mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-17 06:15:20 +00:00
e92b08ef6a
The orderByField/orderBy query params were passed straight into Eloquent's orderBy() in every model's scopeWhereOrder (and Invoice::scopeApplyFilters), allowing arbitrary SQL in the ORDER BY clause (boolean-based blind injection). Adds App\Support\SafeOrderBy::apply() which only accepts a plain, optionally table-qualified column identifier as the sort target (rejecting expressions, sub-selects, etc.) and clamps the direction to asc/desc. Routed all 10 model sort sinks through it. Table-qualified columns stay valid, so joined/aliased sorts (e.g. estimates by customers.name) are unaffected. Adds unit tests covering injection rejection, plain + aliased columns, and direction clamping.
Introduction
InvoiceShelf is an open-source web & mobile app that helps you track expenses, payments & create professional invoices & estimates.
The Web Application is made using Laravel & VueJS while the Mobile Apps are built using React Native.
To get started with InvoiceShelf using Docker Compose, check out the Installation docs.
Table of Contents
Documentation
System Requirements
- Starting from v2.2.0 (Laravel 13 upgrade), InvoiceShelf requires PHP 8.4+.
- Before updating from the app settings, verify your server PHP version and required extensions.
- The in-app updater checks requirements and blocks the update if they are not met.
Download
Mobile Apps
- Andorid - Coming Soon
- IOS - Coming Soon
- Source
Discord
Join the InvoiceShelf discord server to discuss: Invite Link
Roadmap
~~Here's a rough roadmap of things to come (not in any specific order):
- Automatic Update
- Email Configuration
- Installation Wizard
- Address Customisation & Default notes
- Edit Email before Sending Invoice
- Available as a docker image
- Performance Improvements
- Customer View page
- Add and Use Custom Fields on Invoices & Estimates.
- Multiple Companies
- Recurring Invoices
- Customer Portal
- Accept Payments (Stripe Integration)
- Improved template system (invoices and estimate)
- Modules and templates marketplace
Credits
InvoiceShelf is made possible thanks to the contributions and support from many people and projects:
- Crater (project inspiration and code base)
- All contributors who have provided code, translations, reported issues, or supported the project in any way.
Translate
Help us translate on https://crowdin.com/project/invoiceshelf
License
InvoiceShelf is released under the GNU AFFERO GENERAL PUBLIC LICENSE Version 3. See LICENSE for details.