Fix #6504: CVE-2017-7886

FIX: Correction with author and validator user on orders

'defaultlang' attribute was not filtered before database request which cause an SQL injection.

Corrected PHP7 warnings for several pages

Fix download delivery and donation document

FIX supplier order line creation with rang = 0

FIX : forgotten parameter for right multicompany use

FIX : global $dateSelector isn't the good one, then date selector on …

Conflicts:
	htdocs/install/mysql/migration/repair.sql

Fix #5911 Added missing Slashes

fixed line where two slashes were missing, that caused an error when creating barcodes.

Fix Subprice was null in supplier proposal and line was not transfered to…

FIX : global $dateSelector isn't the good one, then date selector on objectline_create tpl was hidden

FIX #6679 User with restricted supplier invoice permissions can edit project, payment conditions, payment mode

FIX #6680 User with restricted supplier invoice permissions sees "reopen" button even if he has no permission to do it

FIX #6675 Restricted user with no agenda permissions can see a button to create appointment in thirdparty contact list