Normalize line endings

Fix locale parsing
Restore secondary display sales flow
2026-05-25 08:44:42 -04:00 · 2026-05-22 11:52:08 +03:00 · 2026-05-20 23:37:54 +03:00 · 2026-05-19 21:33:54 +03:00 · 2026-05-19 16:02:05 +04:00 · 2026-05-18 21:48:02 +02:00
42 changed files with 1737 additions and 153 deletions
--- a/.env.example
+++ b/.env.example
@@ -16,6 +16,9 @@ CI_ENVIRONMENT = production
 # Configure with comma-separated list of domains/subdomains:
 #   app.allowedHostnames = 'yourdomain.com,www.yourdomain.com'
 #
+# Or via environment variable (useful for Docker/Compose):
+#   ALLOWED_HOSTNAMES=yourdomain.com,www.yourdomain.com
+#
 # For local development:
 #   app.allowedHostnames = 'localhost'
 #
--- a/.github/workflows/deploy-core.yml
+++ b/.github/workflows/deploy-core.yml
@@ -0,0 +1,219 @@
+name: Deploy Core
+
+on:
+  workflow_call:
+    inputs:
+      image_tag:
+        description: 'Docker image tag to deploy'
+        type: string
+        required: true
+      sha:
+        description: 'Git commit SHA to deploy'
+        type: string
+        required: true
+      description:
+        description: 'Deployment description'
+        type: string
+        required: true
+      pr_number:
+        description: 'Pull request number (optional)'
+        type: string
+        required: false
+    outputs:
+      deployment_id:
+        description: 'GitHub deployment ID'
+        value: ${{ jobs.deploy.outputs.deployment_id }}
+      status:
+        description: 'Deployment status (success/failure)'
+        value: ${{ jobs.deploy.outputs.status }}
+
+concurrency:
+  group: deploy-staging
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  deployments: write
+
+jobs:
+  deploy:
+    name: Deploy to staging
+    runs-on: ubuntu-latest
+    
+    environment:
+      name: staging
+      url: ${{ vars.DEPLOY_URL || 'https://dev.opensourcepos.org' }}
+      deployment: false
+    
+    outputs:
+      deployment_id: ${{ steps.deployment.outputs.deployment_id }}
+      status: ${{ steps.webhook.outputs.status }}
+    
+    steps:
+      - name: Create GitHub Deployment
+        id: deployment
+        env:
+          GH_TOKEN: ${{ github.token }}
+          IMAGE_TAG: ${{ inputs.image_tag }}
+          REF_SHA: ${{ inputs.sha }}
+          DESCRIPTION: ${{ inputs.description }}
+        run: |
+          set -euo pipefail
+          
+          DEPLOYMENT_ID=$(gh api "repos/${GITHUB_REPOSITORY}/deployments" \
+            -X POST \
+            -f ref="${REF_SHA}" \
+            -f environment="staging" \
+            -f description="${DESCRIPTION}" \
+            -F auto_merge=false \
+            -F required_contexts[] \
+            --jq '.id')
+          
+          if [ -z "$DEPLOYMENT_ID" ]; then
+            echo "::error::Failed to create deployment"
+            exit 1
+          fi
+          
+          echo "deployment_id=$DEPLOYMENT_ID" >> "$GITHUB_OUTPUT"
+          echo "Created deployment: $DEPLOYMENT_ID"
+      
+      - name: Set deployment status to in_progress
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          
+          gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
+            -X POST \
+            -f state="in_progress" \
+            -f description="Deployment in progress..." \
+            -f log_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+      
+      - name: Trigger deployment webhook
+        id: webhook
+        env:
+          DEPLOY_WEBHOOK_URL: ${{ secrets.DEPLOY_WEBHOOK_URL }}
+          DEPLOY_WEBHOOK_SECRET: ${{ secrets.DEPLOY_WEBHOOK_SECRET }}
+          DOCKER_REPO_NAME: ${{ secrets.DOCKER_REPO_NAME }}
+          IMAGE_TAG: ${{ inputs.image_tag }}
+          REF_SHA: ${{ inputs.sha }}
+          DEPLOYMENT_ID: ${{ steps.deployment.outputs.deployment_id }}
+          PR_NUMBER: ${{ inputs.pr_number }}
+        run: |
+          set -euo pipefail
+          
+          if [ -z "$DEPLOY_WEBHOOK_URL" ]; then
+            echo "::error::DEPLOY_WEBHOOK_URL secret is not configured"
+            echo "Please add the DEPLOY_WEBHOOK_URL secret in your repository settings"
+            echo "status=failure" >> "$GITHUB_OUTPUT"
+            exit 1
+          fi
+          
+          REPO_NAME="${DOCKER_REPO_NAME:-opensourcepos/opensourcepos}"
+          REPO_NAMESPACE="${REPO_NAME%%/*}"
+          REPO_SHORT_NAME="${REPO_NAME#*/}"
+          PUSHED_AT=$(date +%s)
+          
+          if [ -n "$PR_NUMBER" ]; then
+            PAYLOAD=$(jq -n \
+              --arg callback_url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
+              --argjson pushed_at "$PUSHED_AT" \
+              --arg pusher "$GITHUB_ACTOR" \
+              --arg tag "$IMAGE_TAG" \
+              --arg repo_name "$REPO_NAME" \
+              --arg name "$REPO_SHORT_NAME" \
+              --arg namespace "$REPO_NAMESPACE" \
+              --arg repo_url "https://hub.docker.com/r/${REPO_NAME}/" \
+              --arg deployment_id "$DEPLOYMENT_ID" \
+              --arg repository "$GITHUB_REPOSITORY" \
+              --arg sha "$REF_SHA" \
+              --arg run_id "$GITHUB_RUN_ID" \
+              --arg actor "$GITHUB_ACTOR" \
+              --argjson pr_number "$PR_NUMBER" \
+              '{
+                callback_url: $callback_url,
+                push_data: {pushed_at: $pushed_at, pusher: $pusher, tag: $tag},
+                repository: {repo_name: $repo_name, name: $name, namespace: $namespace, repo_url: $repo_url, status: "Active"},
+                github_deployment: {id: $deployment_id, environment: "staging", repository: $repository, sha: $sha, run_id: $run_id, actor: $actor, pull_request: $pr_number}
+              }')
+          else
+            PAYLOAD=$(jq -n \
+              --arg callback_url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
+              --argjson pushed_at "$PUSHED_AT" \
+              --arg pusher "$GITHUB_ACTOR" \
+              --arg tag "$IMAGE_TAG" \
+              --arg repo_name "$REPO_NAME" \
+              --arg name "$REPO_SHORT_NAME" \
+              --arg namespace "$REPO_NAMESPACE" \
+              --arg repo_url "https://hub.docker.com/r/${REPO_NAME}/" \
+              --arg deployment_id "$DEPLOYMENT_ID" \
+              --arg repository "$GITHUB_REPOSITORY" \
+              --arg sha "$REF_SHA" \
+              --arg run_id "$GITHUB_RUN_ID" \
+              --arg actor "$GITHUB_ACTOR" \
+              '{
+                callback_url: $callback_url,
+                push_data: {pushed_at: $pushed_at, pusher: $pusher, tag: $tag},
+                repository: {repo_name: $repo_name, name: $name, namespace: $namespace, repo_url: $repo_url, status: "Active"},
+                github_deployment: {id: $deployment_id, environment: "staging", repository: $repository, sha: $sha, run_id: $run_id, actor: $actor}
+              }')
+          fi
+          
+          echo "Sending webhook..."
+          echo "Image: ${IMAGE_TAG}"
+          echo "Environment: staging"
+          
+          HEADERS=(-H "Content-Type: application/json")
+          
+          if [ -n "$DEPLOY_WEBHOOK_SECRET" ]; then
+            SIGNATURE=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$DEPLOY_WEBHOOK_SECRET" | sed 's/.*= //')
+            HEADERS+=(-H "X-Hub-Signature-256: sha256=$SIGNATURE")
+            echo "Using HMAC-SHA256 signature verification"
+          else
+            echo "::warning::DEPLOY_WEBHOOK_SECRET not set - webhook calls will not be signed"
+            echo "For security, configure DEPLOY_WEBHOOK_SECRET in your repository settings"
+          fi
+          
+          HTTP_CODE=$(curl -sS --connect-timeout 10 --max-time 120 \
+            -o response.txt -w "%{http_code}" \
+            -X POST \
+            "${HEADERS[@]}" \
+            -d "$PAYLOAD" \
+            "$DEPLOY_WEBHOOK_URL") || HTTP_CODE="000"
+          
+          echo "Response code: $HTTP_CODE"
+          if [ -s response.txt ]; then
+            cat response.txt
+          fi
+          
+          if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
+            echo "status=success" >> "$GITHUB_OUTPUT"
+          else
+            echo "status=failure" >> "$GITHUB_OUTPUT"
+          fi
+      
+      - name: Set deployment status
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          IMAGE_TAG: ${{ inputs.image_tag }}
+        run: |
+          set -euo pipefail
+          
+          STATE="${{ steps.webhook.outputs.status }}"
+          
+          if [ "$STATE" = "success" ]; then
+            DESCRIPTION=$(jq -nr --arg tag "$IMAGE_TAG" \
+              '"Deployed image \($tag) to staging"')
+            
+            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
+              -X POST \
+              -f state="success" \
+              -f description="$DESCRIPTION"
+          else
+            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
+              -X POST \
+              -f state="failure" \
+              -f description="Deployment failed"
+            exit 1
+          fi
--- a/.github/workflows/deploy-pr.yml
+++ b/.github/workflows/deploy-pr.yml
@@ -0,0 +1,79 @@
+name: PR Deploy
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+concurrency:
+  group: staging-deploy
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  deployments: write
+  pull-requests: write
+
+jobs:
+  prepare:
+    name: Prepare deployment
+    runs-on: ubuntu-latest
+    if: >
+      github.event.review.state == 'approved' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    outputs:
+      image_tag: ${{ steps.image.outputs.tag }}
+      sha: ${{ github.event.pull_request.head.sha }}
+      pr_number: ${{ github.event.pull_request.number }}
+    
+    steps:
+      - name: Checkout PR
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      
+      - name: Get image tag
+        id: image
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          IMAGE_TAG="pr-${PR_NUMBER}-${PR_SHA:0:7}"
+          echo "tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
+
+  deploy:
+    name: Deploy to staging
+    needs: prepare
+    uses: ./.github/workflows/deploy-core.yml
+    with:
+      image_tag: ${{ needs.prepare.outputs.image_tag }}
+      sha: ${{ needs.prepare.outputs.sha }}
+      description: Deploy PR #${{ needs.prepare.outputs.pr_number }} to staging
+      pr_number: ${{ needs.prepare.outputs.pr_number }}
+    secrets: inherit
+
+  comment:
+    name: Comment deployment status
+    needs: [prepare, deploy]
+    if: always()
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+      IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
+      PR_NUMBER: ${{ needs.prepare.outputs.pr_number }}
+      REF_SHA: ${{ needs.prepare.outputs.sha }}
+      STATUS: ${{ needs.deploy.outputs.status }}
+    
+    steps:
+      - name: Comment on PR
+        run: |
+          if [ "$STATUS" = "success" ]; then
+            BODY=$(jq -nr --arg tag "$IMAGE_TAG" --arg sha "$REF_SHA" --arg url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
+              '"✅ **Staging deployment completed**\n\n🔗 **URL**: https://dev.opensourcepos.org\n📦 **Image Tag**: `\($tag)`\n🔨 **Commit**: \($sha)\n\nView logs: \($url)"')
+          else
+            BODY=$(jq -nr --arg url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
+              '"❌ **Staging deployment failed**\n\nCheck the [workflow logs](\($url)) for details."')
+          fi
+          
+          gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
+            -X POST \
+            -f body="$BODY"
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,23 @@
+name: Deploy
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: 'Docker image tag to deploy (e.g., v3.4.0, latest)'
+        required: true
+        default: 'latest'
+
+permissions:
+  contents: read
+  deployments: write
+
+jobs:
+  deploy:
+    name: Deploy to staging
+    uses: ./.github/workflows/deploy-core.yml
+    with:
+      image_tag: ${{ inputs.image_tag }}
+      sha: ${{ github.sha }}
+      description: Deploy image ${{ inputs.image_tag }}
+    secrets: inherit
--- a/3
+++ b/3
@@ -13,7 +13,8 @@ RUN echo "date.timezone = \"\${PHP_TIMEZONE}\"" > /usr/local/etc/php/conf.d/time

 WORKDIR /app
 COPY --chown=www-data:www-data . /app
-RUN chmod 770 /app/writable/uploads /app/writable/logs /app/writable/cache \
+RUN chmod 750 /app/writable/logs /app/writable/uploads /app/writable/cache /app/public/uploads /app/public/uploads/item_pics \
+    && chmod 640 /app/writable/uploads/importCustomers.csv \
    && ln -s /app/*[^public] /var/www \
    && rm -rf /var/www/html \
    && ln -nsf /app/public /var/www/html
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -5,8 +5,9 @@
  - [Supported Versions](#supported-versions)
  - [Security Advisories](#security-advisories)
  - [Reporting a Vulnerability](#reporting-a-vulnerability)
+  - [Disclosure Process](#disclosure-process)

-<!-- END doctoc generated TOC please keep comment here to allow auto update -->
+<!-- END doctoc generated TOC please keep comment here to allow update -->

 # Security Policy

@@ -21,26 +22,116 @@ We release patches for security vulnerabilities.

 ## Security Advisories

-The following security vulnerabilities have been published:
-
-### High Severity
-
-| CVE | Vulnerability | CVSS | Published | Fixed In | Credit |
-|-----|--------------|------|-----------|----------|--------|
-| [CVE-2025-68434](https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-wjm4-hfwg-5w5r) | CSRF leading to Admin Creation | 8.8 | 2025-12-17 | 3.4.2 | @Nixon-H, @jekkos |
-| [CVE-2025-68147](https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-xgr7-7pvw-fpmh) | Stored XSS in Return Policy | 8.1 | 2025-12-17 | 3.4.2 | @Nixon-H, @jekkos |
-| [CVE-2025-66924](https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-gv8j-f6gq-g59m) | Stored XSS in Item Kits | 7.2 | 2026-03-04 | 3.4.2 | @hungnqdz, @omkaryepre |
-
-### Medium Severity
-
-| CVE | Vulnerability | CVSS | Published | Fixed In | Credit |
-|-----|--------------|------|-----------|----------|--------|
-| [CVE-2025-68658](https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-32r8-8r9r-9chw) | Stored XSS in Company Name | 4.3 | 2026-01-13 | 3.4.2 | @hungnqdz |
-
-For a complete list including draft advisories, see our [GitHub Security Advisories page](https://github.com/opensourcepos/opensourcepos/security/advisories).
+For a complete list of published and draft security advisories with CVE details, see our [GitHub Security Advisories page](https://github.com/opensourcepos/opensourcepos/security/advisories).

 ## Reporting a Vulnerability

-Please report (suspected) security vulnerabilities to **[jeroen@steganos.dev](mailto:jeroen@steganos.dev)**. 
+**Option 1: GitHub Security Advisory (Preferred)**

-You will receive a response from us within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.
+1. Create a draft security advisory directly on GitHub:
+   - Go to https://github.com/opensourcepos/opensourcepos/security/advisories
+   - Click "New draft security advisory"
+   - Fill in the vulnerability details using our [template below](#vulnerability-template)
+   - Submit as **draft** (not published)
+
+2. Notify us for triage:
+   - Send an email to **[jeroen@steganos.dev](mailto:jeroen@steganos.dev)** with:
+     - Subject: `[GHSA] Brief description of vulnerability`
+     - Link to the draft advisory
+     - Brief summary
+
+**Option 2: Email Report**
+
+Send vulnerability details to **[jeroen@steganos.dev](mailto:jeroen@steganos.dev)**.
+
+You will receive a response within 48 hours. Confirmed vulnerabilities will be patched within a few days depending on complexity.
+
+## Disclosure Process
+
+### Timeline
+
+| Step | Timeline | Action |
+|------|----------|--------|
+| 1. Report received | Day 0 | We acknowledge within 48 hours |
+| 2. Triage & confirmation | Day 1-3 | We validate the vulnerability |
+| 3. Fix development | Day 3-7 | We develop and test the fix |
+| 4. Patch release | Day 7-10 | We release a security patch |
+| 5. CVE request | Day 7-14 | We request CVE from GitHub (if applicable) |
+| 6. Advisory published | Day 14 | We publish the advisory with credit |
+| 7. Public disclosure | Day 14+ | Full disclosure after patch release |
+
+### CVE Process
+
+**We request CVE identifiers through GitHub's security advisory system.** This is the preferred and easiest method:
+
+1. After we confirm and fix the vulnerability, we'll request a CVE through GitHub
+2. GitHub coordinates with MITRE on our behalf
+3. The CVE is automatically linked to the advisory
+4. You'll be credited as the reporter in the published advisory
+
+**Already have a CVE?** If you've already obtained a CVE from another source (e.g., VulDB, CVE.MITRE.ORG), please include it in your report or advisory. We'll update our advisory to reference the existing CVE.
+
+### No Bug Bounty Program
+
+**Important:** Open Source Point of Sale does not offer a bug bounty program.
+
+- All security research and vulnerability triage is done on a **voluntary basis** in our free time
+- We do not offer monetary rewards for vulnerability reports
+- We do credit reporters in published advisories (unless anonymity is requested)
+- We greatly appreciate the security research community's efforts to help improve project security
+
+### Security Best Practices for Researchers
+
+- **Do not** access, modify, or delete data that doesn't belong to you
+- **Do not** perform denial of service attacks
+- **Do not** publicly disclose vulnerabilities before we've had time to fix them
+- **Do** provide sufficient information to reproduce the vulnerability
+- **Do** allow us reasonable time to fix before public disclosure
+- **Do** report through official channels (GitHub advisories or email)
+
+### Vulnerability Template
+
+When creating a draft advisory, please include:
+
+```
+## Summary
+[Brief description of the vulnerability]
+
+## Impact
+- **Confidentiality:** [High/Medium/Low - what data can be exposed]
+- **Integrity:** [High/Medium/Low - what can be modified]
+- **Availability:** [High/Medium/Low - service disruption potential]
+- **Privilege Required:** [None/Low/High - authentication level needed]
+- **CVSS v3.1:** [Score] ([Vector string])
+
+## Details
+[Technical details about the vulnerability]
+
+**Affected Code:**
+```php
+// Path to affected file and vulnerable code
+```
+
+**Attack Vector:**
+[How an attacker can exploit this]
+
+## Proof of Concept
+```bash
+# Steps to reproduce
+```
+
+## Patch
+[Suggested fix or approach]
+
+## Affected Versions
+- OpenSourcePOS X.Y.Z and earlier
+
+## Credit
+[Your GitHub username or preferred name]
+```
+
+---
+
+**Thank you to all security researchers who have contributed to making Open Source Point of Sale more secure.** Your voluntary efforts help protect thousands of users worldwide and contribute to a safer, more trustworthy free and open-source software ecosystem. We deeply appreciate your responsible disclosure and the time you invest in improving our project.
+
+If you've reported a vulnerability and would like to discuss CVE coordination or have questions about the process, please reach out to us at [jeroen@steganos.dev](mailto:jeroen@steganos.dev).
--- a/app/Config/App.php
+++ b/app/Config/App.php
@@ -58,9 +58,9 @@ class App extends BaseConfig
     * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
     * If you want to accept multiple Hostnames, set this.
     *
-     * E.g.,
-     * When your site URL ($baseURL) is 'http://example.com/', and your site
-     * also accepts 'http://media.example.com/' and 'http://accounts.example.com/':
+     * Or via environment variable (useful for Docker/Compose):
+     *   ALLOWED_HOSTNAMES=example.com,www.example.com
+     * 
     *     ['media.example.com', 'accounts.example.com']
     *
     * @var list<string>
@@ -286,7 +286,11 @@ class App extends BaseConfig

        // Solution for CodeIgniter 4 limitation: arrays cannot be set from .env
        // See: https://github.com/codeigniter4/CodeIgniter4/issues/7311
-        $envAllowedHostnames = getenv('app.allowedHostnames');
+        // Support both: app.allowedHostnames (from .env) and ALLOWED_HOSTNAMES (from environment/Docker)
+        $envAllowedHostnames = getenv('ALLOWED_HOSTNAMES');
+        if ($envAllowedHostnames === false || trim($envAllowedHostnames) === '') {
+            $envAllowedHostnames = getenv('app.allowedHostnames');
+        }
        if ($envAllowedHostnames !== false && trim($envAllowedHostnames) !== '') {
            $this->allowedHostnames = array_values(array_filter(
                array_map('trim', explode(',', $envAllowedHostnames)),
@@ -327,7 +331,7 @@ class App extends BaseConfig
            $errorMessage =
                'Security: allowedHostnames is not configured. ' .
                'Host header injection protection is disabled. ' .
-                'Set app.allowedHostnames in your .env file. ' .
+                'Set app.allowedHostnames in your .env file or ALLOWED_HOSTNAMES environment variable. ' .
                'Example: app.allowedHostnames = "example.com,www.example.com" ' .
                'Received Host: ' . $httpHost;

--- a/app/Config/OSPOS.php
+++ b/app/Config/OSPOS.php
@@ -5,6 +5,7 @@ namespace Config;
 use App\Models\Appconfig;
 use CodeIgniter\Cache\CacheInterface;
 use CodeIgniter\Config\BaseConfig;
+use Config\Database;

 /**
 * This class holds the configuration options stored from the database so that on launch those settings can be cached
@@ -13,7 +14,7 @@ use CodeIgniter\Config\BaseConfig;
 */
 class OSPOS extends BaseConfig
 {
-    public array $settings;
+    public array $settings = [];
    public string $commit_sha1 = 'dev';    // TODO: Travis scripts need to be updated to replace this with the commit hash on build
    private CacheInterface $cache;

@@ -33,25 +34,35 @@ class OSPOS extends BaseConfig

        if ($cache) {
            $this->settings = decode_array($cache);
-        } else {
-            try {
-                $appconfig = model(Appconfig::class);
-                foreach ($appconfig->get_all()->getResult() as $app_config) {
-                    $this->settings[$app_config->key] = $app_config->value;
-                }
-                $this->cache->save('settings', encode_array($this->settings));
-            } catch (\Exception $e) {
-                // Database table doesn't exist yet (migrations haven't run)
-                // or database connection failed. Return empty settings to
-                // allow migration page to display. Catches mysqli_sql_exception
-                // which is not a subclass of DatabaseException.
-                $this->settings = [
-                    'language' => 'english',
-                    'language_code' => 'en',
-                    'company' => 'Home'
-                ];
-            }
+            return;
        }
+
+        try {
+            $db = Database::connect();
+
+            if (!$db->tableExists('app_config')) {
+                $this->settings = $this->getDefaultSettings();
+                return;
+            }
+
+            $appconfig = model(Appconfig::class);
+            foreach ($appconfig->get_all()->getResult() as $app_config) {
+                $this->settings[$app_config->key] = $app_config->value;
+            }
+            $this->cache->save('settings', encode_array($this->settings));
+        } catch (\Exception $e) {
+            $this->settings = $this->getDefaultSettings();
+        }
+    }
+
+    private function getDefaultSettings(): array
+    {
+        return [
+            'language'      => 'english',
+            'language_code' => 'en',
+            'company'       => 'Home',
+            'barcode_type'  => 'Code39'
+        ];
    }

    /**
@@ -62,4 +73,4 @@ class OSPOS extends BaseConfig
        $this->cache->delete('settings');
        $this->set_settings();
    }
-}
+}
--- a/app/Config/Routes.php
+++ b/app/Config/Routes.php
@@ -1,4 +1,4 @@
-<?php
+<?php

 use CodeIgniter\Router\RouteCollection;

@@ -12,6 +12,40 @@ $routes->get('login', 'Login::index');
 $routes->post('login', 'Login::index');
 $routes->post('migrate', 'Login::migrate');

+$routes->get('sales', 'Sales::getIndex');
+$routes->get('sales/customerDisplay', 'Sales::getCustomerDisplay');
+$routes->get('sales/itemSearch', 'Sales::getItemSearch');
+$routes->post('sales/selectCustomer', 'Sales::postSelectCustomer');
+$routes->post('sales/changeMode', 'Sales::postChangeMode');
+$routes->post('sales/setComment', 'Sales::postSetComment');
+$routes->post('sales/setInvoiceNumber', 'Sales::postSetInvoiceNumber');
+$routes->post('sales/setPaymentType', 'Sales::postSetPaymentType');
+$routes->post('sales/setPrintAfterSale', 'Sales::postSetPrintAfterSale');
+$routes->post('sales/setPriceWorkOrders', 'Sales::postSetPriceWorkOrders');
+$routes->post('sales/setEmailReceipt', 'Sales::postSetEmailReceipt');
+$routes->post('sales/addPayment', 'Sales::postAddPayment');
+$routes->post('sales/add', 'Sales::postAdd');
+$routes->post('sales/editItem/(:segment)', 'Sales::postEditItem/$1');
+$routes->post('sales/deleteItem/(:segment)', 'Sales::getDeleteItem/$1');
+$routes->post('sales/deletePayment/(:segment)', 'Sales::getDeletePayment/$1');
+$routes->post('sales/removeCustomer', 'Sales::getRemoveCustomer');
+$routes->post('sales/complete', 'Sales::postComplete');
+$routes->post('sales/cancel', 'Sales::postCancel');
+$routes->post('sales/suspend', 'Sales::postSuspend');
+$routes->post('sales/unsuspend', 'Sales::postUnsuspend');
+$routes->post('sales/checkInvoiceNumber', 'Sales::postCheckInvoiceNumber');
+$routes->post('sales/changeItemNumber', 'Sales::postChangeItemNumber');
+$routes->post('sales/changeItemName', 'Sales::postChangeItemName');
+$routes->post('sales/changeItemDescription', 'Sales::postChangeItemDescription');
+$routes->get('sales/suspended', 'Sales::getSuspended');
+$routes->get('sales/discardSuspendedSale', 'Sales::getDiscardSuspendedSale');
+$routes->get('sales/sales_keyboard_help', 'Sales::getSalesKeyboardHelp');
+$routes->get('sales/receipt/(:num)', 'Sales::getReceipt/$1');
+$routes->get('sales/invoice/(:num)', 'Sales::getInvoice/$1');
+$routes->get('sales/edit/(:num)', 'Sales::getEdit/$1');
+$routes->post('sales/delete/(:num)', 'Sales::postDelete/$1');
+$routes->post('sales/save/(:num)', 'Sales::postSave/$1');
+
 $routes->add('no_access/index/(:segment)', 'No_access::index/$1');
 $routes->add('no_access/index/(:segment)/(:segment)', 'No_access::index/$1/$2');

--- a/app/Controllers/Config.php
+++ b/app/Controllers/Config.php
@@ -82,7 +82,7 @@ class Config extends Secure_Controller
        $npmDev = false;
        $license = [];

-        $license[$i]['title'] = 'Open Source Point of Sale ' . config('App')->application_version;
+        $license[$i]['title'] = 'Open Source Point Of Sale ' . config('App')->application_version;

        if (file_exists('license/LICENSE')) {
            $license[$i]['text'] = file_get_contents('license/LICENSE', false, null, 0, 3000);
@@ -241,6 +241,28 @@ class Config extends Secure_Controller
        $data['show_office_group'] = $this->module->get_show_office_group();
        $data['currency_code'] = $this->config['currency_code'] ?? '';
        $data['dbVersion'] = mysqli_get_server_info($this->db->getConnection());
+        $data['scale_export_formats'] = [
+            'txt' => 'TXT',
+            'csv' => 'CSV',
+        ];
+        $data['scale_export_charsets'] = [
+            'windows-1256' => 'Windows-1256',
+            'utf-8' => 'UTF-8',
+            'windows-1252' => 'Windows-1252',
+        ];
+        $data['scale_export_delimiters'] = [
+            ';' => ';',
+            ',' => ',',
+            "\t" => 'Tab',
+        ];
+        $data['scale_export_fields_options'] = [
+            'legacy_code' => lang('Items.item_number'),
+            'item_number' => lang('Items.item_number'),
+            'repeat_item_number' => lang('Items.item_number'),
+            'name' => lang('Items.name'),
+            'unit_price' => lang('Items.unit_price'),
+            'legacy_tail' => lang('Items.item_number'),
+        ];

        // Load all the license statements, they are already XSS cleaned in the private function
        $data['licenses'] = $this->_licenses();
@@ -394,6 +416,7 @@ class Config extends Secure_Controller
            'suggestions_third_column'          => $this->validateSuggestionsColumn($this->request->getPost('suggestions_third_column'), 'other'),
            'giftcard_number'                   => $this->request->getPost('giftcard_number'),
            'derive_sale_quantity'              => $this->request->getPost('derive_sale_quantity') != null,
+            'customer_display_enabled'          => $this->request->getPost('customer_display_enabled') != null,
            'multi_pack_enabled'                => $this->request->getPost('multi_pack_enabled') != null,
            'include_hsn'                       => $this->request->getPost('include_hsn') != null,
            'category_dropdown'                 => $this->request->getPost('category_dropdown') != null
@@ -474,13 +497,36 @@ class Config extends Secure_Controller
     */
    public function postSaveLocale(): ResponseInterface
    {
-        $exploded = explode(":", $this->request->getPost('language'));
+        $language = trim((string) $this->request->getPost('language'));
+        $languageCode = 'en';
+        $languageName = 'english';
+
+        if ($language !== '' && str_contains($language, ':')) {
+            $exploded = array_map('trim', explode(':', $language, 2));
+
+            if (count($exploded) === 2) {
+                $languageCode = htmlspecialchars($exploded[0]);
+                $languageName = htmlspecialchars($exploded[1]);
+            }
+        }
+
        $currency_symbol = $this->request->getPost('currency_symbol');
+        $secondaryCurrencyCode = strtoupper(trim((string) $this->request->getPost('secondary_currency_code')));
+
+        if (!preg_match('/^[A-Z]{3}$/', $secondaryCurrencyCode)) {
+            $secondaryCurrencyCode = '';
+        }
+
        $batch_save_data = [
            'currency_symbol'       => htmlspecialchars($currency_symbol ?? ''),
            'currency_code'         => $this->request->getPost('currency_code'),
-            'language_code'         => $exploded[0],
-            'language'              => $exploded[1],
+            'secondary_currency_enabled'  => $this->request->getPost('secondary_currency_enabled') != null,
+            'secondary_currency_symbol'   => htmlspecialchars($this->request->getPost('secondary_currency_symbol') ?? ''),
+            'secondary_currency_code'     => $secondaryCurrencyCode,
+            'secondary_currency_rate'     => $this->request->getPost('secondary_currency_rate', FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION),
+            'secondary_currency_decimals' => $this->request->getPost('secondary_currency_decimals', FILTER_SANITIZE_NUMBER_INT),
+            'language_code'         => $languageCode,
+            'language'              => $languageName,
            'timezone'              => $this->request->getPost('timezone'),
            'dateformat'            => $this->request->getPost('dateformat'),
            'timeformat'            => $this->request->getPost('timeformat'),
@@ -934,6 +980,7 @@ class Config extends Secure_Controller
            'receipt_show_tax_ind'          => $this->request->getPost('receipt_show_tax_ind') != null,
            'receipt_show_total_discount'   => $this->request->getPost('receipt_show_total_discount') != null,
            'receipt_show_description'      => $this->request->getPost('receipt_show_description') != null,
+            'receipt_show_secondary_currency' => $this->request->getPost('receipt_show_secondary_currency') != null,
            'receipt_show_serialnumber'     => $this->request->getPost('receipt_show_serialnumber') != null,
            'print_silently'                => $this->request->getPost('print_silently') != null,
            'print_header'                  => $this->request->getPost('print_header') != null,
@@ -962,7 +1009,7 @@ class Config extends Secure_Controller
        $batchSaveData = [];

        foreach ($currentShortcuts as $name => $shortcut) {
-            $postedValue = trim((string)$this->request->getPost('key_' . $name));
+            $postedValue = trim((string) $this->request->getPost('key_' . $name));

            if (!in_array($postedValue, $allowedShortcuts, true)) {
                $postedValue = $shortcut['value'];
@@ -1066,3 +1113,6 @@ class Config extends Secure_Controller
        return in_array($column, $allowed, true) ? $column : $fallback;
    }
 }
+
+
+
--- a/app/Controllers/Items.php
+++ b/app/Controllers/Items.php
@@ -154,8 +154,23 @@ class Items extends Secure_Controller
    {
        helper('file');

-        $pic_filename = rawurldecode($pic_filename);
-        $file_extension = pathinfo($pic_filename, PATHINFO_EXTENSION);
+        // Security: Sanitize filename to prevent path traversal
+        // Use basename() to strip directory components and prevent '../' attacks
+        $pic_filename = basename(rawurldecode($pic_filename));
+        $file_extension = strtolower(pathinfo($pic_filename, PATHINFO_EXTENSION));
+
+        // Validate file extension against system-configured allowed image types
+        // Handle both legacy pipe-separated and current comma-separated formats
+        // Fallback to types that GD library can process for thumbnail generation
+        $allowed_types = $this->config['image_allowed_types'] ?? 'jpg,jpeg,gif,png,webp,bmp,tif,tiff';
+        $allowed_extensions = strpos($allowed_types, '|') !== false
+            ? explode('|', $allowed_types)
+            : explode(',', $allowed_types);
+
+        if (!in_array($file_extension, $allowed_extensions, true)) {
+            return $this->response->setStatusCode(400)->setBody('Invalid file type');
+        }
+
        $images = glob("./uploads/item_pics/$pic_filename");
        $base_path = './uploads/item_pics/' . pathinfo($pic_filename, PATHINFO_FILENAME);

@@ -1040,14 +1055,20 @@ class Items extends Secure_Controller
                        });

                        if (!$isFailedRow && $this->item->save_value($itemData, $itemId)) {
-                            $this->save_tax_data($row, $itemData);
-                            $this->save_inventory_quantities($row, $itemData, $allowedStockLocations, $employeeId);
+                            if (!$this->save_tax_data($row, $itemData)) {
+                                $isFailedRow = true;
+                            }
+                            if (!$this->save_inventory_quantities($row, $itemData, $allowedStockLocations, $employeeId)) {
+                                $isFailedRow = true;
+                            }
                            $csvAttributeValues = $this->extractAttributeData($row);
-                            $isFailedRow = !$this->attribute->saveCSVRowAttributeData($csvAttributeValues, $itemData, $attributeData);
+                            if (!$this->attribute->saveCSVRowAttributeData($csvAttributeValues, $itemData, $attributeData)) {
+                                $isFailedRow = true;
+                            }
                            if ($isFailedRow) {
                                $failedRow = $key + 2;
                                $failCodes[] = $failedRow;
-                                log_message('error', "CSV Item import failed on line $failedRow while saving attributes.");
+                                log_message('error', "CSV Item import failed on line $failedRow while saving item.");
                                continue;
                            }

@@ -1237,13 +1258,15 @@ class Items extends Secure_Controller
     * @param array $item_data
     * @param array $allowed_locations
     * @param int $employee_id
+     * @return bool Returns true on success, false on failure
     * @throws ReflectionException
     */
-    private function save_inventory_quantities(array $row, array $item_data, array $allowed_locations, int $employee_id): void
+    private function save_inventory_quantities(array $row, array $item_data, array $allowed_locations, int $employee_id): bool
    {
        // Quantities & Inventory Section
        $comment = lang('Items.inventory_CSV_import_quantity');
        $is_update = (bool)$row['Id'];
+        $success = true;

        foreach ($allowed_locations as $location_id => $location_name) {
            $item_quantity_data = ['item_id' => $item_data['item_id'], 'location_id' => $location_id];
@@ -1257,20 +1280,22 @@ class Items extends Secure_Controller

            if (!empty($row["location_$location_name"]) || $row["location_$location_name"] === '0') {
                $item_quantity_data['quantity'] = $row["location_$location_name"];
-                $this->item_quantity->save_value($item_quantity_data, $item_data['item_id'], $location_id);
+                $success &= $this->item_quantity->save_value($item_quantity_data, $item_data['item_id'], $location_id);

                $csv_data['trans_inventory'] = $row["location_$location_name"];
-                $this->inventory->insert($csv_data, false);
+                $success &= (bool)$this->inventory->insert($csv_data, false);
            } elseif ($is_update) {
-                return;
+                continue;
            } else {
                $item_quantity_data['quantity'] = 0;
-                $this->item_quantity->save_value($item_quantity_data, $item_data['item_id'], $location_id);
+                $success &= $this->item_quantity->save_value($item_quantity_data, $item_data['item_id'], $location_id);

                $csv_data['trans_inventory'] = 0;
-                $this->inventory->insert($csv_data, false);
+                $success &= (bool)$this->inventory->insert($csv_data, false);
            }
        }
+
+        return (bool)$success;
    }

    /**
@@ -1278,8 +1303,9 @@ class Items extends Secure_Controller
     *
     * @param array $row
     * @param array $item_data
+     * @return bool Returns true on success, false on failure
     */
-    private function save_tax_data(array $row, array $item_data): void
+    private function save_tax_data(array $row, array $item_data): bool
    {
        $items_taxes_data = [];

@@ -1291,9 +1317,11 @@ class Items extends Secure_Controller
            $items_taxes_data[] = ['name' => $row['Tax 2 Name'], 'percent' => $row['Tax 2 Percent']];
        }

-        if (isset($items_taxes_data)) {
-            $this->item_taxes->save_value($items_taxes_data, $item_data['item_id']);
+        if (!empty($items_taxes_data)) {
+            return $this->item_taxes->save_value($items_taxes_data, $item_data['item_id']);
        }
+
+        return true;
    }

    /**
--- a/app/Controllers/Login.php
+++ b/app/Controllers/Login.php
@@ -49,6 +49,13 @@ class Login extends BaseController
                return view('login', $data);
            }

+            if (!$data['is_latest'] || $data['is_new_install']) {
+                set_time_limit(3600);
+
+                $migration->setNamespace('App')->latest();
+                return redirect()->to('login');
+            }
+
            $rules = ['username' => 'required|login_check[data]'];
            $messages = [
                'username' => [
@@ -62,13 +69,6 @@ class Login extends BaseController

                return view('login', $data);
            }
-
-            if (!$data['is_latest']) {
-                set_time_limit(3600);
-
-                $migration->setNamespace('App')->latest();
-                return redirect()->to('login');
-            }
        }

        return redirect()->to('home');
@@ -79,18 +79,18 @@ class Login extends BaseController
        try {
            $migration = new MY_Migration(config('Migrations'));
            $migration->migrate_to_ci4();
-            
+
            set_time_limit(3600);
            $migration->setNamespace('App')->latest();
-            
+
            return $this->response->setJSON([
                'success' => true,
                'message' => 'Migration completed successfully'
            ]);
-            
+
        } catch (\Exception $e) {
            log_message('error', 'Migration failed: ' . $e->getMessage());
-            
+
            return $this->response->setJSON([
                'success' => false,
                'message' => 'Migration failed: ' . $e->getMessage()
--- a/app/Controllers/Reports.php
+++ b/app/Controllers/Reports.php
@@ -1246,13 +1246,15 @@ class Reports extends Secure_Controller
    public function get_payment_type(): array
    {
        return [
-            'all'      => lang('Common.none_selected_text'),
-            'cash'     => lang('Sales.cash'),
-            'due'      => lang('Sales.due'),
-            'check'    => lang('Sales.check'),
-            'credit'   => lang('Sales.credit'),
-            'debit'    => lang('Sales.debit'),
-            'invoices' => lang('Sales.invoice')
+            'all'           => lang('Common.none_selected_text'),
+            'cash'          => lang('Sales.cash'),
+            'due'           => lang('Sales.due'),
+            'check'         => lang('Sales.check'),
+            'credit'        => lang('Sales.credit'),
+            'debit'         => lang('Sales.debit'),
+            'bank_transfer' => lang('Sales.bank_transfer'),
+            'wallet'        => lang('Sales.wallet'),
+            'invoices'      => lang('Sales.invoice')
        ];
    }

--- a/app/Controllers/Sales.php
+++ b/app/Controllers/Sales.php
@@ -66,12 +66,168 @@ class Sales extends Secure_Controller
        $this->employee = model(Employee::class);
    }

+    /**
+     * Adds the shared secondary currency context to a view data array.
+     *
+     * @param array $data
+     * @return void
+     */
+    private function _append_secondary_currency(array &$data): void
+    {
+        $secondaryCurrency = secondary_currency_context($this->config);
+        $data['secondaryCurrency'] = $secondaryCurrency;
+
+        if (!$secondaryCurrency['show']) {
+            return;
+        }
+
+        $displayFields = [
+            'total' => 'secondaryTotalDisplay',
+            'amount_due' => 'secondaryAmountDueDisplay',
+            'cash_amount_due' => 'secondaryCashAmountDueDisplay',
+            'non_cash_total' => 'secondaryNonCashTotalDisplay',
+            'non_cash_amount_due' => 'secondaryNonCashAmountDueDisplay'
+        ];
+
+        foreach ($displayFields as $sourceField => $targetField) {
+            if (array_key_exists($sourceField, $data)) {
+                $data[$targetField] = to_secondary_currency((float) $data[$sourceField], $secondaryCurrency);
+            }
+        }
+    }
+
    public function getIndex(): ResponseInterface|string
    {
        $this->session->set('allow_temp_items', 1);
        return $this->_reload();    // TODO: Hungarian Notation
    }

+    /**
+     * Load the customer display popup.
+     *
+     * @return ResponseInterface|string
+     * @noinspection PhpUnused
+     */
+    public function getCustomerDisplay(): ResponseInterface|string
+    {
+        if (($this->config['customer_display_enabled'] ?? false) != 1) {
+            return $this->response->setStatusCode(404)->setBody('');
+        }
+
+        if ($this->session->get('sale_id') == '') {
+            $this->session->set('sale_id', NEW_ENTRY);
+        }
+
+        $secondaryCurrency = secondary_currency_context($this->config);
+        $secondaryCurrencyEnabled = (($this->config['secondary_currency_enabled'] ?? false) == 1);
+        $cashRounding = $this->sale_lib->reset_cash_rounding();
+        $showCustomerDisplay = $secondaryCurrencyEnabled && !empty($secondaryCurrency['rate']) && (float) $secondaryCurrency['rate'] > 0;
+        $companyLines = preg_split("/\r\n|\r|\n/", (string) ($this->config['company'] ?? '')) ?: [];
+        $companyName = array_shift($companyLines) ?? '';
+        $companyDetails = trim(implode("\n", $companyLines));
+        $secondaryCurrencySymbol = trim((string) ($this->config['secondary_currency_symbol'] ?? ''));
+        $secondaryCurrencyCode = trim((string) ($this->config['secondary_currency_code'] ?? ''));
+        $originalCurrencySymbol = trim((string) ($this->config['currency_symbol'] ?? ''));
+        $customerDisplayCurrencyLabel = $secondaryCurrencyCode !== '' ? $secondaryCurrencyCode : ($secondaryCurrencySymbol !== '' ? $secondaryCurrencySymbol : 'LBP');
+        $originalCurrencyLabel = $originalCurrencySymbol !== '' ? $originalCurrencySymbol : '$';
+        $cartHasCustomerDisplay = $showCustomerDisplay;
+        $cartColspan = $cartHasCustomerDisplay ? 6 : 5;
+        $cartItemWidth = $cartHasCustomerDisplay ? 32 : 44;
+        $cartPriceWidth = $cartHasCustomerDisplay ? 18 : 0;
+        $cartOriginalWidth = $cartHasCustomerDisplay ? 18 : 26;
+        $cartQuantityWidth = $cartHasCustomerDisplay ? 12 : 10;
+        $cartDiscountWidth = $cartHasCustomerDisplay ? 10 : 9;
+        $cartTotalWidth = $cartHasCustomerDisplay ? 10 : 11;
+
+        $data = [
+            'cash_rounding' => $cashRounding,
+            'cart' => $this->sale_lib->get_cart()
+        ];
+        $customer_info = $this->_load_customer_data($this->sale_lib->get_customer(), $data, true);
+        $data += [
+            'customer_name' => $data['customer'] ?? lang('Sales.walk_in_customer'),
+            'customer_reward_points' => (int) ($data['customer_rewards']['points'] ?? 0),
+            'customer_reward_package' => $data['customer_rewards']['package_name'] ?? '',
+            'giftcard_remainder' => $this->sale_lib->get_giftcard_remainder(),
+            'rewards_remainder' => $this->sale_lib->get_rewards_remainder(),
+            'customerName' => $data['customer'] ?? lang('Sales.walk_in_customer'),
+            'customerRewardPoints' => (int) ($data['customer_rewards']['points'] ?? 0),
+            'giftcardRemainder' => $this->sale_lib->get_giftcard_remainder()
+        ];
+
+        $tax_details = $this->tax_lib->get_taxes($data['cart']);
+        $data += [
+            'tax_exclusive_subtotal' => $this->sale_lib->get_subtotal(true, true),
+            'taxes' => $tax_details[0],
+            'discount' => $this->sale_lib->get_discount(),
+            'payments' => $this->sale_lib->get_payments()
+        ];
+
+        $totals = $this->sale_lib->get_totals($tax_details[0]);
+        $data += [
+            'item_count' => $totals['item_count'],
+            'total_units' => $totals['total_units'],
+            'subtotal' => $totals['subtotal'],
+            'total' => $totals['total'],
+            'payments_total' => $totals['payment_total'],
+            'payments_cover_total' => $totals['payments_cover_total'],
+            'prediscount_subtotal' => $totals['prediscount_subtotal'],
+            'cash_total' => $totals['cash_total'],
+            'non_cash_total' => $totals['total'],
+            'cash_amount_due' => $totals['cash_amount_due'],
+            'non_cash_amount_due' => $totals['amount_due'],
+            'cash_mode' => $this->session->get('cash_mode'),
+            'selected_payment_type' => $this->sale_lib->get_payment_type(),
+            'comment' => $this->sale_lib->get_comment(),
+            'email_receipt' => $this->sale_lib->is_email_receipt(),
+            'config' => $this->config,
+            'mode' => $this->sale_lib->get_mode(),
+            'rate' => (float) ($secondaryCurrency['rate'] ?? $this->config['secondary_currency_rate'] ?? 0),
+            'secondaryCurrency' => $secondaryCurrency,
+            'secondaryCurrencyEnabled' => $secondaryCurrencyEnabled,
+            'showCustomerDisplay' => $showCustomerDisplay,
+            'companyName' => $companyName,
+            'companyDetails' => $companyDetails,
+            'secondaryCurrencySymbol' => $secondaryCurrencySymbol,
+            'secondaryCurrencyCode' => $secondaryCurrencyCode,
+            'originalCurrencySymbol' => $originalCurrencySymbol,
+            'customerDisplayCurrencyLabel' => $customerDisplayCurrencyLabel,
+            'originalCurrencyLabel' => $originalCurrencyLabel,
+            'cartHasCustomerDisplay' => $cartHasCustomerDisplay,
+            'cartColspan' => $cartColspan,
+            'cartItemWidth' => $cartItemWidth,
+            'cartPriceWidth' => $cartPriceWidth,
+            'cartOriginalWidth' => $cartOriginalWidth,
+            'cartQuantityWidth' => $cartQuantityWidth,
+            'cartDiscountWidth' => $cartDiscountWidth,
+            'cartTotalWidth' => $cartTotalWidth,
+            'items_module_allowed' => $this->employee->has_grant('items', $this->employee->get_logged_in_employee_info()->person_id),
+            'change_price' => $this->employee->has_grant('sales_change_price', $this->employee->get_logged_in_employee_info()->person_id)
+        ];
+
+        $invoice_number = $this->sale_lib->get_invoice_number();
+        if ($invoice_number == null || $invoice_number == '') {
+            $invoice_number = $this->token_lib->render($this->config['sales_invoice_format'], [], false);
+        }
+
+        $data += [
+            'invoice_number' => $invoice_number,
+            'print_after_sale' => $this->sale_lib->is_print_after_sale(),
+            'price_work_orders' => $this->sale_lib->is_price_work_orders(),
+            'pos_mode' => $data['mode'] == 'sale' || $data['mode'] == 'return',
+            'quote_number' => $this->sale_lib->get_quote_number(),
+            'work_order_number' => $this->sale_lib->get_work_order_number(),
+            'amount_due' => $data['cash_mode'] && ($data['selected_payment_type'] === lang('Sales.cash') || $data['payments_total'] > 0) ? $totals['cash_amount_due'] : $totals['amount_due']
+        ];
+        $data['amount_change'] = $data['amount_due'] * -1;
+        $data['payment_change_due'] = ((float) $data['amount_due'] < 0)
+            ? abs((float) $data['amount_due'])
+            : max(((float) $data['payments_total']) - ((float) $data['amount_due']), 0);
+        $data['paymentChangeDue'] = $data['payment_change_due'];
+
+        return view('sales/customer_display', $data);
+    }
+
    /**
     * Load the sale edit modal. Used in app/Views/sales/register.php.
     *
@@ -814,6 +970,7 @@ class Sales extends Secure_Controller

                // Resort and filter cart lines for printing
                $data['cart'] = $this->sale_lib->sort_and_filter_cart($data['cart']);
+                $this->_append_secondary_currency($data);

                if ($data['sale_id_num'] == NEW_ENTRY) {
                    $data['error_message'] = lang('Sales.transaction_failed');
@@ -853,6 +1010,7 @@ class Sales extends Secure_Controller
                $data['cart'] = $this->sale_lib->sort_and_filter_cart($data['cart']);

                $data['barcode'] = null;
+                $this->_append_secondary_currency($data);

                $this->sale_lib->clear_all();
                return view('sales/work_order', $data);
@@ -880,6 +1038,7 @@ class Sales extends Secure_Controller

                $data['cart'] = $this->sale_lib->sort_and_filter_cart($data['cart']);
                $data['barcode'] = null;
+                $this->_append_secondary_currency($data);

                $this->sale_lib->clear_all();
                return view('sales/quote', $data);
@@ -898,6 +1057,7 @@ class Sales extends Secure_Controller
            $data['sale_id'] = 'POS ' . $data['sale_id_num'];

            $data['cart'] = $this->sale_lib->sort_and_filter_cart($data['cart']);
+            $this->_append_secondary_currency($data);

            if ($data['sale_id_num'] == NEW_ENTRY) {
                $data['error_message'] = lang('Sales.transaction_failed');
@@ -1158,6 +1318,7 @@ class Sales extends Secure_Controller
            $invoice_type = 'invoice';
        }
        $data['invoice_view'] = $invoice_type;
+        $this->_append_secondary_currency($data);

        return $data;
    }
@@ -1224,6 +1385,7 @@ class Sales extends Secure_Controller
        }

        $data['amount_change'] = $data['amount_due'] * -1;
+        $this->_append_secondary_currency($data);

        $data['comment'] = $this->sale_lib->get_comment();
        $data['email_receipt'] = $this->sale_lib->is_email_receipt();
@@ -1253,7 +1415,6 @@ class Sales extends Secure_Controller

        $data['quote_number'] = $this->sale_lib->get_quote_number();
        $data['work_order_number'] = $this->sale_lib->get_work_order_number();
-        $data['keyboardShortcuts'] = $this->sale_lib->getKeyShortcuts();

        // TODO: the if/else set below should be converted to a switch
        if ($this->sale_lib->get_mode() == 'sale_invoice') {    // TODO: Duplicated code.
@@ -1642,9 +1803,7 @@ class Sales extends Secure_Controller
     */
    public function getSalesKeyboardHelp(): string
    {
-        return view('sales/help', [
-            'keyboardShortcuts' => $this->sale_lib->getKeyShortcuts()
-        ]);
+        return view('sales/help');
    }

    /**
@@ -1766,3 +1925,5 @@ class Sales extends Secure_Controller
        return null;
    }
 }
+
+
--- a/app/Database/Migrations/20170501150000_upgrade_to_3_1_1.php
+++ b/app/Database/Migrations/20170501150000_upgrade_to_3_1_1.php
@@ -2,6 +2,7 @@

 namespace App\Database\Migrations;

+use CodeIgniter\Database\Exceptions\DatabaseException;
 use CodeIgniter\Database\Migration;

 class Migration_Upgrade_To_3_1_1 extends Migration
@@ -17,7 +18,37 @@ class Migration_Upgrade_To_3_1_1 extends Migration
    public function up(): void
    {
        helper('migration');
-        execute_script(APPPATH . 'Database/Migrations/sqlscripts/3.0.2_to_3.1.1.sql');
+
+        // MariaDB blocks CONVERT TO CHARACTER SET on tables with FK constraints.
+        // Drop all FKs across affected tables before running the SQL script, recreate after.
+        $fkColumns = [
+            ['modules',         'module_id'],
+            ['stock_locations', 'location_id'],
+            ['permissions',     'permission_id'],
+            ['people',          'person_id'],
+            ['suppliers',       'supplier_id'],
+            ['items',           'item_id'],
+            ['item_kits',       'item_kit_id'],
+            ['sales',           'sale_id'],
+            ['receivings',      'receiving_id'],
+            ['employees',       'employee_id'],
+            ['customers',       'person_id'],
+        ];
+
+        $constraints = [];
+        foreach ($fkColumns as [$table, $column]) {
+            foreach (dropAllForeignKeyConstraints($table, $column) as $c) {
+                $constraints[$c['constraintName']] = $c;
+            }
+        }
+
+        if (!execute_script(APPPATH . 'Database/Migrations/sqlscripts/3.0.2_to_3.1.1.sql')) {
+            throw new DatabaseException('Migration script 3.0.2_to_3.1.1.sql failed. Check logs for details.');
+        }
+
+        $droppedTables = ['sales_suspended', 'sales_suspended_items', 'sales_suspended_items_taxes', 'sales_suspended_payments'];
+        $toRecreate = array_filter($constraints, fn($c) => !in_array($c['tableName'], $droppedTables, true));
+        recreateForeignKeyConstraints(array_values($toRecreate));
    }

    /**
--- a/app/Database/Migrations/sqlscripts/3.0.2_to_3.1.1.sql
+++ b/app/Database/Migrations/sqlscripts/3.0.2_to_3.1.1.sql
@@ -327,19 +327,6 @@ INSERT INTO `ospos_sales_items` (sale_id, item_id, description, serialnumber, li
 INSERT INTO `ospos_sales_payments` (sale_id, payment_type, payment_amount) SELECT sale_id, payment_type, payment_amount FROM `ospos_sales_suspended_payments`;
 INSERT INTO `ospos_sales_items_taxes` (sale_id, item_id, line, name, percent) SELECT sale_id, item_id, line, name, percent FROM `ospos_sales_suspended_items_taxes`;

-ALTER TABLE `ospos_sales_suspended_payments` DROP FOREIGN KEY `ospos_sales_suspended_payments_ibfk_1`;
-
-ALTER TABLE `ospos_sales_suspended_items_taxes` DROP FOREIGN KEY `ospos_sales_suspended_items_taxes_ibfk_1`;
-ALTER TABLE `ospos_sales_suspended_items_taxes` DROP FOREIGN KEY `ospos_sales_suspended_items_taxes_ibfk_2`;
-
-ALTER TABLE `ospos_sales_suspended_items` DROP FOREIGN KEY `ospos_sales_suspended_items_ibfk_1`;
-ALTER TABLE `ospos_sales_suspended_items` DROP FOREIGN KEY `ospos_sales_suspended_items_ibfk_2`;
-ALTER TABLE `ospos_sales_suspended_items` DROP FOREIGN KEY `ospos_sales_suspended_items_ibfk_3`;
-
-ALTER TABLE `ospos_sales_suspended` DROP FOREIGN KEY `ospos_sales_suspended_ibfk_1`;
-ALTER TABLE `ospos_sales_suspended` DROP FOREIGN KEY `ospos_sales_suspended_ibfk_2`;
-ALTER TABLE `ospos_sales_suspended` DROP FOREIGN KEY `ospos_sales_suspended_ibfk_3`;
-
 DROP TABLE `ospos_sales_suspended_payments`, `ospos_sales_suspended_items_taxes`, `ospos_sales_suspended_items`, `ospos_sales_suspended`;

 --
--- a/app/Database/Migrations/sqlscripts/3.1.1_to_3.2.0.sql
+++ b/app/Database/Migrations/sqlscripts/3.1.1_to_3.2.0.sql
@@ -140,7 +140,7 @@ CREATE TABLE IF NOT EXISTS `ospos_expense_categories` (
  `category_name` varchar(255) DEFAULT NULL,
  `category_description` varchar(255) NOT NULL,
  `deleted` int(1) NOT NULL DEFAULT '0'
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;


 -- Table structure for table `ospos_expenses`
@@ -154,7 +154,7 @@ CREATE TABLE IF NOT EXISTS `ospos_expenses` (
  `description` varchar(255) NOT NULL,
  `employee_id` int(10) NOT NULL,
  `deleted` int(1) NOT NULL DEFAULT '0'
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;


 -- Indexes for table `ospos_expense_categories`
--- a/app/Database/Migrations/sqlscripts/3.2.1_to_3.3.0.sql
+++ b/app/Database/Migrations/sqlscripts/3.2.1_to_3.3.0.sql
@@ -75,7 +75,7 @@ CREATE TABLE `ospos_cash_up` (
  `open_employee_id` int(10) NOT NULL,
  `close_employee_id` int(10) NOT NULL,
  `deleted` int(1) NOT NULL DEFAULT '0'
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;

 -- Indexes for table `ospos_cash_up`

--- a/app/Database/Migrations/sqlscripts/3.3.0_indiagst.sql
+++ b/app/Database/Migrations/sqlscripts/3.3.0_indiagst.sql
@@ -26,7 +26,7 @@ CREATE TABLE IF NOT EXISTS `ospos_tax_codes` (
    `state` varchar(255) NOT NULL DEFAULT '',
    `deleted` int(1) NOT NULL DEFAULT 0,
    PRIMARY KEY (`tax_code_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;

 ALTER TABLE `ospos_customers`
    ADD COLUMN `tax_id` varchar(32) NOT NULL DEFAULT '' AFTER `taxable`,
@@ -59,7 +59,7 @@ CREATE TABLE `ospos_sales_taxes` (
    `rounding_code` tinyint(2) NOT NULL DEFAULT 0,
    PRIMARY KEY (`sales_taxes_id`),
    KEY `print_sequence` (`sale_id`,`print_sequence`,`tax_group`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;

 CREATE TABLE IF NOT EXISTS `ospos_tax_jurisdictions` (
    `jurisdiction_id` int(11) NOT NULL AUTO_INCREMENT,
@@ -71,7 +71,7 @@ CREATE TABLE IF NOT EXISTS `ospos_tax_jurisdictions` (
    `cascade_sequence` tinyint(2) NOT NULL DEFAULT 0,
    `deleted` int(1) NOT NULL DEFAULT 0,
    PRIMARY KEY (`jurisdiction_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci AUTO_INCREMENT=1;

 ALTER TABLE `ospos_suppliers`
    ADD COLUMN `tax_id` varchar(32) DEFAULT NULL AFTER `account_number`;
@@ -89,7 +89,7 @@ CREATE TABLE IF NOT EXISTS `ospos_tax_rates` (
    `tax_rate` decimal(15,4) NOT NULL DEFAULT 0.0000,
    `tax_rounding_code` tinyint(2) NOT NULL DEFAULT 0,
    PRIMARY KEY (`tax_rate_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;

 -- Add support for sales tax report

--- a/app/Database/Migrations/sqlscripts/3.3.0_paymenttracking.sql
+++ b/app/Database/Migrations/sqlscripts/3.3.0_paymenttracking.sql
@@ -12,7 +12,7 @@ CREATE TABLE `ospos_sales_payments` (
  `reference_code` varchar(40) NOT NULL DEFAULT '',
  PRIMARY KEY (`payment_id`),
  KEY `payment_sale` (`sale_id`, `payment_type`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;

 INSERT INTO ospos_sales_payments (sale_id, payment_type, payment_amount, payment_user)
 SELECT payments.sale_id, payments.payment_type, payments.payment_amount, sales.employee_id
--- a/app/Helpers/locale_helper.php
+++ b/app/Helpers/locale_helper.php
@@ -365,6 +365,74 @@ function to_currency_no_money(?string $number): string
    return to_decimals($number, 'currency_decimals');
 }

+/**
+ * Build the secondary currency rendering context from app config values.
+ *
+ * @param array $config
+ * @return array{show:bool,rate:float,symbol:string,code:string,decimals:int}
+ */
+function secondary_currency_context(array $config): array
+{
+    $rate = (float) ($config['secondary_currency_rate'] ?? 0);
+    $symbol = trim((string) ($config['secondary_currency_symbol'] ?? ''));
+    $code = trim((string) ($config['secondary_currency_code'] ?? ''));
+    $decimals = (int) ($config['secondary_currency_decimals'] ?? ($config['currency_decimals'] ?? DEFAULT_PRECISION));
+
+    return [
+        'show'     => (($config['secondary_currency_enabled'] ?? false) == 1) && $rate > 0,
+        'rate'     => $rate,
+        'symbol'   => $symbol,
+        'code'     => $code,
+        'decimals' => $decimals,
+    ];
+}
+
+/**
+ * Render a value in the secondary currency.
+ *
+ * @param float|int|string|null $number
+ * @param array{show:bool,rate:float,symbol:string,code:string,decimals:int} $secondaryCurrency
+ * @return string
+ */
+function to_secondary_currency(float|int|string|null $number, array $secondaryCurrency): string
+{
+    if (!isset($number) || !$secondaryCurrency['show']) {
+        return '';
+    }
+
+    $config = config(OSPOS::class)->settings;
+    $amount = (float) $number * (float) $secondaryCurrency['rate'];
+    $fmt = new NumberFormatter($config['number_locale'], NumberFormatter::CURRENCY);
+    $fmt->setAttribute(NumberFormatter::MIN_FRACTION_DIGITS, $secondaryCurrency['decimals']);
+    $fmt->setAttribute(NumberFormatter::MAX_FRACTION_DIGITS, $secondaryCurrency['decimals']);
+
+    if (empty($config['thousands_separator'])) {
+        $fmt->setTextAttribute(NumberFormatter::GROUPING_SEPARATOR_SYMBOL, '');
+    }
+
+    $fmt->setSymbol(NumberFormatter::CURRENCY_SYMBOL, $secondaryCurrency['symbol'] !== '' ? $secondaryCurrency['symbol'] : ($secondaryCurrency['code'] !== '' ? $secondaryCurrency['code'] : ''));
+
+    return $fmt->format($amount);
+}
+
+/**
+ * Render the secondary and primary currency amounts together.
+ *
+ * @param float|int|string|null $number
+ * @param array{show:bool,rate:float,symbol:string,code:string,decimals:int} $secondaryCurrency
+ * @return string
+ */
+function to_secondary_currency_dual(float|int|string|null $number, array $secondaryCurrency): string
+{
+    $secondary = to_secondary_currency($number, $secondaryCurrency);
+
+    if ($secondary === '') {
+        return to_currency((string) $number);
+    }
+
+    return $secondary . '<br>' . to_currency((string) $number);
+}
+
 /**
 * @param string|null $number
 * @return string
--- a/app/Helpers/migration_helper.php
+++ b/app/Helpers/migration_helper.php
@@ -172,6 +172,7 @@ function dropAllForeignKeyConstraints(string $table, string $column): array {
            WHERE kcu.TABLE_SCHEMA = DATABASE()
                AND ((kcu.REFERENCED_TABLE_NAME = '" . $db->getPrefix() . "$table' AND kcu.REFERENCED_COLUMN_NAME = '$column')
                OR (kcu.TABLE_NAME = '" . $db->getPrefix() . "$table' AND kcu.COLUMN_NAME = '$column'))
+                AND rc.CONSTRAINT_NAME IS NOT NULL
        ");

    $deletedConstraints = [];
--- a/app/Language/en-GB/Sales.php
+++ b/app/Language/en-GB/Sales.php
@@ -9,6 +9,7 @@ return [
    "amount_due"                       => "Amount Due",
    "amount_tendered"                  => "Amount Tendered",
    "authorized_signature"             => "Authorised Signature",
+    "bank_transfer"                    => "Bank Transfer",
    "cancel_sale"                      => "Cancel",
    "cash"                             => "Cash",
    "cash_1"                           => "",
@@ -223,6 +224,7 @@ return [
    "update"                           => "Update",
    "upi"                              => "UPI",
    "visa"                             => "",
+    "wallet"                           => "Wallet",
    "wholesale"                        => "",
    "work_order"                       => "Work Order",
    "work_order_number"                => "Work Order Number",
--- a/app/Language/en/Config.php
+++ b/app/Language/en/Config.php
@@ -268,10 +268,19 @@ return [
    "receipt_show_company_name"                 => "Show Company Name",
    "receipt_show_description"                  => "Show Description",
    "receipt_show_serialnumber"                 => "Show Serial Number",
+    "receipt_show_secondary_currency"           => "Show Secondary Currency",
    "receipt_show_tax_ind"                      => "Show Tax Indicator",
    "receipt_show_taxes"                        => "Show Taxes",
    "receipt_show_total_discount"               => "Show Total Discount",
    "receipt_template"                          => "Receipt Template",
+    "secondary_currency"                        => "Secondary Currency",
+    "secondary_currency_decimals"               => "Secondary Currency Decimals",
+    "secondary_currency_code"                    => "Secondary Currency Code",
+    "secondary_currency_enable"                  => "Enable Secondary Currency",
+    "secondary_currency_enable_tooltip"          => "Show secondary currency fields and print/display values across the app.",
+    "secondary_currency_rate"                    => "Secondary Currency Rate",
+    "secondary_currency_settings"                => "Secondary Currency Settings",
+    "secondary_currency_symbol"                  => "Secondary Currency Symbol",
    "receiving_calculate_average_price"         => "Calc avg. Price (Receiving)",
    "recv_invoice_format"                       => "Receivings Invoice Format",
    "register_mode_default"                     => "Default Register Mode",
@@ -288,6 +297,7 @@ return [
    "security_issue"                            => "Security Vulnerability Warning",
    "server_notice"                             => "Please use the below info for issue reporting.",
    "service_charge"                            => "",
+    "customer_display"                          => "Customer Display",
    "show_due_enable"                           => "",
    "show_office_group"                         => "Show office icon",
    "statistics"                                => "Send Statistics",
@@ -302,10 +312,6 @@ return [
    "suggestions_layout"                        => "Search Suggestions Layout",
    "suggestions_second_column"                 => "Column 2",
    "suggestions_third_column"                  => "Column 3",
-    "shortcuts"                                 => "Shortcuts",
-    "shortcuts_configuration"                   => "Sales Keyboard Shortcut Configuration",
-    "shortcuts_duplicate_bindings"              => "Shortcut bindings must be unique.",
-    "shortcuts_save_error"                       => "Unable to save shortcut settings.",
    "system_conf"                               => "Setup & Conf",
    "system_info"                               => "System Info",
    "table"                                     => "Table",
@@ -334,3 +340,5 @@ return [
    "work_order_enable"                         => "Work Order Support",
    "work_order_format"                         => "Work Order Format",
 ];
+
+
--- a/app/Language/en/Sales.php
+++ b/app/Language/en/Sales.php
@@ -7,6 +7,7 @@ return [
    "account_number"                   => "Account #",
    "add_payment"                      => "Add Payment",
    "amount_due"                       => "Amount Due",
+    "amount_due_lbp"                   => "Amount Due LBP",
    "amount_tendered"                  => "Amount Tendered",
    "authorized_signature"             => "Authorized Signature",
    "cancel_sale"                      => "Cancel",
@@ -19,6 +20,8 @@ return [
    "cash_deposit"                     => "Cash Deposit",
    "cash_filter"                      => "Cash",
    "change_due"                       => "Change Due",
+    "change"                           => "Change",
+    "currency_rate"                    => "Currency Rate",
    "change_price"                     => "Change Selling Price",
    "check"                            => "Check",
    "check_balance"                    => "Check remainder",
@@ -40,6 +43,7 @@ return [
    "customer_address"                 => "Address",
    "customer_discount"                => "Discount",
    "customer_email"                   => "Email",
+    "customer_name"                    => "Customer Name",
    "customer_location"                => "Location",
    "customer_mailchimp_status"        => "MailChimp Status",
    "customer_optional"                => "(Required for Due Payments)",
@@ -73,12 +77,6 @@ return [
    "employee"                         => "Employee",
    "entry"                            => "Entry",
    "error_editing_item"               => "Error editing item",
-    "negative_price_invalid"           => "Price cannot be negative.",
-    "negative_quantity_invalid"        => "Quantity cannot be negative.",
-    "negative_discount_invalid"        => "Discount cannot be negative.",
-    "discount_percent_exceeds_100"     => "Percentage discount cannot exceed 100%.",
-    "discount_exceeds_item_total"      => "Discount cannot exceed the item total.",
-    "negative_total_invalid"           => "Sale total cannot be negative. Check item discounts and quantities.",
    "find_or_scan_item"                => "Find or Scan Item",
    "find_or_scan_item_or_receipt"     => "Find or Scan Item or Receipt",
    "giftcard"                         => "Gift Card",
@@ -109,6 +107,7 @@ return [
    "item_name"                        => "Item Name",
    "item_number"                      => "Item #",
    "item_out_of_stock"                => "Item is out of stock.",
+    "items"                            => "Items",
    "key_browser"                      => "Helpful Shortcuts",
    "key_cancel"                       => "Cancels Current Quote/Invoice/Sale",
    "key_customer_search"              => "Customer Search",
@@ -150,7 +149,9 @@ return [
    "payment_type"                     => "Type",
    "payments"                         => "",
    "payments_total"                   => "Payments Total",
+    "loyalty_reward_points"            => "Loyalty Reward Points",
    "price"                            => "Price",
+    "price_with_currency"              => "Price (%s)",
    "print_after_sale"                 => "Print after Sale",
    "quantity"                         => "Quantity",
    "quantity_less_than_reorder_level" => "Warning: Desired Quantity is below Reorder Level for that Item.",
@@ -166,10 +167,13 @@ return [
    "receipt_number"                   => "Sale #",
    "receipt_sent"                     => "Receipt sent to",
    "receipt_unsent"                   => "Receipt failed to be sent to",
+    "rate"                             => "Rate",
    "refund"                           => "Refund Type",
    "register"                         => "Sales Register",
    "remove_customer"                  => "Remove Customer",
    "remove_discount"                  => "",
+    "customer_display"                 => "Customer Display",
+    "summary"                          => "Summary",
    "return"                           => "Return",
    "rewards"                          => "Reward Points",
    "rewards_balance"                  => "Reward Points Balance",
@@ -181,6 +185,7 @@ return [
    "sales_total"                      => "",
    "select_customer"                  => "Select Customer",
    "selected_customer"                => "Selected Customer",
+    "walk_in_customer"                 => "Walk-in Customer",
    "send_invoice"                     => "Send Invoice",
    "send_quote"                       => "Send Quote",
    "send_receipt"                     => "Send Receipt",
@@ -211,6 +216,7 @@ return [
    "tax_percent"                      => "Tax %",
    "taxed_ind"                        => "T",
    "total"                            => "Total",
+    "total_lbp"                        => "Total LBP",
    "total_tax_exclusive"              => "Tax excluded",
    "transaction_failed"               => "Sales Transaction failed.",
    "unable_to_add_item"               => "Item add to Sale failed",
@@ -230,3 +236,5 @@ return [
    "work_order_sent"                  => "Work Order sent to",
    "work_order_unsent"                => "Work Order failed to be sent to",
 ];
+
+
--- a/app/Language/es-ES/Sales.php
+++ b/app/Language/es-ES/Sales.php
@@ -9,6 +9,7 @@ return [
    "amount_due"                       => "Monto Adeudado",
    "amount_tendered"                  => "Cantidad Recibida",
    "authorized_signature"             => "Firma Autorizada",
+    "bank_transfer"                    => "Transferencia Bancaria",
    "cancel_sale"                      => "Cancelar Venta",
    "cash"                             => "Efectivo",
    "cash_1"                           => "1",
@@ -222,6 +223,7 @@ return [
    "update"                           => "Editar",
    "upi"                              => "PIN UPI",
    "visa"                             => "Tarjeta Visa",
+    "wallet"                           => "Monedero",
    "wholesale"                        => "Precio al por mayor",
    "work_order"                       => "Orden trabajo",
    "work_order_number"                => "Numero Orden Trabajo",
--- a/app/Language/es-MX/Sales.php
+++ b/app/Language/es-MX/Sales.php
@@ -9,6 +9,7 @@ return [
    "amount_due"                       => "Monto de adeudo",
    "amount_tendered"                  => "Cantidad Recibida",
    "authorized_signature"             => "Firma Autorizada",
+    "bank_transfer"                    => "Transferencia Bancaria",
    "cancel_sale"                      => "Cancelar",
    "cash"                             => "Efectivo",
    "cash_1"                           => "",
@@ -222,6 +223,7 @@ return [
    "update"                           => "Actualizar",
    "upi"                              => "UPI",
    "visa"                             => "",
+    "wallet"                           => "Monedero",
    "wholesale"                        => "",
    "work_order"                       => "Orden de trabajo",
    "work_order_number"                => "Número de orden de trabajo",
--- a/app/Language/fr/Sales.php
+++ b/app/Language/fr/Sales.php
@@ -9,6 +9,7 @@ return [
    "amount_due"                       => "Montant à Payer",
    "amount_tendered"                  => "Montant Présenté",
    "authorized_signature"             => "Signature autorisée",
+    "bank_transfer"                    => "Virement Bancaire",
    "cancel_sale"                      => "Annuler la Vente",
    "cash"                             => "Espèce",
    "cash_1"                           => "",
@@ -222,6 +223,7 @@ return [
    "update"                           => "Éditer",
    "upi"                              => "UPI",
    "visa"                             => "",
+    "wallet"                           => "Portefeuille",
    "wholesale"                        => "",
    "work_order"                       => "Commande de travail",
    "work_order_number"                => "Numéro de commande",
--- a/app/Libraries/MY_Migration.php
+++ b/app/Libraries/MY_Migration.php
@@ -25,7 +25,7 @@ class MY_Migration extends MigrationRunner
    public function get_latest_migration(): int
    {
        $migrations = $this->findMigrations();
-        return (int) basename(end($migrations)->version);
+        return basename(end($migrations)->version);
    }

    /**
@@ -41,7 +41,7 @@ class MY_Migration extends MigrationRunner
                $builder = $db->table('migrations');
                $builder->select('version')->orderBy('version', 'DESC')->limit(1);
                $result = $builder->get()->getRow();
-                return $result ? (int) $result->version : 0;
+                return $result ? $result->version : 0;
            }
        } catch (\Exception $e) {
            // Database not available yet (e.g. fresh install before schema).
--- a/app/Libraries/Sale_lib.php
+++ b/app/Libraries/Sale_lib.php
@@ -108,6 +108,11 @@ class Sale_lib
        'custom_tax_invoice'
    ];

+    private const ALLOWED_RECEIPT_TEMPLATES = [
+        'receipt_default',
+        'receipt_short'
+    ];
+
    public function get_invoice_type_options(): array
    {
        $invoice_types = [];
@@ -161,6 +166,11 @@ class Sale_lib
        return in_array($invoice_type, self::ALLOWED_INVOICE_TYPES, true);
    }

+    public static function isValidReceiptTemplate(string $receipt_template): bool
+    {
+        return in_array($receipt_template, self::ALLOWED_RECEIPT_TEMPLATES, true);
+    }
+
    /**
     * @return array
     */
--- a/app/Models/Attribute.php
+++ b/app/Models/Attribute.php
@@ -601,6 +601,10 @@ class Attribute extends Model
     */
    public function saveAttributeLink(int $itemId, int $definitionId, int $attributeId): bool
    {
+        if ($attributeId <= 0) {
+            return false;
+        }
+
        $normalizedItemId = empty($itemId) ? null : $itemId;
        $normalizedAttributeId = empty($attributeId) ? null : $attributeId;

--- a/app/Models/Receiving.php
+++ b/app/Models/Receiving.php
@@ -294,7 +294,9 @@ class Receiving extends Model
            lang('Sales.check') => lang('Sales.check'),
            lang('Sales.debit') => lang('Sales.debit'),
            lang('Sales.credit') => lang('Sales.credit'),
-            lang('Sales.due') => lang('Sales.due')
+            lang('Sales.due') => lang('Sales.due'),
+            lang('Sales.bank_transfer') => lang('Sales.bank_transfer'),
+            lang('Sales.wallet') => lang('Sales.wallet')
        ];
    }

--- a/app/Models/Reports/Summary_sales_taxes.php
+++ b/app/Models/Reports/Summary_sales_taxes.php
@@ -33,14 +33,16 @@ class Summary_sales_taxes extends Summary_report
     * @param object $builder
     * @return void
     */
-    protected function _where(array $inputs, object &$builder): void    // TODO: hungarian notation
+    protected function _where(array $inputs, object &$builder): void
    {
        $builder->where('sales.sale_status', COMPLETED);

-        if (empty($this->config['date_or_time_format'])) {    // TODO: Duplicated code
-            $builder->where('DATE(sales.sale_time) BETWEEN ' . $this->db->escape($inputs['start_date']) . ' AND ' . $this->db->escape($inputs['end_date']));
+        if (empty($this->config['date_or_time_format'])) {
+            $builder->where('DATE(sales.sale_time) >=', $inputs['start_date']);
+            $builder->where('DATE(sales.sale_time) <=', $inputs['end_date']);
        } else {
-            $builder->where('sales.sale_time BETWEEN ' . $this->db->escape(rawurldecode($inputs['start_date'])) . ' AND ' . $this->db->escape(rawurldecode($inputs['end_date'])));
+            $builder->where('sales.sale_time >=', $inputs['start_date']);
+            $builder->where('sales.sale_time <=', $inputs['end_date']);
        }
    }

@@ -53,9 +55,11 @@ class Summary_sales_taxes extends Summary_report
        $builder = $this->db->table('sales_taxes');

        if (empty($this->config['date_or_time_format'])) {
-            $builder->where('DATE(sale_time) BETWEEN ' . $inputs['start_date'] . ' AND ' . $inputs['end_date']);
+            $builder->where('DATE(sale_time) >=', $inputs['start_date']);
+            $builder->where('DATE(sale_time) <=', $inputs['end_date']);
        } else {
-            $builder->where('sale_time BETWEEN ' . $this->db->escape(rawurldecode($inputs['start_date'])) . ' AND ' . $this->db->escape(rawurldecode($inputs['end_date'])));
+            $builder->where('sale_time >=', $inputs['start_date']);
+            $builder->where('sale_time <=', $inputs['end_date']);
        }

        $builder->select('reporting_authority, jurisdiction_name, tax_category, tax_rate, SUM(sale_tax_amount) AS tax');
--- a/app/Models/Sale.php
+++ b/app/Models/Sale.php
@@ -277,6 +277,14 @@ class Sale extends Model
            $builder->like('payment_type', lang('Sales.debit'));
        }

+        if ($filters['only_bank_transfer']) {
+            $builder->like('payment_type', lang('Sales.bank_transfer'));
+        }
+
+        if ($filters['only_wallet']) {
+            $builder->like('payment_type', lang('Sales.wallet'));
+        }
+
        $builder->groupBy('payment_type');

        $payments = $builder->get()->getResultArray();
@@ -1509,5 +1517,13 @@ class Sale extends Model
        if ($filters['only_check']) {
            $builder->like('payments.payment_type', lang('Sales.check'));
        }
+
+        if ($filters['only_bank_transfer']) {
+            $builder->like('payments.payment_type', lang('Sales.bank_transfer'));
+        }
+
+        if ($filters['only_wallet']) {
+            $builder->like('payments.payment_type', lang('Sales.wallet'));
+        }
    }
 }
--- a/app/Views/configs/general_config.php
+++ b/app/Views/configs/general_config.php
@@ -29,7 +29,7 @@
                            ) ?>
                        </div>
                        <div class="col-sm-7">
-                            <a href="<?= 'https://bootswatch.com/3/' . ('bootstrap' == ($config['theme']) ? 'default' : esc($config['theme'])) ?>" target="_blank" rel=”noopener”>
+                            <a href="<?= 'https://bootswatch.com/3/' . ('bootstrap' == ($config['theme']) ? 'default' : esc($config['theme'])) ?>" target="_blank" rel="noopener">
                                <span><?= lang('Config.theme_preview') . ' ' . ucfirst(esc($config['theme'])) . ' ' ?></span>
                                <span class="glyphicon glyphicon-new-window"></span>
                            </a>
@@ -130,14 +130,17 @@
            </div>

            <div class="form-group form-group-sm">
-                <?= form_label(lang('Config.receiving_calculate_average_price'), 'receiving_calculate_average_price', ['class' => 'control-label col-xs-2']) ?>
-                <div class="col-xs-1">
-                    <?= form_checkbox([
-                        'name'    => 'receiving_calculate_average_price',
-                        'id'      => 'receiving_calculate_average_price',
-                        'value'   => 'receiving_calculate_average_price',
-                        'checked' => $config['receiving_calculate_average_price'] == 1
-                    ]) ?>
+                <?= form_label(lang('Config.receiving_cost_price_method'), 'receiving_cost_price_method', ['class' => 'control-label col-xs-2']) ?>
+                <div class="col-xs-3">
+                    <?= form_dropdown(
+                        'receiving_cost_price_method',
+                        [
+                            'average' => lang('Config.receiving_cost_price_method_average'),
+                            'new'     => lang('Config.receiving_cost_price_method_new'),
+                        ],
+                        (($config['receiving_cost_price_method'] ?? (($config['receiving_calculate_average_price'] ?? 1) ? 'average' : 'new'))),
+                        ['id' => 'receiving_cost_price_method', 'class' => 'form-control']
+                    ) ?>
                </div>
            </div>

@@ -278,7 +281,7 @@
                        'checked' => $config['gcaptcha_enable'] == 1
                    ]) ?>
                    <label class="control-label">
-                        <a href="https://www.google.com/recaptcha/admin" target="_blank">
+                        <a href="https://www.google.com/recaptcha/admin" target="_blank" rel="noopener noreferrer">
                            <span class="glyphicon glyphicon-info-sign" data-toggle="tooltip" data-placement="right" title="<?= lang('Config.gcaptcha_tooltip') ?>"></span>
                        </a>
                    </label>
@@ -405,6 +408,18 @@
                </div>
            </div>

+            <div class="form-group form-group-sm">
+                <?= form_label(lang('Config.customer_display'), 'customer_display_enabled', ['class' => 'control-label col-xs-2']) ?>
+                <div class="col-xs-1">
+                    <?= form_checkbox([
+                        'name'    => 'customer_display_enabled',
+                        'id'      => 'customer_display_enabled',
+                        'value'   => 'customer_display_enabled',
+                        'checked' => ($config['customer_display_enabled'] ?? 1) == 1
+                    ]) ?>
+                </div>
+            </div>
+
            <div class="form-group form-group-sm">
                <?= form_label(lang('Config.show_office_group'), 'show_office_group', ['class' => 'control-label col-xs-2']) ?>
                <div class="col-xs-1">
@@ -441,6 +456,7 @@
                </div>
            </div>

+
            <div class="form-group form-group-sm">
                <?= form_label(lang('Config.category_dropdown'), 'category_dropdown', ['class' => 'control-label col-xs-2']) ?>
                <div class="col-xs-1">
@@ -541,3 +557,6 @@
        }));
    });
 </script>
+
+
+
--- a/app/Views/partial/customer_display_header.php
+++ b/app/Views/partial/customer_display_header.php
@@ -0,0 +1,249 @@
+<?php
+/**
+ * @var array $config
+ * @var string $companyName
+ * @var string $companyDetails
+ */
+
+helper('url');
+?>
+
+<!doctype html>
+<html lang="<?= esc(service('request')->getLocale()) ?>">
+<head>
+    <meta charset="utf-8">
+    <title><?= lang('Sales.customer_display') ?></title>
+    <link rel="shortcut icon" type="image/x-icon" href="<?= base_url('images/favicon.ico') ?>">
+    <link rel="stylesheet" href="<?= base_url('resources/bootswatch/' . (empty($config['theme']) ? 'flatly' : esc($config['theme'])) . '/bootstrap.min.css') ?>">
+    <link rel="stylesheet" href="<?= base_url('resources/opensourcepos-8e34d6a398.min.css') ?>">
+    <style>
+        html, body {
+            margin: 0;
+            padding: 0;
+            background: #f8f8f8;
+            color: #333;
+            font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
+        }
+
+        body {
+            width: 100%;
+            overflow: hidden;
+        }
+
+        .customer-display-header {
+            background: #1f3143;
+            color: #fff;
+            text-align: center;
+            font-size: 15px;
+            font-weight: 700;
+            letter-spacing: 0.02em;
+            padding: 6px 12px;
+            border-bottom: 1px solid #102131;
+        }
+
+        .customer-display-shell {
+            width: 100%;
+            max-width: 1280px;
+            margin: 0 auto;
+            padding: 12px 18px 18px;
+            box-sizing: border-box;
+        }
+
+        .customer-display-company {
+            text-align: center;
+            margin-bottom: 18px;
+        }
+
+        .customer-display-company img {
+            display: block;
+            margin: 0 auto 6px;
+            max-height: 84px;
+            max-width: 240px;
+        }
+
+        .customer-display-company .company-name {
+            font-size: 20px;
+            font-weight: 600;
+            line-height: 1.2;
+            margin-top: 12px;
+        }
+
+        .customer-display-company .company-details {
+            font-size: 13px;
+            line-height: 1.35;
+            white-space: pre-line;
+        }
+
+        .customer-display-company .company-phone {
+            font-size: 13px;
+            line-height: 1.35;
+            margin-top: 4px;
+        }
+
+        .customer-display-main-row {
+            display: flex;
+            gap: 14px;
+            align-items: flex-start;
+            margin-top: 6px;
+        }
+
+        .customer-display-cart-column {
+            flex: 1 1 auto;
+            min-width: 0;
+        }
+
+        .customer-display-summary-column {
+            flex: 0 0 320px;
+            width: 320px;
+        }
+
+        .customer-display-summary-panel,
+        .customer-display-info-panel,
+        .customer-display-items-panel {
+            margin-bottom: 0;
+        }
+
+        .customer-display-summary-panel .panel-heading,
+        .customer-display-info-panel .panel-heading,
+        .customer-display-items-panel .panel-heading {
+            font-weight: 600;
+        }
+
+        .customer-display-summary-panel .table,
+        .customer-display-info-table {
+            margin-bottom: 0;
+            font-size: 13px;
+        }
+
+        .customer-display-summary-panel .table > tbody > tr > th,
+        .customer-display-info-table > tbody > tr > th {
+            background: #f8fbfd;
+            width: 56%;
+            font-weight: 700;
+        }
+
+        .customer-display-summary-panel .table > tbody > tr > td,
+        .customer-display-info-table > tbody > tr > td {
+            width: 44%;
+            text-align: right;
+            white-space: nowrap;
+            font-weight: 600;
+        }
+
+        .customer-display-summary-panel .rate-row th,
+        .customer-display-summary-panel .rate-row td {
+            color: #c00000;
+        }
+
+        .customer-display-summary-panel .summary-section-row th {
+            background: #eaf2f8;
+            color: #1f3b5b;
+            font-weight: 700;
+        }
+
+        .customer-display-summary-panel .summary-subtable {
+            width: 100%;
+        }
+
+        .customer-display-summary-panel .summary-subtable > tbody > tr > th {
+            background: #fdfefe;
+            font-weight: 600;
+        }
+
+        .customer-display-summary-panel .summary-subtable > tbody > tr > td {
+            font-weight: 600;
+        }
+
+        .register-wrap {
+            width: 100%;
+        }
+
+        #register {
+            width: 100%;
+            margin: 0;
+            table-layout: fixed;
+            background: #fff;
+        }
+
+        #register th,
+        #register td {
+            text-align: center;
+            vertical-align: middle;
+            padding: 6px 5px;
+            word-wrap: break-word;
+        }
+
+        #register thead th {
+            font-size: 12px;
+            font-weight: 600;
+            color: #333;
+        }
+
+        #register tbody td {
+            font-size: 15px;
+        }
+
+        #register tbody td.item-name-cell {
+            font-size: 16px;
+            text-align: left;
+        }
+
+        #register tbody td.price-cell {
+            font-size: 15px;
+        }
+
+        #register tbody td.serial-cell {
+            font-size: 12px;
+            color: #2F4F4F;
+        }
+
+        .customer-display-summary-panel .table > tbody > tr > th,
+        .customer-display-info-table > tbody > tr > th {
+            border-top: 1px solid #e5e5e5;
+        }
+
+        .customer-display-summary-panel .table > tbody > tr > td,
+        .customer-display-info-table > tbody > tr > td {
+            border-top: 1px solid #e5e5e5;
+        }
+
+        .customer-display-summary-panel .panel-body,
+        .customer-display-info-panel .panel-body,
+        .customer-display-items-panel .panel-body {
+            padding: 12px 15px;
+        }
+
+        .customer-display-summary-column .panel-body {
+            padding-top: 8px;
+        }
+
+        .customer-display-summary-column .customer-name-value,
+        .customer-display-summary-column .giftcard-value,
+        .customer-display-summary-column .reward-value {
+            text-align: right;
+        }
+
+        .customer-display-footer {
+            margin-top: 14px;
+            text-align: center;
+            font-size: 12px;
+            color: #777;
+        }
+    </style>
+</head>
+<body>
+    <div class="customer-display-header">Open Source Point of Sale</div>
+    <div class="customer-display-shell">
+        <div class="customer-display-company">
+            <?php if (!empty($config['company_logo'])) { ?>
+                <img src="<?= base_url('uploads/' . esc($config['company_logo'], 'url')) ?>" alt="company_logo">
+            <?php } ?>
+            <div class="company-name"><?= esc($companyName) ?></div>
+            <div class="company-phone">Phone: <?= esc((string)($config['phone'] ?? '')) ?></div>
+            <?php if ($companyDetails !== '') { ?>
+                <div class="company-details"><?= nl2br(esc($companyDetails)) ?></div>
+            <?php } ?>
+        </div>
+
+        <div class="customer-display-main-row">
+
--- a/app/Views/sales/customer_display.php
+++ b/app/Views/sales/customer_display.php
@@ -0,0 +1,224 @@
+<?php
+/**
+ * @var array $cart
+ * @var array $config
+ * @var float $rate
+ * @var float $total
+ * @var float $subtotal
+ * @var float $prediscount_subtotal
+ * @var array $taxes
+ * @var array $payments
+ * @var float $amount_change
+ */
+
+$priceWithCurrencyLabel = lang('Sales.price_with_currency');
+
+?>
+
+<?= view('partial/customer_display_header') ?>
+
+            <div class="customer-display-cart-column">
+                <div class="register-wrap">
+                    <div class="panel panel-default customer-display-items-panel">
+                        <div class="panel-heading"><?= lang('Sales.items') ?></div>
+                        <div class="panel-body table-responsive">
+                            <table class="table table-striped table-condensed" id="register">
+                                <thead>
+                                    <tr>
+                                        <th style="width: <?= (int) $cartItemWidth ?>%;"><?= lang('Sales.item_name') ?></th>
+                                        <?php if ($cartHasCustomerDisplay) { ?>
+                                            <th style="width: <?= (int) $cartPriceWidth ?>%;"><?= sprintf($priceWithCurrencyLabel, esc($customerDisplayCurrencyLabel)) ?></th>
+                                        <?php } ?>
+                                        <th style="width: <?= (int) $cartOriginalWidth ?>%;"><?= sprintf($priceWithCurrencyLabel, esc($originalCurrencyLabel)) ?></th>
+                                        <th style="width: <?= (int) $cartQuantityWidth ?>%;"><?= lang('Sales.quantity') ?></th>
+                                        <th style="width: <?= (int) $cartDiscountWidth ?>%;"><?= lang('Sales.discount') ?></th>
+                                        <th style="width: <?= (int) $cartTotalWidth ?>%;"><?= lang('Sales.total') ?></th>
+                                    </tr>
+                                </thead>
+                                <tbody id="cart_contents">
+                                    <?php if (count($cart) == 0) { ?>
+                                        <tr>
+                                            <td colspan="<?= (int) $cartColspan ?>">
+                                                <div class="alert alert-dismissible alert-info"><?= lang('Sales.no_items_in_cart') ?></div>
+                                            </td>
+                                        </tr>
+                                    <?php } else { ?>
+                                        <?php foreach (array_reverse($cart, true) as $line => $item) { ?>
+                                            <tr>
+                                                <td class="item-name-cell">
+                                                    <?= esc($item['name']) ?><br>
+                                                    <?= !empty($item['attribute_values']) ? esc($item['attribute_values']) : '' ?>
+                                                </td>
+                                                <?php if ($cartHasCustomerDisplay) { ?>
+                                                    <td class="price-cell">
+                                                        <?= to_secondary_currency((float)$item['price'], $secondaryCurrency) ?>
+                                                    </td>
+                                                <?php } ?>
+                                                <td class="price-cell">
+                                                    <?= to_currency($item['price']) ?>
+                                                </td>
+                                                <td class="price-cell">
+                                                    <?= to_quantity_decimals($item['quantity']) ?>
+                                                </td>
+                                                <td class="price-cell">
+                                                    <?= to_decimals($item['discount'], 0) ?>
+                                                </td>
+                                                <td class="price-cell">
+                                                    <?= $item['item_type'] == ITEM_AMOUNT_ENTRY ? to_currency_no_money($item['discounted_total']) : to_currency($item['discounted_total']) ?>
+                                                </td>
+                                            </tr>
+                                            <tr>
+                                                <td colspan="<?= $cartHasCustomerDisplay ? 3 : 2 ?>"></td>
+                                                <td class="serial-cell">
+                                                    <?= $item['is_serialized'] == 1 ? lang('Sales.serial') : '' ?>
+                                                </td>
+                                                <td colspan="2" class="serial-cell">
+                                                    <?php if ($item['is_serialized'] == 1) {
+                                                        echo esc($item['serialnumber']);
+                                                    } ?>
+                                                </td>
+                                            </tr>
+                                        <?php } ?>
+                                    <?php } ?>
+                                </tbody>
+                            </table>
+                        </div>
+                    </div>
+                </div>
+            </div>
+            <div class="customer-display-summary-column">
+                <div class="panel panel-primary customer-display-summary-panel">
+                    <div class="panel-heading"><?= lang('Sales.summary') ?></div>
+                    <div class="panel-body">
+                        <table class="table table-condensed summary-subtable">
+                            <tbody>
+                                <tr>
+                                    <th><?= lang('Sales.total') ?></th>
+                                    <td><?= to_currency($total) ?></td>
+                                </tr>
+                                <?php if ($showCustomerDisplay): ?>
+                                    <tr>
+                                        <th><?= lang('Sales.total') ?> <?= esc($customerDisplayCurrencyLabel) ?></th>
+                                        <td><?= to_secondary_currency((float)$total, $secondaryCurrency) ?></td>
+                                    </tr>
+                                    <tr class="rate-row">
+                                        <th><?= lang('Sales.rate') ?></th>
+                                        <td><?= number_format((float) $rate, 2) ?></td>
+                                    </tr>
+                                <?php endif; ?>
+                            </tbody>
+                        </table>
+
+                        <table class="table table-condensed summary-subtable" style="margin-top: 10px;">
+                            <tbody>
+                                <tr class="summary-section-row">
+                                    <th colspan="2"><?= lang('Sales.customer') ?></th>
+                                </tr>
+                                <tr>
+                                    <th><?= lang('Sales.customer_name') ?></th>
+                                    <td class="customer-name-value"><?= esc($customerName ?? lang('Sales.walk_in_customer')) ?></td>
+                                </tr>
+                                <tr>
+                                    <th><?= lang('Sales.giftcard_balance') ?></th>
+                                    <td class="giftcard-value"><?= to_currency((float) ($giftcardRemainder ?? 0)) ?></td>
+                                </tr>
+                                <tr>
+                                    <th><?= lang('Sales.loyalty_reward_points') ?></th>
+                                    <td class="reward-value"><?= esc((string)($customerRewardPoints ?? 0)) ?></td>
+                                </tr>
+                            </tbody>
+                        </table>
+
+                        <table class="table table-condensed summary-subtable" style="margin-top: 10px;">
+                            <tbody>
+                                <tr class="summary-section-row">
+                                    <th colspan="2"><?= lang('Sales.change') ?></th>
+                                </tr>
+                                <tr>
+                                    <th><?= lang('Sales.payments_total') ?></th>
+                                    <td><?= to_currency($payments_total) ?></td>
+                                </tr>
+                                <tr>
+                                    <th><?= lang('Sales.amount_due') ?></th>
+                                    <td><?= to_currency($amount_due) ?></td>
+                                </tr>
+                                <?php if ($showCustomerDisplay): ?>
+                                    <tr>
+                                        <th><?= lang('Sales.amount_due') ?> <?= esc($customerDisplayCurrencyLabel) ?></th>
+                                        <td><?= to_secondary_currency((float)$amount_due, $secondaryCurrency) ?></td>
+                                    </tr>
+                                <?php endif; ?>
+                                <tr>
+                                    <th><?= lang('Sales.change_due') ?></th>
+                                    <td><?= to_currency($paymentChangeDue ?? 0) ?></td>
+                                </tr>
+                                <?php if ($showCustomerDisplay): ?>
+                                    <tr>
+                                        <th><?= lang('Sales.change_due') ?> <?= esc($customerDisplayCurrencyLabel) ?></th>
+                                        <td><?= to_secondary_currency((float)($paymentChangeDue ?? 0), $secondaryCurrency) ?></td>
+                                    </tr>
+                                <?php endif; ?>
+                            </tbody>
+                        </table>
+                    </div>
+                </div>
+            </div>
+        </div>
+
+        <div class="customer-display-footer"></div>
+    </div>
+
+<script>
+        const customerDisplayId = new URLSearchParams(window.location.search).get('displayId') || '';
+        const customerDisplayStorageSuffix = customerDisplayId !== '' ? '_' + customerDisplayId : '';
+        const customerDisplayStorageKeys = {
+            open: 'customerDisplayOpen' + customerDisplayStorageSuffix,
+            dirtyAt: 'customerDisplayDirtyAt' + customerDisplayStorageSuffix
+        };
+
+        localStorage.setItem(customerDisplayStorageKeys.open, '1');
+
+        let lastDirtyAt = localStorage.getItem(customerDisplayStorageKeys.dirtyAt) || '';
+        let refreshTimer = null;
+
+        const scheduleRefresh = function(dirtyAt) {
+            if (refreshTimer !== null) {
+                clearTimeout(refreshTimer);
+            }
+
+            refreshTimer = setTimeout(function() {
+                if (localStorage.getItem(customerDisplayStorageKeys.open) !== '1') {
+                    return;
+                }
+
+                if (localStorage.getItem(customerDisplayStorageKeys.dirtyAt) === dirtyAt) {
+                    window.location.reload();
+                }
+            }, 700);
+        };
+
+        const checkForRefresh = function() {
+            const dirtyAt = localStorage.getItem(customerDisplayStorageKeys.dirtyAt) || '';
+            if (dirtyAt !== '' && dirtyAt !== lastDirtyAt) {
+                lastDirtyAt = dirtyAt;
+                scheduleRefresh(dirtyAt);
+            }
+        };
+
+        window.addEventListener('storage', function(event) {
+            if (event.key === customerDisplayStorageKeys.dirtyAt) {
+                checkForRefresh();
+            }
+        });
+
+        setInterval(checkForRefresh, 500);
+
+        window.addEventListener('beforeunload', function() {
+            localStorage.removeItem(customerDisplayStorageKeys.open);
+        });
+    </script>
+
+</body>
+</html>
+
+
--- a/app/Views/sales/receipt.php
+++ b/app/Views/sales/receipt.php
@@ -2,11 +2,14 @@
 /**
 * @var int $sale_id_num
 * @var bool $print_after_sale
+ * @var string $receipt_template_view
 * @var array $config
 */

 use App\Models\Employee;

+$template = $receipt_template_view ?? 'receipt_default';
+
 ?>

 <?= view('partial/header') ?>
@@ -61,6 +64,6 @@ if (isset($error_message)) {
    <?php endif; ?>
 </div>

-<?= view('sales/' . $config['receipt_template']) ?>
+<?= view('sales/' . $template) ?>

 <?= view('partial/footer') ?>
--- a/app/Views/sales/register.php
+++ b/app/Views/sales/register.php
@@ -61,6 +61,20 @@ if (isset($success)) {
 helper('url');
 ?>

+<?php if ($secondaryCurrency['show']): ?>
+    <?php $secondaryCurrencyLabel = $secondaryCurrency['symbol'] ?: $secondaryCurrency['code']; ?>
+    <table align="center" style="font-size: 22px; font-weight: 600; background-color: rgb(221, 221, 221); width: 25%; margin: 0 auto 0.5em; border: dashed 1px;">
+        <tr>
+            <td style="text-align: center; padding-right: 5%;"><?= lang(ucfirst($controller_name) . '.total') ?>:</td>
+            <td style="text-align: center;"><?= to_currency($total) ?></td>
+        </tr>
+        <tr>
+            <td style="text-align: center; padding-right: 5%;"><?= lang(ucfirst($controller_name) . '.total') ?> <?= esc($secondaryCurrencyLabel) ?>:</td>
+            <td style="text-align: center;"><?= $secondaryTotalDisplay ?? to_secondary_currency((float) $total, $secondaryCurrency) ?></td>
+        </tr>
+    </table>
+<?php endif; ?>
+
 <div id="register_wrapper">

    <!-- Top register controls -->
@@ -90,6 +104,16 @@ helper('url');
                    </li>
                <?php } ?>

+                <?php if (($config['customer_display_enabled'] ?? true) == 1) { ?>
+                    <li class="pull-right">
+                        <?= anchor(
+                            "$controller_name/customerDisplay",
+                            '<span class="glyphicon glyphicon-blackboard">&nbsp;</span>' . lang(ucfirst($controller_name) . '.customer_display'),
+                            ['class' => 'btn btn-success btn-sm', 'id' => 'show_customer_display', 'title' => lang(ucfirst($controller_name) . '.customer_display'), 'onclick' => 'return openCustomerDisplay(this.href);']
+                        ) ?>
+                    </li>
+                <?php } ?>
+
                <li class="pull-right">
                    <button class="btn btn-default btn-sm modal-dlg" id="show_suspended_sales_button" data-href="<?= esc("$controller_name/suspended") ?>"
                        title="<?= lang(ucfirst($controller_name) . '.suspended_sales') ?>">
@@ -191,7 +215,7 @@ helper('url');
                                if ($items_module_allowed && $change_price) {
                                    echo form_input(['name' => 'price', 'class' => 'form-control input-sm', 'value' => to_currency_no_money($item['price']), 'tabindex' => ++$tabindex, 'onClick' => 'this.select();']);
                                } else {
-                                    echo to_currency($item['price']);
+                                    echo $secondaryCurrency['show'] ? to_secondary_currency_dual((float) $item['price'], $secondaryCurrency) : to_currency($item['price']);
                                    echo form_hidden('price', to_currency_no_money($item['price']));
                                }
                                ?>
@@ -362,9 +386,6 @@ helper('url');
                    <button class="btn btn-info btn-sm modal-dlg" data-btn-submit="<?= lang('Common.submit') ?>" data-href="<?= "customers/view" ?>" title="<?= lang(ucfirst($controller_name) . ".new_customer") ?>">
                        <span class="glyphicon glyphicon-user">&nbsp;</span><?= lang(ucfirst($controller_name) . ".new_customer") ?>
                    </button>
-                    <button class="btn btn-default btn-sm modal-dlg" id="show_keyboard_help" data-href="<?= esc("$controller_name/salesKeyboardHelp") ?>" title="<?= lang(ucfirst($controller_name) . '.key_title') ?>">
-                        <span class="glyphicon glyphicon-share-alt">&nbsp;</span><?= lang(ucfirst($controller_name) . '.key_help') ?>
-                    </button>
                </div>
            <?php } ?>
        <?= form_close() ?>
@@ -380,7 +401,7 @@ helper('url');
            </tr>
            <?php foreach ($taxes as $tax_group_index => $tax) { ?>
                <tr>
-                    <th style="width: 55%;"><?= (float)$tax['tax_rate'] . '% ' . $tax['tax_group'] ?></th>
+                <th style="width: 55%;"><?= (float)$tax['tax_rate'] . '% ' . esc($tax['tax_group']) ?></th>
                    <th style="width: 45%; text-align: right;"><?= to_currency_tax($tax['sale_tax_amount']) ?></th>
                </tr>
            <?php } ?>
@@ -388,6 +409,12 @@ helper('url');
                <th style="width: 55%; font-size: 150%"><?= lang(ucfirst($controller_name) . '.total') ?></th>
                <th style="width: 45%; font-size: 150%; text-align: right;"><span id="sale_total"><?= to_currency($total) ?></span></th>
            </tr>
+            <?php if ($secondaryCurrency['show']) { ?>
+                <tr>
+                    <th style="width: 55%; font-size: 120%"><?= lang(ucfirst($controller_name) . '.total') ?> <?= esc($secondaryCurrencyLabel) ?></th>
+                    <th style="width: 45%; font-size: 120%; text-align: right;"><span id="sale_total_secondary_currency"><?= $secondaryTotalDisplay ?? to_secondary_currency((float) $total, $secondaryCurrency) ?></span></th>
+                </tr>
+            <?php } ?>
        </table>

        <?php if (count($cart) > 0) { // Only show this part if there are Items already in the register ?>
@@ -396,16 +423,21 @@ helper('url');
                    <th style="width: 55%;"><?= lang(ucfirst($controller_name) . '.payments_total') ?></th>
                    <th style="width: 45%; text-align: right;"><?= to_currency($payments_total) ?></th>
                </tr>
+            <tr>
+                <th style="width: 55%; font-size: 120%"><?= lang(ucfirst($controller_name) . '.amount_due') ?></th>
+                <th style="width: 45%; font-size: 120%; text-align: right;"><span id="sale_amount_due"><?= to_currency($amount_due) ?></span></th>
+            </tr>
+            <?php if ($secondaryCurrency['show']) { ?>
                <tr>
-                    <th style="width: 55%; font-size: 120%"><?= lang(ucfirst($controller_name) . '.amount_due') ?></th>
-                    <th style="width: 45%; font-size: 120%; text-align: right;"><span id="sale_amount_due"><?= to_currency($amount_due) ?></span></th>
+                    <th style="width: 55%; font-size: 120%"><?= lang(ucfirst($controller_name) . '.amount_due') ?> <?= esc($secondaryCurrencyLabel) ?></th>
+                    <th style="width: 45%; font-size: 120%; text-align: right;"><span id="sale_amount_due_secondary_currency"><?= $secondaryAmountDueDisplay ?? to_secondary_currency((float) $amount_due, $secondaryCurrency) ?></span></th>
                </tr>
-            </table>
+            <?php } ?>
+        </table>

            <div id="payment_details">
                <?php if ($payments_cover_total) { // Show Complete sale button instead of Add Payment if there is no amount due left ?>
                    <?= form_open("$controller_name/addPayment", ['id' => 'add_payment_form', 'class' => 'form-horizontal']) ?>
-                        <input type="hidden" name="complete_after_payment" value="0">
                        <table class="sales_table_100">
                            <tr>
                                <td><?= lang(ucfirst($controller_name) . '.payment') ?></td>
@@ -582,8 +614,76 @@ helper('url');
        cancel: keyboardShortcuts?.cancel?.code ?? null
    };

+    window.customerDisplayWindow = window.customerDisplayWindow || null;
+    window.customerDisplayDisplayId = window.customerDisplayDisplayId || sessionStorage.getItem('customerDisplayId') || localStorage.getItem('customerDisplayId') || '';
+
+    window.customerDisplayStorageSuffix = function() {
+        return window.customerDisplayDisplayId ? '_' + window.customerDisplayDisplayId : '';
+    };
+
+    window.customerDisplayStorageKeys = function() {
+        const suffix = window.customerDisplayStorageSuffix();
+
+        return {
+            open: 'customerDisplayOpen' + suffix,
+            dirtyAt: 'customerDisplayDirtyAt' + suffix
+        };
+    };
+
+    window.openCustomerDisplay = function(url) {
+        if (window.customerDisplayDisplayId === '') {
+            window.customerDisplayDisplayId = String(Date.now()) + Math.random().toString(36).slice(2);
+        }
+
+        const keys = window.customerDisplayStorageKeys();
+        const displayUrl = new URL(url, window.location.href);
+        displayUrl.searchParams.set('displayId', window.customerDisplayDisplayId);
+
+        sessionStorage.setItem('customerDisplayId', window.customerDisplayDisplayId);
+        localStorage.setItem('customerDisplayId', window.customerDisplayDisplayId);
+        localStorage.setItem(keys.open, '1');
+        localStorage.setItem(keys.dirtyAt, String(Date.now()));
+        window.customerDisplayWindow = window.open(displayUrl.toString(), 'customer_display_' + window.customerDisplayDisplayId, 'width=1280,height=720,resizable=yes,scrollbars=yes');
+        if (window.customerDisplayWindow && !window.customerDisplayWindow.closed) {
+            window.customerDisplayWindow.focus();
+        }
+
+        return false;
+    };
+
+    window.refreshCustomerDisplay = function() {
+        const keys = window.customerDisplayStorageKeys();
+
+        if (localStorage.getItem(keys.open) !== '1') {
+            return;
+        }
+
+        localStorage.setItem(keys.dirtyAt, String(Date.now()));
+        if (window.customerDisplayWindow && !window.customerDisplayWindow.closed) {
+            window.customerDisplayWindow.location.reload();
+            window.customerDisplayWindow.focus();
+        }
+    };
+
+    window.notifyCustomerDisplay = function() {
+        window.refreshCustomerDisplay();
+    };
+
+    const secondaryAmounts = <?= json_encode([
+        'total' => $secondaryTotalDisplay ?? null,
+        'amountDue' => $secondaryAmountDueDisplay ?? null,
+        'cashAmountDue' => $secondaryCashAmountDueDisplay ?? null,
+        'nonCashTotal' => $secondaryNonCashTotalDisplay ?? null,
+        'nonCashAmountDue' => $secondaryNonCashAmountDueDisplay ?? null
+    ], JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP) ?>;
+
    $(document).ready(function() {
+        setTimeout(function() {
+            window.notifyCustomerDisplay();
+        }, 300);
+
        const redirect = function() {
+            window.notifyCustomerDisplay();
            window.location.href = "<?= site_url('sales'); ?>";
        };

@@ -611,7 +711,10 @@ helper('url');
                    'item_id': item_id,
                    'item_number': item_number,
                },
-                dataType: 'json'
+                dataType: 'json',
+                success: function() {
+                    window.notifyCustomerDisplay();
+                }
            });
        });

@@ -625,7 +728,10 @@ helper('url');
                    'item_id': item_id,
                    'item_name': item_name,
                },
-                dataType: 'json'
+                dataType: 'json',
+                success: function() {
+                    window.notifyCustomerDisplay();
+                }
            });
        });

@@ -639,7 +745,10 @@ helper('url');
                    'item_id': item_id,
                    'item_description': item_description,
                },
-                dataType: 'json'
+                dataType: 'json',
+                success: function() {
+                    window.notifyCustomerDisplay();
+                }
            });
        });

@@ -688,6 +797,7 @@ helper('url');
            delay: 10,
            select: function(a, ui) {
                $(this).val(ui.item.value);
+                window.notifyCustomerDisplay();
                $('#select_customer_form').submit();
                return false;
            }
@@ -706,6 +816,7 @@ helper('url');
            delay: 10,
            select: function(a, ui) {
                $(this).val(ui.item.value);
+                window.notifyCustomerDisplay();
                $('#add_payment_form').submit();
                return false;
            }
@@ -745,28 +856,33 @@ helper('url');
        });

        $('#finish_sale_button').click(function() {
+            window.notifyCustomerDisplay();
            $('#buttons_form').attr('action', "<?= "$controller_name/complete" ?>");
            $('#buttons_form').submit();
        });

        $('#finish_invoice_quote_button').click(function() {
+            window.notifyCustomerDisplay();
            $('#buttons_form').attr('action', "<?= "$controller_name/complete" ?>");
            $('#buttons_form').submit();
        });

        $('#suspend_sale_button').click(function() {
+            window.notifyCustomerDisplay();
            $('#buttons_form').attr('action', "<?= site_url("$controller_name/suspend") ?>");
            $('#buttons_form').submit();
        });

        $('#cancel_sale_button').click(function() {
            if (confirm("<?= lang(ucfirst($controller_name) . '.confirm_cancel_sale') ?>")) {
+                window.notifyCustomerDisplay();
                $('#buttons_form').attr('action', "<?= site_url("$controller_name/cancel") ?>");
                $('#buttons_form').submit();
            }
        });

        $('#add_payment_button').click(function() {
+            window.notifyCustomerDisplay();
            $('#add_payment_form').find('input[name="complete_after_payment"]').val('0');
            $('#add_payment_form').submit();
        });
@@ -803,11 +919,13 @@ helper('url');
            if (response.success) {
                if (resource.match(/customers$/)) {
                    $('#customer').val(response.id);
+                    window.notifyCustomerDisplay();
                    $('#select_customer_form').submit();
                } else {
                    var $stock_location = $("select[name='stock_location']").val();
                    $('#item_location').val($stock_location);
                    $('#item').val(response.id);
+                    window.notifyCustomerDisplay();
                    if (stay_open) {
                        $('#add_item_form').ajaxSubmit();
                    } else {
@@ -830,10 +948,17 @@ helper('url');

    function check_payment_type() {
        var cash_mode = <?= json_encode($cash_mode) ?>;
+        const updateSecondaryRows = function(totalDisplay, amountDueDisplay) {
+            if (totalDisplay !== null && amountDueDisplay !== null) {
+                $("#sale_total_secondary_currency").html(totalDisplay);
+                $("#sale_amount_due_secondary_currency").html(amountDueDisplay);
+            }
+        };

        if ($("#payment_types").val() == "<?= lang(ucfirst($controller_name) . '.giftcard') ?>") {
            $("#sale_total").html("<?= to_currency($total) ?>");
            $("#sale_amount_due").html("<?= to_currency($amount_due) ?>");
+            updateSecondaryRows(secondaryAmounts.total, secondaryAmounts.amountDue);
            $("#amount_tendered_label").html("<?= lang(ucfirst($controller_name) . '.giftcard_number') ?>");
            $("#amount_tendered:enabled").val('').focus();
            $(".giftcard-input").attr('disabled', false);
@@ -842,6 +967,7 @@ helper('url');
        } else if (($("#payment_types").val() == "<?= lang(ucfirst($controller_name) . '.cash') ?>" && cash_mode == '1')) {
            $("#sale_total").html("<?= to_currency($non_cash_total) ?>");
            $("#sale_amount_due").html("<?= to_currency($cash_amount_due) ?>");
+            updateSecondaryRows(secondaryAmounts.nonCashTotal, secondaryAmounts.cashAmountDue);
            $("#amount_tendered_label").html("<?= lang(ucfirst($controller_name) . '.amount_tendered') ?>");
            $("#amount_tendered:enabled").val("<?= to_currency_no_money($cash_amount_due) ?>");
            $(".giftcard-input").attr('disabled', true);
@@ -849,6 +975,7 @@ helper('url');
        } else {
            $("#sale_total").html("<?= to_currency($non_cash_total) ?>");
            $("#sale_amount_due").html("<?= to_currency($amount_due) ?>");
+            updateSecondaryRows(secondaryAmounts.nonCashTotal, secondaryAmounts.nonCashAmountDue);
            $("#amount_tendered_label").html("<?= lang(ucfirst($controller_name) . '.amount_tendered') ?>");
            $("#amount_tendered:enabled").val("<?= to_currency_no_money($amount_due) ?>");
            $(".giftcard-input").attr('disabled', true);
@@ -861,6 +988,7 @@ helper('url');
        if ($(event.target).closest('.modal').length || $('.modal.in').length) {
            return;
        }
+
        if (event.altKey) {
            switch (event.keyCode) {
                case shortcutCodes.items:
@@ -909,3 +1037,6 @@ helper('url');
 </script>

 <?= view('partial/footer') ?>
+
+
+
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -46,6 +46,7 @@ services:
            - .:/app
        environment:
            - CI_ENVIRONMENT=development
+            - ALLOWED_HOSTNAMES=localhost
            - MYSQL_USERNAME=admin
            - MYSQL_PASSWORD=pointofsale
            - MYSQL_DB_NAME=ospos
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -16,6 +16,7 @@ services:
            - logs:/app/writable/logs
        environment:
            - CI_ENVIRONMENT=production
+            - ALLOWED_HOSTNAMES=localhost
            - FORCE_HTTPS=false
            - PHP_TIMEZONE=UTC
            - MYSQL_USERNAME=admin
--- a/tests/Config/AppTest.php
+++ b/tests/Config/AppTest.php
@@ -18,6 +18,7 @@ class AppTest extends CIUnitTestCase
        // Clean up environment
        putenv('CI_ENVIRONMENT');
        putenv('app.allowedHostnames');
+        putenv('ALLOWED_HOSTNAMES');
        unset($_SERVER['HTTP_HOST']);
    }

@@ -281,4 +282,106 @@ class AppTest extends CIUnitTestCase
        putenv('app.allowedHostnames');
        putenv('CI_ENVIRONMENT');
    }
+
+    public function testAllowedHostnamesEnvVarParsedAsCommaSeparated(): void
+    {
+        // Set ALLOWED_HOSTNAMES environment variable
+        putenv('ALLOWED_HOSTNAMES=example.com,www.example.com,demo.example.com');
+
+        $_SERVER['HTTP_HOST'] = 'www.example.com';
+        $_SERVER['SCRIPT_NAME'] = '/index.php';
+        $_SERVER['HTTPS'] = null;
+
+        $app = new App();
+
+        // Constructor should parse comma-separated values
+        $this->assertEquals(['example.com', 'www.example.com', 'demo.example.com'], $app->allowedHostnames);
+        $this->assertStringContainsString('www.example.com', $app->baseURL);
+
+        // Clean up
+        putenv('ALLOWED_HOSTNAMES');
+    }
+
+    public function testAllowedHostnamesEnvVarTakesPrecedenceOverDotEnv(): void
+    {
+        // Set both environment variables
+        putenv('ALLOWED_HOSTNAMES=allowed1.com,allowed2.com');
+        putenv('app.allowedHostnames=dotenv1.com,dotenv2.com');
+
+        $_SERVER['HTTP_HOST'] = 'allowed1.com';
+        $_SERVER['SCRIPT_NAME'] = '/index.php';
+        $_SERVER['HTTPS'] = null;
+
+        $app = new App();
+
+        // ALLOWED_HOSTNAMES should take precedence
+        $this->assertEquals(['allowed1.com', 'allowed2.com'], $app->allowedHostnames);
+        $this->assertStringContainsString('allowed1.com', $app->baseURL);
+
+        // Clean up
+        putenv('ALLOWED_HOSTNAMES');
+        putenv('app.allowedHostnames');
+    }
+
+    public function testAllowedHostnamesEnvVarFallsBackToDotEnv(): void
+    {
+        // Only set app.allowedHostnames, not ALLOWED_HOSTNAMES
+        putenv('app.allowedHostnames=dotenv1.com,dotenv2.com');
+
+        $_SERVER['HTTP_HOST'] = 'dotenv1.com';
+        $_SERVER['SCRIPT_NAME'] = '/index.php';
+        $_SERVER['HTTPS'] = null;
+
+        $app = new App();
+
+        // Should fall back to app.allowedHostnames
+        $this->assertEquals(['dotenv1.com', 'dotenv2.com'], $app->allowedHostnames);
+        $this->assertStringContainsString('dotenv1.com', $app->baseURL);
+
+        // Clean up
+        putenv('app.allowedHostnames');
+    }
+
+    public function testAllowedHostnamesEnvVarTrimmedWhitespace(): void
+    {
+        // Set environment variable with whitespace
+        putenv('ALLOWED_HOSTNAMES= example.com , www.example.com , demo.example.com ');
+
+        $_SERVER['HTTP_HOST'] = 'example.com';
+        $_SERVER['SCRIPT_NAME'] = '/index.php';
+        $_SERVER['HTTPS'] = null;
+
+        $app = new App();
+
+        // Values should be trimmed
+        $this->assertEquals(['example.com', 'www.example.com', 'demo.example.com'], $app->allowedHostnames);
+
+        // Clean up
+        putenv('ALLOWED_HOSTNAMES');
+    }
+
+    public function testAllowedHostnamesEnvVarFiltersEmptyEntries(): void
+    {
+        // Trailing comma should not produce empty entry
+        putenv('ALLOWED_HOSTNAMES=example.com,');
+        $_SERVER['HTTP_HOST'] = 'example.com';
+        $_SERVER['SCRIPT_NAME'] = '/index.php';
+        $_SERVER['HTTPS'] = null;
+
+        $app = new App();
+        $this->assertEquals(['example.com'], $app->allowedHostnames);
+
+        // Clean up
+        putenv('ALLOWED_HOSTNAMES');
+
+        // Whitespace-only entry should be filtered
+        putenv('ALLOWED_HOSTNAMES=example.com, ,www.example.com');
+        $_SERVER['HTTP_HOST'] = 'example.com';
+
+        $app = new App();
+        $this->assertEquals(['example.com', 'www.example.com'], $app->allowedHostnames);
+
+        // Clean up
+        putenv('ALLOWED_HOSTNAMES');
+    }
 }
Author	SHA1	Message	Date
WebShells	19184b50c6	Normalize line endings	2026-05-22 11:52:08 +03:00
WebShells	1a6cfffc27	Fix locale parsing	2026-05-20 23:37:54 +03:00
WebShells	5e0541c53e	Restore secondary display sales flow	2026-05-19 21:33:54 +03:00
objecttothis	b0dddc22a3	Bugfixes to get Migration working on MySQL and MariaDB (#4551 ) * Bugfixes to get Migration working on MySQL Signed-off-by: objec <objecttothis@gmail.com> * MariaDB compatibility fixes - Drop foreign key constraints before making charset changes - Fix dropAllForeignKeyConstraints helper function. - Added `IF EXISTS` to DROP statements - Do not try to readd FK constraints for tables which were dropped. - MariaDB 11.8.x changes the default implicit collation to uca1400 which breaks the IndiaGST migration, et. al. Explicitly declare utf8_general_ci in affected migrations. Signed-off-by: objec <objecttothis@gmail.com> * Fix changes which break MySQL migrations - MySQL does not support IF EXISTS in foreign key constraints. Since the PHP is now handling dropping those constraints, these lines are redundant. Remove them. Signed-off-by: objec <objecttothis@gmail.com> * Resolve code review recommendations - Add try/catch around DB connect statement - Heed result of execute_script function and throw an exception on failure. Signed-off-by: objec <objecttothis@gmail.com> * Refactor out duplicate code Signed-off-by: objec <objecttothis@gmail.com> * Initialize array variable causing potential issues Signed-off-by: objec <objecttothis@gmail.com> --------- Signed-off-by: objec <objecttothis@gmail.com>	2026-05-19 16:02:05 +04:00
jekkos	8d6b166673	feat: Add deployment workflow with approval gates (#4522 ) * feat: Add deployment workflows with approval gates Add GitHub Actions workflows for controlled deployments: deploy.yml - Manual Deploy: - Triggered via Actions UI (workflow_dispatch) - Select environment (production/staging) - Select Docker image tag - Reusable via workflow_call for other workflows - Creates GitHub deployment records with status tracking - Sends Docker Hub compatible webhook payload - Environment input validation for workflow_call deploy-pr.yml - PR Deploy: - Auto-triggers when PR is approved (same-repo only) - Deploys to staging environment - Image tag format: pr-{number}-{short-sha} - Posts deployment status as PR comment - Fork PR protection: only runs for same-repo PRs Security: - jq-based JSON payload construction (prevents script injection) - HMAC-SHA256 signature verification for webhook - Untrusted inputs via env: blocks (not inline interpolation) - Environment validation before deployment - Fork detection guard for PR deployments Fixes CodeRabbit review comments: - Invalid jq string filter syntax (missing quotes) - Unvalidated environment input in workflow_call - Fork PR deployments blocked by pull_request_review restrictions * refactor: Limit deployment to staging only - Remove environment input choice (was production/staging) - Hardcode environment to 'staging' throughout - Simplify workflow - no environment validation needed - Update concurrency group to deploy-staging * refactor: Extract deployment logic to reusable deploy-core.yml Restructure workflows to eliminate code duplication: deploy-core.yml (new): - Reusable workflow with all deployment logic - Creates GitHub deployment record - Sends webhook payload to external service - Handles status updates - Accepts image_tag, sha, description, pr_number inputs - Outputs deployment_id and status deploy.yml (simplified): - Manual trigger only - Calls deploy-core with user-provided image_tag - 18 lines (was 175) deploy-pr.yml (simplified): - PR approval trigger with fork guard - Prepare job: checkout, generate PR image tag - Deploy job: calls deploy-core - Comment job: post status to PR - 70 lines (was 204) --------- Co-authored-by: Ollama <ollama@steganos.dev>	2026-05-18 21:48:02 +02:00
jekkos	093ec7fb13	fix: validate attributeId > 0 in saveAttributeLink() (#4508 ) - Add early validation to reject attributeId <= 0 - Ensure consistent handling of invalid attribute_id in INSERT/UPDATE paths - Prevent foreign key constraint violations from invalid attribute references Fixes #4460 Co-authored-by: Ollama <ollama@steganos.dev> Co-authored-by: objecttothis <17935339+objecttothis@users.noreply.github.com>	2026-05-18 14:13:20 +02:00
jekkos	9c89a2e2cb	fix: Capture CSV import failures in save_tax_data and save_inventory_quantities (#4507 ) * fix: capture CSV import failures in save_tax_data and save_inventory_quantities - Change save_tax_data() return type from void to bool - Change save_inventory_quantities() return type from void to bool - Accumulate failure status with &= operator in save_inventory_quantities - Update postImportCsvFile() to capture return values and set isFailedRow - Properly propagate failures to failCodes array Fixes #4475 * fix: Change isset to !empty for items_taxes_data check - isset was always true since array was initialized - Use !empty to properly check if there are tax items to save Address CodeRabbit review feedback * fix: Capture inventory insert result in save_inventory_quantities - Combine inventory insert result with success tracking - Use &= operator to accumulate failures from both operations - Ensure failures from inventory inserts are propagated Address CodeRabbit review feedback --------- Co-authored-by: Ollama <ollama@steganos.dev>	2026-05-17 22:23:43 +02:00
jekkos	2f51c4ef52	fix(security): SQL injection and path traversal vulnerabilities (#4539 ) Security fixes for two vulnerabilities: 1. SQL Injection in Summary Sales Taxes Report (GHSA-5j9m-2f98-cjqw) - Fixed unsanitized user input concatenation in getData() method - Applied proper escaping using $this->db->escape() for start_date/end_date - Consistent with existing _where() method implementation 2. Path Traversal in Receipt Template (GHSA-h6wm-fhw2-m3q3) - Added ALLOWED_RECEIPT_TEMPLATES whitelist constant - Added isValidReceiptTemplate() validation method - Validate receipt_template before saving in Config controller - Validate receipt_template before rendering in receipt view - Default to 'receipt_default' for invalid values - Consistent with invoice_type fix pattern (commit `31d25e06d`) Affected files: - app/Models/Reports/Summary_sales_taxes.php - app/Libraries/Sale_lib.php - app/Controllers/Config.php - app/Views/sales/receipt.php Co-authored-by: Ollama <ollama@steganos.dev>	2026-05-15 23:10:04 +02:00
jekkos	def0c27a0e	fix(security): Path traversal vulnerability in getPicThumb (#4545 ) Security impact: - Authenticated attackers could read arbitrary files on the server - Path traversal via unsanitized pic_filename parameter - Could read .env, config files, encryption keys Fix: - Apply basename() to strip directory components - Validate file extension to allowlist image types only - Add explicit error response for invalid file types CVE: Pending Affected: <= 3.4.2 Reported by: Kamran Saifullah (VulDB) Co-authored-by: Ollama <ollama@steganos.dev>	2026-05-15 22:04:29 +02:00
BhojKamal	90c981b6b7	feat: Bank transfer and wallet payment option added #4540 (#4547 ) --------- Co-authored-by: Lotussoft Youngtech <lotussoftyoungtech@gmail.com> Co-authored-by: objecttothis <17935339+objecttothis@users.noreply.github.com>	2026-05-15 20:50:34 +02:00
jekkos	6ff28d8a4d	docs: Update SECURITY.md with disclosure process (#4549 ) * docs: Update SECURITY.md with disclosure process and advisory template - Update published advisories table with CVE-2026-41306 and CVE-2026-41307 - Add disclosure process timeline - Add vulnerability template for researchers - Explain GitHub advisory creation workflow - Document security best practices for researchers This streamlines the vulnerability reporting process by allowing researchers to create draft advisories directly on GitHub, reducing triage overhead. * docs: Update SECURITY.md with CVE process and reporter acknowledgments - Add CVE request procedure through GitHub - Document that existing CVEs should be shared in reports - Clarify no bug bounty program (voluntary triage) - Add security best practices for researchers - Thank security researchers for contributions - Explain vulnerability template format * docs: Simplify SECURITY.md - remove CVE table, link to GitHub advisories --------- Co-authored-by: Ollama <ollama@steganos.dev>	2026-05-15 12:24:39 +02:00
jekkos	70fb347fc4	fix(docker): correct permissions and fix migration barcode_type error (#4546 ) * fix(ci): include hidden files in Docker build context actions/upload-artifact@v4 excludes hidden files (dotfiles) by default, causing .htaccess files to be missing from the Docker image. Add include-hidden-files: true to preserve .htaccess in the build artifact. * fix(docker): correct permissions and add barcode_type default - Set proper permissions (750) for writable/logs, writable/uploads, writable/cache, public/uploads, and public/uploads/item_pics - Set permissions (640) for writable/uploads/importCustomers.csv - Add barcode_type default value to prevent 'unknown key' error during initial migration when database is not yet initialized --------- Co-authored-by: Ollama <ollama@steganos.dev> Co-authored-by: objecttothis <17935339+objecttothis@users.noreply.github.com>	2026-05-13 20:55:59 +02:00
jekkos	2f5c0130f4	feat: add ALLOWED_HOSTNAMES environment variable support for Docker/Compose (#4544 ) Allow configuring allowed hostnames via ALLOWED_HOSTNAMES environment variable as an alternative to app.allowedHostnames in .env file. This is more convenient for Docker/Compose deployments where environment variables are set directly in compose files. The ALLOWED_HOSTNAMES variable takes precedence over app.allowedHostnames if both are set, allowing deployment-specific overrides. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Ollama <ollama@steganos.dev> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-05-13 09:03:32 +02:00