Open Source Point of Sale

Introduction · Demo · Installation · 🇧🇷 Changes in this fork · Contributing · Bugs · FAQ · Donate · License · Credits

👋 Introduction

Open Source Point of Sale is a web-based point of sale system. The application is written in PHP, uses MySQL (or MariaDB) as the data storage back-end, and has a simple but intuitive user interface.

The latest 3.4 version is a complete overhaul of the original software. It uses CodeIgniter 4 as a framework and is based on Bootstrap 3 using Bootswatch themes. Along with improved functionality and security.

The features include:

• Stock management (items and kits with an extensible list of attributes)
• VAT, GST, customer, and multi tiers taxation
• Sale register with transactions logging
• Quotation and invoicing
• Expenses logging
• Cash up function
• Printing and emailing of receipts, invoices and quotations
• Barcode generation and printing
• Database of customers and suppliers
• Multiuser with permission control
• Reporting on sales, orders, expenses, inventory status and more
• Receivings
• Gift cards
• Rewards
• Restaurant tables
• Messaging (SMS)
• Multilanguage
• Selectable Bootstrap based UI theme with Bootswatch
• MailChimp integration
• Optional Google reCAPTCHA to protect the login page from brute force attacks
• GDPR ready

🧪 Live Demo

We've got a live version of our latest master running for you to play around with and test everything out. It's a containerized install that will reinitialize when new functionality is merged into our code repository.

You can find the demo here and log in with these credentials.
👤 Username admin
🔒 Password pointofsale

If you bump into an issue, please check the status page here to confirm if the server is up and running.

🖥️ Development Demo

Besides the demo of the latest master, we also have a development server that builds when there's a new commit to our repository. It's mainly used for testing out new code before merging it into the master. It can be found here.

The log in credentials are the same as the regular live demo.

---

---

🇧🇷 Changes in this fork (Ismael Douglas)

This section documents the original work accumulated in this fork on top of opensourcepos/opensourcepos. All credit for the base project remains with the Open Source Point of Sale team. The fork is 27 commits ahead of upstream and complies with the OSPOS license — the mandatory footer notice and the upstream copyright notice have been preserved.

Since May 2026 the fork has accumulated 27 commits touching 357 files (18 added, 339 modified). Summary of the areas worked on:

🖨️ ESC/POS thermal printing (new)

Native receipt-printer integration, removing the reliance on browser-based printing:

Item	Detail
Library	app/Libraries/ThermalPrinter.php (new) — wraps mike42/escpos-php ^4.0
Controller	app/Controllers/Printer.php (new)
Endpoints	GET printer/test · GET printer/printReceipt/(:num) · POST printer/quickPrint
Transports	CUPS, file, and direct TCP/IP
Commands	Store header, items, subtotal, discounts, taxes, total, barcode, cash drawer, auto cutter, logo, and test print
Automation	Automatic print on sale completion (configurable), reprint button, and quick print

Dedicated documentation in docs/escpos-thermal-printer.md.

🎨 Interface and UX

The main screens were rewritten around information density and usability for elderly users / low digital literacy:

• public/css/modern.css — the primary stylesheet (~2,400 lines), with custom.css, register.css, ospos.css, and accessible.css as supporting layers.
• accessible.css — enlarged typography and contrast adjustments.
• Register (POS) — a checkout modal supporting multiple payments within a single sale (Cash, Debit, Credit, PIX, and Store Credit), real-time change calculation, and a "Miscellaneous item" field.
• Sales management — a summary strip with totals and an AJAX-updated payment summary (Sales::getPaymentSummary(), app/Controllers/Sales.php).
• Keyboard shortcuts at the register: ESC cancels the sale, and Alt+1 … Alt+9 for item search, customer search, suspend sale, suspended sales, amount tendered, add payment, complete sale, complete quote, and a shortcuts help modal.

🔐 Security and reliability

Fixes applied and verified against the code:

• SQL injection — app/Models/Item.php: the attribute search interpolated user input directly into HAVING. It now uses escapeLikeString() with bound parameters, and the attribute_dvalues column was corrected to attribute_values / attribute_dtvalues.
• XSS — esc() applied in app/Views/barcode_sheet.php (URLs, title, attributes) and in app/Views/login.php (company name, logo, and SVG titles); table measurements cast to (int).
• CSRF — protection switched from session to cookie in app/Config/Security.php.
• Cookies — httponly = false and samesite = 'Lax' in app/Config/Cookie.php, required so the application JavaScript can read the CSRF cookie. Deliberate trade-off: the cookie is reachable from JavaScript, and token randomisation/regeneration is disabled.
• Configuration — @immutable on app/Config/Autoload.php; passwords removed from .env.example.
• Dependencies — the MailChimp integration was removed from the CSV import flow.

🧭 Routes

app/Config/Routes.php now declares 299 explicit routes (176 GET + 123 POST) across 23 controllers, including the three new ones for the printer module. CodeIgniter's auto-routing remains enabled in app/Config/Routing.php as a fallback layer.

🧰 JavaScript

public/resources/js/js-fa93e8894e.cookie.js — js-cookie v2.2.1 with a patch that fixes the module conflict in AMD/Define environments, which had prevented the CSRF cookie from being read and therefore blocked form submission.

🌍 Languages

Adjustments in app/Language/pt-BR/ (Config.php, Sales.php) for the new discount, payment type, and sales summary fields.

📚 Documentation and environments

Project-specific documentation under docs/, including:

• ambientes-ospos.md — separation between production and test, with distinct session cookies, database session, and CSRF flags for the two environments.
• escpos-thermal-printer.md — thermal printer setup, configuration, and troubleshooting.
• tutorial-ospos.md — installation, usage, and route architecture.
• ospos-status.md and setup-pendente.md — project status and outstanding tasks.
• AGENTS.md at the repository root — working conventions and environment context.

---

💾 Installation

Please refrain from creating issues about installation problems before having read the FAQ and going through existing GitHub issues. We have a build pipeline that checks the sanity of our latest repository commit, and in case the application itself is broken then our build will be as well.

This application can be set up in many different ways and we only support the ones described in the INSTALL.md file.

For more information and recommendations on support hardware, like receipt printers and barcode scanners, read this page on our wiki.

✨ Contributing

Everyone is more than welcome to help us improve this project. If you think you've got something to help us go forward, feel free to open a pull request or join the conversation on Element.

Want to help translate Open Source Point of Sale in your language? You can find our Weblate here, sign up, and start translating. You can subscribe to different languages to receive a notification once a new string is added or needs updating. Have a look at our guidelines below to help you get started.

Only with the help of the community, we can keep language translations up to date. Thanks!

🐛 Reporting Bugs

Before creating a new issue, you'll need copy and include the info under the System Info tab in the configuration section in most cases. If that information is not provided in full, your issue might be tagged as pending.

If you're reporting a potential security issue, please refer to our security policy found in the SECURITY.md file.

NOTE: If you're running non-release code, please make sure you always run the latest database upgrade script and download the latest master code.

📖 FAQ

• If you get the message system folder missing, then you have cloned the source using git and you need to run a build first. Check INSTALL.md for instructions or download latest zip file from GitHub releases instead.

• If at login time you read The installation is not correct, check your php.ini file., please check the error_log in public folder to understand what's wrong and make sure you read the INSTALL.md. To know how to enable error_log, please read the comment in issue #1770.

• If you installed your OSPOS under a web server subdir, please edit public/.htaccess and go to the lines with the comments if in web root or if in subdir, uncomment one and replace <OSPOS path> with your path, and follow the instruction on the second comment line. If you face more issues, please read issue #920 for more information.

• Apache server configurations are SysAdmin issues and not strictly related to OSPOS. Please make sure you can show a "Hello world" HTML page before pointing to OSPOS public directory. Make sure .htaccess is correctly configured.

• If the avatar pictures are not shown in items or at item save you get an error, please make sure your writable and subdirs are assigned to the correct owner and the access permission is set to 750.

• If you install OSPOS in Docker behind a proxy that performs ssloffloading, you can enable the URL generated to be HTTPS instead of HTTP, by activating the environment variable FORCE_HTTPS = 1.

• If you install OSPOS behind a proxy and OSPOS constantly drops your session, consider whitelisting the proxy IP address by setting public array $proxyIPs = []; in the main PHP config file.

• If you have suhosin installed and face an issue with CSRF, please make sure you read issue #1492.

• PHP ≥ 8.2 is required to run this app.

🏃 Keep the Machine Running

If you like our project, please consider buying us a coffee through the button below so we can keep adding features. Please star the project if you like it!

Or refer to the FUNDING.yml file.

If you choose to deploy OSPOS in the cloud, you can contribute to the project by using DigitalOcean and signing up through our referral link. You'll receive a free $200, 60-day credit if you run OSPOS in a DigitalOcean droplet through our referral link.

📄 License

Open Source Point of Sale is licensed under MIT terms with an important addition:

The footer signature "© 2010 - current year · opensourcepos.org · 3.x.x - hash" including the version, hash and link to our website MUST BE RETAINED, MUST BE VISIBLE IN EVERY PAGE and CANNOT BE MODIFIED.

Also worth noting:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

For more details please read the LICENSE file.

It's important to understand that although you are free to use the application, the copyright has to stay and the license agreement applies in all cases. Therefore, any actions like:

• Removing LICENSE and/or any license files is prohibited
• Authoring the footer notice replacing it with your own or even worse claiming the copyright is absolutely prohibited
• Claiming full ownership of the code is prohibited

In short, you are free to use the application, but you cannot claim any property on it.

Any person or company found breaching the license agreement might find a bunch of monkeys at the door ready to destroy their servers.

🙏 Credits

DigitalOcean	JetBrains	GitHub
Many thanks to DigitalOcean for providing the project with hosting credits.	Many thanks to JetBrains for providing a free license of IntelliJ IDEA to kindly support the development of OSPOS.	Many thanks to GitHub for providing free continuous integration via GitHub Actions for open-source projects.