Facturx 1.6.156: stronger access controls, units and currencies in the XML

Update, then re-enable the module

Two of the fixes in this release apply to existing data only when the module is re-enabled. After deployment, go to Home > Setup > Modules to disable and then re-enable Facturx: this is the action that repairs the extra fields described below.

Fixed access controls

Several checks were missing on the received invoice import pages. They are now in place:

• an import belonging to another entity can no longer be viewed, modified, reset or deleted. The same goes for mass actions on invoices, which now leave aside those of entities you cannot see;
• the PDF of a received invoice can no longer be reached through a public sharing link;
• saving a Peppol identifier from the search page now requires the write permission on third parties;
• the migration of routing identifiers to the community module no longer starts from a plain link: it goes through the form on its page.

In the same pass, the access point's OAuth2 tokens and client secret are now encrypted in the database instead of being stored in clear text, and the script on the "About" page carries a hash that makes it compatible with a strict content security policy.

If you use the module in multi-entity mode or the received invoice import channel, this update is not optional.

Four causes of rejection for your invoices

The VAT exemption reason is no longer repeated on each line. It is carried once, at the VAT breakdown level, where the standard expects it. The DATEV accounting software, widely used in Germany, rejected invoices that repeated it.

French legal mentions and the BT-23 invoicing mode are now sent only on an invoice issued by a French seller. These are obligations of French law: transmitting them for an establishment invoicing under other rules was at best noise, at worst a reason for refusal. A new setting makes it possible to force the decision one way or the other when detection based on your company's country is not enough.

The unit of your invoice lines is now sent in the XML. Until now each line was declared in pieces, whatever its unit: a 7-hour service announced 7 pieces to your customer. The 37 units shipped with Dolibarr are now mapped to the UN/ECE Recommendation 20 list expected by the standard: hours as HUR, kilograms as KGM, square metres as MTK. There is nothing to configure. If you have added your own units to the dictionary, enter the list code directly there (for example KWH for a kilowatt-hour) and it will be transmitted as is; a unit with no equivalent continues to be sent as a piece.

An invoice in a foreign currency keeps its currency and its amounts. If you invoice in dollars, the XML carries USD and all amounts in dollars: unit prices, line totals, discounts, VAT breakdown, down payments and grand totals. The XML therefore describes the same invoice as the PDF your customer has in front of him. VAT is additionally expressed in your company's accounting currency, as article 289 of the CGI requires from a French seller and as your customer's accounting needs. The summary invoice template follows the same rule.

The extra fields are back

The Chorus and XRechnung fields that disappeared from your records reappear when the module is re-enabled. The repair also covers the delivery location identifier on contacts and the summary group on products, which the previous version left aside.

The creation of these fields has also become safer: a field that fails no longer cancels the creation of all those declared after it, and module activation stops and says so when a field could not be created, instead of leaving you with an incomplete record and no message. The configuration page now names the fields that Dolibarr hides, rather than letting them vanish without explanation.

Access point and received invoices

• the status of a document sent to the access point is kept again: its table was missing at installation;
• two received invoices can no longer end up with the same reference;
• a malformed XML received from the network indicates the line that breaks it, instead of a generic message;
• the failure to merge attachments into the Factur-X PDF is reported to you, and not only written in the log;
• the OAuth2 return address follows the actual location of your installation; it was fixed under /custom/facturx;
• an unknown access point driver is refused instead of being loaded blindly;
• the warning about the billing contact is translated, it was displayed in English.

Miscellaneous

The FACTURX_DISABLE_VERSION_CHECK setting disables the version check performed each time the module is activated, for installations without outbound access. The numbering and document template block, inherited from the skeleton and without effect, has been removed from the configuration pages.