Don't enforce barcodes to be unique (fixes #1205)

(Error page was not shown properly)

.devtools/create_release_package.bat

@@ -0,0 +1,18 @@
+set projectPath=%~dp0
+if %projectPath:~-1%==\ set projectPath=%projectPath:~0,-1%
+set projectPath=%projectPath%\..
+
+set releasePath=%projectPath%\.release
+mkdir "%releasePath%"
+
+copy "%projectPath%\version.json" versiontemp.json
+for /f "tokens=*" %%a in ('jq .Version versiontemp.json --raw-output') do set version=%%a
+del versiontemp.json
+
+del "%releasePath%\grocy_%version%.zip"
+7za a -r "%releasePath%\grocy_%version%.zip" "%projectPath%\*" -xr!.* -xr!build.bat -xr!composer.json -xr!composer.lock -xr!package.json -xr!yarn.lock
+7za a "%releasePath%\grocy_%version%.zip" "%projectPath%\public\.htaccess"
+7za rn "%releasePath%\grocy_%version%.zip" .htaccess public\.htaccess
+7za d "%releasePath%\grocy_%version%.zip" data\*.* data\storage data\viewcache\*
+7za a "%releasePath%\grocy_%version%.zip" "%projectPath%\data\.htaccess"
+7za rn "%releasePath%\grocy_%version%.zip" .htaccess data\.htaccess

.devtools/install_dependencies.bat

@@ -0,0 +1,4 @@
+pushd ..
+call composer install
+yarn install
+popd

.devtools/transifex_download.bat

@@ -0,0 +1,11 @@
+pushd ..
+tx pull --all --minimum-perc=70
+tx pull --language en_GB
+copy /Y localization\en\userfield_types.po localization\en_GB\userfield_types.po
+copy /Y localization\en\stock_transaction_types.po localization\en_GB\stock_transaction_types.po
+copy /Y localization\en\component_translations.po localization\en_GB\component_translations.po
+copy /Y localization\en\chore_period_types.po localization\en_GB\chore_period_types.po
+copy /Y localization\en\chore_assignment_types.po localization\en_GB\chore_assignment_types.po
+copy /Y localization\en\permissions.po localization\en_GB\permissions.po
+copy /Y localization\en\locales.po localization\en_GB\locales.po
+popd

.devtools/transifex_upload.bat

@@ -0,0 +1,3 @@
+pushd ..
+tx push --source
+popd

.devtools/update_dependencies.bat

@@ -0,0 +1,4 @@
+pushd ..
+call composer update
+yarn upgrade
+popd

.dockerignore

@@ -1,6 +0,0 @@
-.git
-.vscode
-.gitignore
-build.bat
-Dockerfile
-.DS_store

.editorconfig

@@ -0,0 +1,8 @@
+root = true
+
+[*]
+indent_style = tab
+indent_size = 4
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

.gitattributes

@@ -0,0 +1,2 @@
+* text=auto
+*.sh text eol=lf

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,10 @@
+---
+name: Bug report
+about: If you've found something that does not work, please report it to help improve grocy
+title: 'Bug: '
+labels: bug, ui-bug
+assignees: ''
+
+---
+
+Please describe the bug as detailed as possible, provide the steps how to reproduce it and maybe attach screenshots where useful.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+    - name: Question / Help
+      url: https://www.reddit.com/r/grocy
+      about: Please use the r/grocy subreddit for general questions / help

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,10 @@
+---
+name: Feature request
+about: Ideas for improvements or new things which you would find useful are always welcome
+title: 'Feature request: '
+labels: enhancement
+assignees: ''
+
+---
+
+Please describe what you would find useful and please also check (by searching open requests here) if that was maybe already requested.

.php_cs

@@ -0,0 +1,97 @@
+<?php
+
+return PhpCsFixer\Config::create()
+    ->setRules(array(
+        '@PSR2' => true,
+        'array_indentation' => true,
+        'array_syntax' => array('syntax' => 'short'),
+        'combine_consecutive_unsets' => true,
+        'method_separation' => true,
+        'no_multiline_whitespace_before_semicolons' => true,
+        'single_quote' => true,
+
+        'binary_operator_spaces' => array(
+            'align_double_arrow' => false,
+            'align_equals' => false,
+        ),
+        // 'blank_line_after_opening_tag' => true,
+        // 'blank_line_before_return' => true,
+        'braces' => array(
+            'allow_single_line_closure' => true,
+			'position_after_anonymous_constructs' => 'same',
+			'position_after_control_structures' => 'next',
+			'position_after_functions_and_oop_constructs' => 'next',
+        ),
+        // 'cast_spaces' => true,
+        // 'class_definition' => array('singleLine' => true),
+        'concat_space' => array('spacing' => 'one'),
+        'declare_equal_normalize' => true,
+        'function_typehint_space' => true,
+        'hash_to_slash_comment' => true,
+        'include' => true,
+        'lowercase_cast' => true,
+        // 'native_function_casing' => true,
+        // 'new_with_braces' => true,
+        // 'no_blank_lines_after_class_opening' => true,
+        // 'no_blank_lines_after_phpdoc' => true,
+        // 'no_empty_comment' => true,
+        // 'no_empty_phpdoc' => true,
+        // 'no_empty_statement' => true,
+        'no_extra_consecutive_blank_lines' => array(
+            'extra',
+            'parenthesis_brace_block',
+            'square_brace_block',
+            'throw',
+            'use',
+        ),
+        'no_leading_import_slash' => true,
+        'no_leading_namespace_whitespace' => true,
+        // 'no_mixed_echo_print' => array('use' => 'echo'),
+        'no_multiline_whitespace_around_double_arrow' => true,
+        // 'no_short_bool_cast' => true,
+        // 'no_singleline_whitespace_before_semicolons' => true,
+        'no_spaces_around_offset' => true,
+        // 'no_trailing_comma_in_list_call' => true,
+        // 'no_trailing_comma_in_singleline_array' => true,
+        // 'no_unneeded_control_parentheses' => true,
+        // 'no_unused_imports' => true,
+        'no_whitespace_before_comma_in_array' => true,
+        'no_whitespace_in_blank_line' => true,
+        // 'normalize_index_brace' => true,
+        'object_operator_without_whitespace' => true,
+        // 'php_unit_fqcn_annotation' => true,
+        // 'phpdoc_align' => true,
+        // 'phpdoc_annotation_without_dot' => true,
+        // 'phpdoc_indent' => true,
+        // 'phpdoc_inline_tag' => true,
+        // 'phpdoc_no_access' => true,
+        // 'phpdoc_no_alias_tag' => true,
+        // 'phpdoc_no_empty_return' => true,
+        // 'phpdoc_no_package' => true,
+        // 'phpdoc_no_useless_inheritdoc' => true,
+        // 'phpdoc_return_self_reference' => true,
+        // 'phpdoc_scalar' => true,
+        // 'phpdoc_separation' => true,
+        // 'phpdoc_single_line_var_spacing' => true,
+        // 'phpdoc_summary' => true,
+        // 'phpdoc_to_comment' => true,
+        // 'phpdoc_trim' => true,
+        // 'phpdoc_types' => true,
+        // 'phpdoc_var_without_name' => true,
+        // 'pre_increment' => true,
+        // 'return_type_declaration' => true,
+        // 'self_accessor' => true,
+        // 'short_scalar_cast' => true,
+        'single_blank_line_before_namespace' => true,
+        // 'single_class_element_per_statement' => true,
+        // 'space_after_semicolon' => true,
+        // 'standardize_not_equals' => true,
+        'ternary_operator_spaces' => true,
+        // 'trailing_comma_in_multiline_array' => true,
+        'trim_array_spaces' => true,
+        'unary_operator_spaces' => true,
+        'whitespace_after_comma_in_array' => true,
+    ))
+    ->setIndent("\t")
+    ->setLineEnding("\n")
+;

.tx/config

@@ -0,0 +1,56 @@
+[main]
+host = https://www.transifex.com
+
+[grocy.chore_period_types]
+file_filter = localization/<lang>/chore_period_types.po
+source_file = localization/chore_period_types.pot
+source_lang = en
+type = PO
+
+[grocy.chore_assignment_types]
+file_filter = localization/<lang>/chore_assignment_types.po
+source_file = localization/chore_assignment_types.pot
+source_lang = en
+type = PO
+
+[grocy.component_translations]
+file_filter = localization/<lang>/component_translations.po
+source_file = localization/component_translations.pot
+source_lang = en
+type = PO
+
+[grocy.demo_data]
+file_filter = localization/<lang>/demo_data.po
+source_file = localization/demo_data.pot
+source_lang = en
+type = PO
+
+[grocy.stock_transaction_types]
+file_filter = localization/<lang>/stock_transaction_types.po
+source_file = localization/stock_transaction_types.pot
+source_lang = en
+type = PO
+
+[grocy.strings]
+file_filter = localization/<lang>/strings.po
+source_file = localization/strings.pot
+source_lang = en
+type = PO
+
+[grocy.userfield_types]
+file_filter = localization/<lang>/userfield_types.po
+source_file = localization/userfield_types.pot
+source_lang = en
+type = PO
+
+[grocy.permissions]
+file_filter = localization/<lang>/permissions.po
+source_file = localization/permissions.pot
+source_lang = en
+type = PO
+
+[grocy.locales]
+file_filter = localization/<lang>/locales.po
+source_file = localization/locales.pot
+source_lang = en
+type = PO

.vscode/settings.json

@@ -1,3 +1,17 @@
 {
-	"phpserver.relativePath": "public"
+	"phpserver.relativePath": "public",
+	"editor.formatOnType": true,
+	"editor.formatOnPaste": true,
+	"editor.formatOnSave": true,
+	"editor.insertSpaces": false,
+	"javascript.format.placeOpenBraceOnNewLineForControlBlocks": true,
+	"javascript.format.placeOpenBraceOnNewLineForFunctions": true,
+	"javascript.format.insertSpaceAfterFunctionKeywordForAnonymousFunctions": false,
+	"javascript.preferences.quoteStyle": "double",
+	"blade.format.enable": true,
+	"html.format.wrapAttributes": "force",
+	"html.format.wrapLineLength": 0,
+	"php-cs-fixer.formatHtml": true,
+	"php-cs-fixer.autoFixBySemicolon": true,
+	"php-cs-fixer.onsave": true,
 }

Dockerfile-grocy

@@ -1,58 +0,0 @@
-FROM php:7.2-fpm-alpine
-MAINTAINER Talmai Oliveira <to@talm.ai>
-
-RUN	apk update && \
-	apk upgrade && \
-	apk add --update yarn git &&\
-	mkdir -p /www && \
-    # Set environments
-	sed -i "s|;*daemonize\s*=\s*yes|daemonize = no|g" /usr/local/etc/php-fpm.conf && \
-	sed -i "s|;*listen\s*=\s*127.0.0.1:9000|listen = 9000|g" /usr/local/etc/php-fpm.conf && \
-	sed -i "s|;*listen\s*=\s*/||g" /usr/local/etc/php-fpm.conf && \
-#	sed -i "s|;*log_level\s*=\s*notice|log_level = debug|g" /usr/local/etc/php-fpm.conf && \
-	sed -i "s|;*chdir\s*=\s*/var/www|chdir = /www|g" /usr/local/etc/php-fpm.d/www.conf && \
-#	sed -i "s|;*access.log\s*=\s*log/\$pool.access.log|access.log = \$pool.access.log|g" /usr/local/etc/php-fpm.d/www.conf && \
-#	sed -i "s|;*pm.status_path\s*=\s*/status|pm.status_path = /status|g" /usr/local/etc/php-fpm.d/www.conf && \
-#	sed -i "s|;*memory_limit =.*|memory_limit = ${PHP_MEMORY_LIMIT}|i" /usr/local/etc/php.ini && \
-#    sed -i "s|;*upload_max_filesize =.*|upload_max_filesize = ${MAX_UPLOAD}|i" /usr/local/etc/php.ini && \
-#    sed -i "s|;*max_file_uploads =.*|max_file_uploads = ${PHP_MAX_FILE_UPLOAD}|i" /usr/local/etc/php.ini && \
-#    sed -i "s|;*post_max_size =.*|post_max_size = ${PHP_MAX_POST}|i" /usr/local/etc/php.ini && \
-#    sed -i "s|;*cgi.fix_pathinfo=.*|cgi.fix_pathinfo= 0|i" /usr/local/etc/php.ini && \
-	wget https://raw.githubusercontent.com/composer/getcomposer.org/1b137f8bf6db3e79a38a5bc45324414a6b1f9df2/web/installer -O - -q | php -- --quiet && \
-    # Cleaning up
-	rm -rf /var/cache/apk/*
-
-COPY public /www/public
-COPY info.php /www/public
-COPY controllers /www/controllers
-COPY data /www/data
-COPY helpers /www/helpers
-COPY localization/ /www/localization
-COPY middleware/ /www/middleware
-COPY migrations/ /www/migrations
-COPY publication_assets/ /www/publication_assets
-COPY services/ /www/services
-COPY views/ /www/views
-COPY .yarnrc /www/
-COPY *.php /www/
-COPY *.json /www/
-COPY composer.* /root/.composer/
-COPY *yarn* /www/
-COPY *.sh /www/
-
-# run php composer.phar with -vvv for extra debug information
-RUN cd /var/www/html && \
-	php composer.phar --working-dir=/www/ -n install && \
-	cp /www/config-dist.php /www/data/config.php && \
-	cd /www && \
-	yarn install && \
-	chown www-data:www-data -R /www/
-
-# Set Workdir
-WORKDIR /www/public
-
-# Expose volumes
-VOLUME ["/www"]
-
-# Expose ports
-EXPOSE 9000

Dockerfile-grocy-nginx

@@ -1,32 +0,0 @@
-FROM alpine:latest
-MAINTAINER Talmai Oliveira <to@talm.ai>
-
-RUN	apk update && \
-	apk upgrade && \
-	apk add --update openssl nginx && \
-	mkdir -p /etc/nginx/certificates && \
-	mkdir -p /var/run/nginx && \
-	mkdir -p /usr/share/nginx/html && \
-	openssl req \
-		-x509 \
-		-newkey rsa:2048 \
-		-keyout /etc/nginx/certificates/key.pem \
-		-out /etc/nginx/certificates/cert.pem \
-		-days 365 \
-		-nodes \
-		-subj /CN=localhost && \
-	rm -rf /var/cache/apk/*
-
-COPY docker_nginx/nginx.conf /etc/nginx/nginx.conf
-COPY docker_nginx/common.conf /etc/nginx/common.conf
-COPY docker_nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf
-COPY docker_nginx/conf.d/ssl.conf /etc/nginx/conf.d/ssl.conf
-
-# Expose volumes
-VOLUME ["/etc/nginx/conf.d", "/var/log/nginx"]
-
-# Expose ports
-EXPOSE 80 443
-
-# Entry point
-ENTRYPOINT ["/usr/sbin/nginx", "-g", "daemon off;"]

README.md

@@ -1,59 +1,81 @@
-# grocy
-ERP beyond your fridge
+<div align="center">
+<img alt="Logo" height="50" src="https://raw.githubusercontent.com/grocy/grocy/master/public/img/grocy_logo.svg?sanitize=true"/>
+<h3>ERP beyond your fridge</h3>
+<h5> grocy is a web-based self-hosted groceries & household management solution for your home</h5>
+</div>
+
+-----
 
 ## Give it a try
-- Public demo of the latest stable version &rarr; [https://demo.grocy.info](https://demo.grocy.info)
-- Public demo of the latest pre-release version (current master branch) &rarr; [https://demo-prerelease.grocy.info](https://demo-prerelease.grocy.info)
+- Public demo of the latest stable version (`release` branch) &rarr; [https://demo.grocy.info](https://demo.grocy.info)
+- Public demo of the current development version (`master` branch) &rarr; [https://demo-prerelease.grocy.info](https://demo-prerelease.grocy.info)
+
+## Questions / Help / Bug reporting / Feature requests
+There is the [r/grocy subreddit](https://www.reddit.com/r/grocy) to connect with other grocy users and getting help.
+
+If you've found something that does not work or if you have an idea for an improvement or new things which you would find useful, feel free to open a request on the [issue tracker](https://github.com/grocy/grocy/issues) here.
+
+Please don't send me private messages regarding grocy help. I check the issue tracker and the subreddit pretty much daily, but don't provide grocy support beyond that.
+
+## Community contributions
+See the website for a list of community contributed Add-ons / Tools: [https://grocy.info/addons](https://grocy.info/addons)
 
 ## Motivation
 A household needs to be managed. I did this so far (almost 10 years) with my first self written software (a C# windows forms application) and with a bunch of Excel sheets. The software is a pain to use and Excel is Excel. So I searched for and tried different things for a (very) long time, nothing 100 % fitted, so this is my aim for a "complete household management"-thing. ERP your fridge!
 
 ## How to install
-> **NEW**
+> Checkout [grocy-desktop](https://github.com/grocy/grocy-desktop), if you want to run grocy without having to manage a webserver just like a normal ("indows) desktop application.
 >
-> There is now grocy-desktop if you want to run grocy without a webserver just like a normal (windows) desktop application.
->
-> See https://github.com/berrnd/grocy-desktop or directly download the [latest release](https://releases.grocy.info/latest-desktop) - the installation is nothing more than just clicking 2 times "next"...
+> Directly download the [latest release](https://releases.grocy.info/latest-desktop) - the installation is nothing more than just clicking 2 times "next".
 
-Just unpack the [latest release](https://releases.grocy.info/latest) on your PHP (SQLite extension required, currently only tested with PHP 7.2) enabled webserver (webservers root should point to the `public` directory), copy `config-dist.php` to `data/config.php`, edit it to your needs, ensure that the `data` directory is writable and you're ready to go, (to make writable `chown -R www-data:www-data data/`). Default login is user `admin` with password `admin`, please change the password immediately (see user menu).
+See [https://grocy.info/links](https://grocy.info/links) for some installation guides and troubleshooting help.
 
-Alternatively clone this repository and install Composer and Yarn dependencies manually.
+grocy is technically a pretty simple PHP application, so the basic notes to get it running are:
+- Unpack the [latest release](https://releases.grocy.info/latest)
+- Copy `config-dist.php` to `data/config.php` + edit to your needs
+- Ensure that the `data` directory is writable
+- The webserver root should point to the `public` directory
+- Include `try_files $uri /index.php$is_args$query_string;` in your location block if you use nginx
+  - Or disable URL rewriting (see the option `DISABLE_URL_REWRITING` in `data/config.php`)
+- SQLite 3.8.3 or higher is required and everything is currently only tested against PHP 7.4
+- &rarr; Default login is user `admin` with password `admin`, please change the password immediately (user menu at the top right corner)
 
-If you use nginx as your webserver, please include `try_files $uri /index.php;` in your location block.
-
-If, however, your webserver does not support URL rewriting, set `DISABLE_URL_REWRITING` in `data/config.php` (`Setting('DISABLE_URL_REWRITING', true);`).
+Alternatively clone this repository (the `release` branch always references the latest released version, or checkout the latest tagged revision) and install Composer and Yarn dependencies manually.
 
 ## How to run using Docker
 
-The docker images build are based on [Alpine](https://hub.docker.com/_/alpine/), with an extremelly low footprint (less than 10 MB for nginx, and less than 70MB for grocy with php-fm. That number is eventually bumped up to 353MB after all the dependencies are downloaded, however). Anyhow, to run using docker just do the following:
-
-```
-> docker-compose up
-```
-
-And grocy should be accessible via `http(s)://localhost/`. The https option will work. However, since the certificate is self-signed, most browsers will complain.
+See [grocy/grocy-docker](https://github.com/grocy/grocy-docker) or [linuxserver/docker-grocy](https://github.com/linuxserver/docker-grocy) for instructions.
 
 ## How to update
-Just overwrite everything with the latest release while keeping the `data` directory, check `config-dist.php` for new configuration options and add them to your `data/config.php` (the default from values `config-dist.php` will be used for not in `data/config.php` defined settings). Just to be sure, please empty `data/viewcache`.
+Just overwrite everything with the latest release while keeping the `data` directory, check `config-dist.php` for new configuration options and add them to your `data/config.php` where appropriate (the default values from `config-dist.php` will be used for not in `data/config.php` defined settings). Just to be sure, please empty `data/viewcache`.
 
-If you run grocy on Linux, there is also `update.sh` (remember to make the script executable, `chmod +x update.sh` and ensure that you have `unzip` installed) which does exactly this and additionally creates a backup (`.tgz` archive) of the current installation in `data/backups` (backups older than 60 days will be deleted during the update).
+If you run grocy on Linux, there is also `update.sh` (remember to make the script executable (`chmod +x update.sh`) and ensure that you have `unzip` installed) which does exactly this and additionally creates a backup (`.tgz` archive) of the current installation in `data/backups` (backups older than 60 days will be deleted during the update).
 
 ## Localization
-grocy is fully localizable - the default language is English (integrated into code), a German localization is always maintained by me. There is one file per language in the `localization` directory, if you want to create a translation, it's best to copy `localization/de.php` to a new one (e. g. `localization/it.php`) and translating all strings there. (Language can be changed in `data/config.php`, e. g. `Setting('CULTURE', 'it');`)
+grocy is fully localizable - the default language is English (integrated into code), a German localization is always maintained by me.
+You can easily help translating grocy at https://www.transifex.com/grocy/grocy, if your language is incomplete or not available yet.
+(The default language can be set in `data/config.php`, e. g. `Setting('DEFAULT_LOCALE', 'it');` and there is also a user setting (see the user settings page) to set a different language per user).
 
-### Maintaining your own localization
-As the German translation will always be the most complete one, for maintaining your localization it would be easiest when you compare your localization with the German one with a diff tool of your choice.
+The [pre-release demo](https://demo-prerelease.grocy.info) is available for any translation which is at least 70 % complete and will pull the translations from Transifex 10 minutes past every hour, so you can have a kind of instant preview of your contributed translations. Thank you!
+
+Also any translation which once reached a completion level of 70 % will be included in releases.
+
+_RTL languages are unfortunately not yet supported._
 
 ## Things worth to know
 
 ### REST API & data model documentation
-See the integrated Swagger UI instance on [/api](https://demo-en.grocy.info/api).
+See the integrated Swagger UI instance on [/api](https://demo.grocy.info/api).
 
-### Barcode readers
-Some fields also allow to select a value by scanning a barcode. It works best when your barcode reader prefixes every barcode with a letter which is normally not part of a item name (I use a `$`) and sends a `TAB` after a scan.
+### Barcode readers & camera scanning
+Some fields (with a barcode icon above) also allow to select a value by scanning a barcode. It works best when your barcode reader prefixes every barcode with a letter which is normally not part of a item name (I use a `$`) and sends a `TAB` after a scan.
+
+Additionally it's also possible to use your device camera to scan a barcode by using the camera button on the right side of the corresponding field (powered by [Quagga2](https://github.com/ericblade/quagga2), totally offline / client-side camera stream processing, please note due to browser security restrictions, this only works when serving grocy via a secure connection (`https://`)). Quick video demo: https://www.youtube.com/watch?v=Y5YH6IJFnfc
+
+_My personal recommendation: Use a USB barcode laser scanner. They are cheap and work 1000 % better, faster, under any lighting condition and from any angle._
 
 ### Input shorthands for date fields
-For (productivity) reasons all date (and time) input fields use the ISO-8601 format regardless of localization.
+For (productivity) reasons all date (and time) input (and display) fields use the ISO-8601 format regardless of localization.
 The following shorthands are available:
 - `MMDD` gets expanded to the given day on the current year, if > today, or to the given day next year, if < today, in proper notation
   - Example: `0517` will be converted to `2018-05-17`
@@ -61,13 +83,15 @@ The following shorthands are available:
   - Example: `20190417` will be converted to `2019-04-17`
 - `YYYYMMe` or `YYYYMM+` gets expanded to the end of the given month in the given year in proper notation
   - Example: `201807e` will be converted to `2018-07-31`
-- `x` gets expanded to `2999-12-31` (which I use for products which never expire)
-- Down/up arrow keys will increase/decrease the date by one day
+- `x` gets expanded to `2999-12-31` (which I use for products which are never overdue)
+- Down/up arrow keys will increase/decrease the date by 1 day
 - Right/left arrow keys will increase/decrease the date by 1 week
+- Shift + down/up arrow keys will increase/decrease the date by 1 month
+- Shift + right/left arrow keys will increase/decrease the date by 1 year
 
 ### Keyboard shorthands for buttons
 Wherever a button contains a bold highlighted letter, this is a shortcut key.
-Example: Button "Add as new **p**roduct" can be "pressed" by using the `P` key on your keyboard.
+Example: Button "**P** Add as new product" can be "pressed" by using the `P` key on your keyboard.
 
 ### Barcode lookup via external services
 Products can be directly added to the database via looking them up against external services by a barcode.
@@ -77,27 +101,43 @@ There is no plugin included for any service, see the reference implementation in
 ### Database migrations
 Database schema migration is automatically done when visiting the root (`/`) route (click on the logo in the left upper edge).
 
+_Please note: Database migrations are supposed to work between releases, not between every commit. If you want to run the current `master` branch (which is the development version), however, you need to handle that (and maybe more) yourself._
+
+### Disable certain features
+If you don't use certain feature sets of grocy (for example if you don't need "Chores"), there are feature flags per major feature set to hide/disable the related UI elements (see `config-dist.php`)
+
 ### Adding your own CSS or JS without to have to modify the application itself
 - When the file `data/custom_js.html` exists, the contents of the file will be added just before `</body>` (end of body) on every page
 - When the file `data/custom_css.html` exists, the contents of the file will be added just before `</head>` (end of head) on every page
 
 ### Demo mode
-When the file `data/demo.txt` exists, the application will work in a demo mode which means authentication is disabled and some demo data will be generated during the database schema migration.
+When the `MODE` setting is set to `dev`, `demo` or `prerelease`, the application will work in a demo mode which means authentication is disabled and some demo data will be generated during the database schema migration.
 
 ### Embedded mode
-When the file `embedded.txt` exists, it must contain a valid and writable path which will be used as the data directory instead of `data` and authentication will be disabled (used in [grocy-desktop](https://github.com/berrnd/grocy-desktop)).
+When the file `embedded.txt` exists, it must contain a valid and writable path which will be used as the data directory instead of `data` and authentication will be disabled (used in [grocy-desktop](https://github.com/grocy/grocy-desktop)).
 
 In embedded mode, settings can be overridden by text files in `data/settingoverrides`, the file name must be `<SettingName>.txt` (e. g. `BASE_URL.txt`) and the content must be the setting value (normally one single line).
 
+## Contributing / Say thanks
+Any help is more than appreciated. Feel free to pick any open unassigned issue and submit a pull request, but please leave a short comment or assign the issue yourself, to avoid working on the same thing.
+
+See https://grocy.info/#say-thanks for more ideas if you just want to say thanks.
+
+## Roadmap
+There is none. The progress of a specific bug/enhancement is always tracked in the corresponding issue, at least by commit comment references.
+
 ## Screenshots
-#### Dashboard
-![Dashboard](https://github.com/berrnd/grocy/raw/master/publication_assets/dashboard.png "Dashboard")
+#### Stock overview
+![Stock overview](https://github.com/grocy/grocy/raw/master/.github/publication_assets/stock.png "Stock overview")
 
-#### Purchase - with barcode scan
-![Purchase - with barcode scan](https://github.com/berrnd/grocy/raw/master/publication_assets/purchase-with-barcode.gif "purchase-with-barcode")
+#### Shopping List
+![Shopping List](https://github.com/grocy/grocy/raw/master/.github/publication_assets/shoppinglist.png "Shopping List")
 
-#### Consume - with manual search
-![Consume - with manual search](https://github.com/berrnd/grocy/raw/master/publication_assets/consume.gif "consume")
+#### Meal Plan
+![Meal Plan](https://github.com/grocy/grocy/raw/master/.github/publication_assets/mealplan.png "Meal Plan")
+
+#### Chores overview
+![Chores overview](https://github.com/grocy/grocy/raw/master/.github/publication_assets/chores.png "Chores overview")
 
 ## License
 The MIT License (MIT)

app.php

@@ -1,37 +1,10 @@
 <?php
 
-use \Psr\Http\Message\ServerRequestInterface as Request;
-use \Psr\Http\Message\ResponseInterface as Response;
-
-use \Grocy\Helpers\UrlManager;
-use \Grocy\Controllers\LoginController;
-
-// Definitions for embedded mode
-if (file_exists(__DIR__ . '/embedded.txt'))
-{
-	define('GROCY_IS_EMBEDDED_INSTALL', true);
-	define('GROCY_DATAPATH', file_get_contents(__DIR__ . '/embedded.txt'));
-	define('GROCY_USER_ID', 1);
-}
-else
-{
-	define('GROCY_IS_EMBEDDED_INSTALL', false);
-	define('GROCY_DATAPATH', __DIR__ . '/data');
-}
-
-// Definitions for demo mode
-if (file_exists(GROCY_DATAPATH . '/demo.txt'))
-{
-	define('GROCY_IS_DEMO_INSTALL', true);
-	if (!defined('GROCY_USER_ID'))
-	{
-		define('GROCY_USER_ID', 1);
-	}
-}
-else
-{
-	define('GROCY_IS_DEMO_INSTALL', false);
-}
+use Grocy\Controllers\LoginController;
+use Grocy\Helpers\UrlManager;
+use Grocy\Middleware\CorsMiddleware;
+use Psr\Container\ContainerInterface as Container;
+use Slim\Factory\AppFactory;
 
 // Load composer dependencies
 require_once __DIR__ . '/vendor/autoload.php';
@@ -40,32 +13,65 @@ require_once __DIR__ . '/vendor/autoload.php';
 require_once GROCY_DATAPATH . '/config.php';
 require_once __DIR__ . '/config-dist.php'; // For not in own config defined values we use the default ones
 
-// Setup base application
-$appContainer = new \Slim\Container([
-	'settings' => [
-		'displayErrorDetails' => true,
-		'determineRouteBeforeAppMiddleware' => true
-	],
-	'view' => function($container)
+// Definitions for dev/demo/prerelease mode
+if ((GROCY_MODE === 'dev' || GROCY_MODE === 'demo' || GROCY_MODE === 'prerelease') && !defined('GROCY_USER_ID'))
 {
-		return new \Slim\Views\Blade(__DIR__ . '/views', GROCY_DATAPATH . '/viewcache');
-	},
-	'LoginControllerInstance' => function($container)
-	{
-		return new LoginController($container, 'grocy_session');
-	},
-	'UrlManager' => function($container)
-	{
-		return new UrlManager(GROCY_BASE_URL);
-	},
-	'ApiKeyHeaderName' => function($container)
-	{
-		return 'GROCY-API-KEY';
+	define('GROCY_USER_ID', 1);
+	define('GROCY_SHOW_AUTH_VIEWS', true);
 }
-]);
-$app = new \Slim\App($appContainer);
+
+// Definitions for disabled authentication mode
+if (GROCY_DISABLE_AUTH === true)
+{
+	if (!defined('GROCY_USER_ID'))
+	{
+		define('GROCY_USER_ID', 1);
+	}
+
+	define('GROCY_SHOW_AUTH_VIEWS', false);
+}
+
+// Setup base application
+AppFactory::setContainer(new DI\Container());
+$app = AppFactory::create();
+
+$container = $app->getContainer();
+$container->set('view', function (Container $container) {
+	return new Slim\Views\Blade(__DIR__ . '/views', GROCY_DATAPATH . '/viewcache');
+});
+$container->set('UrlManager', function (Container $container) {
+	return new UrlManager(GROCY_BASE_URL);
+});
+$container->set('ApiKeyHeaderName', function (Container $container) {
+	return 'GROCY-API-KEY';
+});
 
 // Load routes from separate file
 require_once __DIR__ . '/routes.php';
 
+// Set base path if defined
+if (!empty(GROCY_BASE_PATH))
+{
+	$app->setBasePath(GROCY_BASE_PATH);
+}
+
+if (GROCY_MODE === 'production' || GROCY_MODE === 'dev')
+{
+	$app->add(new \Grocy\Middleware\LocaleMiddleware($container));
+}
+else
+{
+	define('GROCY_LOCALE', GROCY_DEFAULT_LOCALE);
+}
+
+$authMiddlewareClass = GROCY_AUTH_CLASS;
+$app->add(new $authMiddlewareClass($container, $app->getResponseFactory()));
+// Add default middleware
+$app->addRoutingMiddleware();
+$errorMiddleware = $app->addErrorMiddleware(true, false, false);
+$errorMiddleware->setDefaultErrorHandler(
+	new \Grocy\Controllers\ExceptionController($app, $container)
+);
+
+$app->add(new CorsMiddleware($app->getResponseFactory()));
 $app->run();

build.bat

@@ -1,13 +0,0 @@
-set projectPath=%~dp0
-if %projectPath:~-1%==\ set projectPath=%projectPath:~0,-1%
-
-set releasePath=%projectPath%\.release
-mkdir "%releasePath%"
-
-for /f "tokens=*" %%a in ('build_tools\jq.exe .Version version.json --raw-output') do set version=%%a
-
-del "%releasePath%\grocy_%version%.zip"
-"build_tools\7za.exe" a -r "%releasePath%\grocy_%version%.zip" "%projectPath%\*" -xr!.* -xr!build_tools -xr!build.bat -xr!composer.json -xr!composer.lock -xr!package.json -xr!yarn.lock -xr!publication_assets
-"build_tools\7za.exe" a "%releasePath%\grocy_%version%.zip" "%projectPath%\public\.htaccess"
-"build_tools\7za.exe" rn "%releasePath%\grocy_%version%.zip" .htaccess public\.htaccess
-"build_tools\7za.exe" d "%releasePath%\grocy_%version%.zip" data\*.* data\storage data\viewcache\*

changelog/10_1.4.0_2017-06-04.md

@@ -0,0 +1 @@
+- Added a login screen and switched to cookie/session based authentication instead of HTTP-basic-auth

changelog/11_1.5.0_2017-07-25.md

@@ -0,0 +1,2 @@
+- New feature: Habit tracking
+- Fixed an issue which prevented that the databse is correctly created on unix systems

changelog/12_1.6.0_2017-11-06.md

@@ -0,0 +1,2 @@
+- New feature: Rechargeable battery management
+- Improved productivity of input forms

changelog/13_1.6.1_2017-11-09.md

@@ -0,0 +1 @@
+- Improved sidebar responsiveness

changelog/14_1.7.0_2018-04-15.md

@@ -0,0 +1,2 @@
+- Allow to add anything to the shopping list, not only products
+- Major project refactoring

changelog/15_1.8.0_2018-04-16.md

@@ -0,0 +1 @@
+- grocy is now fully localizable and ships by default with English and German translations

changelog/16_1.8.1_2018-04-18.md

@@ -0,0 +1,2 @@
+- New configuration option "BASE_URL" to define base installation URL (should make subdirectory installations possible, see #3)
+- Added some missing translations

changelog/17_1.8.2_2018-04-18.md

@@ -0,0 +1 @@
+- Fixed login form didn't respect the configured BASE_URL

changelog/18_1.9.0_2018-04-21.md

@@ -0,0 +1 @@
+- Documented the REST API and data model, see the integrated instance of Swagger UI at [/api](https://demo.grocy.info/api)

changelog/19_1.9.1_2018-04-22.md

@@ -0,0 +1 @@
+- Added validation of all API requests and improved Swagger/OpenAPI description

changelog/1_0.1.0_2017-04-15.md

@@ -0,0 +1 @@
+- Basic features, mainly about a interface to record grocery purchases and consumptions

changelog/20_1.9.2_2018-04-22.md

@@ -0,0 +1 @@
+- Added a plugin system for looking up products against external services by barcode, see #6 for reference

changelog/21_1.10.0_2018-05-12.md

@@ -0,0 +1,4 @@
+- It's now possible to consume products directly from stock overview with one click
+- Added due/overdue info on bateries- and habits overview (like on stock overview)
+- Reworked general page layout and improved responsiveness (see #9 and thanks @d-Rickyy-b)
+- Translations fixes

changelog/22_1.11.0_2018-06-15.md

@@ -0,0 +1 @@
+- Added an option to not use URL rewriting (for webservers which, however, don't support URL rewriting)

changelog/23_1.12.0_2018-07-08.md

@@ -0,0 +1,2 @@
+- On the stockoverview it's now possible to filter the products by location
+- All dropdowns are now sorted alphabetically

changelog/24_1.12.1_2018-07-08.md

@@ -0,0 +1 @@
+- Bug fix for location filtering on stock overview page did not work in all browsers

changelog/25_1.13.0_2018-07-12.md

@@ -0,0 +1,3 @@
+- Upgraded Bootstrap and some other dependencies (grocy now looks even better!)
+- Added Italian translation (thanks @davidoskky)
+  - => Demo for this language available at: https://it.demo.grocy.info

changelog/26_1.13.1_2018-07-12.md

@@ -0,0 +1,5 @@
+This was released shortly after the last release to fix a small regression bug, original changes from Version 1.13.0:
+
+- Upgraded Bootstrap and some other dependencies (grocy now looks even better!)
+- Added Italian translation (thanks @davidoskky)
+  - => Demo for this language available at: https://it.demo.grocy.info

changelog/27_1.14.0_2018-07-15.md

@@ -0,0 +1,13 @@
+- New feature: **Recipes**
+  - Organize a list of products, amounts and a description into recipes and see at a glance if everything needed is in stock or put the missing things with one click on the shopping list
+  - Try it live on the demo page: => https://demo.grocy.info/recipes
+- Added norwegian translation (thanks @BlizzWave)
+  - Demo available at: => https://no.demo.grocy.info
+- A lot of small UI improvements
+  - Columns in tables can now be reordered
+  - Show a calendar on the shopping list page (useful, at least for me)
+  - Table column ordering and sorting is now remembered
+  - Sidebar collapse state is now remembered
+  - Fixed datetimepicker border
+  - Keep the parent sidebar menu item expanded if the active page is a sub menu item
+- Custom JS/CSS file names have changed [see README](https://github.com/berrnd/grocy#adding-your-own-css-or-js-without-to-have-to-modify-the-application-itself)

changelog/28_1.15.0_2018-07-22.md

@@ -0,0 +1,9 @@
+- New related project: **grocy-desktop**
+  - => https://github.com/berrnd/grocy-desktop
+  - Run grocy without a webserver just like a normal (windows) desktop application
+  - New "embedded mode" for grocy to help running in "desktop application mode" [see README](https://github.com/berrnd/grocy#embedded-mode)
+- New datepicker shorthands and improvements
+  - `YYYYMMe` or `YYYYMM+` gets expanded to the end of the given month in the given year in proper notation
+  - Changed: `MMDD` will be expanded to the given day next year if > today
+  - [see README](https://github.com/berrnd/grocy#input-shorthands-for-date-fields)
+- Some other small bug fixes

changelog/29_1.16.0_2018-07-25.md

@@ -0,0 +1,8 @@
+- Replaced the single user (so far defined in `/data/config.php`) with a multi-user management
+  - The currently defined user will automatically be migrated, please remove `HTTP_USER` and `HTTP_PASSWORD` from your config file afterwards
+  - For this it was necessary to delete all sessions and API keys during the migration
+- Added an update script (`/update.sh`) to make updates (on Linux machines) easier
+  - See also ["How to update" in README](https://github.com/berrnd/grocy#how-to-update)
+- Added the possibility to track who did a habit
+- Added a rudimentary habit analysis possibility
+- Different small UI, code and translation improvements

changelog/2_0.2.0_2017-04-16.md

@@ -0,0 +1 @@
+- General improvements, the work goes on...

changelog/30_1.17.0_2018-08-04.md

@@ -0,0 +1,4 @@
+- Basic product price tracking (can be entered on purchase, a little price history chart is shown in the product card - right side on purchase/consume/etc. pages)
+- Proper pluralization of everything (for quantity units you can enter the plural form in master data)
+- On all overview pages the statistics shown in the header are now updated when doing changes directly on the page (e. g. consuming a product)
+- Lots of small fixes and improvements (form validation, translations - thanks for keeping the norwegian translation always updated @BlizzWave, other small bugs)

changelog/31_1.18.0_2018-08-11.md

@@ -0,0 +1,5 @@
+- The complete row is now refreshed on changes on all overview pages
+- Added a checkbox to set the "never expires date" in best before date inputs (alternative to shortcut "x")
+- Recipes can now have arbitrary quantity units and stock is only checked for one unit then (imagine you have sugar in "Packs" in stock but your recipe "Pancakes" needs 200 grams)
+- Added a "consume this recipe button" to remove all ingredients of a recipe from stock with one click
+- Other small UI changes/improvements

changelog/32_1.18.1_2018-09-08.md

@@ -0,0 +1 @@
+- Some smaller UI bug fixes and enhancements (thanks again for all the testing @BlizzWave)

changelog/33_1.19.0_2018-09-24.md

@@ -0,0 +1,6 @@
+- New feature: Tasks / To-do list
+- Renamed habits to chores as this is more what it is about
+- Products can now be organized in product groups, this group is also used to group the items on the shopping list (you can use this to optimize your way in the supermarket for example)
+- Added an option to stay logged in permanently (checkbox on the login page)
+- When the database was changed externally, the current page is automatically reloaded when there was no input for at least 50 seconds
+- Fixed some minor UI bugs

changelog/34_1.19.1_2018-09-27.md

@@ -0,0 +1,2 @@
+- The colored info bars on top of all (overview)pages can now be clicked to filter the table accordingly
+- Fixed some minor mostly UI related bugs

changelog/35_1.19.2_2018-09-29.md

@@ -0,0 +1,2 @@
+- Important bug fix: All forms were submitted twice when using ENTER instead of the OK/Save button
+- Norwegian translation updates (thanks @BlizzWave )

changelog/36_1.20.0_2018-09-30.md

@@ -0,0 +1,3 @@
+- New optional "Night Mode" (thanks a lot @BlizzWave, can also be activated automatically by a time range - see the new dropdown menu next to the user menu)
+- Docker support (thanks @talmai)
+- Fixed some minor UI bugs

changelog/37_1.21.0_2018-10-06.md

@@ -0,0 +1,6 @@
+- New feature: Equipment
+  - Manage all your household equipment/devices in one place and have the information/instruction manual at hand when needed
+- New feature: Products can now have pictures
+  - Add them in the product edit page
+  - Will be shown in the productcard (purchase/consume/etc. pages) and when you click the product name on the stock overview page (a little image icon next to the product name indicates if the product has an image)
+- Recipes and the new equipment edit page now have a little editor with text formatting capabilities

changelog/38_1.22.0_2018-10-27.md

@@ -0,0 +1,14 @@
+- Added a journal for stock bookings, chore executions and battery charge cycles
+  - => Button in each line on the overview pages or the "Journal" button next to the headline on every overview page
+- Added the possibility to undo any stock booking, chore execution and battery charge cycle
+  - => Button in the success popup while booking a purchase/consume/etc. or on the new journal pages (see above)
+- Presets for new products are now configurable
+  - => "Presets for new products" button next to the headline on the products list page
+- Recipes can now be nested (include a recipe into another one)
+- Recipe ingredients can now be grouped together which will result in headlines per group in the rendered recipe
+  - => Group can be set on the recipe position edit page, demo recipe is "Pizza")
+- On the stock overview page, the product card is now shown when clicking the product name
+- Added option to filter by product group on stock overview page
+- When auto reloading on external changes is enabled, the page is not reloaded when there is a fullscreen card active (recipe/equipment instruction manual)
+- On the product-/chore-/batterycard there is now a link to the edit page of the corresponding item
+- Some other minor bug fixes

changelog/39_1.23.0_2018-11-24.md

@@ -0,0 +1,18 @@
+- New feature: "Shopping list to stock workflow"
+  - Add a single shopping list item or all at once to stock directly from the shopping list
+  - There are new "stock settings" under settings menu in the top right corner
+  - You can enable there, that all products which have "Default best before days" set, are added without confirmation in this workflow
+  - => This means, you can add the whole shopping list to stock with one click, if you want
+- Improved stock handling
+  - On consume, a specific stock item can now be picked
+  - A stock item can now be marked as "opened" (on the consume page or directly from stock overview, visible in the product card and on the stock overview page)
+- New feature: Calendar
+  - Shows all upcoming product expirations, due chores, due tasks and due battery charge cycles
+- New translation: French (thanks all the translators)
+  - As for all languages, a demo is available at: https://fr.demo.grocy.info
+- Small other improvements
+  - Allow fraction numbers for recipe ingredients when not checked against stock and add an option to not check stock for a recipe position
+  - The current time can now be shown in the header (see the settings menu next to the user icon)
+- Changed: Docker related things are now in a separate repository: https://github.com/grocy/grocy-docker
+- Changed: Translations are now managed with Transifex: https://www.transifex.com/grocy/grocy
+

changelog/3_0.3.0_2017-04-17.md

@@ -0,0 +1 @@
+- Form validation and barcode input handling improvements

changelog/40_1.23.1_2018-11-27.md

@@ -0,0 +1,2 @@
+- Added a skip button when adding all shopping list items in "Shopping list to stock workflow"
+- Fixed some minor UI related bugs

changelog/41_1.24.0_2018-12-30.md

@@ -0,0 +1 @@
+- All `config.php` settings can now also be set via environment variables (for [grocy-docker](https://github.com/grocy/grocy-docker))

changelog/42_1.24.1_2019-01-10.md

@@ -0,0 +1,5 @@
+- Fixed a SQL error during database migration when using SQLite >= 3.25.2
+- Improved data tables loading time
+- Location edit form did not work (master data)
+- Quantity unit "purchase to stock factor" was not respected when putting a recipe on the shopping list or when comparing the already on the shopping list amount
+- Better API response for POST routes when there is no or invalid JSON request body content

changelog/43_2.0.0_2019-03-06.md

@@ -0,0 +1,23 @@
+- Breaking change: The API has been completely reworked, please review [the documentation](https://demo.grocy.info/api) before updating when you are using the API
+- New feature: Tare weight handling
+  - An option per product
+  - Imagine this: You have flour in jars, the jar weighs 500 grams, currently there are 1000 grams in stock, the new weight including the jar is 1100 grams - grocy can now calculate the used amount on consume/purchase/inventory automatically, you only have to enter the weighed amount including the jar (demo product to showcase this "Flour")
+- Recipe improvements
+  - Recipes are now scalable - define per recipe for how much servings it is, change the desired servings on the fly when the recipe is displayed, ingredient amounts are scaled accordingly
+  - The cost of a recipe is now displayed based on the last purchase price per ingredient (recipe scaling also applies)
+  - When putting all missing recipe ingredients on the shopping list, it is now possible to ignore certain ingredients (in the popup when clicking the "Put missing items on shopping list" button)
+  - A new option per recipe to not check against the amount already on the shopping list when putting all missing ingredients on it (by default, only the amount not already on the shopping list is added, when this is enabled, always the whole missing amount will be put on the shopping list)
+  - On consume, there can now be tracked for which recipe it was, this is also tracked automatically when using the "Consume all ingredients needed by this recipe" button (for future statistical purposes)
+  - Recipes can now have pictures
+  - New "gallery view" for recipes (demo available at https://demo.grocy.info/recipes?tab=gallery)
+- Stock improvements
+  - It is now optionally possible to have partial units in stock (option per product)
+  - On purchase, a different location can now be assigned (imagine you have two freezers, by default you store your pizza there, but sometimes there)
+- New translations: (thanks all the translators)
+  - Spanish (demo available at https://es.demo.grocy.info)
+  - Turkish (demo available at https://tr.demo.grocy.info)
+- Other improvements
+  - The calendar can now be shared/integrated in iCal format (button in the header on the calendar page)
+  - Added feature flags to hide/disable certain parts of grocy when you don't use them (for example hide "Chores" and all related UI elements, when you don't use it, see `config-dist.php`)
+  - Added a "Apple Touch Icon" and a "Web App Manifest" which should improve grocy on mobile devices and also enables "Add to Home screen" on major mobile browsers
+  - A lot of other minor small and bigger UI improvements

changelog/44_2.1.0_2019-03-09.md

@@ -0,0 +1,10 @@
+- Some small UI fixes & improvements
+  - Recipe ingredient notes were not displayed
+  - Edit/delete buttons on the equipment page had no icons
+  - Improved the overview pages "action buttons column" (e. g. hide more rarely used actions behind a context/dropdown menu)
+  - The "purchase to stock conversion factor" is now displayed on the purchase page when QU units are different (above the amount field)
+  - Some JS files were not loaded correctly on case sensitive file systems
+  - The changelog is now included as markdown files (in `/changelog` directory, one file per release with a filename in format `<ReleaseNumber>_<Version>_<ReleaseDateIso>.md`) and shown in the about dialog
+  - Please review your `CURRENCY` setting in `data/config.php`, see also `config-dist.php` - this should be the ISO 4217 code of the currency to properly work with the JS `toLocaleString` function
+- New translation: (thanks all the translators)
+  - Russian (demo available at https://ru.demo.grocy.info)

changelog/45_2.2.0_2019-03-10.md

@@ -0,0 +1,5 @@
+- New API method to get a product by its barcode (`/stock/products/by-barcode/{barcode}`, thanks @matejdro)
+- The best before date on the purchase and inventory page can now also be today or earlier, but when so, a short hint is displayed
+- Fixed some UI bugs
+  - When consuming a product with "Allow partial units in stock" enabled from the stock overview page, the displayed amount after the stock booking was wrong
+  - The inventory form was not validated with certain click paths

changelog/46_2.3.0_2019-04-06.md

@@ -0,0 +1,17 @@
+- Stock improvements
+  - A different location can now also be set during inventory (as for purchases)
+  - A partial minimum stock amount can now be set when "Allow partial units in stock" is enabled (product option)
+- Recipe improvements
+  - There is now a default per product for "Disable stock fulfillment checking for this ingredient" (ingredient option, default can be defined as a product option)
+- Some small UI fixes & improvements
+  - THe "Mark as open" button on the stock overview page was disabled when the current stock amount was exactly 1
+  - The number in the "x products expiring within the next 5 days" badge was incorrect for products expiring exactly in 5 days
+  - On the product groups page there is now a new column which displays the product count per group (+ a link to the products page filtered by that product group)
+  - Added a message to clarify that in product dropdowns also something unknown can be entered to start a workflow
+  - Some other small CSS fixes (context menus were not fully displayed when the parent container was to small, improved padding for text inputs)
+- As always: Updated translations (thanks all the translators)
+
+### Self promotion
+[grocy-desktop](https://github.com/grocy/grocy-desktop) is now also available through the Microsoft Store 
+
+<a href="//www.microsoft.com/store/apps/9nwb1trnnksf?cid=storebadge&ocid=badge"><img src="https://assets.windowsphone.com/85864462-9c82-451e-9355-a3d5f874397a/English_get-it-from-MS_InvariantCulture_Default.png" alt="Get it from Microsoft" width="150px" /></a>

changelog/47_2.4.0_2019-05-10.md

@@ -0,0 +1,34 @@
+- New feature: Userfields
+  - Attach any custom field to any entity (Products, Locations, Euqipment, etc.)
+  - Userfields can have types (Text, Number, Date, etc.)
+  - Will be shown / can be filled on the edit page of the corresponding entity and will also optionally show in the corresponding tables (inclcudes overview pages)
+  - => Can be configured under Master data / Userfields
+- New feature: Meal planning
+  - Simple approach for the beginning (more to come): A week view where you can add recipes for each day (new menu entry in the sidebar, below calendar)
+  - Of course it's also possible to put missing things directly on the shopping list from there, also for a complete week at once
+- General improvements
+  - The "expires soon" or "due soon" days (yelllow bar at the top of each overview page) can now be configured
+    - => New settings page for each area under the settings icon at the top right
+- Stock improvements
+  - It's now possible to have multiple / named shopping lists
+    - Automations still use the default shopping list and also the default shopping list cannot be deleted
+  - More information on the product card like "Spoil rate" or "Average shelf life"
+  - It's now possible to set a price for added products during inventory
+  - It's now possible to customize the default amount for purchase/consume (see stock settings under the settings icon on the top right)
+- Chores improvements
+  - New recurrence patterns - chores can now also be "scheduled" to repat daily/weekly/monthly
+  - It's now possible to track the day of a chore execution only (without the time, option per chore)
+- Recipe improvements
+  - It's now possible to enter a "variable amount" (e. g. if a recipe needs "1 - 2 cups"), the original amount is still used for stock fulfillment checking (if enabled for that recipe ingredient)
+- New translations: (thanks all the translators)
+  - Swedish (demo available at https://sv.demo.grocy.info)
+  - Polish (demo available at https://pl.demo.grocy.info)
+- Internal improvement: Localizations are now handled via gettext, both on server and client side
+  - Mainly to properly handle languages with more than 2 plural forms
+  - This involved some string changes which results in a needed (re)translation of about 20 strings (excluding demo data)
+  - Also applies to quantity units, n-plural forms can be entered on the quantity unit edit page
+  - It's not required to install the PHP gettext extension, on both, server and client, managed implementations of gettext are used ([oscarotero/Gettext](https://github.com/oscarotero/Gettext) & [oscarotero/gettext-translator](https://github.com/oscarotero/gettext-translator))
+- Some other small fixes and improvements
+  - The "Add as barcode to existing product" productpicker workflow failed to add the barcode to the given product
+  - Recipes can now be filter by stock availability
+  - Added a feature flag (`config.php` setting) to also be able to hide all stock related UI elements and routes

changelog/48_2.4.1_2019-05-16.md

@@ -0,0 +1,2 @@
+- Fixed a performance problem for loading data tables related to the new Userfields feature
+- Fixed that when using single quotes in a product name did not trigger the workflow popup

changelog/49_2.4.2_2019-06-09.md

@@ -0,0 +1,11 @@
+- Fixed that deleting meal plan entries did not work
+- Fixed a problem that the user settings were not properly initialized for the frontend JS part when not logged only (so potentially affected only the login page)
+- Fixed an issue that the shopping list did not load when a plural translation for a quantity unit was missing
+- Fixed that tooltips were visible forever when consuming all products on the stock overview page
+- Fixed that login did not work when "Stay logged in permanently" was set and grocy runs on a 32-bit system (thanks @matejdro)
+- Fixed page reloads when "Auto reload on external changes" is enabled and there is unsaved form data (the detection did not work for forms in modal dialogs, e. g. when adding a entry to the meal plan)
+- Fixed (again) that the product picker did not work properly when the product name contains single quotes
+- Fixed that a entered barcode on the product edit page was only saved when "adding" it to the barcodes list by pressing `TAB` (is now automatically added to the list also when just leaving the field)
+- Improved that errors/messages from the API are shown properly when undoing a stock booking is not possible (stock journal page)
+- Improved night mode CSS (done by @BlizzWave, thanks!)
+- A new localization for `en_GB` is now always included - nothing is really translated there, it's only about component "translations" that e. g. the first day of the week is correct for calendars

changelog/4_0.4.0_2017-04-18.md

@@ -0,0 +1 @@
+- Add possibility to have multiple barcodes per product

changelog/50_2.4.3_2019-07-06.md

@@ -0,0 +1,16 @@
+- Fixed the messed up message/toast after consuming a product from the stock overview page
+- Fixed that "Track date only" chores were always tracked today, regardless of the given date
+- Fixed that the "week costs" were wrong after removing a meal plan entry
+- Fixed wrong recipes costs calculation with nested recipes when the base recipe servings are > 1 (also affected the meal plan when adding such a recipe there)
+- Fixed consuming recipes did not consume ingredients of the nested recipes
+- Improved recipes API - added new endpoints to get stock fulfillment information (thanks @Aerex)
+- Improved date display for products that never expires (instead of "2999-12-31" now just "Never" will be shown)
+- Improved date display for dates of today and no time (instead of the hours since midnight now just "Today" will be shown)
+- Improved shopping list handling
+  - Items can now be switched between lists (there is a shopping list dropdown on the item edit page)
+  - Items can now be marked as "done" (new check mark button per item, when clicked, the item will be displayed greyed out, when clicked again the item will be displayed normally again)
+- Improved that products can now also be consumed as spoiled from the stock overview page (option in the more/context menu per line)
+- Added a "consume this recipe"-button to the meal plan (and also a button to consume all recipes for a whole week)
+- Added the possibility to undo a task (new button per task, only visible when task is already completed) and also a corresponding API endpoint
+- Added a new `config.php` setting `DISABLE_AUTH` to be able to disable authentication / the login screen, defaults to `false`
+- Added a new `config.php` setting `CALENDAR_FIRST_DAY_OF_WEEK` to be able to change the first day of a week used for calendar views (meal plan for example) in the frontend, defaults to locale default

changelog/51_2.4.4_2019-07-07.md

@@ -0,0 +1,6 @@
+- Fixed that price data (last price & chart) was not taken from inventory correction bookings, only purchases
+- Fixed weekly chores were scheduled on the same day after execution
+- Fixed that undone chores were also included in "Last tracked"
+- Fixed the date-time-picker width was too narrow sometimes
+- Improved that execution dates of "Track date only" chores will never display the time part
+- Improved date display for products that never expire (again, there was a display problem after consuming an item on the stock overview page)

changelog/52_2.5.0_2019-09-22.md

@@ -0,0 +1,107 @@
+### New feature: Custom entities / objects / lists
+- Custom entities are based on Userfields and can be used to add any custom lists you want to have in grocy
+- They can have an own menu entry in the sidebar
+- => See "Manage master data" -> "Userentities" or try it on the demo: https://demo.grocy.info/userobjects/exampleuserentity
+
+### New feature: Use the device camera for barcode scanning
+- Available on any barcode-enabled field (so currently only for picking products) - a new camera button at the right of side the text field
+- Implemented using [QuaggaJS](https://github.com/serratus/quaggaJS) - camera stream processing happens totally offline / client-side
+- Please note due to browser security restrictions, this only works when serving grocy via a secure connection (`https://`)
+- There is also a `config.php` setting `DISABLE_BROWSER_BARCODE_CAMERA_SCANNING` to disable this, if you don't need it at all (defaults to `false`)
+- I you have problems that barcodes are not recognized properly, there is a little "barcode scanner testing page" at [/barcodescannertesting](https://demo.grocy.info/barcodescannertesting)
+- => Quick video demo: https://www.youtube.com/watch?v=Y5YH6IJFnfc
+
+### Stock improvements/fixes
+- Products can now have variations (nested products)
+  - Define the parent product for a product on the product edit page (only one level is possible, means a product which is used as a parent product in another product, cannot have a parent product itself)
+  - Parent and sub products can have stock (both are regular products, no difference from that side)
+  - On the stock overview page, the aggregated amount is displayed next to the amount (sigma sign)
+  - When a recipe needs a parent product, the need is also fulfilled when enough sub product(s) are in stock
+- Quantity units can now be linked (related measurements / unit conversion)
+  - On the quantity unit edit page default conversion can be defined for each unit
+  - Products "inherit" the default conversion and additionally can have their own / override the default ones
+- It's now possible to print a "Location Content Sheet" with the current stock per location - new button at the top of the stock overview page (thought to hang it at the location, note used amounts on paper and track it in grocy later)
+- Stock overview page improvements
+  - Options in the more/context-menu to directly open the purchase/consume/inventory pages prefilled with the current product in a popup/dialog
+  - Option in the more/context-menu to add the current product directly to a shopping list
+  - Option in the more/context-menu to search for recipes containing the current product
+  - It's now possible to undo stock bookings ("Undo"-button in the success message, like it was already possible on the purchase/consume/inventory pages)
+  - Improved that on any stock changes the corresponding product table row is properly refreshed
+- New `config.php` setting `FEATURE_SETTING_STOCK_COUNT_OPENED_PRODUCTS_AGAINST_MINIMUM_STOCK_AMOUNT` to configure if opened products should be considered for minimum stock amounts (defaults to `true`, so opened products will now be considered missing by default - please change this setting if you want the old behavior)
+- The product description now can have formattings (HTML/WYSIWYG editor like for recipes)
+- Products now have a new field for calories (kcal, per stock quantity unit)
+- "Factor purchase to stock quantity unit" (product option) can now also be a decimal number when "Allow partial units in stock" is enabled
+- New "Sub feature flags" in `config.php` to disable some sub-features (hide the corresponding UI elements) if you don't need them (all new feature flags default to `true`, so no changed behavior when not configured)
+  - `FEATURE_FLAG_STOCK_PRICE_TRACKING` to disable product price tracking
+  - `FEATURE_FLAG_STOCK_LOCATION_TRACKING` to disable product location tracking
+  - `FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_TRACKING` to disable product best before date tracking
+  - `FEATURE_FLAG_STOCK_PRODUCT_OPENED_TRACKING` to disable product opened tracking
+- Fixed/refined some things regarding purchase/consume/inventory of products with enabled tare weight handling (nothing was broken, but the success popups may not displayed the correct amount that was posted)
+- Fixed that "Spoil rate" and "Average shelf life" on the product card was wrong in most cases
+- When going to the product edit page, after saving the product, it will now always return to the previous page
+
+### Shopping list improvements
+- Shopping lists now have a notes field (HTML/WYSIWYG editor, just to save some notes per shopping list)
+- Shopping lists can now be printed (new button next to the add/delete shopping list button)
+
+### Recipe improvements
+- Based on the new linked quantity units, recipe ingredients can now use any product related unit, the amount is calculated according to the conversion factor of the unit relation
+- Based on the new calories field per product, the calories per recipe are now shown based on the selected servings (in the header, next to the costs)
+- New option "price factor" per recipe ingredient (defaults to `1`) - the resulting costs of the recipe ingredient will be multiplied by that factor
+  - Use this for example for spices in combination with "Only check if a single unit is in stock" to not take the full price of a pack of pepper into account for a recipe
+- The search field on the recipe overview page now also searches for product names of recipe ingredients (means it's possible to search a recipe by a product name)
+- Fixed a problem where the meal plan did not load when a recipe, which was already added to the meal plan, was deleted
+
+### Chores improvements
+- Chores can now be assigned to users
+  - Option per chore, different "assignment types" like "Random", "Who least did first", etc.
+  - On the chores overview page, the list can be filtered to only show chores assigned to the currently logged in user (or to any other user)
+- New option "Due date rollover" per chore which means the chore can never be overdue, the due date will shift forward each day when due
+- New option "Consume product on chore execution" per chore to automatically consume a product when a chore execution is tracked
+- When tracking an execution from the chores overview page, filters are re-applied afterwards (means when you have filtered the page to only show overdue chores and after the execution the chore is not overdue anymore, it will now be immediately hidden)
+
+### Equipment improvements/fixes
+- Fixed that the delete button not always deleted the currently selected equipment item
+
+### Userfield improvements/fixes
+- New Userfield type "Select list" for a list of predefined values where a single or also multiple values can then be selected on the entity object
+- New Userfield type "Link" - a single-line-textbox where the content will be rendered as a clickable link
+- Userfields of type "checkbox" are rendered as a checkmark in tables when checked (instead of "1" as till now)
+- Product Userfields are now also rendered on the shopping list (for items which have a product referenced)
+- Fixed that the Userfield type "Preset list" had always the caption "Product group" instead of the configured one (thanks @oncleben31)
+
+### General & other improvements/fixes
+- Added a new `config.php` setting `CALENDAR_SHOW_WEEK_OF_YEAR` to configure if calendars should show week numbers (defaults to `true`)
+- Fixed that date/time pickers not considered the `config.php` setting `CALENDAR_FIRST_DAY_OF_WEEK`
+- Improved the handling which entry page to use with disabled feature flags (thanks @nielstholenaar)
+- Boolean settings provided via environment variables (so the strings `true` and `false`) are now parsed correctly (thanks @mduret)
+- All uploaded pictures (currently for products and recipes) are now automatically downscaled to the appropriate size when serving them to improve page load times (this requires the `php-gd` extension, if not installed, images will not be downscaled)
+- It's now possible to test plural forms of quantity units (button on the quantity unit edit page, only visible if the current language requires more than 2 plural forms)
+- On the login page the sidebar an all top-navbar menus is now hidden
+- New translations: (thanks all the translators)
+  - Danish (demo available at https://da.demo.grocy.info)
+  - Dutch (demo available at https://nl.demo.grocy.info)
+- Internal change for how the localizations for the demo instances are handled
+  - For the pre-release demo now all currently supported languages are available (was already the case for the stable demo)
+    - Additionally all language files which reached the completion limit of 80 % will now be automatically pulled from Transifex 10 minutes past every hour (to have a kind of instant preview of changed translations)
+  - The URLs have changed, I'll try to keep all existing URLs redirecting properly for a long time
+    - If you want to link to the demo, please only use https://demo.grocy.info (stable demo) or https://demo-prerelease.grocy.info (current master branch demo)
+
+### API improvements & non-breaking changes
+- New endpoint `/objects/{entity}/search/{searchString}` to search for objects by name (contains search)
+- New endpoint `/stock/shoppinglist/add-product` to add a product to a shopping list (thanks @Forceu)
+- New endpoint `/stock/shoppinglist/remove-product` to remove a product from a shopping list (thanks @Forceu)
+- New endpoint `/chores/executions/calculate-next-assignments` to (re)calculate next user assignments for a single or all chores
+- New endpoint `/stock/products/by-barcode/{barcode}/add` to add a product to stock by its barcode
+- New endpoint `/stock/products/by-barcode/{barcode}/consume` to remove a product to stock by its barcode
+- New endpoint `/stock/products/by-barcode/{barcode}/inventory` to inventory a product by its barcode
+- New endpoint `/stock/products/by-barcode/{barcode}/open` to mark a product as opened by its barcode
+- New endpoint `/stock/bookings/{bookingId}` to retrieve a single stock booking
+- Endpoint `GET /files/{group}/{fileName}` can now also downscale pictures (see API documentation on [/api](https://demo.grocy.info/api))
+- When adding a product (through `stock/product/{productId}/add` or `stock/product/{productId}/inventory`) with omitted best before date and if the given product has "Default best before days" set, the best before date is calculated based on that (so far always today was used which is still the case when no date is supplied and also the product has no "Default best before days set) (thanks @Forceu)
+- Field `stock_amount` of endpoint `/stock/products/{productId}` now returns `0` instead of `null` when the given product is not in stock (thanks @Forceu)
+- Fixed that `/system/db-changed-time` always returned the current time (more or less) due to that that time is the database file modification time and the database is effectively changed on each request because of session information tracking - which now explicitly does not change the database file modification time, so this should work again to determine if any data changes happened
+- It's now also possible to provide the API key via a query parameter (same name as the header, so `GROCY-API-KEY`)
+
+#### Say thanks
+Because there were some questions about that in the past: If grocy is useful for you, [say thanks](https://grocy.info/#say-thanks)!

changelog/53_2.5.1_2019-09-28.md

@@ -0,0 +1,37 @@
+### Stock improvements/fixes
+- Fixed that barcode lookups now compare the whole barcode, not parts of it (e. g. when you have two products with the barcodes `$1` and `$10` and scan `$1` maybe the product of `$10` was found till now)
+- Fixed that the "X products are already expired" count on the stock overview page was wrong
+- Fixed that after product actions (consume/purchase/etc.) on the stock overview page the highlighting of the row was maybe wrong
+- After product actions (consume/purchase/etc.) on the stock overview page on a sub product, now also the parent product (row) is refreshed
+- It's now possible to accumulate min. stock amounts on parent product level (new option per product, means the sub product will never be "missing" then, only the parent product)
+- On the purchase page there is now an option to select that the price is the total price (for the whole amount) - below the price field, defaults to "Unit price" (as it was until now), when set to "Total price", the entered price will be divided by the amount before posting
+- "Average shelf life" on the product card now displays just "Unlimited" when the resulting value would be > 200 years (for products which never expire, as they have a best before date of 2999-12-31)
+
+### Shopping list improvements
+- When adding a product to the shopping list from the new context/more menu from the stock overview page and if the product is already on the shopping list, the amount of that entry will be updated acccordingly instead of adding a new (double) shopping list item
+- Added a "clear" button above the new notes field on the shopping list page to quickly clear the notes field with one click
+
+### Recipe improvements/fixes
+- Fixed a problem regarding quantity unit conversion handling for recipe ingredients of products with no unit relations, but only a different purchase/stock quantity unit
+- It's now possible to display a recipe directly from the meal plan (new "eye button") (thanks @kriddles)
+- Improved the responsiveness of the meal plan and calendar page by automatically switching to a day calendar view on smaller screens (thanks for the idea @kriddles)
+
+### Chores improvements
+- There is now a new sub feature flag `FEATURE_FLAG_CHORES_ASSIGNMENTS` to disable chore assignments if you don't need them (defaults to `true`, so no changed behavior when not configured)
+
+### Calendar improvements
+- The calendar now also contains all planned recipes from the meal plan on the corresponding day
+- Improved that dates in the iCal calendar export now include the server timezone
+
+### Custom lists/fields improvements
+- Optimized the custom lists page that it can be printed properly (search field etc. is hidden when printing the page)
+
+### General & other improvements/fixes
+- Fixed that the browser barcode scanner button was not clickable on iOS Safari & other small styles fixes/improvements for iOS Safari (thanks @DeeeeLAN)
+- It's now also possible to set the meal plan page as the default/entry page (`config.php` setting `ENTRY_PAGE`) (thanks @lwis)
+- Some UI detail-refinements
+- In the header of the product-/chore-/battery-card there is now also a button to directly jump to the journal of the current product/chore/battery
+
+### API improvements/fixes
+- The API Endpoint `GET /files/{group}/{fileName}` now also returns a `Cache-Control` header (defaults fixed to 30 days) to further increase page load times
+- Fixed that the API endpoint `/stock/shoppinglist/add-product` failed when a product should be added which was not already on the shopping list (thanks @Forceu)

changelog/54_2.5.2_2019-10-05.md

@@ -0,0 +1,15 @@
+### Stock fixes
+- Fixed that product specific quantity unit conversions (product overrides) were also displayed on the product edit page of other products with the same stock quantity unit
+
+### Recipe fixes
+- Fixed that recipes were displayed without ingredients if the total recipe count was > 100
+
+### Shopping list improvements
+- Added a new sub feature flag `FEATURE_FLAG_SHOPPINGLIST_MULTIPLE_LISTS` to disable multiple shopping lists if you only need one (defaults to `true`, so no changed behavior when not configured)
+
+### Chores improvements
+- Added a new period type "yearly" (for yearly schedules)
+- Added a "period interval" option per chore to have more flexible schedules (possible for the daily/weekly/monthly/yearly schedules, means "schedule this chore only every x days/weeks/months" to have for example biweekly schedules)
+
+### General & other improvements
+- New Input shorthands for date fields to increase/decrease the date by 1 month/year (shift + arrow keys, see the full list [here](https://github.com/grocy/grocy#input-shorthands-for-date-fields))

changelog/55_2.6.0_2020-01-31.md

@@ -0,0 +1,85 @@
+### New feature: Transfer products between locations and edit stock entries
+- New menu entry in the sidebar to transfer products (or as a shortcut in the more/context menu per line on the stock overview page)
+- New button "Stock entries" in the header of the stock overview page (or as a shortcut in the more/context menu per line) to show the detail stock entries behind each product
+  - From there you can also edit the stock entries
+- (A huge THANK YOU goes to @kriddles for the work on this feature)
+
+### New feature: Scan mode
+- Just scan one product after another, no manual input required and audio feedback is provided
+- New switch-button on the purchase and consume page
+- When enabled
+  - The amount will always be filled with `1` after changing/scanning a product
+  - If all fields could be automatically populated (means for purchase the product has a default best before date set), the transaction is automatically submitted
+    - If not, a warning is displayed and you can fill in the missing information
+  - Audio feedback is provided after scanning and on success/error of the transaction
+- => Quick video demo: https://www.youtube.com/watch?v=83dm9iD718k
+
+### New feature: Self produced products
+- To a recipe a product can be attached
+  - This products needs a "Default best before date"
+- On using "Consume all ingredients needed by this recipe" and when it has a product attached, one unit of that product (per serving in purchase quantity unit) will be added to stock (with the proper price based on the recipe ingredients)
+- (Thanks @kriddles for the initial work on this)
+
+### New feature: Freeze/Thaw products
+- New product options "Default best before days after freezing/thawing" to set how the best before date should be changed on freezing/thawing
+- New location option "Is freezer" to indicate if the location is a freezer
+- => When moving a product from/to a freezer location, the best before date is changed accordingly
+- There is also a new sub feature flag `FEATURE_FLAG_STOCK_PRODUCT_FREEZING` to disable this if you don't need it (defaults to `true`)
+
+### Stock improvements/fixes
+- The productcard gets now also refreshed after a transaction was posted (purchase/consume/etc.) (thanks @kriddles)
+- The product field calories (kcal) now also allows decimal numbers
+- On the inventory page, "New amount" is now prefilled with the current stock amount of the selected product
+- Fixed that entering partial amounts was not possible on the inventory page (only applies if the product option "Allow partial units in stock" is enabled)
+- Fixed that on purchase a wrong minimum amount was enforced for products with enabled tare weight handling in combination with different purchase/stock quantity units
+- Fixed that the productcard did not load correctly when `FEATURE_FLAG_STOCK_LOCATION_TRACKING` was set to `false` (thanks @kriddles)
+- Fixed that the "Add as barcode to existing product" workflow did not work twice when not switching the page inbetween
+
+### Shopping list improvements/fixes
+- Added a compact view to have a better shopping list for shopping trips (new button "Compact view" in the header, additionally this is automatically enabled on mobile devices / when screen width is < 768 px)
+- It's now possible to filter for only undone (not striked through) items (new option in the "Filter by status" dropdown)
+- Fixed that when `FEATURE_FLAG_SHOPPINGLIST_MULTIPLE_LISTS` was set to `false`, the shopping list appeared empty after some actions
+
+### Recipe improvements
+- When consuming a recipe and if an ingredient is not in stock, but that product has any subproduct which is in stock, this gets now consumed (before consuming was not possible in that case)
+- When adding or editing a recipe ingredient, a dialog is now used instead of switching between pages (thanks @kriddles)
+
+### Meal plan improvements/fixes
+- It's now possible to add notes per day (in the dropdown of the add button in the header of each day column)
+- It's now possible to products directly (also in the dropdown of the add button in the header of each day column, maybe useful in combination with the new "Self produced products" feature)
+- Added that the calories per serving are now also shown
+- Added that the total costs and calories per day are displayed in the header of each day column
+- Added a new `config.php` setting `MEAL_PLAN_FIRST_DAY_OF_WEEK` which can be used to start the meal plan on a different day (defaults to `CALENDAR_FIRST_DAY_OF_WEEK`, so no changed behavior when not configured)
+- Fixed that when `FEATURE_FLAG_STOCK_PRICE_TRACKING` was set to `false`, prices were still shown (thanks @kriddles)
+- Fixed that the week costs were missing for the weeks 1 - 9 of a year
+
+### Calendar improvements
+- Improved that meal plan events in the iCal calendar export now contain a link to the appropriate meal plan week in the body of the event (thanks @kriddles)
+
+### Task fixes
+- Fixed that a due date was required when editing an existing task
+
+### API improvements/fixes
+- The endpoint `/stock` now includes also the product object itself (new field/property `product`) (thanks @gsacre)
+- The endpoint `/stock/products/{productId}/entries` can now include stock entries of child products (if the given product is a parent product and in addition to the ones of the given product) - new query parameter `include_sub_products` (defaults to `false` so no changed behavior when not supplied)
+- New endpoints for the new stock transfer & stock entry edit capabilities
+- Fixed that the route `/stock/barcodes/external-lookup/{barcode}` did not work, because the `barcode` argument was expected as a route argument but the route was missing it (thanks @Mikhail5555 and @beetle442002)
+- Fixed the response type description of the `/stock/volatile` endpoint
+
+### General & other improvements/fixes
+- It's now possible to keep the screen on always or when a "fullscreen-card" (e. g. used for recipes) is displayed
+  - New user options in the display settings menu in the top right corner (defaults to disabled)
+- Slightly optimized table loading & search performance (thanks @lwis)
+- Added that the currently active sidebar menu item is always in view
+- Reordered the sidebar menu items a little bit, grouped them by borders and made them a little smaller to waste less space
+- Changed/removed some animations (and replaced jQuery UI by [Animate.css](https://daneden.github.io/animate.css/)) to improve responsiveness
+- Fixed that also the first column (where in most tables only buttons/menus are displayed) in tables was searched when using the general search field
+- Fixed that the meal plan menu entry (sidebar) was not visible when the calendar was disabled (`FEATURE_FLAG_CALENDAR`) (thanks @lwis)
+- For integration: If a `GET` parameter `closeAfterCreation` is passed to the product edit page, the window will be closed on save (due to Browser restrictions, this only works when the window was opened from JavaScript) (thanks @Forceu)
+- Fixed that the `update.sh` file had wrong line endings (DOS instead of Unix)
+- Internal change: Demo mode is now handled via the setting `MODE` instead of checking the existence of the file `data/demo.txt`
+- There is now a RSS feed for the changelog, subscribe to get notified about new releases: https://grocy.info/changelog/feed
+- New translations: (thanks all the translators)
+  - Hungarian (demo available at https://hu.demo.grocy.info)
+  - Portuguese (Brazil) (demo available at https://pt-br.demo.grocy.info)
+  - Slovak (demo available at https://sk.demo.grocy.info)

changelog/56_2.6.1_2020-03-06.md

@@ -0,0 +1,49 @@
+## !! Important notice
+If you run grocy in a subdirectory, you need to set a new `config.php` setting (`BASE_PATH`, see `config-dist.php`)
+
+### Stock fixes
+- Fixed purchase/consume/inventory problems when `FEATURE_FLAG_STOCK_LOCATION_TRACKING` was set to `false`
+- Fixed that products on the Location Content Sheet were not ordered by the product name
+
+### Shopping list improvements/fixes
+- Added an option to hide the month-calendar (in the shopping list settings / top right corner settings menu) (defaults to disabled, so please enable this option if you still want to have the month-calendar on the shopping list)
+- Optimized the new compact view (there was a little too much white space at the sides of the page)
+- Added an option to not switch to the new compact view on mobile devices automatically (in the shopping list settings / top right corner settings menu) (defaults to `false`, so no changed behavior when not configured) (thanks @Forceu)
+- Fixed that the "Shopping list to stock workflow" did not work when `FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_TRACKING` was set to `false`
+
+### Recipe improvements/fixes
+- Optimized the ordering of the inputs on the recipe ingredient edit page (moved "Only check if a single unit is in stock" before the amount)
+- Variable ingredient amounts are now marked accordingly on the renedered recipe
+- After selecting a recipe on mobile devices, the page now automatically scrolls to the recipe card
+- Added the recipes base servings to be displayed on the recipe card and properly named the servings column in the recipes list/table (thanks @kriddles)
+- Added that recipe ingredients can now also be displayed grouped by the products product group (additionally to the ingredient group, new option in the recipes settings / top right corner settings menu) (defaults to `false`, so no changed behavior when not configured) (thanks @kriddles)
+- Fixed that when editing a recipe ingredient which had "Only check if a single unit is in stock" set, not any quantity unit could be picked and the amount stayed empty
+- Fixed that when reloading the "new recipe"-page (or when it gets auto-reloaded due to "Auto reload on external changes" is enabled), for each reload a new recipe was created
+- Fixed that the recipe "fullscreen card" was not correctly displayed
+- Fixed that nested recipes showed all ingredients of the nested recipes twice
+- Fixed that when displaying or consuming a recipe from the meal plan the serving amount was maybe wrong (was the one from the recipe instead the one from the meal plan entry) (thanks @kriddles)
+- Fixed that the stock fulfillment counts on the recipe card were maybe wrong if that recipe was also added to the meal plan (thanks @kriddles)
+- Fixed that the recipe page was reloaded when expanding a collapsed row on mobile (thanks @Mikhail5555)
+
+### Meal plan improvements
+- Improved that all add-dialogs can be submitted by using `ENTER` and that the next input is automatically selected after selecting a recipe/product
+- Added an edit button to all types of meal plan entries
+- When adding a recipe, the serving amount is now prefilled with the one of the selected recipe (thanks @kriddles)
+- Fixed that the meal plan not used the full height on mobile devices
+
+### Calendar fixes
+- Fixed to only include events when the corresponding feature flag is enabled (e. g. don't show expiring products when `FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_TRACKING` is set to `false`) (thanks @kriddles)
+- Fixed that the calendar not used the full height on mobile devices
+
+### API improvements/fixes
+- The endpoint `/chores` now also includes the chore name (new field `chore_name`) (thanks @DarienFord)
+
+### General & other improvements/fixes
+- Big backend performance improvements (thanks @zebardy)
+- Added a button to enable the device flash light on the camera barcode scanner popup (thanks @radim-ek)
+- Optimized the top navbar height and overall spacing to waste less space
+- Replaced the scan-mode-switch-button by a native button because it's less disturbing
+- Fixed that the "contextual time ago" of date/time pickers was not displayed
+- New translations: (thanks all the translators)
+  - Czech (demo available at https://cs.demo.grocy.info)
+  - Portuguese (Portugal) (demo available at https://pt-pt.demo.grocy.info)

changelog/57_2.6.2_2020-04-03.md

@@ -0,0 +1 @@
+Security fix (see [#696](https://github.com/grocy/grocy/issues/696))

changelog/58_2.7.0_2020-04-16.md

@@ -0,0 +1,66 @@
+### New feature: Price history per store
+- Define stores under master data
+- New product option to set the default store
+- Track on purchase/inventory in which store you bought the product (gets prefilled by the last store you purchased the product, or the default store of the product if you never bought it)
+- => The price history chart on the product card shows a line per store
+- (Thanks @immae and @kriddles)
+
+### Stock improvements/fixes
+- When creating a new product, the "QU id stock" is now preset by the "QU id purchase" (because most of the time that's most probably the same) (thanks @Mik-)
+- Clarified the row-button colors and toolips on the stock entries page
+- Added a camera-barcode-scanning-button to the barcode(s) field on the product edit page to be able to also scan barcodes by the device camera there
+- Added a new option (stock settings / top right corner settings menu) to show an icon on the stock overview if the product is already on the shopping list (next to the amount) (defaults to enabled)
+- Fixed that the aggregated parent product amount (displayed on the stock overview page and on the product card) did not respect quantity unit conversions when the parent/sub products had different stock quantity units (the unit conversion needs to be globally defined, or as an override on the sub product)
+- Fixed the conversion factor hint to display also decimal places on the purchase page (only displayed when the product has a different purchase/stock quantity unit)
+- Fixed that the stock entries page was broken when there were product userfields defined with enabled "Show as column in tables"
+- Fixed that best before dates were displayed on the stock overview and stock entries page even with disabled `FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_TRACKING`
+- Fixed that when editing a stock entry and setting a decimal amount, the decimal part was ignored (only possible when the product option "Allow partial units in stock" is enabled)
+- Fixed that "Default best before days" and "Default best before days after opened" on the product edit page were always shown regardless of the feature flags `FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_TRACKING` and `FEATURE_FLAG_STOCK_PRODUCT_OPENED_TRACKING`
+- Fixed that the form validation limits for the amount input and products with enabled tare weight handling were wrong
+- Fixed that the price was saved wrong for products with a different purchase/stock quantity unit when using "Total price" on purchase (resulted for example in wrong recipe costs)
+- Fixed that undoing "product-opened"-actions was not possible
+- Fixed/improved consuming from the stock overview page for products with enabled tare weight handling ("consume 1" button is now disabled for such products, "consume all" works again)
+
+### Shopping list improvements/fixes
+- It's now possible to collapse/expand the product group sections (by clicking on the grey group header)
+- Fixed that the "shopping list to stock workflow"-dialog was not visible in compact view
+- Fixed that when printing the shopping list, configured userfields were not included
+
+### Recipe fixes
+- Fixed that when editing an ingredient with "Only check if a single unit is in stock" set, the quantity unit was always set to the products stock quantity unit regardless if a different one was selected for that ingredient
+- Fixed a PHP notice on the recipes page when there are no recipes (thanks @mrunkel)
+
+### Chores fixes
+- Fixed that weekly chores, where the next execution should be in the same week, were scheduled always for the next week only
+
+### Calendar fixes
+- Fixed that the "Share/Integrate calendar (iCal)" button did not work (thanks @tsia)
+
+### API improvements/fixes
+- New endpoint `/user/settings` to get all user settings of the currently logged in user (key/value pairs)
+- New endpoint `/system/config` to get all config settings (`config.php`) (key/value pairs)
+- The endpoint `/stock/products/{productId}/locations` now also returns the current stock amount of the product in that loctation (new field/property `amount`) (thanks @Forceu)
+- The endpoints `/objects/{entity}` and `/objects/{entity}/{objectId}` now also include/return userfields of the object(s) (new field/property `userfields` per object, key/value pairs or `null`, when the object has no userfields)
+- Fixed that CORS was broken (there was no response to preflight OPTIONS requests)
+
+### General & other improvements/fixes
+- Optimized that sometimes the corresponding form was not validated when selecting a date from the datetimepicker
+- New `config.php` setting `FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_FIELD_NUMBER_PAD` which activates the number pad for best-before-date fields on (supported) mobile browsers (useful because of [shorthands](https://github.com/grocy/grocy#input-shorthands-for-date-fields)) (defaults to `true`) (thanks @Mik-)
+- Enhancements for the camera barcode scanner
+  - Torch / light improvements (thanks @Mik-)
+    - The light button is only displayed when the device has a flash light
+    - New `config.php` setting `FEATURE_FLAG_AUTO_TORCH_ON_WITH_CAMERA` to always enable the flash light automatically
+  - It's now possible to change the camera when the device has more than one (dropdown in the camera scanning dialog, only visible if there is more than one camera available) (thanks @MichaelMadsen)
+  - Replaced [QuaggaJS](https://github.com/serratus/quaggaJS) (seems to be unmaintained) by [Quagga2](https://github.com/ericblade/quagga2)
+  - New user setting `quagga2_numofworkers` (`config.php`) to make the Quagga2 setting "numOfWorkers" adjustable (defaults to `4`)
+  - Various display/CSS improvements (thanks @Mik-)
+- Prerequisites (PHP extensions, critical files/folders) will now be checked and properly reported if there are problems (thanks @Forceu)
+- Improved the the overview pages on mobile devices (main column was hidden) (thanks @Mik-)
+- The general search field now searches accent insensitive (and table sorting is also accent insensitive)
+- Fixed that all number inputs are always prefilled in the browser locale number format
+- Optimized the handling of settings provided by `data/settingoverrides` files (thanks @dacto)
+- Optimized the update script (`update.sh`) to create the backup tar archive before writing to it (was a problem on Btrfs file systems) (thanks @shane-kerr)
+- Fixed (again) that the `update.sh` file had wrong line endings (DOS instead of Unix)
+- New translations: (thanks all the translators)
+  - Japanese (demo available at https://ja.demo.grocy.info)
+  - Chinese (Taiwan) (demo available at https://zh-tw.demo.grocy.info)

changelog/59_2.7.1_2020-04-17.md

@@ -0,0 +1,2 @@
+- Fixed that camera barcode scanning was broken
+- Fixed that the new prerequisites check handled things incorrectly in Docker images and in embedded mode

changelog/5_1.0.0_2017-04-20.md

@@ -0,0 +1 @@
+- Ready to ERP your fridge!

changelog/60_3.0.0_2020-12-22.md

@@ -0,0 +1,271 @@
+> ⚠️ The major version bump is due to breaking API changes, please see below if you use the API
+
+### New feature: Use any product related quantity unit anywhere
+- Finally it's possible to use any product related quantity unit on any page
+- Products still have one quantity unit stock and one (default) quantity unit purchase, but any QU, which has a direct or indirect conversion for that product, can be used to pick an amount
+  - Because the stock quantity unit is now the base for everything, it cannot be changed after the product was once added to stock (for now, maybe there will be a possibilty to change it in a future release)
+
+### New feature: Prefill purchase data by barcodes
+- Imagine you buy for example eggs in different pack sizes and they have different barcodes
+- Each product barcode can be assigned an amount, quantity unit and store (on the product edit page), which is then automatically prefilled on the purchase page
+- Additionally, the last price per barcode will be tracked and prefilled as a "Total price" on purchase
+- (Thanks @kriddles for the initial work on this)
+
+### New feature: User permissions
+- Users can now have permissions, can be configured per user on the "Manage users" page (lock icon)
+- Default permissions for new users can be set via a new `config.php` setting `DEFAULT_PERMISSIONS` (defaults to `ADMIN`, so no changed behavior when not configured)
+- All currently existing users will get all permissions (`ADMIN`) during the update/migration
+- Creating API keys on the "Manage API keys"-page (top right corner settings menu) now requires the `ADMIN` permission
+  - Other users only see their API keys on that page
+- (Thanks @fipwmaqzufheoxq92ebc for the initial work on this)
+
+### New feature: External authentication support
+- New `config.php` setting `AUTH_CLASS` to change the used authentication provider
+- Via LDAP
+  - New `config.php` settings `LDAP_DOMAIN`, `LDAP_ADDRESS` and `LDAP_BASE_DN`
+  - If you set `AUTH_CLASS` to `Grocy\Middleware\LdapAuthMiddleware`, users will be authenticated against your directory (and will also be created (in grocy), if not already present)
+- Via a reverse proxy
+  - New `config.php` setting `REVERSE_PROXY_AUTH_HEADER`
+  - If you set `AUTH_CLASS` to `Grocy\Middleware\ReverseProxyAuthMiddleware` and your reverse proxy sends a username in the HTTP header `REMOTE_USER` (header name can be changed by the setting `REVERSE_PROXY_AUTH_HEADER`), the user is automatically authenticated (and will also be created (in grocy), if not already present)
+  - (Thanks @fipwmaqzufheoxq92ebc for the initial work on this)
+
+### Stock improvements/fixes
+- Changes about best before dates: It's now possible to distinguish between best before dates and expiration dates:
+  - New product option "Due date type" (defaults to "Best before date")
+  - Wording changes:
+    - All current places where "Best before date" was used now use "Due date"
+    - Products with `Due date type = Best before date` (so all existing products) are "due" or "overdue" (they don't "expire" or are "expired")
+    - Products with `Due date type = Expiration date` (new option) can "expire" or are "expired"
+  - Color changes:
+    - Products which are due soon or expire soon are (still) highlighted in yellow
+    - Products which are overdue are highlighted in grey (there is also a new filter button on the stock overview page for them)
+    - Products which are expired (new option) are highlighted in red
+- When creating a quantity unit conversion it's now possible to automatically create the inverse conversion (thanks @kriddles)
+- The product option "Allow partial units in stock" was removed, partial amounts are now possible by default for all products
+- On purchase there is now a warning shown, when the due date of the purchased product is earlier than the next due date in stock (enabled by default, can be disabled by a new stock setting (top right corner settings menu))
+- The amount to be used for the "quick consume/open buttons" on the stock overview page can now be configured per product (new product option "Quick consume amount", defaults to 1)
+  - This "Quick consume amount" can optionally also be used as the default on the consume page (new stock setting / top right corner settings menu)
+- Products can now be duplicated (new dropdown menu item on the products list page, all fields will be preset from the copied product, except the name)
+- Products can now be merged (new dropdown menu item on the products list page)
+  - Useful if you have two products which are basically the same and want to replace all occurrences of one with the other one
+- When consuming or opening a parent product, which is currently not in stock, any in-stock sub product will now be consumed/opened (like already automatically done when consuming recipes)
+- Opened stock entries get now consumed first by default when no specific stock entry is used/selected
+  - So the default consume rule is now "Opened first, then first due first, then first in first out"
+- Optimized/clarified what the total/unit price on the purchase page is (thanks @kriddles)
+- On the purchase page the amount field is now displayed above/before the due date for better `TAB` handling (thanks @kriddles)
+- Changed that when `FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_TRACKING` is disabled, products now get internally a due date of "never overdue" (aka `2999-12-31`) instead of today (thanks @kriddles)
+- Products can now be disabled to keep the history/journal, but hide it everywhere, without deleting it (new product option "Active", deleting a product now explicitly also deletes its journal and all other references) (thanks @kriddles for the initial work on this)
+- Products can now be hidden from the stock overview page, even if they are in-stock (new product option "Never show on stock overview", disabled by default, so no changed behavior when not configured)
+  - That's maybe useful for parent products you only use as a kind of "container"
+- The due date is now also prefilled on the inventory page based on the products "Default due days" (was only done on the purchase page before)
+- On the stock journal page, it's now visible if a consume-booking was spoiled
+- It's now tracked who made a stock change (currently logged in user, visible on the stock journal page) (thanks @fipwmaqzufheoxq92ebc)
+- Product edit page improvements ("Save & continue" button, deleting and adding a product picuture is now possible in one go) (thanks @Ma27)
+- For products with tare weight handling enabled, it's now optionally possible to consume a fixed/exact amount (just like for "normal" products) in case you don't want to weigh the whole container this time (new checkbox on the consume page) (thanks @fipwmaqzufheoxq92ebc)
+- The stock overview page now also shows the value - new column and also the total value in the header (thanks @kriddles)
+- It's now possible to set a custom purchased date on purchase (new field on the purchase and inventory page, hidden by default - enable it by a new stock setting (top right corner settings menu)) (thanks @kriddles)
+- The decimal places for all amount and price inputs can now be configured (stock settings / top right corner settings menu, default for amounts is `4`, for prices `2`)
+- When clicking the product name on the shopping list, the product card will now be displayed (like on the stock overview page) (thanks @kriddles)
+- On the product card there is now also a button to jump directly to the stock entries of the corresponding product (thanks @kriddles)
+- The product picker workflows can now also be started by `ENTER` (additionally to `TAB`)
+- Added a "retry camera barcode scan" button (button with camera icon, shortcut `C`) to the product picker workflow dialog
+- Added more filters on the stock journal page
+- Added a grouped/summarized stock journal (new button "Journal summary" at the top of the stock journal page) (thanks @fipwmaqzufheoxq92ebc)
+  - Provides an overview of summarized transactions per product, transaction type and user + summarized amount
+- The product option "Default due days after freezing" now also supports `-1` (like the option "Default due days") to set the product to "never due" on freezing
+- Fixed that changing the products "Factor purchase to stock quantity unit" not longer messes up historical prices (which results for example in wrong recipe costs) (thanks @kriddles)
+- Fixed that when adding products through a product picker workflow and when the created products contains special characters, the product was not preselected on the previous page (thanks @Forceu)
+- Fixed that when editing a product the default store was not visible / always empty regardless if the product had one set (thanks @kriddles)
+- Fixed that `FEATURE_SETTING_STOCK_COUNT_OPENED_PRODUCTS_AGAINST_MINIMUM_STOCK_AMOUNT` (option to configure if opened products should be considered for minimum stock amounts) was not handled correctly (thanks @teddybeermaniac)
+- Fixed that the "Due soon" sum (yellow filter button) on the stock overview page didn't include products which are due today (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that the shopping cart icon on the stock overview page was also shown if the product was on an already deleted shopping list (if enabled) (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that when editing a stock entry without a price, the price field was prefilled with `1`
+- Fixed that the location & product groups filter on the stock overview page used a contains search instead of an exact search
+- Fixed that the amount on the success popup was wrong when consuming a product with "Tare weight handling" enabled
+- Fixed that the aggregated amount of parent products was wrong on the stock overview page when the child products had not the same stock quantity units
+- Fixed that edited stock entries were not considered for the price history chart on the product card
+- Fixed that `FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_TRACKING` is set to `false`, the purchase page validation failed (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that consuming (and editing the amount of) products with enabled tare weight handling did not work on the stock entries page
+- Fixed that the recipes dropdown on the consume page also displayed internal recipes (thanks @kriddles)
+- Fixed that opening tare weight handling enabled products is prevented via the UI and the API (as this makes no sense)
+- Fixed that undoing a consume transaction of an opened item added it back to stock unopened
+- Fixed that a "Total price" on purchase was not handled correctly for tare weight handling enabled products (the total price was wrongly related to the amount including the tare weight)
+
+### Shopping list improvements
+- Added a button to add all currently in-stock but overdue and expired products to the shopping list (thanks @m-byte)
+- Improved that when `FEATURE_FLAG_STOCK` is disabled, all product/stock related inputs and buttons are now hidden on the shopping list page (thanks @fipwmaqzufheoxq92ebc)
+- Shopping list items can now have their own Userfields (entity `shopping_list`), on the shopping list table those fields are rendered additionally to the product Userfields
+- The print view is now configurable (new dialog before printing - option to hide header, group products by their product group, alternative list layout)
+- Fixed that "Add products that are below defined min. stock amount" always rounded up the missing amount to an integral number, this now allows decimal numbers
+
+### Recipe improvements/fixes
+- It's now possible to print recipes (button next to the recipe title) (thanks @zsarnett)
+- Changed that recipe costs are now based on the costs of the products picked by the default consume rule ("Opened first, then first due first, then first in first out") (thanks @kriddles)
+  - Recipe costs were based on the last purchase price per product before, so this now better reflects the current real costs
+- Improved the recipe add workflow (a recipe called "New recipe" is now not automatically created when starting to add a recipe) (thanks @zsarnett)
+- On the recipe page, the calories and costs per ingredient are now shown to get a better overview of how much each ingredient contributed
+- Fixed that images on the recipe gallery view were not scaled correctly on larger screens (thanks @zsarnett)
+- Fixed that decimal ingredient amounts maybe resulted in wrong conversions or truncated decimal places if your locale does not use a dot as the decimal separator (thanks @m-byte)
+- Fixed that a recipe cannot be included in itself (because this will cause an infinite loop) (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that when editing a recipe ingredient the checkbox "Disable stock fulfillment checking for this ingredient" was not initaliased with the saved value
+- Fixed that the status filter ("Enough in stock", etc.) on the recipes page did not filter recipes on the gallery tab (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that consuming a recipe ingredient with tare weight handling enabled consumed a wrong amount (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that consuming a parent product recipe ingredient did not consider quantity unit conversion when effectively consuming a child product
+
+### Meal plan fixes
+- Fixed that for products the quantity unit purchase was displayed instead of the products quantity unit stock (thanks @BenoitAnastay)
+
+### Chores improvements/fixes
+- Chores can now be disabled to keep the history/journal, but hide it everywhere, without deleting it (new chore option "Active", deleting a chore now explicitly also deletes its journal and all other references)
+- Changed that not assigned chores on the chores overview page display now just a dash instead of an ellipsis in the "Assigned to" column to make this more clear (thanks @Germs2004)
+- The assignment type "Random" now don't prevents anymore that the last user will be assigned next
+- Fixed (again) that weekly chores, where the next execution should be in the same week, were scheduled (not) always (but sometimes) for the next week only (thanks @shadow7412)
+- Fixed that the assignment type "In alphabetic order" did not work correctly (the last person in the list was always assigned next once reached) (thanks @fipwmaqzufheoxq92ebc)
+
+### Equipment improvements
+- There is now a button to download the instruction manual (next to the "expand to fullscreen"-button)
+
+### Calendar improvements/fixes
+- Events are now links to the corresponding page (thanks @zsarnett)
+- Fixed a PHP warning when using the "Share/Integrate calendar (iCal)" button (thanks @tsia)
+- Fixed that "Track date only"-chores were always displayed at 12am (are now displayed as all-day events)
+- Fixed that it was not possible to switch to an other view than the default one on mobile (thanks @PhyberApex)
+
+### Tasks improvements
+- Tasks don't need to unique anymore (name field)
+
+### Batteries improvements
+- Batteries can now be disabled to keep the history/journal, but hide it everywhere, without deleting it (new battery option "Active", deleting a battery now explicitly also deletes its journal and all other references)
+
+### Userfield improvements/fixes
+- New Userfield type "File" to attach any file, will be rendered as a link to the file in tables (if enabled) (thanks @fipwmaqzufheoxq92ebc)
+- New Userfield type "Picture" to attach a picture, the picture will be rendered (small) in tables (if enabled) (thanks @fipwmaqzufheoxq92ebc)
+- New Userfield type "Link (with title)" - a link with a title (two input fields), so that the title is rendered in tables (if enabled) instead of the link itself
+- Userfields can now be reordered on the input form (new field "Sort number" per Userfield, fields will be ordered by that number, if any)
+- Users can now also have Userfields
+
+### General & other improvements/fixes
+- UI refresh / style improvements (thanks @zsarnett for the idea and initial work on this)
+- Improved mobile views (thanks @4lloyd for the idea and initial work on this)
+  - The buttons on the top of each page and the filter row is now collapsed (use the ellipsis/filter button to show them, this also superseded the shopping list compact view)
+  - Tables are horizontally scrollable (instead of collapsing columns which don't fit)
+- All tables are now customizable (new little eye icon on the top left corner on each table)
+  - Table columns be shown/hidden
+    - There are also new columns on some pages, hidden by default
+      - Stock overview: Value, Product group, Calories, Last purchased, Last price, Min. stock amount
+      - Products list: Default store
+      - Shopping list: Last price (Unit), Last price (Total), Default store, Barcodes (as scannable code-image)
+  - Row grouping can be customized to use any available column (thanks @edenhaus)
+- Table states (visible columns, sorting, column order and so on) are now saved server side (in user settings) means that this stays the same when using different browsers
+- Dialogs are now used everywhere where appropriate instead of jumping between pages (for example when adding/editing shopping list items)
+- Added a "Clear filter"-button on all pages (with filters) to quickly reset applied filters
+- Users can now have a picture (will then be shown next to the current user name instead of the generic user icon)
+- Prefilled number inputs now use sensible decimal places (max. the configured decimals while hiding trailing zeros where appropriate, means if you never use partial amounts for a product, you'll never see decimals for it)
+- Improved / more precise validation messages for number inputs
+- Optimized what's hidden when `GROCY_FEATURE_FLAG_STOCK` is disabled
+  - Products, quantity units and product groups are possible to use now
+  - Means you can use for example the shopping list, recipes and the meal plan with products while the "stock handling part" is hidden
+- Ordering now happens case-insensitive
+- The data path (previously fixed to the `data` folder) is now configurable, making it possible to run multiple grocy instances from the same directory (with different `config.php` files / different database, etc.) (thanks @fgrsnau)
+  - Via an environment variable `GROCY_DATAPATH` (higher priority)
+  - Via an FastCGI parameter `GROCY_DATAPATH` (lower priority)
+- The language can now be set per user (see the new user settings page / top right corner settings menu) (thanks @fipwmaqzufheoxq92ebc)
+  - Additionally, the language is now also auto-guessed based on the browser locale (HTTP-Header `Accept-Language`)
+  - The `config.php` option `CULTURE` was renamed to `DEFAULT_LOCALE`
+  - So the used language is based on (in that order)
+    - The user setting
+    - If not set, then based on browser locale
+    - If no matching localizaton was found, `DEFAULT_LOCALE` from `config.php` is used
+- Performance improvements (page loading time) of the stock overview page (thanks @fipwmaqzufheoxq92ebc)
+- The prerequisites checker now also checks for the minimum required SQLite version (thanks @Forceu)
+- Replaced (again, added before in v2.7.0, then reverted in v2.7.1 due to some problems) [QuaggaJS](https://github.com/serratus/quaggaJS) (seems to be unmaintained) by [Quagga2](https://github.com/ericblade/quagga2)
+- More `config.php` settings (see the section `Component configuration for Quagga2`) to tweak Quagga2 (this is the component used for device camera for barcode scanning) (thanks @andrelam)
+- Some localization string fixes (thanks @duckfullstop)
+- Better error pages
+- Fixed that numeric and date-time sorting of table columns did not work correctly
+- Fixed that XSS / HTML injection was possible through some user input fields (low severity / not really a problem as this could not be abused unauthenticated)
+- New translations: (thanks all the translators)
+  - Greek (demo available at https://el.demo.grocy.info)
+  - Korean (demo available at https://ko.demo.grocy.info)
+  - Chinese (China) (demo available at https://zh-cn.demo.grocy.info)
+  - Tamil (demo available at https://ta.demo.grocy.info)
+  - Finnish (demo available at https://fi.demo.grocy.info)
+
+### API improvements/fixes
+- ⚠️ **Breaking changes**:
+  - All prices are now related to the products stock quantity unit (instead of the products purchase QU)
+  - All (product) amounts are now related to the products stock quantity unit (was related to the products purchase QU for the shopping list before)
+  - The product object no longer has a field `barcodes` with a comma separated barcode list, instead barcodes are now stored in a separate table/entity `product_barcodes` (use the existing "Generic entity interactions" endpoints to access them)
+  - The endpoint `/objects/{entity}/search` was removed (use the existing `/objects/{entity}` endpoint with new new filter capabilities mentioned below)
+  - The output / field names of `ProductDetailsResponse` have slightly changed (endpoint `/stock/products/{productId}`)
+  - Endpoint `/stock/volatile`
+    - The query parameter `expring_days` was renamed to `due_soon_days`
+    - The field `expiring_products` was renamed to `due_products`
+    - The field `expired_products` now only contains expired products (so them with `Due date type = Expiration date`)
+    - The new field `overdue_products` contains only overdue products (so them with `Due date type = Best before date`)
+  - The following endpoints now return all bookings of the transaction (so the response is now an array, was before a single stock booking - and a random one if the transaction affected multiple stock entries)
+    - PUT `/stock/entry/{entryId}`
+    - POST `/stock/products/{productId}/add`
+    - POST `/stock/products/{productId}/consume`
+    - POST `/stock/products/{productId}/transfer`
+    - POST `/stock/products/{productId}/inventory`
+    - POST `/stock/products/{productId}/open`
+    - POST `/stock/products/by-barcode/{barcode}/add`
+    - POST `/stock/products/by-barcode/{barcode}/consume`
+    - POST `/stock/products/by-barcode/{barcode}/transfer`
+    - POST `/stock/products/by-barcode/{barcode}/inventory`
+    - POST `/stock/products/by-barcode/{barcode}/open`
+    - (The response is the same as if you would fetch the stock transaction via `/stock/transactions/{transactionId}`)
+- For better integration (apps), it's now possible to show a QR-Code for API keys (thanks @fipwmaqzufheoxq92ebc)
+  - New QR-Code button on the "Manage API keys"-page (top right corner settings menu), the QR-Codes contains `<API-Url>|<API-Key>`
+  - And on the calendar page when using the button "Share/Integrate calendar (iCal)", there the QR-Codes contains the Share-URL (which is displayed in the textbox above)
+- The output of the following endpoints can now be filtered (by any field), ordered and paginated (thanks for the initial work on this @fipwmaqzufheoxq92ebc)
+  - `/objects/{entity}`
+  - `/stock/products/{productId}/entries`
+  - `/stock/products/{productId}/locations`
+  - `/recipes/fulfillment`
+  - `/users`
+  - `/tasks`
+  - `/chores`
+  - `/batteries`
+  - There are 4 new (optional) query parameters to utilize that
+    - `order` The field to order by (use the separator `:` to specify the sort order - `asc` or `desc`, defaults to `asc` when omitted)
+    - `limit` The maximum number of objects to return
+    - `offset` The number of objects to skip
+    - `query[]` An array of conditions, each of them is a string in the form of `<field><condition><value>`, where
+      - `<field>` is a field name
+      - `<condition>` is a comparison operator, one of
+        - `=` equal
+		- `!=` not equal
+        - `~` LIKE
+        - `!~` not LIKE
+        - `<` less
+        - `>` greater
+        - `<=` less or equal
+        - `>=` greater or equal
+        - `§` regular expression
+      - `<value>` is the value to search for
+- New endpoint `/stock/shoppinglist/add-overdue-products` to add all currently in-stock but overdue products to a shopping list (thanks @m-byte)
+- New endpoint `/stock/shoppinglist/add-expired-products` to add all currently in-stock but expired products to a shopping list
+- New endpoints GET/POST/PUT `/users/{userId}/permissions` for the new user permissions feature mentioned above
+- New endpoint `/user` to get the currently authenticated user
+- New endpoint DELETE `/user/settings/{settingKey}` to delete a user setting
+- New endpoint POST `/stock/products/{productIdToKeep}/merge/{productIdToRemove}` for the new product merging feature mentioned above
+- The following entities are now also available via the endpoint `/objects/{entity}` (only listing, no edit)
+  - `stock_log` (the stock journal)
+  - `stock` (the "raw" stock entries)
+  - `stock_current_locations` (info how much of each product is currently stored at which location)
+- Performance improvements of the `/stock/products/*` endpoints (thanks @fipwmaqzufheoxq92ebc)
+- The endpoint `/stock/products/{productId}/locations` now also has an optional query parameter `include_sub_products` to optionally also return locations of sub products of the given product
+- The following endpoints  now have an optional request body parameter `allow_subproduct_substitution` to consume/open any child product when the given product is a parent product and currently not in stock
+  - `/stock/products/{productId}/consume`
+  - `/stock/products/by-barcode/{barcode}/consume`
+  - `/stock/products/{productId}/open`
+  - `/stock/products/by-barcode/{barcode}/open`
+- Fixed that the endpoint `/objects/{entity}/{objectId}` always returned successfully, even when the given object not exists (now returns `404` when the object is not found) (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that the endpoint `/stock/volatile` didn't include products which are due today (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that the endpoint `/objects/{entity}` did not include Userfields for Userentities (so the effective endpoint `/objects/userobjects`)
+- Fixed that the endpoint `/stock/consume` returned the response code `200` and an empty response body when `stock_entry_id` was set (consuming a specific stock entry) but invalid (now returns the response code `400`) (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that the endpoint `/user/settings/{settingKey}` didn't return the default setting if it was not configured for the current user (same behavior as the endpoint `/user/settings` now)
+- Endpoint `/calendar/ical`: Fixed that "Track date only"-chores were always set to happen at 12am (are treated as all-day events now)
+- Fixed (again) that CORS was broken

changelog/6_1.0.1_2017-04-20.md

@@ -0,0 +1 @@
+- Added flow to directly add products and barcodes from purchase and inventory view

changelog/7_1.1.0_2017-04-21.md

@@ -0,0 +1,2 @@
+* New feature: Shopping list (which is also automatically filled based on defined min. stock amount)
+* Small UI changes for better productivity

changelog/8_1.2.0_2017-04-21.md

@@ -0,0 +1 @@
+- Added a flow to add a new product with prefilled barcode

changelog/9_1.3.0_2017-04-22.md

@@ -0,0 +1 @@
+- Added a favicon and more productivity improvements

composer.json

@@ -1,10 +1,17 @@
 {
 	"require": {
 		"php": ">=7.2",
-		"slim/slim": "^3.8",
-		"morris/lessql": "^0.3.4",
+		"slim/slim": "^4.0",
+		"slim/psr7": "^1.0",
+		"slim/http": "^1.0",
+		"php-di/php-di": "^6.0",
 		"rubellum/slim-blade-view": "^0.1.1",
-		"tuupola/cors-middleware": "^0.7.0"
+		"morris/lessql": "^0.4.1",
+		"gettext/gettext": "^4.8",
+		"eluceo/ical": "^0.16.0",
+		"erusev/parsedown": "^1.7",
+		"gumlet/php-image-resize": "^1.9",
+		"ezyang/htmlpurifier": "^4.13"
 	},
 	"autoload": {
 		"psr-4": {

config-dist.php

@@ -1,47 +1,188 @@
 <?php
 
-# Either "production", "dev" or "prerelease"
+// Settings can also be overwritten in two ways
+//
+// First priority
+// A .txt file with the same name as the setting in /data/settingoverrides
+// the content of the file is used as the setting value
+//
+// Second priority
+// An environment variable with the same name as the setting and prefix "GROCY_"
+// so for example "GROCY_BASE_URL"
+//
+// Third priority
+// The settings defined here below
+
+// Either "production", "dev", "demo" or "prerelease"
+// When not "production", authentication will be disabled and
+// demo data will be populated during database migrations
 Setting('MODE', 'production');
 
-# Either "en" or "de" or the filename (without extension) of
-# one of the other available localization files in the "/localization" directory
-Setting('CULTURE', 'en');
+// Either "en" or "de" or the directory name of
+// one of the other available localization folders in the "/localization" directory
+Setting('DEFAULT_LOCALE', 'en');
 
-# To keep it simple: grocy does not handle any currency conversions,
-# this here is used to format all money values,
-# so can be anything (e. g. "USD" OR "$", doesn't matter...)
-Setting('CURRENCY', '$');
+// This is used to define the first day of a week for calendar views in the frontend,
+// leave empty to use the locale default
+// Needs to be a number where Sunday = 0, Monday = 1 and so forth
+Setting('CALENDAR_FIRST_DAY_OF_WEEK', '');
 
-# The base url of your installation,
-# should be just "/" when running directly under the root of a (sub)domain
-# or for example "https:/example.com/grocy" when using a subdirectory
+// If calendars should show week numbers
+Setting('CALENDAR_SHOW_WEEK_OF_YEAR', true);
+
+// To keep it simple: grocy does not handle any currency conversions,
+// this here is used to format all money values,
+// so doesn't really matter, but should be the
+// ISO 4217 code of the currency ("USD", "EUR", "GBP", etc.)
+Setting('CURRENCY', 'USD');
+
+// When running grocy in a subdirectory, this should be set to the relative path, otherwise empty
+// It needs to be set to the part (of the URL) after the document root,
+// if URL rewriting is disabled, including index.php
+// Example with URL Rewriting support:
+//  Root URL = https://example.com/grocy
+//  => BASE_PATH = /grocy
+// Example without URL Rewriting support:
+//  Root URL = https://example.com/grocy/public/index.php/
+//  => BASE_PATH = /grocy/public/index.php
+Setting('BASE_PATH', '');
+
+// The base URL of your installation,
+// should be just "/" when running directly under the root of a (sub)domain
+// or for example "https://example.com/grocy" when using a subdirectory
 Setting('BASE_URL', '/');
 
-# The plugin to use for external barcode lookups,
-# must be the filename without .php extension and must be located in /data/plugins,
-# see /data/plugins/DemoBarcodeLookupPlugin.php for an example implementation
+// The plugin to use for external barcode lookups,
+// must be the filename without .php extension and must be located in /data/plugins,
+// see /data/plugins/DemoBarcodeLookupPlugin.php for an example implementation
 Setting('STOCK_BARCODE_LOOKUP_PLUGIN', 'DemoBarcodeLookupPlugin');
 
-# If, however, your webserver does not support URL rewriting,
-# set this to true
+// If, however, your webserver does not support URL rewriting, set this to true
 Setting('DISABLE_URL_REWRITING', false);
 
+// Specify an custom homepage if desired - by default the homepage will be set to the stock overview page,
+// this needs to be one of the following values:
+// stock, shoppinglist, recipes, chores, tasks, batteries, equipment, calendar, mealplan
+Setting('ENTRY_PAGE', 'stock');
 
-# Default user settings
-# These settings can be changed per user, here the defaults
-# are defined which are used when the user has not changed the setting so far
+// Set this to true if you want to disable authentication / the login screen,
+// places where user context is needed will then use the default (first existing) user
+Setting('DISABLE_AUTH', false);
 
-# Night mode related
+// Either "Grocy\Middleware\DefaultAuthMiddleware", "Grocy\Middleware\ReverseProxyAuthMiddleware"
+// or any class that implements Grocy\Middleware\AuthMiddleware
+Setting('AUTH_CLASS', 'Grocy\Middleware\DefaultAuthMiddleware');
+
+// When using ReverseProxyAuthMiddleware,
+// the name of the HTTP header which your reverse proxy uses to pass the username (on successful authentication)
+Setting('REVERSE_PROXY_AUTH_HEADER', 'REMOTE_USER');
+
+// When using LdapAuthMiddleware
+Setting('LDAP_DOMAIN', ''); // Example value "local"
+Setting('LDAP_ADDRESS', ''); // Example value "ldap://vm-dc2019.local.berrnd.net"
+Setting('LDAP_BASE_DN', ''); // Example value "OU=OU_Users,DC=local,DC=berrnd,DC=net"
+
+// Set this to true if you want to disable the ability to scan a barcode via the device camera (Browser API)
+Setting('DISABLE_BROWSER_BARCODE_CAMERA_SCANNING', false);
+
+// Set this if you want to have a different start day for the weekly meal plan view,
+// leave empty to use CALENDAR_FIRST_DAY_OF_WEEK (see above)
+// Needs to be a number where Sunday = 0, Monday = 1 and so forth
+Setting('MEAL_PLAN_FIRST_DAY_OF_WEEK', '');
+
+// Default permissions for new users
+// the array needs to contain the technical/constant names
+// see the file controllers/Users/User.php for possible values
+Setting('DEFAULT_PERMISSIONS', ['ADMIN']);
+
+// Default user settings
+// These settings can be changed per user, here the defaults
+// are defined which are used when the user has not changed the setting so far
+
+// Night mode related
 DefaultUserSetting('night_mode_enabled', false); // If night mode is enabled always
 DefaultUserSetting('auto_night_mode_enabled', false); // If night mode is enabled automatically when inside a given time range (see the two settings below)
-DefaultUserSetting('auto_night_mode_time_range_from', "20:00"); // Format HH:mm
-DefaultUserSetting('auto_night_mode_time_range_to', "07:00"); // Format HH:mm
+DefaultUserSetting('auto_night_mode_time_range_from', '20:00'); // Format HH:mm
+DefaultUserSetting('auto_night_mode_time_range_to', '07:00'); // Format HH:mm
 DefaultUserSetting('auto_night_mode_time_range_goes_over_midnight', true); // If the time range above goes over midnight
 DefaultUserSetting('currently_inside_night_mode_range', false); // If we're currently inside of night mode time range (this is not user configurable, but stored as a user setting because it's evaluated client side to be able to use the client time instead of the maybe different server time)
+
+// Keep screen on settings
+DefaultUserSetting('keep_screen_on', false); // Keep the screen always on
+DefaultUserSetting('keep_screen_on_when_fullscreen_card', false); // Keep the screen on when a "fullscreen-card" is displayed
+
+// Stock settings
 DefaultUserSetting('product_presets_location_id', -1); // Default location id for new products (-1 means no location is preset)
 DefaultUserSetting('product_presets_product_group_id', -1); // Default product group id for new products (-1 means no product group is preset)
 DefaultUserSetting('product_presets_qu_id', -1); // Default quantity unit id for new products (-1 means no quantity unit is preset)
+DefaultUserSetting('stock_decimal_places_amounts', 4); // Default decimal places allowed for amounts
+DefaultUserSetting('stock_decimal_places_prices', 2); // Default decimal places allowed for prices
+DefaultUserSetting('stock_due_soon_days', 5);
+DefaultUserSetting('stock_default_purchase_amount', 0);
+DefaultUserSetting('stock_default_consume_amount', 1);
+DefaultUserSetting('stock_default_consume_amount_use_quick_consume_amount', false);
+DefaultUserSetting('scan_mode_consume_enabled', false);
+DefaultUserSetting('scan_mode_purchase_enabled', false);
+DefaultUserSetting('show_icon_on_stock_overview_page_when_product_is_on_shopping_list', true);
+DefaultUserSetting('show_purchased_date_on_purchase', false); // Wheter the purchased date should be editable on purchase (defaults to today otherwise)
+DefaultUserSetting('show_warning_on_purchase_when_due_date_is_earlier_than_next', true); // Show a warning on purchase when the due date of the purchased product is earlier than the next due date in stock
 
-# If the page should be automatically reloaded when there was
-# an external change
+// Shopping list settings
+DefaultUserSetting('shopping_list_to_stock_workflow_auto_submit_when_prefilled', false); // Automatically do the booking using the last price and the amount of the shopping list item, if the product has "Default due days" set
+DefaultUserSetting('shopping_list_show_calendar', false);
+
+// Recipe settings
+DefaultUserSetting('recipe_ingredients_group_by_product_group', false); // Group recipe ingredients by their product group
+
+// Chores settings
+DefaultUserSetting('chores_due_soon_days', 5);
+
+// Batteries settings
+DefaultUserSetting('batteries_due_soon_days', 5);
+
+// Tasks settings
+DefaultUserSetting('tasks_due_soon_days', 5);
+
+// If the page should be automatically reloaded when there was
+// an external change
 DefaultUserSetting('auto_reload_on_db_change', true);
+
+// Show a clock in the header next to the logo or not
+DefaultUserSetting('show_clock_in_header', false);
+
+// Component configuration for Quagga2 - read https://github.com/ericblade/quagga2#configobject for details
+// Below is a generic good configuration,
+// for an iPhone 7 Plus, halfsample = true, patchsize = small, frequency = 5 yields very good results
+DefaultUserSetting('quagga2_numofworkers', 4);
+DefaultUserSetting('quagga2_halfsample', false);
+DefaultUserSetting('quagga2_patchsize', 'medium');
+DefaultUserSetting('quagga2_frequency', 10);
+DefaultUserSetting('quagga2_debug', true);
+
+// Feature flags
+// grocy was initially about "stock management for your household", many other things
+// came and still come by, because they are useful - here you can disable the parts
+// which you don't need to have a less cluttered UI
+// (set the setting to "false" to disable the corresponding part, which should be self explanatory)
+Setting('FEATURE_FLAG_STOCK', true);
+Setting('FEATURE_FLAG_SHOPPINGLIST', true);
+Setting('FEATURE_FLAG_RECIPES', true);
+Setting('FEATURE_FLAG_CHORES', true);
+Setting('FEATURE_FLAG_TASKS', true);
+Setting('FEATURE_FLAG_BATTERIES', true);
+Setting('FEATURE_FLAG_EQUIPMENT', true);
+Setting('FEATURE_FLAG_CALENDAR', true);
+
+// Sub feature flags
+Setting('FEATURE_FLAG_STOCK_PRICE_TRACKING', true);
+Setting('FEATURE_FLAG_STOCK_LOCATION_TRACKING', true);
+Setting('FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_TRACKING', true);
+Setting('FEATURE_FLAG_STOCK_PRODUCT_OPENED_TRACKING', true);
+Setting('FEATURE_FLAG_STOCK_PRODUCT_FREEZING', true);
+Setting('FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_FIELD_NUMBER_PAD', true); // Activate the number pad in due date fields on (supported) mobile browsers
+Setting('FEATURE_FLAG_SHOPPINGLIST_MULTIPLE_LISTS', true);
+Setting('FEATURE_FLAG_CHORES_ASSIGNMENTS', true);
+
+// Feature settings
+Setting('FEATURE_SETTING_STOCK_COUNT_OPENED_PRODUCTS_AGAINST_MINIMUM_STOCK_AMOUNT', true); // When set to true, opened items will be counted as missing for calculating if a product is below its minimum stock amount
+Setting('FEATURE_FLAG_AUTO_TORCH_ON_WITH_CAMERA', true); // Enables the torch automaticaly (if the device has one)

controllers/BaseApiController.php

@@ -2,27 +2,145 @@
 
 namespace Grocy\Controllers;
 
+use LessQL\Result;
+
 class BaseApiController extends BaseController
 {
+	protected $OpenApiSpec = null;
 
-	public function __construct(\Slim\Container $container)
+	const PATTERN_FIELD = '[A-Za-z_][A-Za-z0-9_]+';
+	const PATTERN_OPERATOR = '!?(=|~|<|>|(>=)|(<=)|(§))';
+	const PATTERN_VALUE = '[A-Za-z_0-9.$#^|]+';
+
+	public function __construct(\DI\Container $container)
 	{
 		parent::__construct($container);
+	}
+
+	protected function ApiResponse(\Psr\Http\Message\ResponseInterface $response, $data)
+	{
+		$response->getBody()->write(json_encode($data));
+		return $response;
+	}
+
+	protected function EmptyApiResponse(\Psr\Http\Message\ResponseInterface $response, $status = 204)
+	{
+		return $response->withStatus($status);
+	}
+
+	protected function GenericErrorResponse(\Psr\Http\Message\ResponseInterface $response, $errorMessage, $status = 400)
+	{
+		return $response->withStatus($status)->withJson([
+			'error_message' => $errorMessage
+		]);
+	}
+
+	public function FilteredApiResponse(\Psr\Http\Message\ResponseInterface $response, Result $data, array $query)
+	{
+		$data = $this->queryData($data, $query);
+		return $this->ApiResponse($response, $data);
+	}
+
+	protected function queryData(Result $data, array $query)
+	{
+		if (isset($query['query']))
+		{
+			$data = $this->filter($data, $query['query']);
+		}
+
+		if (isset($query['limit']))
+		{
+			$data = $data->limit(intval($query['limit']), intval($query['offset'] ?? 0));
+		}
+
+		if (isset($query['order']))
+		{
+			$parts = explode(':', $query['order']);
+
+			if (count($parts) == 1)
+			{
+				$data = $data->orderBy($parts[0]);
+			}
+			else
+			{
+				if ($parts[1] != 'asc' && $parts[1] != 'desc')
+				{
+					throw new \Exception('Invalid sort order ' . $parts[1]);
+				}
+
+				$data = $data->orderBy($parts[0], $parts[1]);
+			}
+		}
+
+		return $data;
+	}
+
+	protected function filter(Result $data, array $query): Result
+	{
+		foreach ($query as $q)
+		{
+			$matches = [];
+			preg_match(
+				'/(?P<field>' . self::PATTERN_FIELD . ')'
+				. '(?P<op>' . self::PATTERN_OPERATOR . ')'
+				. '(?P<value>' . self::PATTERN_VALUE . ')/',
+				$q,
+				$matches
+			);
+
+			if (!array_key_exists('field', $matches) || !array_key_exists('op', $matches) || !array_key_exists('value', $matches))
+			{
+				throw new \Exception('Invalid query');
+			}
+
+			$sqlOrNull = '';
+			if (strtolower($matches['value']) == 'null')
+			{
+				$sqlOrNull = ' OR ' . $matches['field'] . ' IS NULL';
+			}
+
+			switch ($matches['op']) {
+				case '=':
+					$data = $data->where($matches['field'] . ' = ?' . $sqlOrNull, $matches['value']);
+					break;
+				case '!=':
+					$data = $data->where($matches['field'] . ' != ?' . $sqlOrNull, $matches['value']);
+					break;
+				case '~':
+					$data = $data->where($matches['field'] . ' LIKE ?', '%' . $matches['value'] . '%');
+					break;
+				case '!~':
+					$data = $data->where($matches['field'] . ' NOT LIKE ?', '%' . $matches['value'] . '%');
+					break;
+				case '<':
+					$data = $data->where($matches['field'] . ' < ?', $matches['value']);
+					break;
+				case '>':
+					$data = $data->where($matches['field'] . ' > ?', $matches['value']);
+					break;
+				case '>=':
+					$data = $data->where($matches['field'] . ' >= ?', $matches['value']);
+					break;
+				case '<=':
+					$data = $data->where($matches['field'] . ' <= ?', $matches['value']);
+					break;
+				case '§':
+					$data = $data->where($matches['field'] . ' REGEXP ?', $matches['value']);
+					break;
+
+			}
+		}
+
+		return $data;
+	}
+
+	protected function getOpenApispec()
+	{
+		if ($this->OpenApiSpec == null)
+		{
 			$this->OpenApiSpec = json_decode(file_get_contents(__DIR__ . '/../grocy.openapi.json'));
 		}
 
-	protected $OpenApiSpec;
-
-	protected function ApiResponse($data)
-	{
-		return json_encode($data);
-	}
-
-	protected function VoidApiActionResponse($response, $success = true, $status = 200, $errorMessage = '')
-	{
-		return $response->withStatus($status)->withJson(array(
-			'success' => $success,
-			'error_message' => $errorMessage
-		));
+		return $this->OpenApiSpec;
 	}
 }

controllers/BaseController.php

@@ -2,50 +2,180 @@
 
 namespace Grocy\Controllers;
 
-use \Grocy\Services\DatabaseService;
-use \Grocy\Services\ApplicationService;
-use \Grocy\Services\LocalizationService;
-use \Grocy\Services\UsersService;
+use Grocy\Controllers\Users\User;
+use Grocy\Services\ApiKeyService;
+use Grocy\Services\ApplicationService;
+use Grocy\Services\BatteriesService;
+use Grocy\Services\CalendarService;
+use Grocy\Services\ChoresService;
+use Grocy\Services\DatabaseService;
+use Grocy\Services\FilesService;
+use Grocy\Services\LocalizationService;
+use Grocy\Services\RecipesService;
+use Grocy\Services\SessionService;
+use Grocy\Services\StockService;
+use Grocy\Services\TasksService;
+use Grocy\Services\UserfieldsService;
+use Grocy\Services\UsersService;
 
 class BaseController
 {
-	public function __construct(\Slim\Container $container) {
-		$databaseService = new DatabaseService();
-		$this->Database = $databaseService->GetDbConnection();
+	protected $AppContainer;
 
-		$localizationService = new LocalizationService(GROCY_CULTURE);
-		$this->LocalizationService = $localizationService;
-
-		if (GROCY_MODE === 'prerelease')
+	public function __construct(\DI\Container $container)
 	{
-			$commitHash = trim(exec('git log --pretty="%h" -n1 HEAD'));
-			$commitDate = trim(exec('git log --date=iso --pretty="%cd" -n1 HEAD'));
+		$this->AppContainer = $container;
+		$this->View = $container->get('view');
+	}
 
-			$container->view->set('version', "pre-release-$commitHash");
-			$container->view->set('releaseDate', \substr($commitDate, 0, 19));
+	protected function getApiKeyService()
+	{
+		return ApiKeyService::getInstance();
+	}
+
+	protected function getApplicationservice()
+	{
+		return ApplicationService::getInstance();
+	}
+
+	protected function getBatteriesService()
+	{
+		return BatteriesService::getInstance();
+	}
+
+	protected function getCalendarService()
+	{
+		return CalendarService::getInstance();
+	}
+
+	protected function getChoresService()
+	{
+		return ChoresService::getInstance();
+	}
+
+	protected function getDatabase()
+	{
+		return $this->getDatabaseService()->GetDbConnection();
+	}
+
+	protected function getDatabaseService()
+	{
+		return DatabaseService::getInstance();
+	}
+
+	protected function getFilesService()
+	{
+		return FilesService::getInstance();
+	}
+
+	protected function getLocalizationService()
+	{
+		if (!defined('GROCY_LOCALE'))
+		{
+			define('GROCY_LOCALE', GROCY_DEFAULT_LOCALE);
+		}
+
+		return LocalizationService::getInstance(GROCY_LOCALE);
+	}
+
+	protected function getRecipesService()
+	{
+		return RecipesService::getInstance();
+	}
+
+	protected function getSessionService()
+	{
+		return SessionService::getInstance();
+	}
+
+	protected function getStockService()
+	{
+		return StockService::getInstance();
+	}
+
+	protected function getTasksService()
+	{
+		return TasksService::getInstance();
+	}
+
+	protected function getUserfieldsService()
+	{
+		return UserfieldsService::getInstance();
+	}
+
+	protected function getUsersService()
+	{
+		return UsersService::getInstance();
+	}
+
+	protected function render($response, $page, $data = [])
+	{
+		$container = $this->AppContainer;
+
+		$versionInfo = $this->getApplicationService()->GetInstalledVersion();
+		$this->View->set('version', $versionInfo->Version);
+		$this->View->set('releaseDate', $versionInfo->ReleaseDate);
+
+		$localizationService = $this->getLocalizationService();
+		$this->View->set('__t', function (string $text, ...$placeholderValues) use ($localizationService) {
+			return $localizationService->__t($text, $placeholderValues);
+		});
+		$this->View->set('__n', function ($number, $singularForm, $pluralForm) use ($localizationService) {
+			return $localizationService->__n($number, $singularForm, $pluralForm);
+		});
+		$this->View->set('GettextPo', $localizationService->GetPoAsJsonString());
+
+		// TODO: Better handle this generically based on the current language (header in .po file?)
+		$dir = 'ltr';
+		if (GROCY_LOCALE == 'he_IL')
+		{
+			$dir = 'rtl';
+		}
+		$this->View->set('dir', $dir);
+
+		$this->View->set('U', function ($relativePath, $isResource = false) use ($container) {
+			return $container->get('UrlManager')->ConstructUrl($relativePath, $isResource);
+		});
+
+		$embedded = false;
+		if (isset($_GET['embedded']))
+		{
+			$embedded = true;
+		}
+		$this->View->set('embedded', $embedded);
+
+		$constants = get_defined_constants();
+		foreach ($constants as $constant => $value)
+		{
+			if (substr($constant, 0, 19) !== 'GROCY_FEATURE_FLAG_')
+			{
+				unset($constants[$constant]);
+			}
+		}
+
+		$this->View->set('featureFlags', $constants);
+		if (GROCY_AUTHENTICATED)
+		{
+			$this->View->set('permissions', User::PermissionList());
+		}
+
+		return $this->View->render($response, $page, $data);
+	}
+
+	protected function renderPage($response, $page, $data = [])
+	{
+		$this->View->set('userentitiesForSidebar', $this->getDatabase()->userentities()->where('show_in_sidebar_menu = 1')->orderBy('name'));
+		try
+		{
+			$usersService = $this->getUsersService();
+
+			if (defined('GROCY_USER_ID'))
+			{
+				$this->View->set('userSettings', $usersService->GetUserSettings(GROCY_USER_ID));
 			}
 			else
 			{
-			$applicationService = new ApplicationService();
-			$versionInfo = $applicationService->GetInstalledVersion();
-			$container->view->set('version', $versionInfo->Version);
-			$container->view->set('releaseDate', $versionInfo->ReleaseDate);
-		}
-
-		$container->view->set('localizationStrings', $localizationService->GetCurrentCultureLocalizations());
-		$container->view->set('L', function($text, ...$placeholderValues) use($localizationService)
-		{
-			return $localizationService->Localize($text, ...$placeholderValues);
-		});
-		$container->view->set('U', function($relativePath, $isResource = false) use($container)
-		{
-			return $container->UrlManager->ConstructUrl($relativePath, $isResource);
-		});
-
-		try {
-			$usersService = new UsersService();
-			if (defined('GROCY_USER_ID')) {
-				$container->view->set('userSettings', $usersService->GetUserSettings(GROCY_USER_ID));
+				$this->View->set('userSettings', null);
 			}
 		}
 		catch (\Exception $ex)
@@ -53,10 +183,29 @@ class BaseController
 			// Happens when database is not initialised or migrated...
 		}
 
-		$this->AppContainer = $container;
+		return $this->render($response, $page, $data);
 	}
 
-	protected $AppContainer;
-	protected $Database;
-	protected $LocalizationService;
+	private static $htmlPurifierInstance = null;
+
+	protected function GetParsedAndFilteredRequestBody($request)
+	{
+		if (self::$htmlPurifierInstance == null)
+		{
+			self::$htmlPurifierInstance = new \HTMLPurifier(\HTMLPurifier_Config::createDefault());
+		}
+
+		$requestBody = $request->getParsedBody();
+		foreach ($requestBody as $key => &$value)
+		{
+			// HTMLPurifier removes boolean values (true/false), so explicitly keep them
+			// Maybe also possible through HTMLPurifier config (http://htmlpurifier.org/live/configdoc/plain.html)
+			if (!is_bool($value))
+			{
+				$value = self::$htmlPurifierInstance->purify($value);
+			}
+		}
+
+		return $requestBody;
+	}
 }

controllers/BatteriesApiController.php

@@ -2,64 +2,68 @@
 
 namespace Grocy\Controllers;
 
-use \Grocy\Services\BatteriesService;
+use Grocy\Controllers\Users\User;
 
 class BatteriesApiController extends BaseApiController
 {
-	public function __construct(\Slim\Container $container)
+	public function BatteryDetails(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
-		parent::__construct($container);
-		$this->BatteriesService = new BatteriesService();
+		try
+		{
+			return $this->ApiResponse($response, $this->getBatteriesService()->GetBatteryDetails($args['batteryId']));
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
 	}
 
-	protected $BatteriesService;
+	public function Current(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		return $this->FilteredApiResponse($response, $this->getBatteriesService()->GetCurrent(), $request->getQueryParams());
+	}
 
-	public function TrackChargeCycle(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function TrackChargeCycle(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		User::checkPermission($request, User::PERMISSION_BATTERIES_TRACK_CHARGE_CYCLE);
+
+		$requestBody = $this->GetParsedAndFilteredRequestBody($request);
+
+		try
 		{
 			$trackedTime = date('Y-m-d H:i:s');
-		if (isset($request->getQueryParams()['tracked_time']) && !empty($request->getQueryParams()['tracked_time']) && IsIsoDateTime($request->getQueryParams()['tracked_time']))
+
+			if (array_key_exists('tracked_time', $requestBody) && IsIsoDateTime($requestBody['tracked_time']))
 			{
-			$trackedTime = $request->getQueryParams()['tracked_time'];
+				$trackedTime = $requestBody['tracked_time'];
 			}
 
-		try
-		{
-			$chargeCycleId = $this->BatteriesService->TrackChargeCycle($args['batteryId'], $trackedTime);
-			return $this->ApiResponse(array('charge_cycle_id' => $chargeCycleId));
+			$chargeCycleId = $this->getBatteriesService()->TrackChargeCycle($args['batteryId'], $trackedTime);
+			return $this->ApiResponse($response, $this->getDatabase()->battery_charge_cycles($chargeCycleId));
 		}
 		catch (\Exception $ex)
 		{
-			return $this->VoidApiActionResponse($response, false, 400, $ex->getMessage());
+			return $this->GenericErrorResponse($response, $ex->getMessage());
 		}
 	}
 
-	public function BatteryDetails(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function UndoChargeCycle(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
+		User::checkPermission($request, User::PERMISSION_BATTERIES_UNDO_CHARGE_CYCLE);
+
 		try
 		{
-			return $this->ApiResponse($this->BatteriesService->GetBatteryDetails($args['batteryId']));
+			$this->ApiResponse($response, $this->getBatteriesService()->UndoChargeCycle($args['chargeCycleId']));
+			return $this->EmptyApiResponse($response);
 		}
 		catch (\Exception $ex)
 		{
-			return $this->VoidApiActionResponse($response, false, 400, $ex->getMessage());
+			return $this->GenericErrorResponse($response, $ex->getMessage());
 		}
 	}
 
-	public function Current(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function __construct(\DI\Container $container)
 	{
-		return $this->ApiResponse($this->BatteriesService->GetCurrent());
-	}
-
-	public function UndoChargeCycle(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		try
-		{
-			$this->ApiResponse($this->BatteriesService->UndoChargeCycle($args['chargeCycleId']));
-			return $this->ApiResponse(array('success' => true));
-		}
-		catch (\Exception $ex)
-		{
-			return $this->VoidApiActionResponse($response, false, 400, $ex->getMessage());
-		}
+		parent::__construct($container);
 	}
 }

controllers/BatteriesController.php

@@ -2,63 +2,81 @@
 
 namespace Grocy\Controllers;
 
-use \Grocy\Services\BatteriesService;
-
 class BatteriesController extends BaseController
 {
-	public function __construct(\Slim\Container $container)
+	public function BatteriesList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
-		parent::__construct($container);
-		$this->BatteriesService = new BatteriesService();
+		if (isset($request->getQueryParams()['include_disabled']))
+		{
+			$batteries = $this->getDatabase()->batteries()->orderBy('name', 'COLLATE NOCASE');
+		}
+		else
+		{
+			$batteries = $this->getDatabase()->batteries()->where('active = 1')->orderBy('name', 'COLLATE NOCASE');
 		}
 
-	protected $BatteriesService;
-
-	public function Overview(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		return $this->AppContainer->view->render($response, 'batteriesoverview', [
-			'batteries' => $this->Database->batteries()->orderBy('name'),
-			'current' => $this->BatteriesService->GetCurrent(),
-			'nextXDays' => 5
+		return $this->renderPage($response, 'batteries', [
+			'batteries' => $batteries,
+			'userfields' => $this->getUserfieldsService()->GetFields('batteries'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('batteries')
 		]);
 	}
 
-	public function TrackChargeCycle(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function BatteriesSettings(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
-		return $this->AppContainer->view->render($response, 'batterytracking', [
-			'batteries' =>  $this->Database->batteries()->orderBy('name')
-		]);
+		return $this->renderPage($response, 'batteriessettings');
 	}
 
-	public function BatteriesList(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		return $this->AppContainer->view->render($response, 'batteries', [
-			'batteries' => $this->Database->batteries()->orderBy('name')
-		]);
-	}
-
-	public function BatteryEditForm(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function BatteryEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
 		if ($args['batteryId'] == 'new')
 		{
-			return $this->AppContainer->view->render($response, 'batteryform', [
-				'mode' => 'create'
+			return $this->renderPage($response, 'batteryform', [
+				'mode' => 'create',
+				'userfields' => $this->getUserfieldsService()->GetFields('batteries')
 			]);
 		}
 		else
 		{
-			return $this->AppContainer->view->render($response, 'batteryform', [
-				'battery' =>  $this->Database->batteries($args['batteryId']),
-				'mode' => 'edit'
+			return $this->renderPage($response, 'batteryform', [
+				'battery' => $this->getDatabase()->batteries($args['batteryId']),
+				'mode' => 'edit',
+				'userfields' => $this->getUserfieldsService()->GetFields('batteries')
 			]);
 		}
 	}
 
-	public function Journal(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function Journal(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
-		return $this->AppContainer->view->render($response, 'batteriesjournal', [
-			'chargeCycles' => $this->Database->battery_charge_cycles()->orderBy('tracked_time', 'DESC'),
-			'batteries' => $this->Database->batteries()->orderBy('name')
+		return $this->renderPage($response, 'batteriesjournal', [
+			'chargeCycles' => $this->getDatabase()->battery_charge_cycles()->orderBy('tracked_time', 'DESC'),
+			'batteries' => $this->getDatabase()->batteries()->where('active = 1')->orderBy('name', 'COLLATE NOCASE')
 		]);
 	}
+
+	public function Overview(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		$usersService = $this->getUsersService();
+		$nextXDays = $usersService->GetUserSettings(GROCY_USER_ID)['batteries_due_soon_days'];
+
+		return $this->renderPage($response, 'batteriesoverview', [
+			'batteries' => $this->getDatabase()->batteries()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'current' => $this->getBatteriesService()->GetCurrent(),
+			'nextXDays' => $nextXDays,
+			'userfields' => $this->getUserfieldsService()->GetFields('batteries'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('batteries')
+		]);
+	}
+
+	public function TrackChargeCycle(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		return $this->renderPage($response, 'batterytracking', [
+			'batteries' => $this->getDatabase()->batteries()->where('active = 1')->orderBy('name', 'COLLATE NOCASE')
+		]);
+	}
+
+	public function __construct(\DI\Container $container)
+	{
+		parent::__construct($container);
+	}
 }

controllers/CalendarApiController.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace Grocy\Controllers;
+
+class CalendarApiController extends BaseApiController
+{
+	public function Ical(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		try
+		{
+			$vCalendar = new \Eluceo\iCal\Component\Calendar('grocy');
+
+			$events = $this->getCalendarService()->GetEvents();
+
+			foreach ($events as $event)
+			{
+				$date = new \DateTime($event['start']);
+				$date->setTimezone(new \DateTimeZone(date_default_timezone_get()));
+
+				if ($event['date_format'] === 'date')
+				{
+					$date->setTime(23, 59, 59);
+				}
+
+				$description = '';
+				if (isset($event['description']))
+				{
+					$description = $event['description'];
+				}
+
+				$vEvent = new \Eluceo\iCal\Component\Event();
+				$vEvent->setDtStart($date)
+					->setDtEnd($date)
+					->setSummary($event['title'])
+					->setDescription($description)
+					->setNoTime($event['date_format'] === 'date' || (isset($event['allDay']) && $event['allDay']))
+					->setUseTimezone(true);
+
+				$vCalendar->addComponent($vEvent);
+			}
+
+			$response->write($vCalendar->render());
+			$response = $response->withHeader('Content-Type', 'text/calendar; charset=utf-8');
+			return $response->withHeader('Content-Disposition', 'attachment; filename="grocy.ics"');
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function IcalSharingLink(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		try
+		{
+			return $this->ApiResponse($response, [
+				'url' => $this->AppContainer->get('UrlManager')->ConstructUrl('/api/calendar/ical?secret=' . $this->getApiKeyService()->GetOrCreateApiKey(\Grocy\Services\ApiKeyService::API_KEY_TYPE_SPECIAL_PURPOSE_CALENDAR_ICAL))
+			]);
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function __construct(\DI\Container $container)
+	{
+		parent::__construct($container);
+	}
+}

controllers/CalendarController.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Grocy\Controllers;
+
+class CalendarController extends BaseController
+{
+	public function Overview(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		return $this->renderPage($response, 'calendar', [
+			'fullcalendarEventSources' => $this->getCalendarService()->GetEvents()
+		]);
+	}
+
+	public function __construct(\DI\Container $container)
+	{
+		parent::__construct($container);
+	}
+}

controllers/ChoresApiController.php

@@ -2,70 +2,114 @@
 
 namespace Grocy\Controllers;
 
-use \Grocy\Services\ChoresService;
+use Grocy\Controllers\Users\User;
 
 class ChoresApiController extends BaseApiController
 {
-	public function __construct(\Slim\Container $container)
+	public function CalculateNextExecutionAssignments(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
-		parent::__construct($container);
-		$this->ChoresService = new ChoresService();
+		try
+		{
+			$requestBody = $this->GetParsedAndFilteredRequestBody($request);
+
+			$choreId = null;
+
+			if (array_key_exists('chore_id', $requestBody) && !empty($requestBody['chore_id']) && is_numeric($requestBody['chore_id']))
+			{
+				$choreId = intval($requestBody['chore_id']);
 			}
 
-	protected $ChoresService;
+			if ($choreId === null)
+			{
+				$chores = $this->getDatabase()->chores();
+				foreach ($chores as $chore)
+				{
+					$this->getChoresService()->CalculateNextExecutionAssignment($chore->id);
+				}
+			}
+			else
+			{
+				$this->getChoresService()->CalculateNextExecutionAssignment($choreId);
+			}
 
-	public function TrackChoreExecution(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+			return $this->EmptyApiResponse($response);
+		}
+		catch (\Exception $ex)
 		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function ChoreDetails(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		try
+		{
+			return $this->ApiResponse($response, $this->getChoresService()->GetChoreDetails($args['choreId']));
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function Current(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		return $this->FilteredApiResponse($response, $this->getChoresService()->GetCurrent(), $request->getQueryParams());
+	}
+
+	public function TrackChoreExecution(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		$requestBody = $this->GetParsedAndFilteredRequestBody($request);
+
+		try
+		{
+			User::checkPermission($request, User::PERMISSION_CHORE_TRACK_EXECUTION);
+
 			$trackedTime = date('Y-m-d H:i:s');
-		if (isset($request->getQueryParams()['tracked_time']) && !empty($request->getQueryParams()['tracked_time']) && IsIsoDateTime($request->getQueryParams()['tracked_time']))
+
+			if (array_key_exists('tracked_time', $requestBody) && (IsIsoDateTime($requestBody['tracked_time']) || IsIsoDate($requestBody['tracked_time'])))
 			{
-			$trackedTime = $request->getQueryParams()['tracked_time'];
+				$trackedTime = $requestBody['tracked_time'];
 			}
 
 			$doneBy = GROCY_USER_ID;
-		if (isset($request->getQueryParams()['done_by']) && !empty($request->getQueryParams()['done_by']))
+
+			if (array_key_exists('done_by', $requestBody) && !empty($requestBody['done_by']))
 			{
-			$doneBy = $request->getQueryParams()['done_by'];
+				$doneBy = $requestBody['done_by'];
 			}
 
-		try
+			if ($doneBy != GROCY_USER_ID)
 			{
-			$choreExecutionId = $this->ChoresService->TrackChore($args['choreId'], $trackedTime, $doneBy);
-			return $this->ApiResponse(array('chore_execution_id' => $choreExecutionId));
+				User::checkPermission($request, User::PERMISSION_CHORE_TRACK_EXECUTION_EXECUTION);
+			}
+
+			$choreExecutionId = $this->getChoresService()->TrackChore($args['choreId'], $trackedTime, $doneBy);
+			return $this->ApiResponse($response, $this->getDatabase()->chores_log($choreExecutionId));
 		}
 		catch (\Exception $ex)
 		{
-			return $this->VoidApiActionResponse($response, false, 400, $ex->getMessage());
+			return $this->GenericErrorResponse($response, $ex->getMessage());
 		}
 	}
 
-	public function ChoreDetails(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function UndoChoreExecution(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
 		try
 		{
-			return $this->ApiResponse($this->ChoresService->GetChoreDetails($args['choreId']));
+			User::checkPermission($request, User::PERMISSION_CHORE_UNDO_EXECUTION);
+
+			$this->ApiResponse($response, $this->getChoresService()->UndoChoreExecution($args['executionId']));
+			return $this->EmptyApiResponse($response);
 		}
 		catch (\Exception $ex)
 		{
-			return $this->VoidApiActionResponse($response, false, 400, $ex->getMessage());
+			return $this->GenericErrorResponse($response, $ex->getMessage());
 		}
 	}
 
-	public function Current(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function __construct(\DI\Container $container)
 	{
-		return $this->ApiResponse($this->ChoresService->GetCurrent());
-	}
-
-	public function UndoChoreExecution(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		try
-		{
-			$this->ApiResponse($this->ChoresService->UndoChoreExecution($args['executionId']));
-			return $this->ApiResponse(array('success' => true));
-		}
-		catch (\Exception $ex)
-		{
-			return $this->VoidApiActionResponse($response, false, 400, $ex->getMessage());
-		}
+		parent::__construct($container);
 	}
 }

controllers/ChoresController.php

@@ -2,67 +2,95 @@
 
 namespace Grocy\Controllers;
 
-use \Grocy\Services\ChoresService;
-
 class ChoresController extends BaseController
 {
-	public function __construct(\Slim\Container $container)
+	public function ChoreEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
-		parent::__construct($container);
-		$this->ChoresService = new ChoresService();
-	}
+		$usersService = $this->getUsersService();
+		$users = $usersService->GetUsersAsDto();
 
-	protected $ChoresService;
-
-	public function Overview(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		return $this->AppContainer->view->render($response, 'choresoverview', [
-			'chores' => $this->Database->chores()->orderBy('name'),
-			'currentChores' => $this->ChoresService->GetCurrent(),
-			'nextXDays' => 5
-		]);
-	}
-
-	public function TrackChoreExecution(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		return $this->AppContainer->view->render($response, 'choretracking', [
-			'chores' => $this->Database->chores()->orderBy('name'),
-			'users' => $this->Database->users()->orderBy('username')
-		]);
-	}
-
-	public function ChoresList(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		return $this->AppContainer->view->render($response, 'chores', [
-			'chores' => $this->Database->chores()->orderBy('name')
-		]);
-	}
-
-	public function Journal(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		return $this->AppContainer->view->render($response, 'choresjournal', [
-			'choresLog' => $this->Database->chores_log()->orderBy('tracked_time', 'DESC'),
-			'chores' => $this->Database->chores()->orderBy('name'),
-			'users' => $this->Database->users()->orderBy('username')
-		]);
-	}
-
-	public function ChoreEditForm(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
 		if ($args['choreId'] == 'new')
 		{
-			return $this->AppContainer->view->render($response, 'choreform', [
-				'periodTypes' => GetClassConstants('\Grocy\Services\ChoresService'),
-				'mode' => 'create'
+			return $this->renderPage($response, 'choreform', [
+				'periodTypes' => GetClassConstants('\Grocy\Services\ChoresService', 'CHORE_PERIOD_TYPE_'),
+				'mode' => 'create',
+				'userfields' => $this->getUserfieldsService()->GetFields('chores'),
+				'assignmentTypes' => GetClassConstants('\Grocy\Services\ChoresService', 'CHORE_ASSIGNMENT_TYPE_'),
+				'users' => $users,
+				'products' => $this->getDatabase()->products()->orderBy('name', 'COLLATE NOCASE')
 			]);
 		}
 		else
 		{
-			return $this->AppContainer->view->render($response, 'choreform', [
-				'chore' =>  $this->Database->chores($args['choreId']),
-				'periodTypes' => GetClassConstants('\Grocy\Services\ChoresService'),
-				'mode' => 'edit'
+			return $this->renderPage($response, 'choreform', [
+				'chore' => $this->getDatabase()->chores($args['choreId']),
+				'periodTypes' => GetClassConstants('\Grocy\Services\ChoresService', 'CHORE_PERIOD_TYPE_'),
+				'mode' => 'edit',
+				'userfields' => $this->getUserfieldsService()->GetFields('chores'),
+				'assignmentTypes' => GetClassConstants('\Grocy\Services\ChoresService', 'CHORE_ASSIGNMENT_TYPE_'),
+				'users' => $users,
+				'products' => $this->getDatabase()->products()->orderBy('name', 'COLLATE NOCASE')
 			]);
 		}
 	}
+
+	public function ChoresList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		if (isset($request->getQueryParams()['include_disabled']))
+		{
+			$chores = $this->getDatabase()->chores()->orderBy('name', 'COLLATE NOCASE');
+		}
+		else
+		{
+			$chores = $this->getDatabase()->chores()->where('active = 1')->orderBy('name', 'COLLATE NOCASE');
+		}
+
+		return $this->renderPage($response, 'chores', [
+			'chores' => $chores,
+			'userfields' => $this->getUserfieldsService()->GetFields('chores'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('chores')
+		]);
+	}
+
+	public function ChoresSettings(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		return $this->renderPage($response, 'choressettings');
+	}
+
+	public function Journal(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		return $this->renderPage($response, 'choresjournal', [
+			'choresLog' => $this->getDatabase()->chores_log()->orderBy('tracked_time', 'DESC'),
+			'chores' => $this->getDatabase()->chores()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'users' => $this->getDatabase()->users()->orderBy('username')
+		]);
+	}
+
+	public function Overview(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		$usersService = $this->getUsersService();
+		$nextXDays = $usersService->GetUserSettings(GROCY_USER_ID)['chores_due_soon_days'];
+
+		return $this->renderPage($response, 'choresoverview', [
+			'chores' => $this->getDatabase()->chores()->orderBy('name', 'COLLATE NOCASE'),
+			'currentChores' => $this->getChoresService()->GetCurrent(),
+			'nextXDays' => $nextXDays,
+			'userfields' => $this->getUserfieldsService()->GetFields('chores'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('chores'),
+			'users' => $usersService->GetUsersAsDto()
+		]);
+	}
+
+	public function TrackChoreExecution(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		return $this->renderPage($response, 'choretracking', [
+			'chores' => $this->getDatabase()->chores()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'users' => $this->getDatabase()->users()->orderBy('username')
+		]);
+	}
+
+	public function __construct(\DI\Container $container)
+	{
+		parent::__construct($container);
+	}
 }

controllers/EquipmentController.php

@@ -2,30 +2,40 @@
 
 namespace Grocy\Controllers;
 
-
 class EquipmentController extends BaseController
 {
-	public function Overview(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		return $this->AppContainer->view->render($response, 'equipment', [
-			'equipment' => $this->Database->equipment()->orderBy('name')
-		]);
-	}
+	protected $UserfieldsService;
 
-	public function EditForm(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function EditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
 		if ($args['equipmentId'] == 'new')
 		{
-			return $this->AppContainer->view->render($response, 'equipmentform', [
-				'mode' => 'create'
+			return $this->renderPage($response, 'equipmentform', [
+				'mode' => 'create',
+				'userfields' => $this->getUserfieldsService()->GetFields('equipment')
 			]);
 		}
 		else
 		{
-			return $this->AppContainer->view->render($response, 'equipmentform', [
-				'equipment' =>  $this->Database->equipment($args['equipmentId']),
-				'mode' => 'edit'
+			return $this->renderPage($response, 'equipmentform', [
+				'equipment' => $this->getDatabase()->equipment($args['equipmentId']),
+				'mode' => 'edit',
+				'userfields' => $this->getUserfieldsService()->GetFields('equipment')
 			]);
 		}
 	}
+
+	public function Overview(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		return $this->renderPage($response, 'equipment', [
+			'equipment' => $this->getDatabase()->equipment()->orderBy('name', 'COLLATE NOCASE'),
+			'userfields' => $this->getUserfieldsService()->GetFields('equipment'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('equipment')
+		]);
+	}
+
+	public function __construct(\DI\Container $container)
+	{
+		parent::__construct($container);
+	}
 }

controllers/ExceptionController.php

@@ -0,0 +1,80 @@
+<?php
+
+namespace Grocy\Controllers;
+
+use Psr\Http\Message\ServerRequestInterface;
+use Psr\Log\LoggerInterface;
+use Slim\Exception\HttpException;
+use Slim\Exception\HttpForbiddenException;
+use Slim\Exception\HttpNotFoundException;
+use Throwable;
+
+class ExceptionController extends BaseApiController
+{
+	/**
+	 * @var \Slim\App
+	 */
+	private $app;
+
+	public function __construct(\Slim\App $app, \DI\Container $container)
+	{
+		parent::__construct($container);
+		$this->app = $app;
+	}
+
+	public function __invoke(ServerRequestInterface $request, Throwable $exception, bool $displayErrorDetails, bool $logErrors, bool $logErrorDetails, ?LoggerInterface $logger = null)
+	{
+		$response = $this->app->getResponseFactory()->createResponse();
+		$isApiRoute = string_starts_with($request->getUri()->getPath(), '/api/');
+
+		if (!defined('GROCY_AUTHENTICATED'))
+		{
+			define('GROCY_AUTHENTICATED', false);
+		}
+
+		if ($isApiRoute)
+		{
+			$status = 500;
+
+			if ($exception instanceof HttpException)
+			{
+				$status = $exception->getCode();
+			}
+
+			$data = [
+				'error_message' => $exception->getMessage()
+			];
+
+			if ($displayErrorDetails)
+			{
+				$data['error_details'] = [
+					'stack_trace' => $exception->getTraceAsString(),
+					'file' => $exception->getFile(),
+					'line' => $exception->getLine()
+				];
+			}
+
+			return $this->ApiResponse($response->withStatus($status)->withHeader('Content-Type', 'application/json'), $data);
+		}
+
+		if ($exception instanceof HttpNotFoundException)
+		{
+			define('GROCY_AUTHENTICATED', false);
+
+			return $this->renderPage($response->withStatus(404), 'errors/404', [
+				'exception' => $exception
+			]);
+		}
+
+		if ($exception instanceof HttpForbiddenException)
+		{
+			return $this->renderPage($response->withStatus(403), 'errors/403', [
+				'exception' => $exception
+			]);
+		}
+
+		return $this->renderPage($response->withStatus(500), 'errors/500', [
+			'exception' => $exception
+		]);
+	}
+}

controllers/FilesApiController.php

@@ -2,98 +2,171 @@
 
 namespace Grocy\Controllers;
 
-use \Grocy\Services\FilesService;
+use Grocy\Services\FilesService;
+use Slim\Exception\HttpNotFoundException;
 
 class FilesApiController extends BaseApiController
 {
-	public function __construct(\Slim\Container $container)
-	{
-		parent::__construct($container);
-		$this->FilesService = new FilesService();
-	}
-
-	protected $FilesService;
-
-	public function UploadFile(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function DeleteFile(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
 		try
 		{
-			if (isset($request->getQueryParams()['file_name']) && !empty($request->getQueryParams()['file_name']) && IsValidFileName($request->getQueryParams()['file_name']))
+			if (IsValidFileName(base64_decode($args['fileName'])))
 			{
-				$fileName = $request->getQueryParams()['file_name'];
+				$fileName = base64_decode($args['fileName']);
 			}
 			else
 			{
-				throw new \Exception('file_name query parameter missing or contains an invalid filename');
+				throw new \Exception('Invalid filename');
 			}
 
-			$data = $request->getBody()->getContents();
-			file_put_contents($this->FilesService->GetFilePath($args['group'], $fileName), $data);
+			$filePath = $this->getFilesService()->GetFilePath($args['group'], $fileName);
 
-			return $this->ApiResponse(array('success' => true));
-		}
-		catch (\Exception $ex)
-		{
-			return $this->VoidApiActionResponse($response, false, 400, $ex->getMessage());
-		}
-	}
-
-	public function ServeFile(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		try
-		{
-			if (isset($request->getQueryParams()['file_name']) && !empty($request->getQueryParams()['file_name']) && IsValidFileName($request->getQueryParams()['file_name']))
-			{
-				$fileName = $request->getQueryParams()['file_name'];
-			}
-			else
-			{
-				throw new \Exception('file_name query parameter missing or contains an invalid filename');
-			}
-
-			$filePath = $this->FilesService->GetFilePath($args['group'], $fileName);
-
-			if (file_exists($filePath))
-			{
-				$response->write(file_get_contents($filePath));
-				$response = $response->withHeader('Content-Type', mime_content_type($filePath));
-				return $response->withHeader('Content-Disposition', 'inline; filename="' . $fileName . '"');
-			}
-			else
-			{
-				return $this->VoidApiActionResponse($response, false, 404, 'File not found');
-			}
-		}
-		catch (\Exception $ex)
-		{
-			return $this->VoidApiActionResponse($response, false, 400, $ex->getMessage());
-		}
-	}
-
-	public function DeleteFile(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		try
-		{
-			if (isset($request->getQueryParams()['file_name']) && !empty($request->getQueryParams()['file_name']) && IsValidFileName($request->getQueryParams()['file_name']))
-			{
-				$fileName = $request->getQueryParams()['file_name'];
-			}
-			else
-			{
-				throw new \Exception('file_name query parameter missing or contains an invalid filename');
-			}
-
-			$filePath = $this->FilesService->GetFilePath($args['group'], $fileName);
 			if (file_exists($filePath))
 			{
 				unlink($filePath);
 			}
 
-			return $this->ApiResponse(array('success' => true));
+			return $this->EmptyApiResponse($response);
 		}
 		catch (\Exception $ex)
 		{
-			return $this->VoidApiActionResponse($response, false, 400, $ex->getMessage());
+			return $this->GenericErrorResponse($response, $ex->getMessage());
 		}
 	}
+
+	public function ServeFile(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		try
+		{
+			$fileName = $this->checkFileName($args['fileName']);
+
+			$filePath = $this->getFilePath($args['group'], $fileName, $request->getQueryParams());
+
+			if (file_exists($filePath))
+			{
+				$response->write(file_get_contents($filePath));
+				$response = $response->withHeader('Cache-Control', 'max-age=2592000');
+				$response = $response->withHeader('Content-Type', mime_content_type($filePath));
+				return $response->withHeader('Content-Disposition', 'inline; filename="' . $fileName . '"');
+			}
+			else
+			{
+				throw new HttpNotFoundException($request, 'File not found');
+			}
+		}
+		catch (\Exception $ex)
+		{
+			throw new HttpNotFoundException($request, $ex->getMessage(), $ex);
+		}
+	}
+
+	public function ShowFile(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		try
+		{
+			$fileInfo = explode('_', $args['fileName']);
+			$fileName = $this->checkFileName($fileInfo[1]);
+
+			$filePath = $this->getFilePath($args['group'], base64_decode($fileInfo[0]), $request->getQueryParams());
+
+			if (file_exists($filePath))
+			{
+				$response->write(file_get_contents($filePath));
+				$response = $response->withHeader('Cache-Control', 'max-age=2592000');
+				$response = $response->withHeader('Content-Type', mime_content_type($filePath));
+				return $response->withHeader('Content-Disposition', 'inline; filename="' . $fileName . '"');
+			}
+			else
+			{
+				throw new HttpNotFoundException($request, 'File not found');
+			}
+		}
+		catch (\Exception $ex)
+		{
+			throw new HttpNotFoundException($request, $ex->getMessage(), $ex);
+		}
+	}
+
+	public function UploadFile(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		try
+		{
+			$fileName = $this->checkFileName($args['fileName']);
+
+			$data = $request->getBody()->getContents();
+			file_put_contents($this->getFilesService()->GetFilePath($args['group'], $fileName), $data);
+
+			return $this->EmptyApiResponse($response);
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function __construct(\DI\Container $container)
+	{
+		parent::__construct($container);
+	}
+
+	/**
+	 * @param string $fileName base64-encoded file-name
+	 * @return false|string the decoded file-name
+	 * @throws \Exception if the file-name is invalid.
+	 */
+	protected function checkFileName(string $fileName)
+	{
+		if (IsValidFileName(base64_decode($fileName)))
+		{
+			$fileName = base64_decode($fileName);
+		}
+		else
+		{
+			throw new \Exception('Invalid filename');
+		}
+
+		return $fileName;
+	}
+
+	/**
+	 * @param string $group The group the requested files belongs to.
+	 * @param string $fileName The name of the requested file.
+	 * @param array $queryParams Parameter, e.g. for scaling. Optional.
+	 * @return string
+	 */
+	protected function getFilePath(string $group, string $fileName, array $queryParams = [])
+	{
+		$forceServeAs = null;
+
+		if (isset($queryParams['force_serve_as']) && !empty($queryParams['force_serve_as']))
+		{
+			$forceServeAs = $queryParams['force_serve_as'];
+		}
+
+		if ($forceServeAs == FilesService::FILE_SERVE_TYPE_PICTURE)
+		{
+			$bestFitHeight = null;
+
+			if (isset($queryParams['best_fit_height']) && !empty($queryParams['best_fit_height']) && is_numeric($queryParams['best_fit_height']))
+			{
+				$bestFitHeight = $queryParams['best_fit_height'];
+			}
+
+			$bestFitWidth = null;
+
+			if (isset($queryParams['best_fit_width']) && !empty($queryParams['best_fit_width']) && is_numeric($queryParams['best_fit_width']))
+			{
+				$bestFitWidth = $queryParams['best_fit_width'];
+			}
+
+			$filePath = $this->getFilesService()->DownscaleImage($group, $fileName, $bestFitHeight, $bestFitWidth);
+		}
+		else
+		{
+			$filePath = $this->getFilesService()->GetFilePath($group, $fileName);
+		}
+
+		return $filePath;
+	}
 }

controllers/GenericEntityApiController.php

@@ -2,84 +2,230 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Controllers\Users\User;
+use Slim\Exception\HttpBadRequestException;
+
 class GenericEntityApiController extends BaseApiController
 {
-	public function GetObjects(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function AddObject(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
-		if ($this->IsValidEntity($args['entity']) && !$this->IsEntityWithPreventedListing($args['entity']))
+		User::checkPermission($request, User::PERMISSION_MASTER_DATA_EDIT);
+
+		if ($this->IsValidExposedEntity($args['entity']) && !$this->IsEntityWithNoEdit($args['entity']))
 		{
-			return $this->ApiResponse($this->Database->{$args['entity']}());
-		}
-		else
+			if ($this->IsEntityWithEditRequiresAdmin($args['entity']))
 			{
-			return $this->VoidApiActionResponse($response, false, 400, 'Entity does not exist or is not exposed');
-		}
+				User::checkPermission($request, User::PERMISSION_ADMIN);
 			}
 
-	public function GetObject(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+			$requestBody = $this->GetParsedAndFilteredRequestBody($request);
+
+			try
 			{
-		if ($this->IsValidEntity($args['entity']) && !$this->IsEntityWithPreventedListing($args['entity']))
+				if ($requestBody === null)
 				{
-			return $this->ApiResponse($this->Database->{$args['entity']}($args['objectId']));
-		}
-		else
-		{
-			return $this->VoidApiActionResponse($response, false, 400, 'Entity does not exist or is not exposed');
-		}
+					throw new \Exception('Request body could not be parsed (probably invalid JSON format or missing/wrong Content-Type header)');
 				}
 
-	public function AddObject(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		if ($this->IsValidEntity($args['entity']))
-		{
-			$newRow = $this->Database->{$args['entity']}()->createRow($request->getParsedBody());
+				$newRow = $this->getDatabase()->{$args['entity']}()->createRow($requestBody);
 				$newRow->save();
 				$success = $newRow->isClean();
-			return $this->ApiResponse(array('success' => $success));
+
+				return $this->ApiResponse($response, [
+					'created_object_id' => $this->getDatabase()->lastInsertId()
+				]);
+			}
+			catch (\Exception $ex)
+			{
+				return $this->GenericErrorResponse($response, $ex->getMessage());
+			}
 		}
 		else
 		{
-			return $this->VoidApiActionResponse($response, false, 400, 'Entity does not exist or is not exposed');
+			return $this->GenericErrorResponse($response, 'Entity does not exist or is not exposed');
 		}
 	}
 
-	public function EditObject(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
+	public function DeleteObject(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
-		if ($this->IsValidEntity($args['entity']))
+		User::checkPermission($request, User::PERMISSION_MASTER_DATA_EDIT);
+
+		if ($this->IsValidExposedEntity($args['entity']) && !$this->IsEntityWithNoDelete($args['entity']))
 		{
-			$row = $this->Database->{$args['entity']}($args['objectId']);
-			$row->update($request->getParsedBody());
-			$success = $row->isClean();
-			return $this->ApiResponse(array('success' => $success));
-		}
-		else
+			if ($this->IsEntityWithEditRequiresAdmin($args['entity']))
 			{
-			return $this->VoidApiActionResponse($response, false, 400, 'Entity does not exist or is not exposed');
-		}
+				User::checkPermission($request, User::PERMISSION_ADMIN);
 			}
 
-	public function DeleteObject(\Slim\Http\Request $request, \Slim\Http\Response $response, array $args)
-	{
-		if ($this->IsValidEntity($args['entity']))
-		{
-			$row = $this->Database->{$args['entity']}($args['objectId']);
+			$row = $this->getDatabase()->{$args['entity']}($args['objectId']);
 			$row->delete();
 			$success = $row->isClean();
-			return $this->ApiResponse(array('success' => $success));
+
+			return $this->EmptyApiResponse($response);
 		}
 		else
 		{
-			return $this->VoidApiActionResponse($response, false, 400, 'Entity does not exist or is not exposed');
+			return $this->GenericErrorResponse($response, 'Invalid entity');
 		}
 	}
 
-	private function IsValidEntity($entity)
+	public function EditObject(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
 	{
-		return in_array($entity, $this->OpenApiSpec->components->internalSchemas->ExposedEntity->enum);
+		User::checkPermission($request, User::PERMISSION_MASTER_DATA_EDIT);
+
+		if ($this->IsValidExposedEntity($args['entity']) && !$this->IsEntityWithNoEdit($args['entity']))
+		{
+			if ($this->IsEntityWithEditRequiresAdmin($args['entity']))
+			{
+				User::checkPermission($request, User::PERMISSION_ADMIN);
 			}
 
-	private function IsEntityWithPreventedListing($entity)
+			$requestBody = $this->GetParsedAndFilteredRequestBody($request);
+
+			try
 			{
-		return in_array($entity, $this->OpenApiSpec->components->internalSchemas->ExposedEntitiesPreventListing->enum);
+				if ($requestBody === null)
+				{
+					throw new \Exception('Request body could not be parsed (probably invalid JSON format or missing/wrong Content-Type header)');
+				}
+
+				$row = $this->getDatabase()->{$args['entity']}($args['objectId']);
+				$row->update($requestBody);
+				$success = $row->isClean();
+
+				return $this->EmptyApiResponse($response);
+			}
+			catch (\Exception $ex)
+			{
+				return $this->GenericErrorResponse($response, $ex->getMessage());
+			}
+		}
+		else
+		{
+			return $this->GenericErrorResponse($response, 'Entity does not exist or is not exposed');
+		}
+	}
+
+	public function GetObject(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		if ($this->IsValidExposedEntity($args['entity']) && !$this->IsEntityWithNoListing($args['entity']))
+		{
+			$userfields = $this->getUserfieldsService()->GetValues($args['entity'], $args['objectId']);
+
+			if (count($userfields) === 0)
+			{
+				$userfields = null;
+			}
+
+			$object = $this->getDatabase()->{$args['entity']}($args['objectId']);
+
+			if ($object == null)
+			{
+				return $this->GenericErrorResponse($response, 'Object not found', 404);
+			}
+
+			$object['userfields'] = $userfields;
+
+			return $this->ApiResponse($response, $object);
+		}
+		else
+		{
+			return $this->GenericErrorResponse($response, 'Entity does not exist or is not exposed');
+		}
+	}
+
+	public function GetObjects(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		$objects = $this->queryData($this->getDatabase()->{$args['entity']}(), $request->getQueryParams());
+		$allUserfields = $this->getUserfieldsService()->GetAllValues($args['entity']);
+
+		foreach ($objects as $object)
+		{
+			$userfields = FindAllObjectsInArrayByPropertyValue($allUserfields, 'object_id', $object->id);
+			$userfieldKeyValuePairs = null;
+
+			if (count($userfields) > 0)
+			{
+				foreach ($userfields as $userfield)
+				{
+					$userfieldKeyValuePairs[$userfield->name] = $userfield->value;
+				}
+			}
+
+			$object->userfields = $userfieldKeyValuePairs;
+		}
+
+		if ($this->IsValidExposedEntity($args['entity']) && !$this->IsEntityWithNoListing($args['entity']))
+		{
+			return $this->ApiResponse($response, $objects);
+		}
+		else
+		{
+			return $this->GenericErrorResponse($response, 'Entity does not exist or is not exposed');
+		}
+	}
+
+	public function GetUserfields(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		try
+		{
+			return $this->ApiResponse($response, $this->getUserfieldsService()->GetValues($args['entity'], $args['objectId']));
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function SetUserfields(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	{
+		User::checkPermission($request, User::PERMISSION_MASTER_DATA_EDIT);
+
+		$requestBody = $this->GetParsedAndFilteredRequestBody($request);
+
+		try
+		{
+			if ($requestBody === null)
+			{
+				throw new \Exception('Request body could not be parsed (probably invalid JSON format or missing/wrong Content-Type header)');
+			}
+
+			$this->getUserfieldsService()->SetValues($args['entity'], $args['objectId'], $requestBody);
+			return $this->EmptyApiResponse($response);
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function __construct(\DI\Container $container)
+	{
+		parent::__construct($container);
+	}
+
+	private function IsEntityWithEditRequiresAdmin($entity)
+	{
+		return in_array($entity, $this->getOpenApiSpec()->components->internalSchemas->ExposedEntityEditRequiresAdmin->enum);
+	}
+
+	private function IsEntityWithNoListing($entity)
+	{
+		return in_array($entity, $this->getOpenApiSpec()->components->internalSchemas->ExposedEntityNoListing->enum);
+	}
+
+	private function IsEntityWithNoEdit($entity)
+	{
+		return in_array($entity, $this->getOpenApiSpec()->components->internalSchemas->ExposedEntityNoEdit->enum);
+	}
+
+	private function IsEntityWithNoDelete($entity)
+	{
+		return in_array($entity, $this->getOpenApiSpec()->components->internalSchemas->ExposedEntityNoDelete->enum);
+	}
+
+	private function IsValidExposedEntity($entity)
+	{
+		return in_array($entity, $this->getOpenApiSpec()->components->internalSchemas->ExposedEntity->enum);
 	}
 }