Unstable OpenSourcePOS

This is a build of the latest master which might contain bugs. Use at your own risk.

Check the releases section for the latest official release.

OpensourcePos 3.4.2

This release contains plenty of security fixes beside few bugfixes and improvements. We strongly advise to upgrade.

For docker users, updating docker-compose.yaml is required . There are two new env variables that need to be configured

• ALLOWED_HOSTNAMES=<domain> needs to be added to set the allowed domain for the website that is being served
• THROTTLE_KEY=<randomstring> needs to be configured for an existing installation.

For a regular install, the .env file will need to be adapted

• throttle.key will be added by the migration in case the .env is writable
• app.allowedHostnames needs to be configured once

What's Changed

• Fix writable folder permission check (#4270) by @jekkos in #4273
• Extended payment delete fix by @jekkos in #4274
• Upgrade github workflow (#3708) by @jekkos in #4280
• Fix migration 20250522000000 by @jekkos in #4284
• Upgade CI to 4.6.2 by @jekkos in #4298
• Allow empty tax category id (#4285) by @jekkos in #4288
• Fix for suspended sales (#4283) by @jekkos in #4303
• Fix reference to upload path permission check (#4270) by @jekkos in #4286
• Bump jspdf from 3.0.1 to 3.0.2 by @dependabot[bot] in #4309
• Add transactions to missing config keys migration. by @JustASideQuestNPC in #4318
• [Feature] Add logging to migrations by @JustASideQuestNPC in #4327
• Fix XSS in javascript notification by @jekkos in #4341
• Fix attachment cid by @jekkos in #4314
• Allow anonymous giftcard creation by @jekkos in #4278
• Fix config notification by @jekkos in #4343
• Fix creation of date attribute value (#4310) by @jekkos in #4344
• Escape return_policy in receipt + invoice by @jekkos in #4349
• Add show/hide cost price & profit feature - in reports #4130 by @bhojkamal in #4350
• Fixing Disallowed Characters Issue by @dilushanka in #4355
• Fix multiple XSS vulnerabilities (#3965) by @jekkos in #4356
• Bump lodash from 4.17.21 to 4.17.23 by @dependabot[bot] in #4369
• Bump jspdf and jspdf-autotable by @dependabot[bot] in #4373
• Fix XSS vulnerabilities in invoices + receipts (#3965) by @jekkos in #4363
• Fix permission bypass in Reports submodule access control by @jekkos in #4389
• Use Content-Type application/json for AJAX responses by @jekkos in #4357
• Language Array Key Typo Fix by @lyimolucasl in #4371
• Fix employee language session by @jekkos in #4377
• Broken object level authorization fix by @jekkos in #4391
• Bump dompurify from 3.3.1 to 3.3.2 by @dependabot[bot] in #4402
• Fix incorrect argument types in migration round_number() methods by @jekkos in #4403
• CSV import unit tests by @jekkos in #4399
• Fix whitelist and validate invoice template types by @jekkos in #4393
• Fix second-order SQL injection in currency_symbol config by @jekkos in #4390
• fix(security): add row-level authorization to password change endpoints by @jekkos in #4401
• Fix item thumbnail spaces by @jekkos in #4398
• Fix report permissions by @jekkos in #4397
• Fix SQL injection in custom attribute search by @jekkos in #4410
• Fix stored XSS vulnerability in item descriptions by @jekkos in #4413
• Fix stored XSS vulnerabilities in employee permissions and customer data by @jekkos in #4412
• Fix: Preserve CHECKBOX attribute state when adding attributes (#4385) by @jekkos in #4396
• Fix payment type becoming null when editing sales with dot thousands separator locales by @jekkos in #4417
• Fix broken SQL injection fix - use havingLike() for HAVING clause by @jekkos in #4416
• Fix mass assignment vulnerability in bulk edit by @jekkos in #4414
• Sync language files (#3468) by @jekkos in #4418
• [Feature]: Auto-update issue templates with releases by @jekkos in #4423
• Update SECURITY.md with published security advisories by @jekkos in #4426
• Bump jspdf from 4.1.0 to 4.2.0 by @dependabot[bot] in #4383
• Add filter persistence for table views via URL query string by @jekkos in #4400
• Fix PHPUnit test configuration for database connectivity by @jekkos in #4430
• Fix IDOR vulnerability in password change by @jekkos in #4427
• Fix XSS vulnerability in tax invoice view by @jekkos in #4432
• Fix permission bypass in Sales.getManage() access control by @jekkos in #4428
• Update SECURITY.md with published security advisories by @jekkos in #4431
• Fix SQL injection in suggestions column configuration by @jekkos in #4421
• Fix PHPUnit environment variables not being set by @jekkos in #4434
• Fix DECIMAL attribute not respecting locale format by @jekkos in #4422
• Fix stored XSS vulnerability in Attribute Definitions by @jekkos in #4429
• Fix: Host Header Injection vulnerability by @jekkos in #4433
• [Security] Fix stored XSS in reCAPTCHA Site Key on login page by @jekkos in #4436
• Fix stored XSS via stock location name by @jekkos in #4435
• Fix Token_lib::render() for PHP 8.4 compatibility by @jekkos in #4419
• Fix: Add Debit Card filter to Daily Sales and Takings by @jekkos in #4440
• Fix Taxes Summary Report totals not matching row values by @jekkos in #4437
• Fix: Restrict employee selection in expenses and receivings forms by @jekkos in #4443
• Bump jspdf from 4.2.0 to 4.2.1 by @dependabot[bot] in #4446
• Bump picomatch from 2.3.1 to 2.3.2 by @dependabot[bot] in #4451
• fix: Clear sale session after completing sale by @jekkos in #4454
• Translate missing strings in multiple languages by @jekkos in #4453
• Convert Travis CI to GitHub Actions by @jekkos in #4409
• fix: Use file-based session until database is migrated by @jekkos in #4455
• Fix negative price/quantity/discount validation by @morimori-dev in #4450
• Fix/sendmail command injection by @jekkos in #4469
• refactor: simplify release workflow to version bump only by @jekkos in #4473
• fix: Remove unused router service call in tax_helper by @jekkos in #4479
• fix: Handle empty database on fresh install by @jekkos in #4467
• Fix: Improve allowedHostnames .env configuration and fail-fast in production by @jekkos in #4482
• [Feature]: Case-sensitive attribute updates and CSV Import attribute deletion capability by @objecttothis in https://github.com/opensourcepos/...

OpensourcePos 3.4.1

Today we are thrilled to announce 3.4.1. This release adds quite some bugfixes on top of 3.4.0. The migration path for MySQL coming from versions before 3.4 was broken and should be fixed again with this version.

How to upgrade

WARNING: It's always a good idea to do a backup previous to an upgrade. This is not an exception.

• Unzip and upload Open Source Point of Sale files to the web-server.

Upgrade from release 3.4

• In case you have all config in the .env file you can just overwrite the unzipped .env file with the your custom version.

Clean install / upgrading from a release older than 3.4

• Edit the .env file in the unzipped folder root and set CI_ENVIRONMENT=development. This willl show error messages during the upgrade phase.
• Next add your database username, password and database name in database.default.username, database.default.password and database.default.database and respectively database.development.username, database.development.password and database.development.database in the .env file
• Copy your encryption key from application/config.php and paste it in the encryption.key value in the .env file in case you are upgrading
• Move the content of old uploads dir to the writable/uploads folder in case you used uploaded images
• Restore the CI_ENVIRONMENT=production in the .env file
• Go to your install public dir via the browser. A login screen should appear
• Enjoy!

What's Changed

• Feature: PSR-12 Compliant Indentation by @objecttothis in #4196
• Add .env to dist zip by @jekkos in #4199
• Add CI4 coding standards linter (#3708) by @jekkos in #4198
• Bump canvg from 3.0.10 to 3.0.11 by @dependabot in #4189
• Bump jspdf and jspdf-autotable by @dependabot in #4190
• Feature bump ci to 4.6.0 by @objecttothis in #4197
• Add Kurdish language option to UI by @BudsieBuds in #4210
• Convert language ku to ckb by @BudsieBuds in #4211
• Fix PHP 8.4 errors by @BudsieBuds in #4215
• Add default bootstrap to themes by @BudsieBuds in #4219
• Update language names by @BudsieBuds in #4218
• Update install docs by @BudsieBuds in #4217
• Convert menu icons to SVG by @BudsieBuds in #4220
• Enhance license handling by @BudsieBuds in #4223
• Fix datetime rendering (#4226) by @jekkos in #4227
• Fix datetime rendering by @jekkos in #4228
• Fix null error when sending by email a receipt of a sale that has no invoice by @diego-ramos in #4229
• Update Receivings.php to save form. by @odiea in #4231
• Update Cashups.php for ajax cashup total to work. by @odiea in #4238
• Coding style updates for PSR-12 compliance & improved readability by @BudsieBuds in #4204
• Fix Codeigniter disallowed characters error with payment types that have accents by @diego-ramos in #4232
• Fixed broken escape string for success & warning messages by @Franchovy in #4253
• Bugfix constraint migration fix by @objecttothis in #4230
• Fix item number lookup in sales/receivings (#4212) by @jekkos in #4250

New Contributors

• @diego-ramos made their first contribution in #4229
• @Franchovy made their first contribution in #4253

Full Changelog: 3.4.0...3.4.1

OpensourcePos 3.4.0

Today we are thrilled to announce 3.4.0. This release adds long awaited CI4 and PHP 8.x support

Release Highlights

• Translation updates (Spanish, Indonesian, Swedish, Urdu, Chinese, Thai, French, Dutch)
• PHP 8.x support
• MySQL 8 support
• Security fixes (XSS, SQLi)
• Migration to Gulp as buildsystem
• Decimal validation fix
• Sticky header fix
• Receipt sent as attachment
• Barcode generation library upgrade
• Bump framework to CodeIgniter 4.x.x
• Improve security performance against bots

How to upgrade

For this version an upgrade is required:

WARNING: Always a good idea to do a backup previous to an upgrade. This is not an exception.

• Unzip and upload Open Source Point of Sale files to the web-server.
• Create a .env file in the unzipped folder root and add a the following one line: CI_ENVIRONMENT=development. This will allow to show error messages during the upgrade phase
• Open app/Config/Database.php and modify credentials to connect to your database if needed.
• Copy your encryption key in application/config.php and past it in the key value on line 24 in app/Config/Encryption.php
• Move the content of old uploads dir to writable/uploads
• Go to your install public dir via the browser.
• Remove the .env file in the install root
• Enjoy!

OpensourcePos 3.3.9

Today we're delighted to announce a new release with updated translations and bug fixes. Please read below for more details.

Please use the file in attachment for a full installation.

Features

Version 3.3.9

• Translation updates (Spanish, Croatian, Russian, English, Indonesian, Thai, Central Khmer)
• Fix logout race condition issue
• Fix docker compose file
• Minor report fixes

UPGRADE from version 3.3.8

For this version an upgrade is required:

WARNING: Always a good idea to do a backup previous to an upgrade. This is not an exception.

• Backup your database.
• Backup your ospos files (normally at web server place)
• Backup your ospos/application/config/database.php and ospos/application/config/config.php files
• Remove all your ospos files (do not remove nor modify database data!!!)
• Extract the files for version 3.3.9
• Move the files to your web server place
• Copy application/config/database.php.tmpl to application/config/database.php
• Restore the content of your ospos/application/config/database.php and ospos/application/config/config.php files in the new files
• Move the content of old uploads dir to public/uploads
• Make sure your webroot points to public/ directory as index.php is now contained there
• Log into OSPOS and wait for the automatic migration to complete (the login only takes longer the first time)
• Now you are good to go and use your new version of OSPOS

OpensourcePos 3.3.8

Today we're delighted to announce a new release with new features and bug fixes. Please read below for more details.

Please use the file in attachment for a full installation.

Features

Version 3.3.8

• Translation updates (Flemish, Vietnamese, Thai, Azerbaijani, Spanish, French)
• Fix logo removal issue
• Substract refunds from total rewards if used as a payment method

UPGRADE from version 3.3.7

For this version an upgrade is required:

WARNING: Always a good idea to do a backup previous to an upgrade. This is not an exception.

• Backup your database.
• Backup your ospos files (normally at web server place)
• Backup your ospos/application/config/database.php and ospos/application/config/config.php files
• Remove all your ospos files (do not remove nor modify database data!!!)
• Extract the files for version 3.3.8
• Move the files to your web server place
• Copy application/config/database.php.tmpl to application/config/database.php
• Restore the content of your ospos/application/config/database.php and ospos/application/config/config.php files in the new files
• Move the content of old uploads dir to public/uploads
• Make sure your webroot points to public/ directory as index.php is now contained there
• Log into OSPOS and wait for the automatic migration to complete (the login only takes longer the first time)
• Now you are good to go and use your new version of OSPOS

OpensourcePos 3.3.7

Today we're delighted to announce a new release with new features and bug fixes. Please read below for more details.

Please use the file in attachment for a full installation.

Features

Version 3.3.7

• Enable search in report table
• Add cost price to reports
• Translation updates (Thai, Swedish, Italian)
• Invoice numbering fixes (#3408)
• Fix delete items filter in item list (#3402)

UPGRADE from version 3.3.6

For this version an upgrade is required:

WARNING: Always a good idea to do a backup previous to an upgrade. This is not an exception.

• Backup your database.
• Backup your ospos files (normally at web server place)
• Backup your ospos/application/config/database.php and ospos/application/config/config.php files
• Remove all your ospos files (do not remove nor modify database data!!!)
• Extract the files for version 3.3.6
• Move the files to your web server place
• Copy application/config/database.php.tmpl to application/config/database.php
• Restore the content of your ospos/application/config/database.php and ospos/application/config/config.php files in the new files
• Move the content of old uploads dir to public/uploads
• Make sure your webroot points to public/ directory as index.php is now contained there
• Log into OSPOS and wait for the automatic migration to complete (the login only takes longer the first time)
• Now you are good to go and use your new version of OSPOS

OpensourcePos 3.3.6

Today we're delighted to announce a new release with new features and bug fixes. Please read below for more details.

Please use the file in attachment for a full installation.

Features

Version 3.3.6

• Translation updates (Hungarian, Indonesian, Bosnian, Ukranian, Vietnamese, Spanish)
• Several CSRF and XSS fixes
• Hardening against XSS by introducing a CSP header in the HTTP headers
• Fixes for the payment summary after refresh
• Make footer revision clickable (ref to github)
• reCaptcha issue fix
• Type juggling password fix for old logins
• Clickjacking security mitigations
• Minor reporting adjustments
• Username verification bugfix
• Introduced new global keyboard shortcuts (see overview below)

    ESC     Cancels Current Quote/Invoice/Sale
    ALT + 1         Item Search
    ALT + 2         Customer Search
    ALT + 3         Suspend Current Sale
    ALT + 4         Show Suspended Sales
    ALT + 5         Edit Amount Tendered
    ALT + 6         Add Payment
    ALT + 7         Add Payment and Complete Invoice/Sale
    ALT + 8         Finish Quote/Invoice witdout payment
    ALT + 9         Open Shortcuts Window

    F11 Full Screen mode
    CTRL + Zoom in
    CTRL - Zoom out
    CTRL 0 Reset Zoom

    CTRL P Print out current page
    CTRL F Search reports tables

For this release we would like to thank all the contributors for the continuous effort to keep the project moving forward. Keep up the good work! You know who you are.

UPGRADE from version 3.3.4

For this version an upgrade is required:

WARNING: Always a good idea to do a backup previous to an upgrade. This is not an exception.

• Backup your database.
• Backup your ospos files (normally at web server place)
• Backup your ospos/application/config/database.php and ospos/application/config/config.php files
• Remove all your ospos files (do not remove nor modify database data!!!)
• Extract the files for version 3.3.6
• Move the files to your web server place
• Copy application/config/database.php.tmpl to application/config/database.php
• Restore the content of your ospos/application/config/database.php and ospos/application/config/config.php files in the new files
• Move the content of old uploads dir to public/uploads
• Make sure your webroot points to public/ directory as index.php is now contained there
• Log into OSPOS and wait for the automatic migration to complete (the login only takes longer the first time)
• Now you are good to go and use your new version of OSPOS

OpensourcePos 3.3.4

Today we're delighted to announce a new release with new features and bug fixes. Please read below for more details.

Please use the file in attachment for a full installation.

Features

Version 3.3.4

• Translation updates (Hungarian, Indonesian, Bosnian, Ukranian, Vietnamese, Spanish)
• Prevent data wipeout when calling GET directly on save endpoint
• Cleanup .htaccess
• Docker compose usability improvements
• Cookie secure flag fix for Chrome (you can enable csrf protection again now)
• Use longblob for session storage. This should fix issues preventing a user from adding a large number of items to register
• Cashrounding bugfixes
• Fix daily overview cash sale totals
• Show sale count in transaction report
• Button disable to prevent double submission
• Add barcode field to item kits
• Fix discount register parsing in some specific locales

For this release we would like to thank all the contributors for the continuous effort to keep the project moving forward. Keep up the good work! You know who you are.

UPGRADE from version 3.3.3

For this version an upgrade is required:

WARNING: Always a good idea to do a backup previous to an upgrade. This is not an exception.

• Backup your database.
• Backup your ospos files (normally at web server place)
• Backup your ospos/application/config/database.php and ospos/application/config/config.php files
• Remove all your ospos files (do not remove nor modify database data!!!)
• Extract the files for version 3.3.4
• Move the files to your web server place
• Copy application/config/database.php.tmpl to application/config/database.php
• Restore the content of your ospos/application/config/database.php and ospos/application/config/config.php files in the new files
• Move the content of old uploads dir to public/uploads
• Make sure your webroot points to public/ directory as index.php is now contained there
• Log into OSPOS and wait for the automatic migration to complete (the login only takes longer the first time)
• Now you are good to go and use your new version of OSPOS

OpensourcePos 3.3.3

Today we're delighted to announce a new release with new features and bug fixes. Please read below for more details.

Please use the file in attachment for a full installation.

Features

Version 3.3.3

• Translation updates (Turkish, Flemish, Russian, Arzebadjian, Central Khmer)
• Docker-compose fix for nginx logging (#2953)
• Minor fix for permission settings in system config screen
• Improve table sorting in reports
• Updated composer packages and js plugins
• Removed default sale mode in configuration (default is receipt mode now always)
• Prevent double form submit (#3044)
• Reset payment on item remove and sales register mode change (#3043)
• Quote, invoice and work order template cleanup
• Fix invoice email CSS layout (#3019)
• Use float precision as upper limit for decimal parsing (#3004)
• Add cash rounding type of half (#2922)
• Fix inventory item_quantities correction bug after removing decimal quantity sales (#2964)
• Fix receiving return total (#3033)
• Make receiving data readonly (#2843)
• Fix detailed sales report (#2967)
• Fix supplier category after update (#2972)
• Add credit card filtering on taking screen (#2983)
• Improve PHP7.4 compatibility (#2996)
• Set PHP 7.2 to be the minimum level due to older version deprecations
• Added email CC and BCC (see config/email.php)
• Cash rounding to nearest 5 cents
• Improved security (CSRF protection)
• Various small improvements and bug fixes

For this release we would like to thank all the contributors for the continuous effort to keep the project moving forward. Keep up the good work! You know who you are.

UPGRADE from version 3.3.2

For this version an upgrade is required:

WARNING: Always a good idea to do a backup previous to an upgrade. This is not an exception.

• Backup your database.
• Backup your ospos files (normally at web server place)
• Backup your ospos/application/config/database.php and ospos/application/config/config.php files
• Remove all your ospos files (do not remove nor modify database data!!!)
• Extract the files for version 3.3.3
• Move the files to your web server place
• Copy application/config/database.php.tmpl to application/config/database.php
• Restore the content of your ospos/application/config/database.php and ospos/application/config/config.php files in the new files
• Move the content of old uploads dir to public/uploads
• Make sure your webroot points to public/ directory as index.php is now contained there
• Log into OSPOS and wait for the automatic migration to complete (the login only takes longer the first time)
• Now you are good to go and use your new version of OSPOS