mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-16 22:05:20 +00:00
ac2a8ca939
The AI chat assistant scoped tool queries by company but ignored the per-user Bouncer abilities the rest of the app enforces, so any `use ai` holder could read customers, invoices, payments, and company financials their role couldn't otherwise see. Each AiTool now declares a required ability (entity-aligned); the registry hides unauthorized tools from the model and refuses to execute them as a backstop. Separately, admin/owner-supplied URLs were fetched server-side with no guard against private/reserved targets (SSRF): the AI base URL, the CurrencyConverter "DEDICATED" exchange-rate URL, and S3/Spaces file-disk endpoints. A shared PrivateNetworkGuard now backs a PublicHttpUrl validation rule (save-time) and runtime guards in each driver. - AiTool::requiredAbility() + mapping across all 12 tools - AiToolRegistry filters schemas() by ability and re-checks in execute() - PrivateNetworkGuard / BlockedUrlException / PublicHttpUrl rule (new) - Rule wired into AI config (service + 3 controllers), exchange-rate, and file-disk endpoints; runtime guards in OpenRouterDriver, CurrencyConverterDriver, and FileDiskService - Tests for ability filtering, the guard, the rule, and 422 rejections
Introduction
InvoiceShelf is an open-source web app that helps you track expenses, record payments, and create professional invoices and estimates. It is self-hosted, multi-tenant, and built for individuals and small businesses that want to keep their books on their own infrastructure.
The web application is built with Laravel and Vue 3.
To get started using Docker Compose, follow the Installation guide.
Table of Contents
Documentation
System Requirements
- PHP 8.4+ is required (since v2.2.0, when InvoiceShelf moved to Laravel 13).
- Database: MySQL, MariaDB, PostgreSQL, or SQLite.
- Before updating from inside the app, verify your server meets the target version's PHP and extension requirements.
- The in-app updater verifies requirements and refuses to proceed if they are not met.
Download
Discord
Join the discussion on the InvoiceShelf Discord: Invite Link
Roadmap
Rough roadmap of things to come, not in any specific order:
- Automatic Update
- Email Configuration
- Installation Wizard
- Address Customisation & Default Notes
- Edit Email before Sending Invoice
- Available as a Docker image
- Performance Improvements
- Customer View Page
- Custom Fields on Invoices & Estimates
- Multiple Companies
- Recurring Invoices
- Customer Portal
- Decoupled system settings from company settings (v3.0)
- Proper multi-tenancy system (v3.0)
- Company member invitations with custom roles (v3.0)
- Dark mode (v3.0)
- Full TypeScript refactor of the frontend (v3.0)
- Improved backend architecture (v3.0)
- Security hardening (v3.0)
- Reworked installation wizard (v3.0)
- Module Directory (v3.0)
- Rewritten Payments module (v3.0)
- Accept Payments (Stripe integration)
- Improved template system for invoices and estimates
Translate
Help us translate InvoiceShelf into your language: https://crowdin.com/project/invoiceshelf
Star History
License
InvoiceShelf is released under the GNU Affero General Public License v3.0. See LICENSE for the full text.