id", "INT {$default_key_sign} NOT NULL DEFAULT '0'");
          $migration->addField($table, "is_recursive", "TINYINT NOT NULL DEFAULT '0'");
          $migration->addField($table, "plugin_order_bills_id", "INT {$default_key_sign} NOT NULL DEFAULT '0'");
diff --git a/inc/order_supplier.class.php b/inc/order_supplier.class.php
index 02a3e08..51bbf15 100644
--- a/inc/order_supplier.class.php
+++ b/inc/order_supplier.class.php
@@ -276,24 +276,10 @@ class PluginOrderOrder_Supplier extends CommonDBChild {
       }
       Html::closeForm();
    }
 
 
-   public function checkIfSupplierInfosExists($plugin_order_orders_id) {
-
-      if ($plugin_order_orders_id) {
-         $devices = getAllDataFromTable(self::getTable(),
-                                         ['plugin_order_orders_id' => $plugin_order_orders_id]);
-         if (!empty($devices)) {
-            return true;
-         } else {
-            return false;
-         }
-      }
-   }
-
-
    public static function showDeliveries($suppliers_id) {
       global $DB;
 
       $query = "SELECT COUNT(`glpi_plugin_order_orders_items`.`plugin_order_references_id`) AS ref,
                        `glpi_plugin_order_orders_items`.`plugin_order_deliverystates_id` as sid,
diff --git a/inc/orderinjection.class.php b/inc/orderinjection.class.php
index fc47bba..7af003e 100644
--- a/inc/orderinjection.class.php
+++ b/inc/orderinjection.class.php
@@ -59,19 +59,10 @@ class PluginOrderOrderInjection extends PluginOrderOrder implements PluginDatain
 
    public function connectedTo() {
       return [];
    }
 
-
-   /**
-    * Standard method to add an object into glpi
-    *
-    * @param values fields to add into glpi
-    * @param options options used during creation
-    * @return an array of IDs of newly created objects : for example array(Computer=>1, Networkport=>10)
-    *
-   **/
    public function addOrUpdateObject($values = [], $options = []) {
       $lib = new PluginDatainjectionCommonInjectionLib($this, $values, $options);
       $lib->processAddOrUpdate();
       return $lib->getInjectionResults();
    }
diff --git a/inc/preference.class.php b/inc/preference.class.php
index 7845446..94cf302 100644
--- a/inc/preference.class.php
+++ b/inc/preference.class.php
@@ -83,11 +83,11 @@ class PluginOrderPreference extends CommonDBTM {
 
    /**
     *
     * Display a dropdown of all ODT template files available
     * @since 1.5.3
-    * @param $value default value
+    * @param $value
     */
    public static function dropdownFileTemplates($value = '') {
       return self::dropdownListFiles('template', PLUGIN_ORDER_TEMPLATE_EXTENSION,
                                      PLUGIN_ORDER_TEMPLATE_DIR, $value);
    }
@@ -95,11 +95,11 @@ class PluginOrderPreference extends CommonDBTM {
 
    /**
     *
     * Display a dropdown of all PNG signatures files available
     * @since 1.5.3
-    * @param $value default value
+    * @param $value
     */
    public static function dropdownFileSignatures($value = '', $empy_value = true) {
       return self::dropdownListFiles('sign', PLUGIN_ORDER_SIGNATURE_EXTENSION,
                                      PLUGIN_ORDER_SIGNATURE_DIR, $value);
    }
@@ -108,13 +108,13 @@ class PluginOrderPreference extends CommonDBTM {
    /**
     *
     * Display a dropdown which contains all files of a certain type in a directory
     * @since 1.5.3
     * @param $name dropdown name
-    * @param $extension list files of this extension only
+    * @param array $extension list files of this extension only
     * @param $directory directory in which to look for files
-    * @param $value default value
+    * @param $value
     */
    public static function dropdownListFiles($name, $extension, $directory, $value = '') {
       $files  = self::getFiles($directory, $extension);
       $values = [];
       if (empty($files)) {
@@ -185,11 +185,10 @@ class PluginOrderPreference extends CommonDBTM {
       Html::closeForm();
    }
 
 
    public static function getFiles($directory, $ext) {
-      $array_dir  = [];
       $array_file = [];
 
       if (is_dir($directory)) {
          if ($dh = opendir($directory)) {
             while (($file = readdir($dh)) !== false) {
@@ -208,13 +207,10 @@ class PluginOrderPreference extends CommonDBTM {
                            $array_file[] = [$filename, $filedate, $extension];
                         }
                      } else {
                         $array_file[] = [$filename, $filedate, $extension];
                      }
-
-                  } else if ($filetype == "dir") {
-                     $array_dir[] = $filename;
                   }
                }
             }
             closedir($dh);
          }
diff --git a/inc/reception.class.php b/inc/reception.class.php
index 321fd26..c312e9d 100644
--- a/inc/reception.class.php
+++ b/inc/reception.class.php
@@ -124,11 +124,11 @@ class PluginOrderReception extends CommonDBChild {
       $detail = new PluginOrderOrder_Item();
       $detail->getFromDB($detailID);
 
       if ($detail->fields["itemtype"] == 'SoftwareLicense') {
 
-         $result = $PluginOrderOrder_Item->queryRef($_POST["plugin_order_orders_id"],
+         $result = $detail->queryRef($_POST["plugin_order_orders_id"],
                                                     $detail->fields["plugin_order_references_id"],
                                                     $detail->fields["price_taxfree"],
                                                     $detail->fields["discount"],
                                                     PluginOrderOrder::ORDER_DEVICE_DELIVRED);
          $nb = $DB->numrows($result);
@@ -542,11 +542,10 @@ class PluginOrderReception extends CommonDBChild {
       return $forbidden;
    }
 
 
    function getSpecificMassiveActions($checkitem = null) {
-      $isadmin = static::canUpdate();
       $actions = parent::getSpecificMassiveActions($checkitem);
 
       //remove native transfer action
       unset($actions[MassiveAction::class.MassiveAction::CLASS_ACTION_SEPARATOR.'add_transfer_list']);
       $sep     = __CLASS__.MassiveAction::CLASS_ACTION_SEPARATOR;
@@ -663,33 +662,10 @@ class PluginOrderReception extends CommonDBChild {
             ]
          );
       }
    }
 
-
-   public function dropdownReceptionActions($itemtype, $plugin_order_references_id, $plugin_order_orders_id) {
-      global $CFG_GLPI;
-
-      $rand = mt_rand();
-
-      echo "<select name='receptionActions$rand' id='receptionActions$rand'>";
-      echo "<option value='0' selected>".Dropdown::EMPTY_VALUE."</option>";
-      echo "<option value='reception'>".__("Take item delivery", "order")."</option>";
-      echo "</select>";
-      $params = [
-         'action'                     => '__VALUE__',
-         'itemtype'                   => $itemtype,
-         'plugin_order_references_id' => $plugin_order_references_id,
-         'plugin_order_orders_id'     => $plugin_order_orders_id,
-      ];
-      Ajax::updateItemOnSelectEvent("receptionActions$rand", "show_receptionActions$rand",
-                                    Plugin::getWebDir('order')."/ajax/receptionactions.php",
-                                    $params);
-      echo "<span id='show_receptionActions$rand'>&nbsp;</span>";
-   }
-
-
    public function getReceptionStatus($ID) {
       $detail = new PluginOrderOrder_Item();
       $detail->getFromDB($ID);
 
       switch ($detail->fields["states_id"]) {
@@ -962,11 +938,11 @@ class PluginOrderReception extends CommonDBChild {
 
    /**
    *
    * @param $options
    *
-   * return nothing
+   * @return void
    */
    public static function generateAsset($options = []) {
       // No asset should be generated for PluginOrderOther and PluginOrderReferenceFree items.
       if (array_key_exists('itemtype', $options)
           && (in_array($options['itemtype'], [PluginOrderOther::class, PluginOrderReferenceFree::class]))) {
diff --git a/inc/reference.class.php b/inc/reference.class.php
index 3a5c67d..260e34d 100644
--- a/inc/reference.class.php
+++ b/inc/reference.class.php
@@ -277,11 +277,11 @@ class PluginOrderReference extends CommonDBTM {
       }
       switch ($field) {
          case 'itemtype':
             $types    = PluginOrderOrder_Item::getClasses();
             $itemtype = [];
-            foreach ($types as $key => $type) {
+            foreach ($types as $type) {
                $item            = new $type();
                $itemtype[$type] = $item->getTypeName();
             }
             $options['display'] = false;
             return Dropdown::showFromArray($name, $itemtype, $options);
@@ -848,105 +848,10 @@ class PluginOrderReference extends CommonDBTM {
          $reference_supplier->add($refsup);
       }
       return true;
    }
 
-
-   /**
-    * Display entities of the loaded profile
-    *
-   * @param $myname select name
-    * @param $target target for entity change action
-    */
-   public static function showSelector($target) {
-      $rand = mt_rand();
-      Plugin::loadLang('order');
-      echo "<div class='center' ><span class='b'>".__("Select the wanted item type", "order")
-        ."</span><br>";
-      echo "<a style='font-size:14px;' href='".$target."?reset=reset' title=\""
-        .__("Show all")."\">".str_replace(" ", "&nbsp;", __("Show all"))."</a></div>";
-
-      echo "<div class='left' style='width:100%'>";
-
-      echo "<script type='javascript'>";
-      echo "var Tree_Category_Loader$rand = new Ext.tree.TreeLoader({
-         dataUrl:'".Plugin::getWebDir('order')."/ajax/referencetreetypes.php'
-      });";
-
-      echo "var Tree_Category$rand = new Ext.tree.TreePanel({
-         collapsible      : false,
-         animCollapse     : false,
-         border           : false,
-         id               : 'tree_projectcategory$rand',
-         el               : 'tree_projectcategory$rand',
-         autoScroll       : true,
-         animate          : false,
-         enableDD         : true,
-         containerScroll  : true,
-         height           : 320,
-         width            : 770,
-         loader           : Tree_Category_Loader$rand,
-         rootVisible     : false
-      });";
-
-      // SET the root node.
-      echo "var Tree_Category_Root$rand = new Ext.tree.AsyncTreeNode({
-         text     : '',
-         draggable   : false,
-         id    : '-1'                  // this IS the id of the startnode
-      });
-      Tree_Category$rand.setRootNode(Tree_Category_Root$rand);";
-
-      // Render the tree.
-      echo "Tree_Category$rand.render();
-            Tree_Category_Root$rand.expand();";
-
-      echo "</script>";
-
-      echo "<div id='tree_projectcategory$rand' ></div>";
-      echo "</div>";
-   }
-
-
-   public function title() {
-      echo "<div align='center'>";
-      echo self::getPerTypeJavascriptCode();
-      echo "<a onclick='order_window.show();' href='#modal_reference_content' title='"
-           .__("View by item type", "order")."'>"
-           .__("View by item type", "order")."</a>";
-      echo "</div>";
-
-   }
-
-
-   public static function getPerTypeJavascriptCode() {
-      global $CFG_GLPI;
-
-      $out  = "<script type='text/javascript'>";
-      $out .= "cleanhide('modal_reference_content');";
-      $out .= "var order_window=new Ext.Window({
-         layout:'fit',
-         width:800,
-         height:400,
-         closeAction:'hide',
-         modal: true,
-         autoScroll: true,
-         title: \"".__("View by item type", "order")."\",
-         autoLoad: '".Plugin::getWebDir('order')."/ajax/referencetree.php'
-      });";
-      $out .= "</script>";
-      return $out;
-   }
-
-
-   /**
-    * Get the standard massive actions which are forbidden
-    *
-    * @since version 0.84
-    *
-    * @return an array of massive actions
-    **/
    public function getForbiddenStandardMassiveAction() {
 
       $forbidden = parent::getForbiddenStandardMassiveAction();
       $forbidden[] = 'update';
       return $forbidden;
@@ -1026,21 +931,10 @@ class PluginOrderReference extends CommonDBTM {
                break;
       }
       return;
    }
 
-
-   /*   function getValueToSelect($field_id_or_search_options, $name = '', $values = '', $options = []) {
-      if (isset($field_id_or_search_options['displaytype'])
-         && $field_id_or_search_options['displaytype'] == 'reference_type') {
-            Toolbox::logDebug($field_id_or_search_options['displaytype'],
-                              $field_id_or_search_options, $name, $values, $options);
-
-      }
-      return false;
-   }*/
-
    public static function install(Migration $migration) {
       global $DB;
 
       $default_charset = DBConnection::getDefaultCharset();
       $default_collation = DBConnection::getDefaultCollation();
diff --git a/inc/reference_supplier.class.php b/inc/reference_supplier.class.php
index 038dc89..bd29994 100644
--- a/inc/reference_supplier.class.php
+++ b/inc/reference_supplier.class.php
@@ -245,11 +245,11 @@ class PluginOrderReference_Supplier extends CommonDBChild {
       return true;
    }
 
 
    public function showReferenceManufacturers($ID) {
-      global $DB, $CFG_GLPI;
+      global $DB;
 
       $ref = new PluginOrderReference();
       $ref->getFromDB($ID);
 
       $target = Toolbox::getItemTypeFormURL(__CLASS__);
@@ -329,28 +329,10 @@ class PluginOrderReference_Supplier extends CommonDBChild {
       Html::closeForm();
       echo "</div>";
    }
 
 
-   public function getPriceByReferenceAndSupplier($plugin_order_references_id, $suppliers_id) {
-      global $DB;
-
-      $table = self::getTable();
-      $query = "SELECT `price_taxfree`
-                FROM `$table`
-                WHERE `plugin_order_references_id` = '$plugin_order_references_id'
-                AND `suppliers_id` = '$suppliers_id' ";
-      $result = $DB->query($query);
-
-      if ($DB->numrows($result) > 0) {
-         return $DB->result($result, 0, "price_taxfree");
-      } else {
-         return 0;
-      }
-   }
-
-
    public function getReferenceCodeByReferenceAndSupplier($plugin_order_references_id, $suppliers_id) {
       global $DB;
 
       $table = self::getTable();
       $query = "SELECT `reference_code`
diff --git a/inc/referencefree.class.php b/inc/referencefree.class.php
index f9fb643..8a8c57e 100644
--- a/inc/referencefree.class.php
+++ b/inc/referencefree.class.php
@@ -38,31 +38,10 @@ class PluginOrderReferenceFree extends CommonDBTM {
 
    public static function getTypeName($nb = 0) {
       return __("Reference free", "order");
    }
 
-   public function addDetails($ref_id, $itemtype, $orders_id, $quantity, $price, $discounted_price, $taxes_id) {
-      $order = new PluginOrderOrder();
-      if ($quantity > 0 && $order->getFromDB($orders_id)) {
-         for ($i = 0; $i < $quantity; $i++) {
-            $input["plugin_order_orders_id"]     = $orders_id;
-            $input["plugin_order_ordertaxes_id"] = $taxes_id;
-            $input["itemtype"]                   = $itemtype;
-            $input["entities_id"]                = $order->getEntityID();
-            $input["is_recursive"]               = $order->isRecursive();
-            $input["price_taxfree"]              = $price;
-            $input["price_discounted"]           = $price - ($price * ($discounted_price / 100));
-            $input["states_id"]                  = PluginOrderOrder::ORDER_DEVICE_NOT_DELIVRED;
-
-            $input["price_ati"] = $this->getPricesATI($input["price_discounted"], Dropdown::getDropdownName("glpi_plugin_order_ordertaxes", $taxes_id));
-            $input["discount"]  = $discounted_price;
-
-            $this->add($input);
-         }
-      }
-   }
-
    public static function install(Migration $migration) {
       global $DB;
 
       $default_charset = DBConnection::getDefaultCharset();
       $default_collation = DBConnection::getDefaultCollation();
diff --git a/inc/referenceinjection.class.php b/inc/referenceinjection.class.php
index 9e1fdab..f0b965f 100644
--- a/inc/referenceinjection.class.php
+++ b/inc/referenceinjection.class.php
@@ -61,18 +61,10 @@ class PluginOrderReferenceInjection extends PluginOrderReference
    public function connectedTo() {
       return [];
    }
 
 
-   /**
-    * Standard method to add an object into glpi
-    *
-    * @param values fields to add into glpi
-    * @param options options used during creation
-    * @return an array of IDs of newly created objects : for example [Computer => 1, Networkport => 10]
-    *
-   **/
    public function addOrUpdateObject($values = [], $options = []) {
       $lib = new PluginDatainjectionCommonInjectionLib($this, $values, $options);
       $lib->processAddOrUpdate();
       return $lib->getInjectionResults();
    }
diff --git a/setup.php b/setup.php
index de2b603..bce025c 100644
--- a/setup.php
+++ b/setup.php
@@ -192,11 +192,10 @@ function plugin_version_order() {
       'license'        => 'GPLv2+',
       'requirements'   => [
          'glpi' => [
             'min' => PLUGIN_ORDER_MIN_GLPI,
             'max' => PLUGIN_ORDER_MAX_GLPI,
-            'dev' => true, //Required to allow 9.2-dev
          ]
       ]
    ];
 }
 

Vulnerable code: <?php

/**
 * -------------------------------------------------------------------------
 * Order plugin for GLPI
 * -------------------------------------------------------------------------
 *
 * LICENSE
 *
 * This file is part of Order.
 *
 * Order is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * Order is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Order. If not, see <http://www.gnu.org/licenses/>.
 * -------------------------------------------------------------------------
 * @copyright Copyright (C) 2009-2022 by Order plugin team.
 * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
 * @link      https://github.com/pluginsGLPI/order
 * -------------------------------------------------------------------------
 */

include ("../../../inc/includes.php");

header("Content-Type: text/html; charset=UTF-8");

Html::header_nocache();

if (!defined('GLPI_ROOT')) {
   die("Can not acces directly to this file");
}

Session::checkCentralAccess();

$rand         = $_POST["rand"];
$paramsaction = [
   'plugin_order_references_id' => '__VALUE__',
   'entity_restrict'            => $_POST["entity_restrict"],
   'suppliers_id'               => $_POST["suppliers_id"],
   'itemtype'                   => $_POST['itemtype'],
];
$fields = [
   "quantity",
   "priceht",
   "pricediscounted",
   "taxe",
   "validate",
];

$order_url = Plugin::getWebDir('order');

foreach ($fields as $field) {
   $paramsaction['update'] = $field;
   Ajax::updateItem("show_$field",
                    "$order_url/ajax/referencedetail.php",
                    $paramsaction, "dropdown_reference$rand");
   Ajax::updateItemOnSelectEvent("dropdown_reference$rand",
                                 "show_$field",
                                 "$order_url/ajax/referencedetail.php",
                                 $paramsaction);
}
<?php

/**
 * -------------------------------------------------------------------------
 * Order plugin for GLPI
 * -------------------------------------------------------------------------
 *
 * LICENSE
 *
 * This file is part of Order.
 *
 * Order is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * Order is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Order. If not, see <http://www.gnu.org/licenses/>.
 * -------------------------------------------------------------------------
 * @copyright Copyright (C) 2009-2022 by Order plugin team.
 * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
 * @link      https://github.com/pluginsGLPI/order
 * -------------------------------------------------------------------------
 */

if (strpos($_SERVER['PHP_SELF'], "dropdownContact.php")) {
   include ("../../../inc/includes.php");
   header("Content-Type: text/html; charset=UTF-8");
   Html::header_nocache();
}

if (!defined('GLPI_ROOT')) {
   die("Can not acces directly to this file");
}

Session::checkCentralAccess();

// Make a select box with all glpi users
$where = " WHERE `glpi_contacts_suppliers`.`contacts_id` = `glpi_contacts`.`id`
           AND (`glpi_contacts_suppliers`.`suppliers_id` = '".$_POST['suppliers_id']."'
           AND `glpi_contacts`.`is_deleted` = '0' ) ";


if (isset($_POST["entity_restrict"])) {
   if (!is_numeric($_POST["entity_restrict"]) && !is_array($_POST["entity_restrict"])) {
      $_POST["entity_restrict"] = unserialize(Toolbox::stripslashes_deep($_POST["entity_restrict"]));
   }
   $where .= getEntitiesRestrictRequest("AND", "glpi_contacts", '', $_POST["entity_restrict"], true);
} else {
   $where .= getEntitiesRestrictRequest("AND", "glpi_contacts", '', '', true);
}

if ($_POST['searchText'] != $CFG_GLPI["ajax_wildcard"]) {
   $where .= " AND `glpi_contacts`.`name` ".makeTextSearch($_POST['searchText']);
}

$LIMIT = "LIMIT 0, ".$CFG_GLPI["dropdown_max"];
if ($_POST['searchText'] == $CFG_GLPI["ajax_wildcard"]) {
   $LIMIT = "";
}


$query = "SELECT `glpi_contacts`.*
          FROM `glpi_contacts`,`glpi_contacts_suppliers`
          $where
          ORDER BY `entities_id`, `name` $LIMIT";
//error_log($query);
$result = $DB->query($query);

echo "<select name='contacts_id'>";

echo "<option value='0'>".Dropdown::EMPTY_VALUE."</option>";

if ($DB->numrows($result)) {
   $prev = -1;
   while ($data = $DB->fetchArray($result)) {
      if ($data["entities_id"] != $prev) {
         if ($prev > 0) {
            echo "</optgroup>";
         }
         $prev = $data["entities_id"];
         echo "<optgroup label=\"".Dropdown::getDropdownName("glpi_entities", $prev)."\">";
      }
      $output = formatUserName($data["id"], "", $data["name"], $data["firstname"]);
      if ($_SESSION["glpiis_ids_visible"] || empty($output)) {
         $output .= " (".$data["id"].")";
      }
      echo "<option value=\"".$data["id"]."\" title=\"$output\">"
        .substr($output, 0, $CFG_GLPI["dropdown_chars_limit"])."</option>";
   }
   if ($prev >= 0) {
      echo "</optgroup>";
   }
}

echo "</select>";
<?php

/**
 * -------------------------------------------------------------------------
 * Order plugin for GLPI
 * -------------------------------------------------------------------------
 *
 * LICENSE
 *
 * This file is part of Order.
 *
 * Order is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * Order is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Order. If not, see <http://www.gnu.org/licenses/>.
 * -------------------------------------------------------------------------
 * @copyright Copyright (C) 2009-2022 by Order plugin team.
 * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
 * @link      https://github.com/pluginsGLPI/order
 * -------------------------------------------------------------------------
 */

include ("../../../inc/includes.php");

header("Content-Type: text/html; charset=UTF-8");

Html::header_nocache();

if (!defined('GLPI_ROOT')) {
   die("Can not acces directly to this file");
}

Session::checkCentralAccess();

if ($_POST["plugin_order_references_id"] > 0) {
   $reference_supplier = new PluginOrderReference_Supplier();
   $price = $reference_supplier->getPriceByReferenceAndSupplier($_POST["plugin_order_references_id"],
                                                                $_POST["suppliers_id"]);
   switch ($_POST["update"]) {
      case 'quantity':
         echo "<input type='number' class='form-control' min='0' name='quantity' class='quantity'>";
         break;
      case 'priceht':
         echo "<input type='number' class='form-control' min='0' step='".PLUGIN_ORDER_NUMBER_STEP."'
                      name='price' value='".Html::formatNumber($price, true)."' class='decimal'>";
         break;
      case 'pricediscounted':
         echo "<input type='number' class='form-control' min='0' step='".PLUGIN_ORDER_NUMBER_STEP."'
                      name='discount' class='smalldecimal' value='0'>";
         break;
      case 'taxe':
         $config = PluginOrderConfig::getConfig();
         PluginOrderOrderTax::Dropdown([
            'name'                => "plugin_order_ordertaxes_id",
            'value'               => $config->getDefaultTaxes(),
            'display_emptychoice' => true,
            'emptylabel'          => __("No VAT", "order"),
         ]);
         break;
      case 'validate':
         echo Html::hidden('itemtype', ['value' => $_POST["itemtype"]]);
         echo Html::hidden('plugin_order_references_id',
                           ['value' => $_POST["plugin_order_references_id"]]);
         echo "<input type='submit' name='add_item' value=\"". __("Add")."\" class='submit' >";
         break;
   }
} else {
   return "";
}
         if ($_POST["itemtype"] == 'PluginOrderOther') {
            $file = 'other';
         } else {
            $file = $_POST["itemtype"];
         }
<?php

/**
 * -------------------------------------------------------------------------
 * Order plugin for GLPI
 * -------------------------------------------------------------------------
 *
 * LICENSE
 *
 * This file is part of Order.
 *
 * Order is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * Order is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Order. If not, see <http://www.gnu.org/licenses/>.
 * -------------------------------------------------------------------------
 * @copyright Copyright (C) 2009-2022 by Order plugin team.
 * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
 * @link      https://github.com/pluginsGLPI/order
 * -------------------------------------------------------------------------
 */

$AJAX_INCLUDE = 1;

include ("../../../inc/includes.php");

header("Content-Type: text/html; charset=UTF-8");

Html::header_nocache();

Session::checkLoginUser();

if (!isset($_GET['target'])) {
   $_GET['target'] = Plugin::getWebDir('order')."/front/reference.php";
}

PluginOrderReference::showSelector($_GET['target']);

Html::ajaxFooter();
<?php

/**
 * -------------------------------------------------------------------------
 * Order plugin for GLPI
 * -------------------------------------------------------------------------
 *
 * LICENSE
 *
 * This file is part of Order.
 *
 * Order is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * Order is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Order. If not, see <http://www.gnu.org/licenses/>.
 * -------------------------------------------------------------------------
 * @copyright Copyright (C) 2009-2022 by Order plugin team.
 * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
 * @link      https://github.com/pluginsGLPI/order
 * -------------------------------------------------------------------------
 */

$AJAX_INCLUDE = 1;

include ("../../../inc/includes.php");

header("Content-Type: text/html; charset=UTF-8");

Html::header_nocache();

Session::checkLoginUser();

if (isset($_REQUEST['node'])) {
   $target = "reference.php";
   $nodes  = [];

   // Root node
   if ($_REQUEST['node'] == -1) {
      $pos      = 0;
      $entity   = $_SESSION['glpiactive_entity'];
      $entities = getEntitiesRestrictRequest("AND", "glpi_plugin_order_references");

      $query = "SELECT DISTINCT `itemtype`
                FROM `glpi_plugin_order_references`
                WHERE `glpi_plugin_order_references`.`is_deleted` = '0'
                $entities
                GROUP BY `itemtype`
                ORDER BY `itemtype`";

      if ($result = $DB->query($query)) {
         if ($DB->numrows($result)) {
            $pos = 0;

            while ($row = $DB->fetchArray($result)) {
               $class             = $row['itemtype'];
               $item              = new $class();
               $path['text']      = $item->getTypeName();
               $path['position']  = $pos;
               $pos++;
               $path['draggable'] = false;

               if ($entity == 0) {
                  $link = "&link[1]=AND&searchtype[1]=contains&contains[1]=NULL&field[1]=80";
               } else {
                  $link = "&link[1]=AND&searchtype[1]=contains&contains[1]=".
                          Dropdown::getDropdownName("glpi_entities", $entity)."&field[1]=80";
               }

               $path['href'] = Plugin::getWebDir('order').
                  "/front/$target?is_deleted=0&field[0]=3&searchtype[0]=equals&contains[0]=".
                  rawurlencode($class)."&$link&itemtype=PluginOrderReference&start=0";

               // Check if node is a leaf or a folder.
               $path['leaf'] = true;
               $path['cls']  = 'file';
               $nodes[]      = $path;
            }
         }
      }
   }

   print json_encode($nodes);
}
$dropdown = new PluginOrderBill();
$PluginOrderOrder     = new PluginOrderOrder();
$PluginOrderReference = new PluginOrderReference();
$PluginOrderBill      = new PluginOrderBill();

$pluginOrderOrder_Supplier = new PluginOrderOrder_Supplier();
$order = new PluginOrderOrder();

$reference = new PluginOrderReference();

         $newID = $PluginOrderReference_Supplier->add($_POST);
         $newID = $PluginOrderSurveySupplier->add($_POST);
   global $CFG_GLPI;

         $old_itemtype = '';
         $num          = 0;

            if ($data['itemtype']::canView()) {
               $ID = "";
               if ($_SESSION["glpiis_ids_visible"]
                   || empty($data["name"])) {
                    $ID = " (".$data["id"].")";
               }
               $name = NOT_AVAILABLE;
               if ($item->getFromDB($data["id"])) {
                  $name = $item->getLink();
               }

      global $CFG_GLPI;

   
               $serial       = $item->fields["serial"] ?? "";
               $serial       = false;
			
      $isadmin = static::canUpdate();
   public function getLinkedItemDetails($itemtype, $items_id) {
      $comments = "";

      switch ($itemtype) {
         case 'ConsumableItem' :
            $ci = new Consumable();
            if ($ci->getFromDB($items_id)) {
               $ct = new ConsumableItem();
               $ct->getFromDB($ci->fields['consumableitems_id']);

               $comments .= "<strong>".__("Entity").":</strong> ";
               $comments .= Dropdown::getDropdownName("glpi_entities", $ct->fields["entities_id"]);
               $comments .= '<br><strong>'.__("Consumable").' : </strong> #'.$items_id;
               $comments .= '<br><strong>'.__("Consumable type").' : </strong>';
               $comments .= $ct->fields['name'];
               $comments .= '<br><strong>'.__("Manufacturer").' : </strong>';
               $comments .= Dropdown::getDropdownName('glpi_manufacturers', $ct->fields['manufacturers_id']);
               $comments .= '<br><strong>'.__("State").' : </strong>';
               $comments .= (!$ci->fields['users_id'] ? __("In stock") : __("Used"));
               if ($ci->fields['users_id']) {
                  $comments .= '<br><strong>'.__("User").' : </strong>';
                  $comments .= Dropdown::getDropdownName('glpi_users', $ci->fields['users_id']);
               }
            }
            break;
         case 'CartridgeItem' :
            $ci = new Cartridge();
            if ($ci->getFromDB($items_id)) {
               $ct = new CartridgeItem();
               $ct->getFromDB($ci->fields['cartridgeitems_id']);

               $comments .= "<strong>".__("Entity").":</strong> ";
               $comments .= Dropdown::getDropdownName("glpi_entities", $ct->fields["entities_id"]);
               $comments .= '<br><strong>'.__("Cartridge").' : </strong> #'.$items_id;
               $comments .= '<br><strong>'._n("New", "New", 2).' : </strong>';
               $comments .= $ct->fields['name'];
               $comments .= '<br><strong>'.__("Manufacturer").' : </strong>';
               $comments .= Dropdown::getDropdownName('glpi_manufacturers', $ct->fields['manufacturers_id']);
            }
            break;
         // case 'Computer' :
         // case 'Monitor' :
         // case 'NetworkEquipment' :
         // case 'Peripheral' :
         // case 'Phone' :
         // case 'Printer' :
         default :
            $item = new $itemtype();
            $item->getFromDB($items_id);

            if ($item->getField("name")) {
               $comments .= "<strong>".__("Name").":</strong> ";
               $comments .= $item->getField("name");
            }

            if ($item->getField("entities_id")) {
               $comments .= "<strong>".__("Entity").":</strong> ";
               $comments .= Dropdown::getDropdownName("glpi_entities", $item->getField("entities_id"));
            }

            if ($item->getField("serial") != '') {
               $comments .= "<br><strong>".__("Serial number").":</strong> ";
               $comments .= $item->getField("serial");
            }

            if ($item->getField("otherserial") != '') {
               $comments .= "<br><strong>".__("Inventory number").":</strong> ";
               $comments .= $item->getField("otherserial");
            }
            if ($item->getField("locations_id")) {
               $comments .= "<br><strong>".__("Location").":</strong> ";
               $comments .= Dropdown::getDropdownName('glpi_locations', $item->getField("locations_id"));
            }

            if ($item->getField("users_id")) {
               $comments .= "<br><strong>".__("User").":</strong> ";
               $comments .= Dropdown::getDropdownName('glpi_users', $item->getField("users_id"));
            }
            break;
      }

      return ($comments);
   }



   /*public function dropdownLinkActions($itemtype, $plugin_order_references_id,
                                       $plugin_order_orders_id, $entities_id) {
      global $CFG_GLPI;

      $rand       = mt_rand();
      $reception  = new PluginOrderReception();
      $actions[0] = Dropdown::EMPTY_VALUE;
      if ($reception->checkItemStatus($plugin_order_orders_id, $plugin_order_references_id,
                                      PluginOrderOrder::ORDER_DEVICE_DELIVRED)) {
         if (!in_array($itemtype, self::getTypesThanCannotBeGenerared())) {
            $actions['generation'] = __("Generate item", "order");
         }
         if ($itemtype::canView()) {
            $actions['createLink'] = __("Link to an existing item", "order");
            $actions['deleteLink'] = __("Delete item link", "order");
         }
      }
      $rand   = Dropdown::showFromArray('generationActions', $actions);
      Ajax::updateItemOnSelectEvent("dropdown_generationActions$rand", "show_generationActions$rand",
                                  Plugin::getWebDir('order')."/ajax/linkactions.php",
                                  ['action'                     => '__VALUE__',
                                   'itemtype'                   => $itemtype,
                                   'plugin_order_references_id' => $plugin_order_references_id,
                                   'plugin_order_orders_id'     => $plugin_order_orders_id,
                                   'entities_id'                => $entities_id]);
      echo "<span id='show_generationActions$rand'>&nbsp;</span>";
   }*/

         $result = $PluginOrderOrder_Item->queryRef($detail->fields["plugin_order_orders_id"],
   
   
               $ticketID = $ticket->add($input);
         $result = $this->createLinkWithItem($values["id"], $newID, $add_item["itemtype"],
    * @param unknown_type $itemtype
    * @param unknown_type $items_id
    * @param unknown_type $orders_id
    * @param unknown_type $entity
   public function dropdownSuppliers($myname, $value = 0, $entity_restrict = '') {
      global $DB, $CFG_GLPI;

      $rand     = mt_rand();
      $entities = getEntitiesRestrictRequest("AND", "glpi_suppliers", '', $entity_restrict, true);

      $query = "SELECT `glpi_suppliers`.*
                FROM `glpi_suppliers`
                LEFT JOIN `glpi_contacts_suppliers`
                   ON (`glpi_contacts_suppliers`.`suppliers_id` = `glpi_suppliers`.`id`)
                WHERE `glpi_suppliers`.`is_deleted` = '0'
                $entities
                GROUP BY `glpi_suppliers`.`id`
                ORDER BY `entities_id`, `name`";
      $result = $DB->query($query);

      echo "<select name='suppliers_id' id='suppliers_id'>\n";
      echo "<option value='0'>".Dropdown::EMPTY_VALUE."</option>\n";

      $prev = -1;
      while ($data = $DB->fetchArray($result)) {
         if ($data["entities_id"] != $prev) {
            if ($prev >= 0) {
               echo "</optgroup>";
            }
            $prev = $data["entities_id"];
            echo "<optgroup label=\"".Dropdown::getDropdownName("glpi_entities", $prev)."\">";
         }
         $output = $data["name"];
         if ($_SESSION["glpiis_ids_visible"] || empty($output)) {
            $output .= " (".$data["id"].")";
         }
         echo "<option value='".$data["id"]."' ".($value == $data["id"] ? " selected " : "").
               " title=\"".Html::cleanInputText($output)."\">".
               substr($output, 0, $CFG_GLPI["dropdown_chars_limit"])."</option>";
      }
      if ($prev >= 0) {
         echo "</optgroup>";
      }
      echo "</select>";
      Ajax::updateItemOnSelectEvent("suppliers_id", "show_contacts_id",
                                    Plugin::getWebDir('order')."/ajax/dropdownSupplier.php",
                                    [
                                       'suppliers_id'    => '__VALUE__',
                                       'entity_restrict' => $entity_restrict,
                                       'rand'            => $rand,
                                       'myname'          => $myname,
                                    ]);

      return $rand;
   }


   public function dropdownContacts($suppliers_id, $value = 0, $entity_restrict = '') {
      global $DB, $CFG_GLPI;

      $rand     = mt_rand();
      $entities = getEntitiesRestrictRequest("AND", "glpi_contacts", '', $entity_restrict, true);

      $query = "SELECT `glpi_contacts`.*
                FROM `glpi_contacts`,`glpi_contacts_suppliers`
                WHERE `glpi_contacts_suppliers`.`contacts_id` = `glpi_contacts`.`id`
                AND `glpi_contacts_suppliers`.`suppliers_id` = '$suppliers_id'
                AND `glpi_contacts`.`is_deleted` = '0'
                $entities
                ORDER BY `entities_id`, `name`";
      $result = $DB->query($query);

      echo "<select name='contacts_id'>";
      echo "<option value='0'>".Dropdown::EMPTY_VALUE."</option>";

      if ($DB->numrows($result)) {
         $prev = -1;
         while ($data = $DB->fetchArray($result)) {
            if ($data["entities_id"] != $prev) {
               if ($prev >= 0) {
                  echo "</optgroup>";
               }
               $prev = $data["entities_id"];
               echo "<optgroup label=\"".Dropdown::getDropdownName("glpi_entities", $prev)."\">";
            }
            $output = formatUserName($data["id"], "", $data["name"], $data["firstname"]);
            if ($_SESSION["glpiis_ids_visible"] || empty($output)) {
               $output .= " (".$data["id"].")";
            }
            echo "<option value='".$data["id"]."' ".($value == $data["id"] ? " selected " : "")
              ." title=\"".Html::cleanInputText($output)."\">"
              .substr($output, 0, $CFG_GLPI["dropdown_chars_limit"])."</option>";
         }
         if ($prev >= 0) {
            echo "</optgroup>";
         }
      }
      echo "</select>";
   }


   public function needValidation($ID) {
      if ($ID > 0 && $this->getFromDB($ID)) {
         return $this->isDraft() || $this->isWaitingForApproval();
      } else {
         return false;
      }
   }


         $detail = new PluginOrderOrder_Item();
            $num    = $DB->numrows($result);
            $num    = $DB->numrows($result);
            $ref = $reference->transfer($detail["plugin_order_references_id"], $entity);
      $cron_status = 1;
   /**
    * Get the standard massive actions which are forbidden
    *
    * @since version 0.84
    *
    * @return an array of massive actions
    **/
      global $UNINSTALL_TYPES;

      global $CFG_GLPI;

               $id     = false;
                  $id = $tmp['id'];
                  $id = $budget->add($tmp);
   public function checkIFReferenceExistsInOrder($orders_id, $ref_id) {
      return (countElementsInTable(
         $this->getTable(),
         [
            'plugin_order_orders_id' => $orders_id,
            'plugin_order_references_id' => $ref_id,
         ]
      ));
   }


         $num    = $DB->numrows($result);
   public function getTotalQuantityByRef($orders_id, $references_id) {
      global $DB;

      $query = "SELECT COUNT(*) AS quantity
                FROM `".self::getTable()."`
                WHERE `plugin_order_orders_id` = '$orders_id'
                   AND `plugin_order_references_id` = '$references_id' ";
      $result = $DB->query($query);
      return ($DB->result($result, 0, 'quantity'));
   }


      global $DB;

      global $DB;

            $result = $DB->query($query) or die($DB->error());
   public function checkIfSupplierInfosExists($plugin_order_orders_id) {

      if ($plugin_order_orders_id) {
         $devices = getAllDataFromTable(self::getTable(),
                                         ['plugin_order_orders_id' => $plugin_order_orders_id]);
         if (!empty($devices)) {
            return true;
         } else {
            return false;
         }
      }
   }



   /**
    * Standard method to add an object into glpi
    *
    * @param values fields to add into glpi
    * @param options options used during creation
    * @return an array of IDs of newly created objects : for example array(Computer=>1, Networkport=>10)
    *
   **/
    * @param $value default value
    * @param $value default value
    * @param $extension list files of this extension only
    * @param $value default value
      $array_dir  = [];

                  } else if ($filetype == "dir") {
                     $array_dir[] = $filename;
         $result = $PluginOrderOrder_Item->queryRef($_POST["plugin_order_orders_id"],
      $isadmin = static::canUpdate();

   public function dropdownReceptionActions($itemtype, $plugin_order_references_id, $plugin_order_orders_id) {
      global $CFG_GLPI;

      $rand = mt_rand();

      echo "<select name='receptionActions$rand' id='receptionActions$rand'>";
      echo "<option value='0' selected>".Dropdown::EMPTY_VALUE."</option>";
      echo "<option value='reception'>".__("Take item delivery", "order")."</option>";
      echo "</select>";
      $params = [
         'action'                     => '__VALUE__',
         'itemtype'                   => $itemtype,
         'plugin_order_references_id' => $plugin_order_references_id,
         'plugin_order_orders_id'     => $plugin_order_orders_id,
      ];
      Ajax::updateItemOnSelectEvent("receptionActions$rand", "show_receptionActions$rand",
                                    Plugin::getWebDir('order')."/ajax/receptionactions.php",
                                    $params);
      echo "<span id='show_receptionActions$rand'>&nbsp;</span>";
   }


   * return nothing
            foreach ($types as $key => $type) {

   /**
    * Display entities of the loaded profile
    *
   * @param $myname select name
    * @param $target target for entity change action
    */
   public static function showSelector($target) {
      $rand = mt_rand();
      Plugin::loadLang('order');
      echo "<div class='center' ><span class='b'>".__("Select the wanted item type", "order")
        ."</span><br>";
      echo "<a style='font-size:14px;' href='".$target."?reset=reset' title=\""
        .__("Show all")."\">".str_replace(" ", "&nbsp;", __("Show all"))."</a></div>";

      echo "<div class='left' style='width:100%'>";

      echo "<script type='javascript'>";
      echo "var Tree_Category_Loader$rand = new Ext.tree.TreeLoader({
         dataUrl:'".Plugin::getWebDir('order')."/ajax/referencetreetypes.php'
      });";

      echo "var Tree_Category$rand = new Ext.tree.TreePanel({
         collapsible      : false,
         animCollapse     : false,
         border           : false,
         id               : 'tree_projectcategory$rand',
         el               : 'tree_projectcategory$rand',
         autoScroll       : true,
         animate          : false,
         enableDD         : true,
         containerScroll  : true,
         height           : 320,
         width            : 770,
         loader           : Tree_Category_Loader$rand,
         rootVisible     : false
      });";

      // SET the root node.
      echo "var Tree_Category_Root$rand = new Ext.tree.AsyncTreeNode({
         text     : '',
         draggable   : false,
         id    : '-1'                  // this IS the id of the startnode
      });
      Tree_Category$rand.setRootNode(Tree_Category_Root$rand);";

      // Render the tree.
      echo "Tree_Category$rand.render();
            Tree_Category_Root$rand.expand();";

      echo "</script>";

      echo "<div id='tree_projectcategory$rand' ></div>";
      echo "</div>";
   }


   public function title() {
      echo "<div align='center'>";
      echo self::getPerTypeJavascriptCode();
      echo "<a onclick='order_window.show();' href='#modal_reference_content' title='"
           .__("View by item type", "order")."'>"
           .__("View by item type", "order")."</a>";
      echo "</div>";

   }


   public static function getPerTypeJavascriptCode() {
      global $CFG_GLPI;

      $out  = "<script type='text/javascript'>";
      $out .= "cleanhide('modal_reference_content');";
      $out .= "var order_window=new Ext.Window({
         layout:'fit',
         width:800,
         height:400,
         closeAction:'hide',
         modal: true,
         autoScroll: true,
         title: \"".__("View by item type", "order")."\",
         autoLoad: '".Plugin::getWebDir('order')."/ajax/referencetree.php'
      });";
      $out .= "</script>";
      return $out;
   }


   /**
    * Get the standard massive actions which are forbidden
    *
    * @since version 0.84
    *
    * @return an array of massive actions
    **/

   /*   function getValueToSelect($field_id_or_search_options, $name = '', $values = '', $options = []) {
      if (isset($field_id_or_search_options['displaytype'])
         && $field_id_or_search_options['displaytype'] == 'reference_type') {
            Toolbox::logDebug($field_id_or_search_options['displaytype'],
                              $field_id_or_search_options, $name, $values, $options);

      }
      return false;
   }*/

      global $DB, $CFG_GLPI;
   public function getPriceByReferenceAndSupplier($plugin_order_references_id, $suppliers_id) {
      global $DB;

      $table = self::getTable();
      $query = "SELECT `price_taxfree`
                FROM `$table`
                WHERE `plugin_order_references_id` = '$plugin_order_references_id'
                AND `suppliers_id` = '$suppliers_id' ";
      $result = $DB->query($query);

      if ($DB->numrows($result) > 0) {
         return $DB->result($result, 0, "price_taxfree");
      } else {
         return 0;
      }
   }


   public function addDetails($ref_id, $itemtype, $orders_id, $quantity, $price, $discounted_price, $taxes_id) {
      $order = new PluginOrderOrder();
      if ($quantity > 0 && $order->getFromDB($orders_id)) {
         for ($i = 0; $i < $quantity; $i++) {
            $input["plugin_order_orders_id"]     = $orders_id;
            $input["plugin_order_ordertaxes_id"] = $taxes_id;
            $input["itemtype"]                   = $itemtype;
            $input["entities_id"]                = $order->getEntityID();
            $input["is_recursive"]               = $order->isRecursive();
            $input["price_taxfree"]              = $price;
            $input["price_discounted"]           = $price - ($price * ($discounted_price / 100));
            $input["states_id"]                  = PluginOrderOrder::ORDER_DEVICE_NOT_DELIVRED;

            $input["price_ati"] = $this->getPricesATI($input["price_discounted"], Dropdown::getDropdownName("glpi_plugin_order_ordertaxes", $taxes_id));
            $input["discount"]  = $discounted_price;

            $this->add($input);
         }
      }
   }

   /**
    * Standard method to add an object into glpi
    *
    * @param values fields to add into glpi
    * @param options options used during creation
    * @return an array of IDs of newly created objects : for example [Computer => 1, Networkport => 10]
    *
   **/
            'dev' => true, //Required to allow 9.2-dev
Fixed code:          $PluginOrderReference_Supplier->add($_POST);
         $PluginOrderSurveySupplier->add($_POST);
            if ($data['itemtype']::canView() && $item->getFromDB($data["id"])) {


         $result = $detail->queryRef($detail->fields["plugin_order_orders_id"],


               $ticket->add($input);
         $this->createLinkWithItem($values["id"], $newID, $add_item["itemtype"],
    * @param $itemtype
    * @param $items_id
    * @param $orders_id
    * @param $entity
            $reference->transfer($detail["plugin_order_references_id"], $entity);
                  $budget->add($tmp);
            $DB->query($query) or die($DB->error());
    * @param $value
    * @param $value
    * @param array $extension list files of this extension only
    * @param $value
         $result = $detail->queryRef($_POST["plugin_order_orders_id"],
   * @return void
            foreach ($types as $type) {
      global $DB;