CVE-2017-17898: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2017-12-27T17:08Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/accountancy/tpl/export_journal.tpl.php, htdocs/adherents/canvas/default/tpl/adherentcard_create.tpl.php, htdocs/adherents/canvas/default/tpl/adherentcard_edit.tpl.php, htdocs/adherents/canvas/default/tpl/adherentcard_view.tpl.php, htdocs/adherents/tpl/linkedobjectblock.tpl.php, htdocs/comm/propal/tpl/linkedobjectblock.tpl.php, htdocs/commande/tpl/linkedobjectblock.tpl.php, htdocs/compta/facture/card.php, htdocs/compta/facture/tpl/linkedobjectblock.tpl.php, htdocs/compta/facture/tpl/linkedobjectblockForRec.tpl.php, htdocs/contact/canvas/default/tpl/contactcard_create.tpl.php, htdocs/contact/canvas/default/tpl/contactcard_edit.tpl.php, htdocs/contact/canvas/default/tpl/contactcard_view.tpl.php, htdocs/contrat/tpl/linkedobjectblock.tpl.php, htdocs/core/tpl/admin_extrafields_add.tpl.php, htdocs/core/tpl/admin_extrafields_edit.tpl.php, htdocs/core/tpl/admin_extrafields_view.tpl.php, htdocs/core/tpl/ajax/fileupload_main.tpl.php, htdocs/core/tpl/ajax/fileupload_view.tpl.php, htdocs/core/tpl/ajaxrow.tpl.php, htdocs/core/tpl/bloc_showhide.tpl.php, htdocs/core/tpl/contacts.tpl.php, htdocs/core/tpl/document_actions_post_headers.tpl.php, htdocs/core/tpl/extrafields_view.tpl.php, htdocs/core/tpl/login.tpl.php, htdocs/core/tpl/notes.tpl.php, htdocs/core/tpl/objectline_create.tpl.php, htdocs/core/tpl/objectline_edit.tpl.php, htdocs/core/tpl/objectline_view.tpl.php, htdocs/core/tpl/originproductline.tpl.php, htdocs/core/tpl/passwordforgotten.tpl.php, htdocs/core/tpl/resource_add.tpl.php, htdocs/core/tpl/resource_view.tpl.php, htdocs/ecm/tpl/enablefiletreeajax.tpl.php, htdocs/expedition/tpl/linkedobjectblock.tpl.php, htdocs/expensereport/tpl/linkedobjectblock.tpl.php, htdocs/fichinter/tpl/linkedobjectblock.tpl.php, htdocs/fourn/commande/tpl/linkedobjectblock.tpl.php, htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php, htdocs/main.inc.php, htdocs/modulebuilder/template/core/tpl/mytemplate.tpl.php, htdocs/product/canvas/product/tpl/card_create.tpl.php, htdocs/product/canvas/product/tpl/card_edit.tpl.php, htdocs/product/canvas/product/tpl/card_view.tpl.php, htdocs/product/canvas/product/tpl/list.tpl.php, htdocs/product/canvas/service/tpl/card_create.tpl.php, htdocs/product/canvas/service/tpl/card_edit.tpl.php, htdocs/product/canvas/service/tpl/card_view.tpl.php, htdocs/product/canvas/service/tpl/list.tpl.php, htdocs/product/inventory/tpl/inventory.tpl.php, htdocs/product/stock/tpl/stockcorrection.tpl.php, htdocs/product/stock/tpl/stocktransfer.tpl.php, htdocs/societe/canvas/company/tpl/card_create.tpl.php, htdocs/societe/canvas/company/tpl/card_edit.tpl.php, htdocs/societe/canvas/company/tpl/card_view.tpl.php, htdocs/societe/canvas/individual/tpl/card_create.tpl.php, htdocs/societe/canvas/individual/tpl/card_edit.tpl.php, htdocs/societe/canvas/individual/tpl/card_view.tpl.php, htdocs/societe/tpl/linesalesrepresentative.tpl.php, htdocs/supplier_proposal/tpl/linkedobjectblock.tpl.php
Commit date: 2017-12-21 13:32:16 +0100
Commit message: FIX security vulnerability reported by ADLab of Venustech
Diff: diff --git a/htdocs/accountancy/tpl/export_journal.tpl.php b/htdocs/accountancy/tpl/export_journal.tpl.php
index b5b6920e853..d9d158607b6 100644
--- a/htdocs/accountancy/tpl/export_journal.tpl.php
+++ b/htdocs/accountancy/tpl/export_journal.tpl.php
@@ -13,10 +13,19 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $prefix = $conf->global->ACCOUNTING_EXPORT_PREFIX_SPEC;
 $format = $conf->global->ACCOUNTING_EXPORT_FORMAT;
 $nodateexport = $conf->global->ACCOUNTING_EXPORT_NO_DATE_IN_FILENAME;
 
 $date_export = dol_print_date($now, '%Y%m%d%H%M%S');
diff --git a/htdocs/adherents/canvas/default/tpl/adherentcard_create.tpl.php b/htdocs/adherents/canvas/default/tpl/adherentcard_create.tpl.php
index f0a50e2e9ba..81f34706966 100644
--- a/htdocs/adherents/canvas/default/tpl/adherentcard_create.tpl.php
+++ b/htdocs/adherents/canvas/default/tpl/adherentcard_create.tpl.php
@@ -12,12 +12,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE ADHERENTCARD_CREATE.TPL.PHP DEFAULT -->
 
 <?php
diff --git a/htdocs/adherents/canvas/default/tpl/adherentcard_edit.tpl.php b/htdocs/adherents/canvas/default/tpl/adherentcard_edit.tpl.php
index 8f3af3fe8df..4a699b75a22 100644
--- a/htdocs/adherents/canvas/default/tpl/adherentcard_edit.tpl.php
+++ b/htdocs/adherents/canvas/default/tpl/adherentcard_edit.tpl.php
@@ -12,13 +12,20 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $contact = $GLOBALS['objcanvas']->control->object;
 
 ?>
 
 <!-- BEGIN PHP TEMPLATE ADHERENTCARD_EDIT.TPL.PHP DEFAULT -->
diff --git a/htdocs/adherents/canvas/default/tpl/adherentcard_view.tpl.php b/htdocs/adherents/canvas/default/tpl/adherentcard_view.tpl.php
index e426429ae05..f19ba96c167 100644
--- a/htdocs/adherents/canvas/default/tpl/adherentcard_view.tpl.php
+++ b/htdocs/adherents/canvas/default/tpl/adherentcard_view.tpl.php
@@ -12,14 +12,22 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $contact = $GLOBALS['objcanvas']->control->object;
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE ADHERENTCARD_VIEW.TPL.PHP DEFAULT -->
 <?php echo $this->control->tpl['showhead']; ?>
 
diff --git a/htdocs/adherents/tpl/linkedobjectblock.tpl.php b/htdocs/adherents/tpl/linkedobjectblock.tpl.php
index 19324812beb..118f51a1a89 100644
--- a/htdocs/adherents/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/adherents/tpl/linkedobjectblock.tpl.php
@@ -13,12 +13,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <?php
@@ -31,11 +38,11 @@ $langs->load("members");
 
 $var=true;
 $total=0;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
-	
+
 ?>
 <tr <?php echo $GLOBALS['bc'][$var]; ?> >
     <td><?php echo $langs->trans("Subscription"); ?></td>
     <td><?php echo $objectlink->getNomUrl(1); ?></td>
 	<td align="center"></td>
diff --git a/htdocs/comm/propal/tpl/linkedobjectblock.tpl.php b/htdocs/comm/propal/tpl/linkedobjectblock.tpl.php
index f797025a5de..cc8c6fe0547 100644
--- a/htdocs/comm/propal/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/comm/propal/tpl/linkedobjectblock.tpl.php
@@ -20,10 +20,18 @@
 /**
  *  \file		htdocs/comm/propal/tpl/linkedobjectblock.tpl.php
  *  \ingroup	propal
  *  \brief		Template to show objects linked to proposals
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <?php
@@ -38,11 +46,11 @@ $langs->load("propal");
 $total=0; $ilink=0;
 $var=true;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
     $ilink++;
-    
+
     $trclass=($var?'pair':'impair');
     if ($ilink == count($linkedObjectBlock) && empty($noMoreLinkedObjectBlockAfter) && count($linkedObjectBlock) <= 1) $trclass.=' liste_sub_total';
 ?>
     <tr class="<?php echo $trclass; ?>">
         <td><?php echo $langs->trans("Proposal"); ?></td>
@@ -69,10 +77,10 @@ if (count($linkedObjectBlock) > 1)
     	<td align="center"></td>
     	<td align="right"><?php echo price($total); ?></td>
     	<td align="right"></td>
     	<td align="right"></td>
     </tr>
-    <?php  
+    <?php
 }
 ?>
 
 <!-- END PHP TEMPLATE -->
diff --git a/htdocs/commande/tpl/linkedobjectblock.tpl.php b/htdocs/commande/tpl/linkedobjectblock.tpl.php
index 629cd3c0fb0..39479ba220b 100644
--- a/htdocs/commande/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/commande/tpl/linkedobjectblock.tpl.php
@@ -13,12 +13,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <?php
@@ -34,11 +41,11 @@ $langs->load("orders");
 $total=0; $ilink=0;
 $var=true;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
     $ilink++;
-    
+
     $trclass=($var?'pair':'impair');
     if ($ilink == count($linkedObjectBlock) && empty($noMoreLinkedObjectBlockAfter) && count($linkedObjectBlock) <= 1) $trclass.=' liste_sub_total';
 ?>
     <tr class="<?php echo $trclass; ?>">
         <td><?php echo $langs->trans("CustomerOrder"); ?></td>
@@ -74,10 +81,10 @@ if (count($linkedObjectBlock) > 1)
     	<td align="center"></td>
     	<td align="right"><?php echo price($total); ?></td>
     	<td align="right"></td>
     	<td align="right"></td>
     </tr>
-    <?php  
+    <?php
 }
 ?>
 
 <!-- END PHP TEMPLATE -->
\ No newline at end of file
diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php
index fd9386672e2..e6c30abda2d 100644
--- a/htdocs/compta/facture/card.php
+++ b/htdocs/compta/facture/card.php
@@ -2536,11 +2536,11 @@ if ($action == 'create')
 
 				print '<div id="credit_note_options" class="clearboth">';
 				print '&nbsp;&nbsp;&nbsp; <input data-role="none" type="checkbox" name="invoiceAvoirWithLines" id="invoiceAvoirWithLines" value="1" onclick="$(\'#credit_note_options input[type=checkbox]\').not(this).prop(\'checked\', false);" '.(GETPOST('invoiceAvoirWithLines','int')>0 ? 'checked':'').' /> <label for="invoiceAvoirWithLines">'.$langs->trans('invoiceAvoirWithLines')."</label>";
 				print '<br>&nbsp;&nbsp;&nbsp; <input data-role="none" type="checkbox" name="invoiceAvoirWithPaymentRestAmount" id="invoiceAvoirWithPaymentRestAmount" value="1" onclick="$(\'#credit_note_options input[type=checkbox]\').not(this).prop(\'checked\', false);" '.(GETPOST('invoiceAvoirWithPaymentRestAmount','int')>0 ? 'checked':'').' /> <label for="invoiceAvoirWithPaymentRestAmount">'.$langs->trans('invoiceAvoirWithPaymentRestAmount')."</label>";
 				print '</div>';
-				
+
     			print '</div></div>';
     		}
 		}
 		else
 		{
diff --git a/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php b/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php
index 63c16afae15..ca3ec7c89c0 100644
--- a/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/compta/facture/tpl/linkedobjectblock.tpl.php
@@ -13,12 +13,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <?php
@@ -34,11 +41,11 @@ $langs->load("bills");
 $total=0; $ilink=0;
 $var=true;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
     $ilink++;
-    
+
     $trclass=($var?'pair':'impair');
     if ($ilink == count($linkedObjectBlock) && empty($noMoreLinkedObjectBlockAfter) && count($linkedObjectBlock) <= 1) $trclass.=' liste_sub_total';
 ?>
 	<tr class="<?php echo $trclass; ?>">
         <td><?php echo $langs->trans("CustomerInvoice"); ?></td>
@@ -52,11 +59,11 @@ foreach($linkedObjectBlock as $key => $objectlink)
     			if ($objectlink->statut != 3)		// If not abandonned
     			{
     				$total = $total + $sign * $objectlink->total_ht;
     				echo price($objectlink->total_ht);
     			}
-    			else 
+    			else
     			{
     				echo '<strike>'.price($objectlink->total_ht).'</strike>';
     			}
     		} ?></td>
     	<td align="right"><?php echo $objectlink->getLibStatut(3); ?></td>
@@ -74,10 +81,10 @@ if (count($linkedObjectBlock) > 1)
     	<td align="center"></td>
     	<td align="right"><?php echo price($total); ?></td>
     	<td align="right"></td>
     	<td align="right"></td>
     </tr>
-    <?php  
+    <?php
 }
 ?>
 
 <!-- END PHP TEMPLATE -->
\ No newline at end of file
diff --git a/htdocs/compta/facture/tpl/linkedobjectblockForRec.tpl.php b/htdocs/compta/facture/tpl/linkedobjectblockForRec.tpl.php
index 2e7858fdb08..288e852de71 100644
--- a/htdocs/compta/facture/tpl/linkedobjectblockForRec.tpl.php
+++ b/htdocs/compta/facture/tpl/linkedobjectblockForRec.tpl.php
@@ -13,12 +13,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <?php
@@ -34,11 +41,11 @@ $langs->load("bills");
 $total=0; $ilink=0;
 $var=true;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
     $ilink++;
-    
+
     $trclass=($var?'pair':'impair');
     if ($ilink == count($linkedObjectBlock) && empty($noMoreLinkedObjectBlockAfter) && count($linkedObjectBlock) <= 1) $trclass.=' liste_sub_total';
 ?>
 <tr <?php echo $GLOBALS['bc'][$var]; ?> >
     <td><?php echo $langs->trans("RepeatableInvoice"); ?></td>
diff --git a/htdocs/contact/canvas/default/tpl/contactcard_create.tpl.php b/htdocs/contact/canvas/default/tpl/contactcard_create.tpl.php
index fbd1d1909a8..1561f046845 100644
--- a/htdocs/contact/canvas/default/tpl/contactcard_create.tpl.php
+++ b/htdocs/contact/canvas/default/tpl/contactcard_create.tpl.php
@@ -11,12 +11,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE CONTACTCARD_CREATE.TPL.PHP DEFAULT -->
 
 <?php
diff --git a/htdocs/contact/canvas/default/tpl/contactcard_edit.tpl.php b/htdocs/contact/canvas/default/tpl/contactcard_edit.tpl.php
index 56e91894cdd..1eaccff5a1f 100644
--- a/htdocs/contact/canvas/default/tpl/contactcard_edit.tpl.php
+++ b/htdocs/contact/canvas/default/tpl/contactcard_edit.tpl.php
@@ -11,13 +11,20 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $contact = $GLOBALS['objcanvas']->control->object;
 
 ?>
 
 <!-- BEGIN PHP TEMPLATE CONTACTCARD_EDIT.TPL.PHP DEFAULT -->
diff --git a/htdocs/contact/canvas/default/tpl/contactcard_view.tpl.php b/htdocs/contact/canvas/default/tpl/contactcard_view.tpl.php
index 5dc1c12808f..6041e7c3e2c 100644
--- a/htdocs/contact/canvas/default/tpl/contactcard_view.tpl.php
+++ b/htdocs/contact/canvas/default/tpl/contactcard_view.tpl.php
@@ -11,13 +11,20 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $contact = $GLOBALS['objcanvas']->control->object;
 ?>
 
 <!-- BEGIN PHP TEMPLATE CONTACTCARD_VIEW.TPL.PHP DEFAULT -->
 <?php echo $this->control->tpl['showhead']; ?>
diff --git a/htdocs/contrat/tpl/linkedobjectblock.tpl.php b/htdocs/contrat/tpl/linkedobjectblock.tpl.php
index a2da6cef24e..eae46dad772 100644
--- a/htdocs/contrat/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/contrat/tpl/linkedobjectblock.tpl.php
@@ -12,10 +12,18 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <?php
@@ -31,11 +39,11 @@ $langs->load("contracts");
 $total=0; $ilink=0;
 $var=true;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
     $ilink++;
-    
+
     $trclass=($var?'pair':'impair');
     if ($ilink == count($linkedObjectBlock) && empty($noMoreLinkedObjectBlockAfter) && count($linkedObjectBlock) <= 1) $trclass.=' liste_sub_total';
 ?>
 <tr class="<?php echo $trclass; ?>">
     <td><?php echo $langs->trans("Contract"); ?></td>
diff --git a/htdocs/core/tpl/admin_extrafields_add.tpl.php b/htdocs/core/tpl/admin_extrafields_add.tpl.php
index 62821372e56..d9ba847925d 100644
--- a/htdocs/core/tpl/admin_extrafields_add.tpl.php
+++ b/htdocs/core/tpl/admin_extrafields_add.tpl.php
@@ -24,10 +24,17 @@
  * $conf, $lang,
  * The following vars may also be defined:
  * $elementtype
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE admin_extrafields_add.tpl.php -->
 <script type="text/javascript">
     jQuery(document).ready(function() {
@@ -54,15 +61,15 @@
     		}
     		?>
 
     		// Case of computed field
     		console.log(type);
-    		if (type == '' || type == 'varchar' || type == 'int' || type == 'double' || type == 'price') { 
-    			jQuery("tr.extra_computed_value").show(); 
+    		if (type == '' || type == 'varchar' || type == 'int' || type == 'double' || type == 'price') {
+    			jQuery("tr.extra_computed_value").show();
     		} else {
     			computed_value.val(''); jQuery("tr.extra_computed_value").hide();
-    		} 
+    		}
     		if (computed_value.val())
     		{
         		console.log("We enter a computed formula");
         		jQuery("#default_value").val('');
         		/* jQuery("#unique, #required, #alwayseditable, #ishidden, #list").removeAttr('checked'); */
@@ -73,11 +80,11 @@
     		{
         		console.log("No computed formula");
         		jQuery("#default_value, #unique, #required, #alwayseditable, #ishidden, #list").attr('disabled', false);
         		jQuery("tr.extra_default_value, tr.extra_unique, tr.extra_required, tr.extra_alwayseditable, tr.extra_ishidden, tr.extra_list").show();
     		}
-    		
+
 			if (type == 'date')          { size.val('').prop('disabled', true); unique.removeAttr('disabled'); jQuery("#value_choice").hide();jQuery("#helpchkbxlst").hide(); }
 			else if (type == 'datetime') { size.val('').prop('disabled', true); unique.removeAttr('disabled'); jQuery("#value_choice").hide(); jQuery("#helpchkbxlst").hide();}
     		else if (type == 'double')   { size.val('24,8').removeAttr('disabled'); unique.removeAttr('disabled'); jQuery("#value_choice").hide(); jQuery("#helpchkbxlst").hide();}
 			else if (type == 'int')      { size.val('10').removeAttr('disabled'); unique.removeAttr('disabled'); jQuery("#value_choice").hide(); jQuery("#helpchkbxlst").hide();}
 			else if (type == 'text')     { size.val('2000').removeAttr('disabled'); unique.prop('disabled', true).removeAttr('checked'); jQuery("#value_choice").hide();jQuery("#helpchkbxlst").hide(); }
@@ -88,28 +95,28 @@
 			else if (type == 'sellist')  { size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); jQuery("#value_choice").show();jQuery("#helpselect").hide();jQuery("#helpsellist").show();jQuery("#helpchkbxlst").hide();jQuery("#helplink").hide();}
 			else if (type == 'radio')    { size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); jQuery("#value_choice").show();jQuery("#helpselect").show();jQuery("#helpsellist").hide();jQuery("#helpchkbxlst").hide();jQuery("#helplink").hide();}
 			else if (type == 'checkbox') { size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); jQuery("#value_choice").show();jQuery("#helpselect").show();jQuery("#helpsellist").hide();jQuery("#helpchkbxlst").hide();jQuery("#helplink").hide();}
 			else if (type == 'chkbxlst') { size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); jQuery("#value_choice").show();jQuery("#helpselect").hide();jQuery("#helpsellist").hide();jQuery("#helpchkbxlst").show();jQuery("#helplink").hide();}
 			else if (type == 'link')     { size.val('').prop('disabled', true); unique.removeAttr('disabled'); jQuery("#value_choice").show();jQuery("#helpselect").hide();jQuery("#helpsellist").hide();jQuery("#helpchkbxlst").hide();jQuery("#helplink").show();}
-			else if (type == 'separate') { 
-				size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); required.val('').prop('disabled', true); 
+			else if (type == 'separate') {
+				size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); required.val('').prop('disabled', true);
 				jQuery("#value_choice").hide();jQuery("#helpselect").hide();jQuery("#helpsellist").hide();jQuery("#helpchkbxlst").hide();jQuery("#helplink").hide();
 			}
 			else {	// type = string
 				size.val('').prop('disabled', true);
 				unique.removeAttr('disabled');
 			}
 
 			if (type == 'separate')
 			{
 				required.removeAttr('checked').prop('disabled', true); alwayseditable.removeAttr('checked').prop('disabled', true); list.val('').prop('disabled', true);
-				jQuery('#size, #default_value').val('').prop('disabled', true); 
+				jQuery('#size, #default_value').val('').prop('disabled', true);
 			}
 			else
 			{
 				default_value.removeAttr('disabled');
-				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled'); 
+				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled');
 			}
     	}
     	init_typeoffields('<?php echo GETPOST('type'); ?>');
     	jQuery("#type").change(function() {
     		init_typeoffields($(this).val());
diff --git a/htdocs/core/tpl/admin_extrafields_edit.tpl.php b/htdocs/core/tpl/admin_extrafields_edit.tpl.php
index 6f049c506a3..b8d3cba1d59 100644
--- a/htdocs/core/tpl/admin_extrafields_edit.tpl.php
+++ b/htdocs/core/tpl/admin_extrafields_edit.tpl.php
@@ -23,10 +23,17 @@
  * $conf, $lang,
  * The following vars may also be defined:
  * $elementtype
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE admin_extrafields_edit.tpl.php -->
 <script type="text/javascript">
     jQuery(document).ready(function() {
@@ -52,15 +59,15 @@
     			print 'jQuery("#value_choice").hide();';
     		}
     		?>
 
     		// Case of computed field
-    		if (type == 'varchar' || type == 'int' || type == 'double' || type == 'price') { 
-    			jQuery("tr.extra_computed_value").show(); 
+    		if (type == 'varchar' || type == 'int' || type == 'double' || type == 'price') {
+    			jQuery("tr.extra_computed_value").show();
     		} else {
     			computed_value.val(''); jQuery("tr.extra_computed_value").hide();
-    		} 
+    		}
     		if (computed_value.val())
     		{
         		console.log("We enter a computed formula");
         		jQuery("#default_value").val('');
         		/* jQuery("#unique, #required, #alwayseditable, #ishidden, #list").removeAttr('checked'); */
@@ -71,11 +78,11 @@
     		{
         		console.log("No computed formula");
         		jQuery("#default_value, #unique, #required, #alwayseditable, #ishidden, #list").attr('disabled', false);
         		jQuery("tr.extra_default_value, tr.extra_unique, tr.extra_required, tr.extra_alwayseditable, tr.extra_ishidden, tr.extra_list").show();
     		}
-    		
+
 			if (type == 'date') { size.val('').prop('disabled', true); unique.removeAttr('disabled'); jQuery("#value_choice").hide();jQuery("#helpchkbxlst").hide(); }
 			else if (type == 'datetime') { size.val('').prop('disabled', true); unique.removeAttr('disabled'); jQuery("#value_choice").hide(); jQuery("#helpchkbxlst").hide();}
     		else if (type == 'double')   { size.removeAttr('disabled'); unique.removeAttr('disabled'); jQuery("#value_choice").hide(); jQuery("#helpchkbxlst").hide();}
 			else if (type == 'int')      { size.removeAttr('disabled'); unique.removeAttr('disabled'); jQuery("#value_choice").hide(); jQuery("#helpchkbxlst").hide();}
 			else if (type == 'text')     { size.removeAttr('disabled'); unique.prop('disabled', true).removeAttr('checked'); jQuery("#value_choice").hide();jQuery("#helpchkbxlst").hide(); }
@@ -89,33 +96,33 @@
 			else if (type == 'chkbxlst') { size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); jQuery("#value_choice").show();jQuery("#helpselect").hide();jQuery("#helpsellist").hide();jQuery("#helpchkbxlst").show();jQuery("#helplink").hide();}
 			else if (type == 'link')     { size.val('').prop('disabled', true); unique.removeAttr('disabled'); jQuery("#value_choice").show();jQuery("#helpselect").hide();jQuery("#helpsellist").hide();jQuery("#helpchkbxlst").hide();jQuery("#helplink").show();}
 			else if (type == 'separate') { size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); required.val('').prop('disabled', true); default_value.val('').prop('disabled', true); jQuery("#value_choice").hide();jQuery("#helpselect").hide();jQuery("#helpsellist").hide();jQuery("#helpchkbxlst").hide();jQuery("#helplink").hide();}
 			else {	// type = string
 				size.val('').prop('disabled', true);
-				unique.removeAttr('disabled');		
+				unique.removeAttr('disabled');
 			}
 
 			if (type == 'separate')
 			{
-				required.removeAttr('checked').prop('disabled', true); alwayseditable.removeAttr('checked').prop('disabled', true); list.val('').prop('disabled', true); 
-				jQuery('#size, #default_value').val('').prop('disabled', true); 
+				required.removeAttr('checked').prop('disabled', true); alwayseditable.removeAttr('checked').prop('disabled', true); list.val('').prop('disabled', true);
+				jQuery('#size, #default_value').val('').prop('disabled', true);
 			}
 			else
 			{
 				default_value.removeAttr('disabled');
-				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled'); 
-			}			
+				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled');
+			}
     	}
     	init_typeoffields(jQuery("#type").val());
     	jQuery("#type").change(function() {
     		init_typeoffields($(this).val());
     	});
 
     	// If we enter a formula, we disable other fields
     	jQuery("#computed_value").keyup(function() {
     		init_typeoffields(jQuery('#type').val());
-    	});    	
+    	});
     });
 </script>
 
 
 <form action="<?php echo $_SERVER["PHP_SELF"]; ?>?attrname=<?php echo $attrname; ?>" method="post">
diff --git a/htdocs/core/tpl/admin_extrafields_view.tpl.php b/htdocs/core/tpl/admin_extrafields_view.tpl.php
index a6d7e735735..6d3bb43f3b2 100644
--- a/htdocs/core/tpl/admin_extrafields_view.tpl.php
+++ b/htdocs/core/tpl/admin_extrafields_view.tpl.php
@@ -20,10 +20,18 @@
  * $textobject
  * $langs
  * $extrafield
  * $elementtype
  */
+
+// Protection to avoid direct call of template
+if (empty($langs) || ! is_object($langs))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE admin_extrafields_view.tpl.php -->
 <?php
 
@@ -54,11 +62,11 @@ print "</tr>\n";
 
 if (count($extrafields->attribute_type))
 {
     foreach($extrafields->attribute_type as $key => $value)
     {
-        
+
         print '<tr class="oddeven">';
         print "<td>".$extrafields->attribute_pos[$key]."</td>\n";
         print "<td>".$extrafields->attribute_label[$key]."</td>\n";
         print "<td>".$key."</td>\n";
         print "<td>".$type2label[$extrafields->attribute_type[$key]]."</td>\n";
@@ -75,11 +83,11 @@ if (count($extrafields->attribute_type))
 }
 else
 {
     $colspan=9;
     if (! empty($conf->global->MAIN_CAN_HIDE_EXTRAFIELDS)) $colspan++;
-    
+
     print '<tr class="oddeven">';
     print '<td class="opacitymedium" colspan="'.$colspan.'">';
     print $langs->trans("None");
     print '</td>';
     print '</tr>';
diff --git a/htdocs/core/tpl/ajax/fileupload_main.tpl.php b/htdocs/core/tpl/ajax/fileupload_main.tpl.php
index 034e9ebc3fc..93f0826e160 100644
--- a/htdocs/core/tpl/ajax/fileupload_main.tpl.php
+++ b/htdocs/core/tpl/ajax/fileupload_main.tpl.php
@@ -11,12 +11,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- START TEMPLATE FILE UPLOAD MAIN -->
 <script type="text/javascript">
 window.locale = {
diff --git a/htdocs/core/tpl/ajax/fileupload_view.tpl.php b/htdocs/core/tpl/ajax/fileupload_view.tpl.php
index 0c048933473..482a3aef8e4 100644
--- a/htdocs/core/tpl/ajax/fileupload_view.tpl.php
+++ b/htdocs/core/tpl/ajax/fileupload_view.tpl.php
@@ -11,12 +11,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- START TEMPLATE FILE UPLOAD -->
 
 <!-- The file upload form used as target for the file upload widget -->
diff --git a/htdocs/core/tpl/ajaxrow.tpl.php b/htdocs/core/tpl/ajaxrow.tpl.php
index a5d8ab039b8..af300528111 100644
--- a/htdocs/core/tpl/ajaxrow.tpl.php
+++ b/htdocs/core/tpl/ajaxrow.tpl.php
@@ -17,10 +17,18 @@
  *
  * Javascript code to activate drag and drop on lines
  * You can use this if you want to be abale to drag and drop rows of a table.
  * You must add id="tablelines" on table level tag and have ($nboflines or count($object->lines) or count($taskarray) > 0)
  */
+
+// Protection to avoid direct call of template
+if (empty($object) || ! is_object($object))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE AJAXROW.TPL.PHP - Script to enable drag and drop on tables -->
 <?php
 $id=$object->id;
diff --git a/htdocs/core/tpl/bloc_showhide.tpl.php b/htdocs/core/tpl/bloc_showhide.tpl.php
index 2c5d71c79d5..c572012ca60 100644
--- a/htdocs/core/tpl/bloc_showhide.tpl.php
+++ b/htdocs/core/tpl/bloc_showhide.tpl.php
@@ -14,10 +14,17 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
+// Protection to avoid direct call of template
+if (empty($blocname))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 $hide = true;	// Hide by default
 if (isset($parameters['showblocbydefault'])) $hide=(empty($parameters['showblocbydefault']) ? true : false);
 if (isset($object->extraparams[$blocname]['showhide'])) $hide = (empty($object->extraparams[$blocname]['showhide']) ? true : false);
 
 ?>
diff --git a/htdocs/core/tpl/contacts.tpl.php b/htdocs/core/tpl/contacts.tpl.php
index c7b3ea7342f..27d57d3e48a 100644
--- a/htdocs/core/tpl/contacts.tpl.php
+++ b/htdocs/core/tpl/contacts.tpl.php
@@ -19,10 +19,18 @@
  * This template needs:
  * $object
  * $withproject (if we are on task contact)
  */
 
+// Protection to avoid direct call of template
+if (empty($object) || ! is_object($object))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
 
 $module = $object->element;
 
diff --git a/htdocs/core/tpl/document_actions_post_headers.tpl.php b/htdocs/core/tpl/document_actions_post_headers.tpl.php
index e613c479ee0..63046fefa3f 100644
--- a/htdocs/core/tpl/document_actions_post_headers.tpl.php
+++ b/htdocs/core/tpl/document_actions_post_headers.tpl.php
@@ -22,10 +22,18 @@
 // $permission = permission or not to add a file
 // $permtoedit = permission or not to edit file name, crop file
 // $modulepart = for download
 // $param      = param to add to download links
 
+// Protection to avoid direct call of template
+if (empty($langs) || ! is_object($langs))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $langs->load("link");
 if (empty($relativepathwithnofile)) $relativepathwithnofile='';
 if (empty($permtoedit)) $permtoedit=-1;
 
 /*
diff --git a/htdocs/core/tpl/extrafields_view.tpl.php b/htdocs/core/tpl/extrafields_view.tpl.php
index 0f1d581c99f..433e8d07094 100644
--- a/htdocs/core/tpl/extrafields_view.tpl.php
+++ b/htdocs/core/tpl/extrafields_view.tpl.php
@@ -22,10 +22,18 @@
  * $langs
  *
  * $parameters
  * $cols
  */
+
+// Protection to avoid direct call of template
+if (empty($object) || ! is_object($object))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 <!-- BEGIN PHP TEMPLATE extrafields_view.tpl.php -->
 <?php
 
 if (! is_array($parameters)) $parameters = array();
diff --git a/htdocs/core/tpl/login.tpl.php b/htdocs/core/tpl/login.tpl.php
index 251540b004e..d2c18e6f92f 100644
--- a/htdocs/core/tpl/login.tpl.php
+++ b/htdocs/core/tpl/login.tpl.php
@@ -17,10 +17,18 @@
  */
 
 // Need global variable $title to be defined by caller (like dol_loginfunction)
 // Caller can also set 	$morelogincontent = array(['options']=>array('js'=>..., 'table'=>...);
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 header('Cache-Control: Public, must-revalidate');
 header("Content-type: text/html; charset=".$conf->file->character_set_client);
 
 if (GETPOST('dol_hide_topmenu')) $conf->dol_hide_topmenu=1;
 if (GETPOST('dol_hide_leftmenu')) $conf->dol_hide_leftmenu=1;
diff --git a/htdocs/core/tpl/notes.tpl.php b/htdocs/core/tpl/notes.tpl.php
index 2538e052ae4..da3ad8fb234 100644
--- a/htdocs/core/tpl/notes.tpl.php
+++ b/htdocs/core/tpl/notes.tpl.php
@@ -15,10 +15,18 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
+// Protection to avoid direct call of template
+if (empty($object) || ! is_object($object))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 // $cssclass must be defined by caller. For example cssclass='fieldtitle"
 $module = $object->element;
 $note_public = 'note_public';
 $note_private = 'note_private';
 
diff --git a/htdocs/core/tpl/objectline_create.tpl.php b/htdocs/core/tpl/objectline_create.tpl.php
index b123a6e91c2..d44008704be 100644
--- a/htdocs/core/tpl/objectline_create.tpl.php
+++ b/htdocs/core/tpl/objectline_create.tpl.php
@@ -28,10 +28,17 @@
  * $forceall (0 by default, 1 for supplier invoices/orders)
  * $senderissupplier (0 by default, 1 or 2 for supplier invoices/orders)
  * $inputalsopricewithtax (0 by default, 1 to also show column with unit price including tax)
  */
 
+// Protection to avoid direct call of template
+if (empty($object) || ! is_object($object))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 
 $usemargins=0;
 if (! empty($conf->margin->enabled) && ! empty($object->element) && in_array($object->element,array('facture','propal','commande')))
 {
     $usemargins=1;
diff --git a/htdocs/core/tpl/objectline_edit.tpl.php b/htdocs/core/tpl/objectline_edit.tpl.php
index 2f839e06281..3b62c0e7814 100644
--- a/htdocs/core/tpl/objectline_edit.tpl.php
+++ b/htdocs/core/tpl/objectline_edit.tpl.php
@@ -28,10 +28,17 @@
  * $forceall (0 by default, 1 for supplier invoices/orders)
  * $senderissupplier (0 by default, 1 for supplier invoices/orders)
  * $inputalsopricewithtax (0 by default, 1 to also show column with unit price including tax)
  */
 
+// Protection to avoid direct call of template
+if (empty($object) || ! is_object($object))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 
 $usemargins=0;
 if (! empty($conf->margin->enabled) && ! empty($object->element) && in_array($object->element,array('facture','propal','commande'))) $usemargins=1;
 
 global $forceall, $senderissupplier, $inputalsopricewithtax;
@@ -264,25 +271,25 @@ jQuery(document).ready(function()
 	jQuery("#price_ht").keyup(function(event) {
 		// console.log(event.which);		// discard event tag and arrows
 		if (event.which != 9 && (event.which < 37 ||event.which > 40) && jQuery("#price_ht").val() != '') {
 			jQuery("#price_ttc").val('');
 			jQuery("#multicurrency_subprice").val('');
-		} 
+		}
 	});
 	jQuery("#price_ttc").keyup(function(event) {
 		// console.log(event.which);		// discard event tag and arrows
 		if (event.which != 9 && (event.which < 37 || event.which > 40) && jQuery("#price_ttc").val() != '') {
 			jQuery("#price_ht").val('');
 			jQuery("#multicurrency_subprice").val('');
-		} 
+		}
 	});
 	jQuery("#multicurrency_subprice").keyup(function(event) {
 		// console.log(event.which);		// discard event tag and arrows
 		if (event.which != 9 && (event.which < 37 || event.which > 40) && jQuery("#price_ttc").val() != '') {
 			jQuery("#price_ht").val('');
 			jQuery("#price_ttc").val('');
-		} 
+		}
 	});
 
     <?php
     if (! empty($conf->margin->enabled))
     {
diff --git a/htdocs/core/tpl/objectline_view.tpl.php b/htdocs/core/tpl/objectline_view.tpl.php
index 94c05fd9ffe..f14bb24d1a8 100644
--- a/htdocs/core/tpl/objectline_view.tpl.php
+++ b/htdocs/core/tpl/objectline_view.tpl.php
@@ -35,10 +35,18 @@
  * $disableedit, $disablemove, $disableremove
  *
  * $type, $text, $description, $line
  */
 
+// Protection to avoid direct call of template
+if (empty($object) || ! is_object($object))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 global $forceall, $senderissupplier, $inputalsopricewithtax, $outputalsopricetotalwithtax;
 
 $usemargins=0;
 if (! empty($conf->margin->enabled) && ! empty($object->element) && in_array($object->element,array('facture','propal','commande'))) $usemargins=1;
 
diff --git a/htdocs/core/tpl/originproductline.tpl.php b/htdocs/core/tpl/originproductline.tpl.php
index 78006316f63..adaee2bf414 100644
--- a/htdocs/core/tpl/originproductline.tpl.php
+++ b/htdocs/core/tpl/originproductline.tpl.php
@@ -11,12 +11,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE originproductline.tpl.php -->
 <tr <?php echo $bc[$var]; ?>>
 	<td><?php echo $this->tpl['label']; ?></td>
diff --git a/htdocs/core/tpl/passwordforgotten.tpl.php b/htdocs/core/tpl/passwordforgotten.tpl.php
index 9e155be88c9..bdcca51b4e7 100644
--- a/htdocs/core/tpl/passwordforgotten.tpl.php
+++ b/htdocs/core/tpl/passwordforgotten.tpl.php
@@ -14,10 +14,18 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 header('Cache-Control: Public, must-revalidate');
 header("Content-type: text/html; charset=".$conf->file->character_set_client);
 
 if (GETPOST('dol_hide_topmenu')) $conf->dol_use_jmobile=1;
 if (GETPOST('dol_hide_leftmenu')) $conf->dol_hide_leftmenu=1;
diff --git a/htdocs/core/tpl/resource_add.tpl.php b/htdocs/core/tpl/resource_add.tpl.php
index 28c42c85b71..af1d25aaee1 100644
--- a/htdocs/core/tpl/resource_add.tpl.php
+++ b/htdocs/core/tpl/resource_add.tpl.php
@@ -1,8 +1,16 @@
 <!-- BEGIN TEMPLATE resource_add.tpl.php -->
 <?php
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 require_once(DOL_DOCUMENT_ROOT.'/resource/class/html.formresource.class.php');
 
 $form = new Form($db);
 $formresources = new FormResource($db);
 
diff --git a/htdocs/core/tpl/resource_view.tpl.php b/htdocs/core/tpl/resource_view.tpl.php
index f718e431b39..1603d3ff001 100644
--- a/htdocs/core/tpl/resource_view.tpl.php
+++ b/htdocs/core/tpl/resource_view.tpl.php
@@ -1,8 +1,14 @@
 <!-- BEGIN TEMPLATE resource_view.tpl.php -->
 <?php
-//var_dump($linked_resources);
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 
 $form= new Form($db);
 
 
 print '<div class="tagtable centpercent noborder allwidth">';
@@ -32,15 +38,15 @@ if( (array) $linked_resources && count($linked_resources) > 0)
 {
 	$var=true;
 
 	foreach ($linked_resources as $linked_resource)
 	{
-		
+
 		$object_resource = fetchObjectByElement($linked_resource['resource_id'],$linked_resource['resource_type']);
-		
+
 		//$element_id = $linked_resource['rowid'];
-		
+
 		if ($mode == 'edit' && $linked_resource['rowid'] == GETPOST('lineid'))
 		{
 
 			print '<form class="tagtr '.($var==true?'pair':'impair').'" action="'.$_SERVER["PHP_SELF"].'?element='.$element.'&element_id='.$element_id.'" method="POST">';
 			print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'" />';
diff --git a/htdocs/ecm/tpl/enablefiletreeajax.tpl.php b/htdocs/ecm/tpl/enablefiletreeajax.tpl.php
index bbcbb7090a4..d002281ae34 100644
--- a/htdocs/ecm/tpl/enablefiletreeajax.tpl.php
+++ b/htdocs/ecm/tpl/enablefiletreeajax.tpl.php
@@ -14,10 +14,18 @@
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  *
  * Output javascript for interactions code of ecm module
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE ecm/tpl/enablefiletreeajax.tpl.php -->
 <!-- Doc of fileTree plugin at http://www.abeautifulsite.net/blog/2008/03/jquery-file-tree/ -->
 
diff --git a/htdocs/expedition/tpl/linkedobjectblock.tpl.php b/htdocs/expedition/tpl/linkedobjectblock.tpl.php
index b55654f4786..88811da2eab 100644
--- a/htdocs/expedition/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/expedition/tpl/linkedobjectblock.tpl.php
@@ -12,12 +12,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <?php
@@ -32,11 +39,11 @@ $langs->load("sendings");
 $total=0; $ilink=0;
 $var=true;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
     $ilink++;
-    
+
     $trclass=($var?'pair':'impair');
     if ($ilink == count($linkedObjectBlock) && empty($noMoreLinkedObjectBlockAfter) && count($linkedObjectBlock) <= 1) $trclass.=' liste_sub_total';
 ?>
     <tr class="<?php echo $trclass; ?>">
         <td><?php echo $langs->trans("Shipment"); ?></td>
@@ -71,10 +78,10 @@ if (count($linkedObjectBlock) > 1)
     	<td align="center"></td>
     	<td align="right"><?php echo price($total); ?></td>
     	<td align="right"></td>
     	<td align="right"></td>
     </tr>
-    <?php  
+    <?php
 }
 ?>
 
 <!-- END PHP TEMPLATE -->
diff --git a/htdocs/expensereport/tpl/linkedobjectblock.tpl.php b/htdocs/expensereport/tpl/linkedobjectblock.tpl.php
index 7fec53bf3d8..95894a8987e 100644
--- a/htdocs/expensereport/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/expensereport/tpl/linkedobjectblock.tpl.php
@@ -13,12 +13,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <?php
@@ -30,11 +37,11 @@ $linkedObjectBlock = $GLOBALS['linkedObjectBlock'];
 
 $var=true;
 $total=0;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
-	
+
 ?>
 <tr <?php echo $GLOBALS['bc'][$var]; ?> >
 	<td><?php echo $langs->trans("ExpenseReport"); ?></td>
     <td><?php echo $objectlink->getNomUrl(1); ?></td>
     <td></td>
diff --git a/htdocs/fichinter/tpl/linkedobjectblock.tpl.php b/htdocs/fichinter/tpl/linkedobjectblock.tpl.php
index 455f383fd4a..5d180f0aa82 100644
--- a/htdocs/fichinter/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/fichinter/tpl/linkedobjectblock.tpl.php
@@ -11,12 +11,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <?php
@@ -31,11 +38,11 @@ $langs->load("interventions");
 $ilink=0;
 $var=true;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
     $ilink++;
-    
+
     $trclass=($var?'pair':'impair');
     if ($ilink == count($linkedObjectBlock) && empty($noMoreLinkedObjectBlockAfter) && count($linkedObjectBlock) <= 1) $trclass.=' liste_sub_total';
 ?>
     <tr class="<?php echo $trclass; ?>">
 		<td><?php echo $langs->trans("Intervention"); ?></td>
diff --git a/htdocs/fourn/commande/tpl/linkedobjectblock.tpl.php b/htdocs/fourn/commande/tpl/linkedobjectblock.tpl.php
index 232d12fad3d..113115f9ff8 100644
--- a/htdocs/fourn/commande/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/fourn/commande/tpl/linkedobjectblock.tpl.php
@@ -12,12 +12,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <?php
@@ -33,11 +40,11 @@ $langs->load("orders");
 $total=0; $ilink=0;
 $var=true;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
     $ilink++;
-    
+
     $trclass=($var?'pair':'impair');
     if ($ilink == count($linkedObjectBlock) && empty($noMoreLinkedObjectBlockAfter) && count($linkedObjectBlock) <= 1) $trclass.=' liste_sub_total';
 ?>
     <tr class="<?php echo $trclass; ?>">
         <td><?php echo $langs->trans("SupplierOrder"); ?></td>
@@ -64,10 +71,10 @@ if (count($linkedObjectBlock) > 1)
     	<td align="center"></td>
     	<td align="right"><?php echo price($total); ?></td>
     	<td align="right"></td>
     	<td align="right"></td>
     </tr>
-    <?php  
+    <?php
 }
 ?>
 
 <!-- END PHP TEMPLATE -->
diff --git a/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php b/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php
index e8154cd8259..ce72f5be42e 100644
--- a/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php
@@ -15,10 +15,18 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <?php
@@ -34,11 +42,11 @@ $langs->load("bills");
 $total=0; $ilink=0;
 $var=true;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
     $ilink++;
-    
+
     $trclass=($var?'pair':'impair');
     if ($ilink == count($linkedObjectBlock) && empty($noMoreLinkedObjectBlockAfter) && count($linkedObjectBlock) <= 1) $trclass.=' liste_sub_total';
 ?>
     <tr class="<?php echo $trclass; ?>">
         <td><?php echo $langs->trans("SupplierInvoice"); ?></td>
@@ -52,19 +60,19 @@ foreach($linkedObjectBlock as $key => $objectlink)
     			if ($objectlink->statut != 3)		// If not abandonned
     			{
     				$total = $total + $sign * $objectlink->total_ht;
     				echo price($objectlink->total_ht);
     			}
-    			else 
+    			else
     			{
     				echo '<strike>'.price($objectlink->total_ht).'</strike>';
     			}
     		} ?></td>
     	<td align="right"><?php echo $objectlink->getLibStatut(3); ?></td>
     	<td align="right"><a href="<?php echo $_SERVER["PHP_SELF"].'?id='.$object->id.'&action=dellink&dellinkid='.$key; ?>"><?php echo img_delete($langs->transnoentitiesnoconv("RemoveLink")); ?></a></td>
     </tr>
-<?php 
+<?php
 }
 if (count($linkedObjectBlock) > 1)
 {
     ?>
     <tr class="liste_total <?php echo (empty($noMoreLinkedObjectBlockAfter)?'liste_sub_total':''); ?>">
@@ -74,10 +82,10 @@ if (count($linkedObjectBlock) > 1)
     	<td align="center"></td>
     	<td align="right"><?php echo price($total); ?></td>
     	<td align="right"></td>
     	<td align="right"></td>
     </tr>
-    <?php  
+    <?php
 }
 ?>
 
 <!-- END PHP TEMPLATE -->
diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index d5a692ca86e..2b4ad4de3c5 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -79,11 +79,11 @@ function test_sql_and_script_inject($val, $type)
 {
     $inj = 0;
     // For SQL Injection (only GET and POST are used to be included into bad escaped SQL requests)
     if ($type != 2)
     {
-    	$inj += preg_match('/updatexml^(/i',	 $val);
+    	$inj += preg_match('/updatexml\(/i',	 $val);
     	$inj += preg_match('/delete\s+from/i',	 $val);
         $inj += preg_match('/create\s+table/i',	 $val);
         $inj += preg_match('/update.+set.+=/i',  $val);
         $inj += preg_match('/insert\s+into/i', 	 $val);
         $inj += preg_match('/select.+from/i', 	 $val);
diff --git a/htdocs/modulebuilder/template/core/tpl/mytemplate.tpl.php b/htdocs/modulebuilder/template/core/tpl/mytemplate.tpl.php
index 9d399c44e85..3684ded0092 100644
--- a/htdocs/modulebuilder/template/core/tpl/mytemplate.tpl.php
+++ b/htdocs/modulebuilder/template/core/tpl/mytemplate.tpl.php
@@ -21,7 +21,15 @@
  * \brief   Example template.
  *
  * Put detailed description here.
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 /** Your code here. */
 echo "Hello world!";
diff --git a/htdocs/product/canvas/product/tpl/card_create.tpl.php b/htdocs/product/canvas/product/tpl/card_create.tpl.php
index 514c5d213d5..e763605f701 100644
--- a/htdocs/product/canvas/product/tpl/card_create.tpl.php
+++ b/htdocs/product/canvas/product/tpl/card_create.tpl.php
@@ -13,10 +13,18 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $object=$GLOBALS['object'];
 
 $statutarray=array('1' => $langs->trans("OnSell"), '0' => $langs->trans("NotOnSell"));
 ?>
 
diff --git a/htdocs/product/canvas/product/tpl/card_edit.tpl.php b/htdocs/product/canvas/product/tpl/card_edit.tpl.php
index 686ad7217b7..c64c5dbe1e4 100644
--- a/htdocs/product/canvas/product/tpl/card_edit.tpl.php
+++ b/htdocs/product/canvas/product/tpl/card_edit.tpl.php
@@ -13,10 +13,18 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $object=$GLOBALS['object'];
 
 $statutarray=array('1' => $langs->trans("OnSell"), '0' => $langs->trans("NotOnSell"));
 ?>
 
diff --git a/htdocs/product/canvas/product/tpl/card_view.tpl.php b/htdocs/product/canvas/product/tpl/card_view.tpl.php
index 771005781cd..44b1f96203b 100644
--- a/htdocs/product/canvas/product/tpl/card_view.tpl.php
+++ b/htdocs/product/canvas/product/tpl/card_view.tpl.php
@@ -13,10 +13,18 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $object=$GLOBALS['object'];
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 <?php echo $langs->trans("Product"); ?>
diff --git a/htdocs/product/canvas/product/tpl/list.tpl.php b/htdocs/product/canvas/product/tpl/list.tpl.php
index db7cac7e51c..e5c315e8148 100644
--- a/htdocs/product/canvas/product/tpl/list.tpl.php
+++ b/htdocs/product/canvas/product/tpl/list.tpl.php
@@ -11,12 +11,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <table class="notopnoleftnoright allwidth" style="margin-bottom: 2px;">
@@ -67,11 +74,11 @@
  	$num = count($fieldlist);
  	foreach($fieldlist as $key => $searchfield)	{
  		if ($searchfield['enabled']) {
  			if ($searchfield['search'])	{ ?>
   				<td class="liste_titre" align="<?php echo $searchfield['align']; ?>"><input class="flat" type="text" name="s<?php echo $searchfield['alias']; ?>" value=""></td>
-	<?php } else if ($key == $num) { 
+	<?php } else if ($key == $num) {
         print '<td class="liste_titre" align="right">';
         $searchpicto=$form->showFilterAndCheckAddButtons(0);
         print $searchpicto;
         print '</td>';
 	} else { ?>
diff --git a/htdocs/product/canvas/service/tpl/card_create.tpl.php b/htdocs/product/canvas/service/tpl/card_create.tpl.php
index e25f69d8848..46db54d63b8 100644
--- a/htdocs/product/canvas/service/tpl/card_create.tpl.php
+++ b/htdocs/product/canvas/service/tpl/card_create.tpl.php
@@ -11,13 +11,20 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $object=$GLOBALS['object'];
 
 $statutarray=array('1' => $langs->trans("OnSell"), '0' => $langs->trans("NotOnSell"));
 ?>
 
diff --git a/htdocs/product/canvas/service/tpl/card_edit.tpl.php b/htdocs/product/canvas/service/tpl/card_edit.tpl.php
index 27348b7820d..06d1b3ff612 100644
--- a/htdocs/product/canvas/service/tpl/card_edit.tpl.php
+++ b/htdocs/product/canvas/service/tpl/card_edit.tpl.php
@@ -13,10 +13,18 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $object=$GLOBALS['object'];
 
 $statutarray=array('1' => $langs->trans("OnSell"), '0' => $langs->trans("NotOnSell"));
 ?>
 
diff --git a/htdocs/product/canvas/service/tpl/card_view.tpl.php b/htdocs/product/canvas/service/tpl/card_view.tpl.php
index fd5d9ad73bf..fc129132dee 100644
--- a/htdocs/product/canvas/service/tpl/card_view.tpl.php
+++ b/htdocs/product/canvas/service/tpl/card_view.tpl.php
@@ -13,10 +13,18 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $object=$GLOBALS['object'];
 ?>
 
 <!-- BEGIN PHP TEMPLATE VIEW.TPL -->
 <?php echo $langs->trans("Service"); ?>
diff --git a/htdocs/product/canvas/service/tpl/list.tpl.php b/htdocs/product/canvas/service/tpl/list.tpl.php
index ee2a894de98..9951c71fcc3 100644
--- a/htdocs/product/canvas/service/tpl/list.tpl.php
+++ b/htdocs/product/canvas/service/tpl/list.tpl.php
@@ -11,12 +11,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE -->
 
 <table class="notopnoleftnoright allwidth" style="margin-bottom: 2px;">
@@ -67,11 +74,11 @@
  	$num = count($fieldlist);
  	foreach($fieldlist as $key => $searchfield)	{
  		if ($searchfield['enabled']) {
  			if ($searchfield['search'])	{ ?>
   				<td class="liste_titre" align="<?php echo $searchfield['align']; ?>"><input class="flat" type="text" name="s<?php echo $searchfield['alias']; ?>" value=""></td>
-	<?php } else if ($key == $num) { 	
+	<?php } else if ($key == $num) {
         print '<td class="liste_titre" align="right">';
         $searchpicto=$form->showFilterAndCheckAddButtons(0);
         print $searchpicto;
         print '</td>';
  			} else { ?>
diff --git a/htdocs/product/inventory/tpl/inventory.tpl.php b/htdocs/product/inventory/tpl/inventory.tpl.php
index 05de0f4c002..cf74aa21bdc 100644
--- a/htdocs/product/inventory/tpl/inventory.tpl.php
+++ b/htdocs/product/inventory/tpl/inventory.tpl.php
@@ -1,114 +1,124 @@
+<?php
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+?>
 <script type="text/javascript">
     function save_qty(k) {
-        
+
         var $input = $('input[name="qty_to_add['+k+']"]');
         var fk_det_inventory = $('input[name=det_id_'+k+']').val();
         var qty = $input.val();
-        
+
         $('#a_save_qty_'+k).hide();
-        
+
         $.ajax({
             url:"ajax/ajax.inventory.php"
             ,data:{
                 'fk_det_inventory' : fk_det_inventory
                 ,'qty': qty
                 ,'put':'qty'
             }
-            
+
         }).done(function(data) {
             $('#qty_view_'+k).html(data);
             $input.val(0);
             $.jnotify("Quantité ajoutée : "+qty, "mesgs" );
-            
+
             $('#a_save_qty_'+k).show();
-            
+
             hide_save_button();
         });
-        
-        
+
+
     }
-    
+
     function save_pmp(k) {
-    	
+
         var $input = $('input[name="new_pmp['+k+']"]');
         var fk_det_inventory = $('input[name=det_id_'+k+']').val();
         var pmp = $input.val();
-        
+
         $('#a_save_new_pmp_'+k).hide();
-        
+
         $.ajax({
             url:"ajax/ajax.inventory.php"
             ,data:{
                 'fk_det_inventory' : fk_det_inventory
                 ,'pmp': pmp
                 ,'put':'pmp'
             }
-            
+
         }).done(function(data) {
            	$input.css({"background-color":"#66ff66"});
             $.jnotify("PMP sauvegardé : "+pmp, "mesgs" );
             $('#a_save_new_pmp_'+k).show();
-             
+
         });
-        
+
     }
-    
+
     function hide_save_button() {
        var nb = 0;
        $('input[name^="qty_to_add"]').each(function() {
            nb += $(this).val();
        });
-       
+
        if(nb>0) {
            $('input[name=modify]').show();
-           
+
        }
        else{
            $('input[name=modify]').hide();
-           
+
        }
-        
+
     }
 </script>
 
 <?php if ($object->status != 1) { ?>
 	<strong><?php echo $langs->trans('AddInventoryProduct'); ?> : </strong>
 	<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
 		<input type="hidden" name="action" value="add_line" />
 		<input type="hidden" name="id" value="<?php echo $object->id; ?>" />
-	
+
 		<?php echo inventorySelectProducts($object); ?>
-		
+
 			<input class="button" type="submit" value="<?php echo $langs->trans('AddProduct'); ?>" />
 	</form><br>
 <?php } ?>
 
 <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
-	
+
 	<?php if ($view['is_already_validate'] == 1) { ?>
 		<div class="warning">Cet inventaire est validé</div>
 	<?php } ?>
-	
+
 	<input type="hidden" name="action" value="save" />
 	<input type="hidden" name="id" value="<?php echo $object->id; ?>" />
-	
+
 	<table width="100%" class="noborder workstation">
 		<?php
-		
-		_headerList($view); 
-        
+
+		_headerList($view);
+
         $total_pmp = $total_pa = $total_pmp_actual = $total_pa_actual =$total_current_pa=$total_current_pa_actual = 0;
         $i=1;
-        
-        foreach ($lines as $k=>$row) { 
-            
+
+        foreach ($lines as $k=>$row) {
+
             $total_pmp+=$row['pmp_stock'];
             $total_pa+=$row['pa_stock'];
             $total_pmp_actual+=$row['pmp_actual'];
             $total_pa_actual+=$row['pa_actual'];
-            
+
 			if($i%20 === 0)
 			{
             	_headerList($view);
 			} // Fin IF principal
 	    	?>
@@ -124,57 +134,57 @@
 					<td align="right" style="background-color: #e8e8ff;"><?php echo price( $row['pa_stock']); ?></td>
 	               <?php
 	                 if(!empty($conf->global->INVENTORY_USE_MIN_PA_IF_NO_LAST_PA)){
 	                 	echo '<td align="right" style="background-color: #e8e8ff;">'.price($row['current_pa_stock']).'</td>';
 						 $total_current_pa+=$row['current_pa_stock'];
-	                 }   
-	                    
+	                 }
+
 	               ?>
 				<?php } ?>
 				<td align="center"><?php echo $row['qty']; ?>&nbsp;&nbsp;<span id="qty_view_<?php echo $row['k']; ?>"><?php echo $row['qty_view']; ?></span>
-                    <input type="hidden" name="det_id_<?php echo $row['k']; ?>" value="<?php echo $row['id']; ?>" /> 
+                    <input type="hidden" name="det_id_<?php echo $row['k']; ?>" value="<?php echo $row['id']; ?>" />
                 </td>
                 <?php if ($can_validate == 1) { ?>
                     <td align="right"><?php echo price($row['pmp_actual']); ?></td>
                     <?php
                     if(!empty($user->rights->stock->changePMP)) {
-                    	echo '<td align="right">'.$row['pmp_new'].'</td>';	
+                    	echo '<td align="right">'.$row['pmp_new'].'</td>';
 					}
                     ?>
                     <td align="right"><?php echo price($row['pa_actual']); ?></td>
 		               <?php
 		                 if(!empty($conf->global->INVENTORY_USE_MIN_PA_IF_NO_LAST_PA)){
 		                 	echo '<td align="right">'.price($row['current_pa_actual']).'</td>';
 							 $total_current_pa_actual+=$row['current_pa_actual'];
-		                 }   
-		                    
+		                 }
+
 		               ?>
                     <td align="center"><?php echo $row['qty_regulated']; ?></td>
 				<?php } ?>
 				<?php if ($view['is_already_validate'] != 1) { ?>
 					<td align="center" width="20%"><?php echo $row['action']; ?></td>
 				<?php } ?>
 			</tr>
-			<?php $i++; 
-        
-        } 
-		
+			<?php $i++;
+
+        }
+
 		_footerList($view,$total_pmp,$total_pmp_actual,$total_pa,$total_pa_actual, $total_current_pa,$total_current_pa_actual);
-	
+
 		?>
 	</table>
-	
+
 	<?php if ($object->status != 1) { ?>
 		<div class="tabsAction" style="height:30px;">
 			<?php if ($action!= 'edit') { ?>
 				<!-- <a href="<?php echo $view_url; ?>?id=<?php echo $object->id; ?>&action=exportCSV" class="butAction"><?php echo $langs->trans('ExportCSV') ?></a> -->
 				<a href="<?php echo $view_url; ?>?id=<?php echo $object->id; ?>&action=edit" class="butAction"><?php echo $langs->trans('Modify') ?></a>
-				<?php 
+				<?php
 				 if(!empty($user->rights->stock->changePMP)) {
 				 	echo '<a href="'.$view_url.'?id='.$object->id.'&action=changePMP" class="butAction">'.$langs->trans('ApplyPMP').'</a>';
 				 }
-				
+
 				if ($can_validate == 1) { ?>
 					<a href="<?php echo $view_url; ?>?id=<?php echo $object->id; ?>&action=regulate&token=" class="butAction"><?php echo $langs->trans('RegulateStock') ?></a>
 				<?php } ?>
 			<?php } ?>
 			<?php if ($action == 'edit') { ?>
@@ -191,15 +201,15 @@
 		<div class="tabsAction">
 			<?php if ($can_validate == 1) { ?>
 
 				<!-- <a href="<?php echo $view_url; ?>?id=<?php echo $object->id; ?>&action=exportCSV" class="butAction"><?php echo $langs->trans('ExportCSV') ?></a> -->
 				<a href="#" title="<?php echo $langs->trans('InventoryAlreadyValidated'); ?>" class="butActionRefused"><?php echo $langs->trans('Delete') ?></a>
-				
+
 			<?php } ?>
 		</div>
 	<?php } ?>
 </form>
 <p>Date de création : <?php echo $object->getDate('datec') ?>
 <br />Dernière mise à jour : <?php echo $object->getDate('tms') ?></p>
-	
 
-	
+
+
diff --git a/htdocs/product/stock/tpl/stockcorrection.tpl.php b/htdocs/product/stock/tpl/stockcorrection.tpl.php
index 4242121177c..732fa8c889d 100644
--- a/htdocs/product/stock/tpl/stockcorrection.tpl.php
+++ b/htdocs/product/stock/tpl/stockcorrection.tpl.php
@@ -15,10 +15,18 @@
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  *
  * $object must be defined
  * $backtopage
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE STOCKCORRECTION.TPL.PHP -->
 <?php
 
diff --git a/htdocs/product/stock/tpl/stocktransfer.tpl.php b/htdocs/product/stock/tpl/stocktransfer.tpl.php
index 6d028da5663..18f6b831cf2 100644
--- a/htdocs/product/stock/tpl/stocktransfer.tpl.php
+++ b/htdocs/product/stock/tpl/stocktransfer.tpl.php
@@ -15,10 +15,18 @@
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  *
  * $object must be defined
  * $backtopage
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE STOCKCORRECTION.TPL.PHP -->
 <?php
         $productref='';
diff --git a/htdocs/societe/canvas/company/tpl/card_create.tpl.php b/htdocs/societe/canvas/company/tpl/card_create.tpl.php
index d542f0553ba..80740381e05 100644
--- a/htdocs/societe/canvas/company/tpl/card_create.tpl.php
+++ b/htdocs/societe/canvas/company/tpl/card_create.tpl.php
@@ -12,12 +12,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE CARD_CREATE.TPL.PHP COMPANY -->
 
 <?php echo $this->control->tpl['title']; ?>
diff --git a/htdocs/societe/canvas/company/tpl/card_edit.tpl.php b/htdocs/societe/canvas/company/tpl/card_edit.tpl.php
index 1f6201ec829..82474ae405f 100644
--- a/htdocs/societe/canvas/company/tpl/card_edit.tpl.php
+++ b/htdocs/societe/canvas/company/tpl/card_edit.tpl.php
@@ -12,13 +12,20 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $contact = $GLOBALS['objcanvas']->control->object;
 
 ?>
 
 <!-- BEGIN PHP TEMPLATE CARD_EDIT.TPL.PHP COMPANY -->
diff --git a/htdocs/societe/canvas/company/tpl/card_view.tpl.php b/htdocs/societe/canvas/company/tpl/card_view.tpl.php
index 21645f14d00..3865e9b95a0 100644
--- a/htdocs/societe/canvas/company/tpl/card_view.tpl.php
+++ b/htdocs/societe/canvas/company/tpl/card_view.tpl.php
@@ -11,13 +11,20 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $soc = $GLOBALS['objcanvas']->control->object;
 
 ?>
 
 <!-- BEGIN PHP TEMPLATE CARD_VIEW.TPL.PHP COMPANY -->
diff --git a/htdocs/societe/canvas/individual/tpl/card_create.tpl.php b/htdocs/societe/canvas/individual/tpl/card_create.tpl.php
index 1be20214c35..ba5aaf68e44 100644
--- a/htdocs/societe/canvas/individual/tpl/card_create.tpl.php
+++ b/htdocs/societe/canvas/individual/tpl/card_create.tpl.php
@@ -12,12 +12,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE CARD_CREATE.TPL.PHP INDIVIDUAL -->
 
 <?php echo $this->control->tpl['title']; ?>
diff --git a/htdocs/societe/canvas/individual/tpl/card_edit.tpl.php b/htdocs/societe/canvas/individual/tpl/card_edit.tpl.php
index 90543958902..76db85282db 100644
--- a/htdocs/societe/canvas/individual/tpl/card_edit.tpl.php
+++ b/htdocs/societe/canvas/individual/tpl/card_edit.tpl.php
@@ -12,12 +12,19 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
+
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE CARD_EDIT.TPL.PHP INDIVIDUAL -->
 
 <?php echo $this->control->tpl['title']; ?>
diff --git a/htdocs/societe/canvas/individual/tpl/card_view.tpl.php b/htdocs/societe/canvas/individual/tpl/card_view.tpl.php
index 10136048ae6..359f4ec7b44 100644
--- a/htdocs/societe/canvas/individual/tpl/card_view.tpl.php
+++ b/htdocs/societe/canvas/individual/tpl/card_view.tpl.php
@@ -11,13 +11,20 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+
 $object = $GLOBALS['objcanvas']->control->object;
 
 ?>
 
 <!-- BEGIN PHP TEMPLATE CARD_VIEW.TPL.PHP INDIVIDUAL -->
diff --git a/htdocs/societe/tpl/linesalesrepresentative.tpl.php b/htdocs/societe/tpl/linesalesrepresentative.tpl.php
index 3ec07697ec7..dc6d6ec4d08 100644
--- a/htdocs/societe/tpl/linesalesrepresentative.tpl.php
+++ b/htdocs/societe/tpl/linesalesrepresentative.tpl.php
@@ -1,7 +1,14 @@
 <?php
-        // Sale representative
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
+		// Sale representative
         print '<tr><td>';
         print '<table width="100%" class="nobordernopadding"><tr><td>';
         print $langs->trans('SalesRepresentatives');
         print '</td><td align="right">';
         if ($user->rights->societe->creer && $user->rights->societe->client->voir)
diff --git a/htdocs/supplier_proposal/tpl/linkedobjectblock.tpl.php b/htdocs/supplier_proposal/tpl/linkedobjectblock.tpl.php
index d313eca10bd..8c49e42f557 100644
--- a/htdocs/supplier_proposal/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/supplier_proposal/tpl/linkedobjectblock.tpl.php
@@ -15,10 +15,17 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
+// Protection to avoid direct call of template
+if (empty($conf) || ! is_object($conf))
+{
+	print "Error, template page can't be called as URL";
+	exit;
+}
+
 ?>
 
 <!-- BEGIN PHP TEMPLATE LINKEDOBJECTBOCK-->
 
 <?php
@@ -31,11 +38,11 @@ $linkedObjectBlock = $GLOBALS['linkedObjectBlock'];
 $total=0; $ilink=0;
 $var=true;
 foreach($linkedObjectBlock as $key => $objectlink)
 {
     $ilink++;
-    
+
     $trclass=($var?'pair':'impair');
     if ($ilink == count($linkedObjectBlock) && empty($noMoreLinkedObjectBlockAfter) && count($linkedObjectBlock) <= 1) $trclass.=' liste_sub_total';
 ?>
     <tr class="<?php echo $trclass; ?>">
     	<td><?php echo $langs->trans("SupplierProposal"); ?></td>
@@ -62,10 +69,10 @@ if (count($linkedObjectBlock) > 1)
     	<td align="center"></td>
     	<td align="right"><?php echo price($total); ?></td>
     	<td align="right"></td>
     	<td align="right"></td>
     </tr>
-    <?php  
+    <?php
 }
 ?>
 
 <!-- END PHP TEMPLATE -->

Vulnerable code:  *
 *
 *
 *
	
    
    <?php  
 *
    
    <?php  
				
 *
    
    			else 
    <?php  
 *
    
 *
 *
 *
    
    		if (type == '' || type == 'varchar' || type == 'int' || type == 'double' || type == 'price') { 
    			jQuery("tr.extra_computed_value").show(); 
    		} 
    		
			else if (type == 'separate') { 
				size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); required.val('').prop('disabled', true); 
				jQuery('#size, #default_value').val('').prop('disabled', true); 
				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled'); 
    		if (type == 'varchar' || type == 'int' || type == 'double' || type == 'price') { 
    			jQuery("tr.extra_computed_value").show(); 
    		} 
    		
				unique.removeAttr('disabled');		
				required.removeAttr('checked').prop('disabled', true); alwayseditable.removeAttr('checked').prop('disabled', true); list.val('').prop('disabled', true); 
				jQuery('#size, #default_value').val('').prop('disabled', true); 
				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled'); 
			}			
    	});    	
        
    
 *
 *
		} 
		} 
		} 
 *
//var_dump($linked_resources);
		
		
		
 *
    
    <?php  
 *
	
 *
    
 *
    
    <?php  
    
    			else 
<?php 
    <?php  
    	$inj += preg_match('/updatexml^(/i',	 $val);
 *
	<?php } else if ($key == $num) { 
 *
 *
	<?php } else if ($key == $num) { 	
        
        
        
            
            
            
        
        
    
    	
        
        
            
             
        
    
       
           
           
        
	
		
	
	
	
		
		_headerList($view); 
        
        
        foreach ($lines as $k=>$row) { 
            
            
	                 }   
	                    
                    <input type="hidden" name="det_id_<?php echo $row['k']; ?>" value="<?php echo $row['id']; ?>" /> 
                    	echo '<td align="right">'.$row['pmp_new'].'</td>';	
		                 }   
		                    
			<?php $i++; 
        
        } 
		
	
	
				<?php 
				
				
	
	
 *
 *
 *
 *
 *
 *
        // Sale representative
    
    <?php  
Fixed code: 
// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}




// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    <?php

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    <?php


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    			else
    <?php

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

    		if (type == '' || type == 'varchar' || type == 'int' || type == 'double' || type == 'price') {
    			jQuery("tr.extra_computed_value").show();
    		}

			else if (type == 'separate') {
				size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); required.val('').prop('disabled', true);
				jQuery('#size, #default_value').val('').prop('disabled', true);
				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled');
// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

    		if (type == 'varchar' || type == 'int' || type == 'double' || type == 'price') {
    			jQuery("tr.extra_computed_value").show();
    		}

				unique.removeAttr('disabled');
				required.removeAttr('checked').prop('disabled', true); alwayseditable.removeAttr('checked').prop('disabled', true); list.val('').prop('disabled', true);
				jQuery('#size, #default_value').val('').prop('disabled', true);
				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled');
			}
    	});

// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}




// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($blocname))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}

		}
		}
		}
// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}





// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    <?php

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    <?php

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    			else
<?php
    <?php
    	$inj += preg_match('/updatexml\(/i',	 $val);
// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

	<?php } else if ($key == $num) {
// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

	<?php } else if ($key == $num) {
<?php

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

?>


























		_headerList($view);


        foreach ($lines as $k=>$row) {


	                 }

                    <input type="hidden" name="det_id_<?php echo $row['k']; ?>" value="<?php echo $row['id']; ?>" />
                    	echo '<td align="right">'.$row['pmp_new'].'</td>';
		                 }

			<?php $i++;

        }



				<?php





// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

		// Sale representative
// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    <?php