# <?php exit('No direct script access allowed'); ?>

# InvoicePlane Configuration File

### START HERE

# Set your URL without trailing slash here, e.g. http://your-domain.com

# If you use a subdomain, use http://subdomain.your-domain.com

# If you use a subfolder, use http://your-domain.com/subfolder

IP_URL=

# Having problems? Enable debug by changing the value to 'true' to enable advanced logging

ENABLE_DEBUG=false

# Having saving troubles?

# Uncomment to disable csrf regenerated on each page load and POST (AJAX)

# CSRF_REGENERATE=false

# Disable server csrf check on each POST (AJAX)

# CSRF_PROTECTION=false

# To Show all PHP errors, change the value to 'development' (Or comment the following line)

CI_ENV=production

X_FRAME_OPTIONS=SAMEORIGIN

ENABLE_X_CONTENT_TYPE_OPTIONS=true

# Session settings

# Leave SESS_SAVE_PATH empty to use PHP's default session save path (sys_get_temp_dir()).

# To store sessions elsewhere, e.g. outside the document root, set an absolute path:

# SESS_SAVE_PATH=/srv/invoiceplane/sessions

SESS_SAVE_PATH=

# Override the session cookie name

SESS_COOKIE_NAME=ip_session

# Override the session database table name (only used when SESS_DRIVER=database)

SESS_TABLE_NAME=ip_sessions

# Destroy the old session ID after regeneration — prevents session fixation attacks.

SESS_REGENERATE_DESTROY=true

# Set this setting to 'true' if you want to disable the setup for security purposes

DISABLE_SETUP=false

# To remove index.php from the URL, set this setting to 'true'.

# Please notice the additional instructions in the htaccess file!

REMOVE_INDEXPHP=false

# These database settings are set during the initial setup

DB_HOSTNAME=

DB_USERNAME=

DB_PASSWORD=

DB_DATABASE=

DB_PORT=

# If you want to be logged out after closing your browser window, set this setting to 0 (ZERO).

# The number represents the amount of minutes after that IP will automatically log out users,

# the default is 10 days.

SESS_EXPIRATION=864000

SESS_MATCH_IP=true

# Database table used to store sessions when SESS_DRIVER=database.

# Only needed if you override the default table name.

SESS_TABLE_NAME=ip_sessions

# Name of the session cookie sent to the browser.

# Only needed if you need to avoid a collision with another application on the same domain.

SESS_COOKIE_NAME=ip_session

# Default Global Amounts Calculation mode - Since 1.6.3

# This change Taxes and discounts calcuation mode

# true : Taxes: Global Y, Item Y. Use classic calculation for Discounts & Taxes : Use same calculation as previous v1.6.3 (Default)

# false : Taxes: Global N, Item Y. Use simple item tax calculation system : Calculate Global discount before Item discount (without tax) and apply item tax on discounted total price

# Notes :

# • "when the client use e-invoice": This is automatically overridden to false by default to use "simple tax" calculation system. It for valid xml data for european models***

# • Dev Note: If you really need to override by true, just add 'legacy_calculation' => true in `$xml_settings`. (See helpers/XMLconfigs/README.md)

# • *** When use Facturx10Xml and Ubl24Xml XMLtemplates based. Download here: https://github.com/InvoicePlane/InvoicePlane-e-invoices

LEGACY_CALCULATION=true

# Enable the deletion of invoices

ENABLE_INVOICE_DELETION=false

# Disable the read-only mode for invoices

DISABLE_READ_ONLY=false

# Password reset rate limiting settings (since v1.6.4)

# Maximum password reset attempts per IP address within the time window

PASSWORD_RESET_IP_MAX_ATTEMPTS=5

# Time window in minutes for IP-based rate limiting

PASSWORD_RESET_IP_WINDOW_MINUTES=60

# Maximum password reset attempts per email address within the time window

PASSWORD_RESET_EMAIL_MAX_ATTEMPTS=3

# Time window in hours for email-based rate limiting

PASSWORD_RESET_EMAIL_WINDOW_HOURS=1

# Password reset token expiration (since v1.7.2)

# Time in minutes before a password reset token expires (default: 15 minutes)

# This prevents indefinite token validity and reduces account takeover risk

PASSWORD_RESET_TOKEN_EXPIRY_MINUTES=15

# Sumex Customizations (Swiss Medical Invoices)

# Need one (or more) Name containing "sumex" in invoice groups

# Settings panel: true to Enable - Since v-1.6.3

SUMEX_SETTINGS=false

# Set the url where post the xml to get a generated pdf - Since v-1.5.0. See https://github.com/InvoicePlane/InvoicePlane/pull/453

SUMEX_URL=

# Security: Strip EXIF metadata from uploaded images

# When enabled, removes GPS coordinates, timestamps, camera info, and other metadata from uploaded images

# This protects user privacy but may slightly reduce image quality

# Default: false (disabled)

SEC_STRIP_EXIF_FROM_IMAGES=false

# Path to a directory containing custom templates (optional)

# Useful for persistent custom templates when running in a container.

# Set an absolute path; the directory should mirror the built-in structure:

# <path>/invoice_templates/pdf/

# <path>/invoice_templates/public/

# <path>/quote_templates/pdf/

# <path>/quote_templates/public/

CUSTOM_TEMPLATES_FOLDER=

# Explicit allowlist of custom template names (without .php extension).

#

# Security: The filesystem is NEVER scanned for templates (prevents Remote Code Execution).

# Only template names listed here are made available in the UI.

# Names must contain only letters, digits, spaces, hyphens, and underscores.

#

# Format: comma-separated names. Quote the whole value when names contain spaces or hyphens.

# CUSTOM_INVOICE_TEMPLATES_PDF="My Template,Another Template"

# CUSTOM_INVOICE_TEMPLATES_PDF="Corporate - Modern,Corporate - Classic"

#

# The corresponding .php file must exist in CUSTOM_TEMPLATES_FOLDER under the matching sub-path.

CUSTOM_INVOICE_TEMPLATES_PDF=

CUSTOM_INVOICE_TEMPLATES_PUBLIC=

CUSTOM_QUOTE_TEMPLATES_PDF=

CUSTOM_QUOTE_TEMPLATES_PUBLIC=

##

## DO NOT CHANGE ANY CONFIGURATION VALUES BELOW THIS LINE!

## =======================================================

##

# This key is automatically set after the first setup. Do not change it manually!

ENCRYPTION_KEY=

ENCRYPTION_CIPHER=AES-256

# Set to true after the initial setup. Access to the setup wizard is blocked when this is true.

# To re-run the setup (e.g. after an upgrade), temporarily set this to false.

SETUP_COMPLETED=false