Fix updateline extrafields contrat fail

FIX: User id correction on holiday request

FIX invoice page list

Fix: User id correction on holiday request

Fix : SEPA XML address should also have dolEscapeXML

Fix special char and size limit in SEPA XML

Fix #6504: CVE-2017-7886

FIX: Correction with author and validator user on orders

'defaultlang' attribute was not filtered before database request which cause an SQL injection.

FIX supplier order line creation with rang = 0

FIX : forgotten parameter for right multicompany use