Fix #6504: CVE-2017-7886

FIX: Correction with author and validator user on orders

'defaultlang' attribute was not filtered before database request which cause an SQL injection.

FIX supplier order line creation with rang = 0

FIX : forgotten parameter for right multicompany use

Fix #5911 Added missing Slashes

fixed line where two slashes were missing, that caused an error when creating barcodes.

Fix total line on list facture

FIX : Agenda getCalendarEvents hook

FIX Corrected bug where product multiprices admin page would not render properly due to a PHP fatal error

Fix: Error when references are numeric

Corrected bug where product multiprices admin page would not render properly due to a PHP fatal error

Return of getCalendarEvents on agenda page :
The array_merge change key of merged array.

FIX : param billed when we change page

FIX : delete bank class lines when we delete bank_categ

Fix: Wrong vat calculation when split discounts

Fix : link to user in bank was wrong regarding expensereport payment

Fix verify of elephant code model for services

Conflicts:
	htdocs/core/class/html.formprojet.class.php