DoliPDF 1.0.16: hardening of ODT to PDF conversion

What this release brings

DoliPDF automatically converts to PDF the documents Dolibarr generates from an ODT template, either through a remote conversion server or through LibreOffice installed on your server. Version 1.0.16 is a maintenance release devoted to the security and robustness of this path.

Secure remote conversion

The conversion server's response is now validated before anything is written to disk: JSON structure, strict base64 decoding, MD5 checksum verification. A truncated or corrupted PDF file is deleted and reported instead of remaining visible in the documents tab. The call to the remote server now accepts only https addresses, and the configuration page displays an explicit warning when a cleartext address is entered.

Cleaned-up configuration page

The module shipped example actions inherited from the Dolibarr module generator, one of which instantiated a class name taken from the request. These actions, irrelevant for a conversion module, have been removed. The API key is no longer displayed in cleartext in read mode, and the "backtopage" return parameter is sanitised before being used in links.

Conversion of all documents

With the "convert only validated documents" option enabled, Dolibarr objects that have no draft/validated life cycle (third parties, contacts, products, users) are now converted normally instead of being silently skipped.

Requirements and tooling

The compatibility floor moves to Dolibarr 14 and PHP 7.4, the values actually required by the code and covered by continuous integration. The user documentation now describes precisely the data sent to the remote service (GDPR transparency), and the "About" page summarises what the module does with links to the documentation and to support.