itdatex E-Invoice Intake
| 开发者 | itdatex |
|---|---|
| 更新时间 | 2026年7月21日 02:48 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
- Accepts XRechnung (UBL and UN/CEFACT/CII), ZUGFeRD (hybrid PDF/A-3 with embedded XML) and Factur-X via drag-and-drop upload
- Detects the format automatically and parses the core fields: invoice number, dates, seller and buyer, VAT ID, totals (net/tax/gross), positions, buyer reference (Leitweg-ID)
- Validates against the embedded EN-16931 XML schema and checks for required fields (BT-1, BT-2, BT-27, BT-112)
- Stores each file with a random name in a protected upload directory and chains every file's SHA-256 with the previous one (revision-evidence)
- Provides a human-readable single-invoice view with header data, parties, amounts, validation issues and an audit trail
- Logs every action (upload, status change, download) in a dedicated audit table
安装:
- Upload the plugin folder to
/wp-content/plugins/itdatex-e-invoice-intake/, or install via the Plugins screen. - Activate the plugin.
- Open the "Rechnungen" menu in the admin sidebar. You can upload your first XRechnung or ZUGFeRD file straight away.
*_reing_invoices, *_reing_files, *_reing_audit_log) and a protected upload directory under wp-content/uploads/itdatex-e-invoice-intake-{random}/. On uninstall, invoice data and files are NOT deleted by default because of statutory retention requirements (8 to 10 years under German tax and commercial law).
To force a full cleanup on uninstall, add this line to your wp-config.php before deleting the plugin:
define( 'REING_UNINSTALL_DELETE_ALL', true );屏幕截图:
常见问题:
Does the plugin send anything to your server?
The free version makes no external HTTP calls. All parsing, validation and storage happens locally in your WordPress installation. You can verify this by inspecting the source — the only network code path is the optional Pro upgrade, which is not part of this plugin.
Which formats are supported?
XRechnung in both UBL and UN/CEFACT (CII) syntax, ZUGFeRD from version 2.0.1 onwards (PDF/A-3 with embedded XML), and Factur-X. Pure PDFs without an embedded XML payload are recognized as "legacy PDF" and stored as files, but their fields can only be extracted with the optional Pro AI extraction.
Is this GoBD-conformant?
The plugin provides the technical foundation — immutable storage, hash chain, audit log — that a GoBD-conformant process requires. Whether your concrete bookkeeping process is GoBD-conformant is a question for your tax advisor and depends on more than just the software you use. We deliberately do NOT advertise "GoBD certification" because no such certification mechanism exists in Germany.
Can I delete invoices?
You can mark invoices as paid or disputed. Physically deleting invoices in WordPress is intentionally not exposed in the UI to protect the integrity of the hash chain. If you have a legal reason to delete (e.g. erroneous double-upload), please use direct database access and document the deletion in your retention log.
What about the upload size limit?
The plugin uses the WordPress / PHP upload size limit (upload_max_filesize, post_max_size). XRechnung files are typically well below 1 MB; ZUGFeRD PDFs can reach a few MB. If you need higher limits, increase them in your php.ini or .htaccess.
Does this work behind nginx?
Yes. The protected upload directory uses both .htaccess (Apache/LiteSpeed) and a randomized directory name so that path guessing fails. File downloads always go through a capability-and-nonce-checked endpoint, never via a direct URL — so the front-end web server's authorization model is irrelevant for the file path security.
Why no WP-Cron / IMAP / DATEV export?
These are paid features in the Pro version. The free version focuses on the core legal requirement — receiving and archiving incoming e-invoices — and keeps the dependency surface small to make security review easy.
更新日志:
- First public release on wp.org. XRechnung and ZUGFeRD parsing (UBL 2.1, UN/CEFACT CII, PDF/A-3 with embedded XML), KoSIT-based field validation, secure server-side storage with a tamper-evident hash chain, upload UI, invoice inbox, single-invoice detail view, secure download endpoint, and a full audit log. WP-CLI commands for headless ingest.
- Replaced the single-line
phpcs:ignorearound the duplicate-check query inIngestService::ingest()with aphpcs:disable/phpcs:enableblock so the sniff annotation also covers the interpolated SQL literal on the following line. No behaviour change.
- Playground Plugin Check compliance pass: rename lexical include-scoped variables to the
reing_prefix inuninstall.phpand the bootstrap file so the sniff no longer flags them; wrap the three admin view files (page-inbox.php,page-invoice.php,page-upload.php) with aphpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFoundblock explaining that the vars are template-locals, not globals. Annotated the read-only$_GETaccesses inAdmin\Pages\InvoiceandAdmin\Pages\Inboxwithphpcs:ignore WordPress.Security.NonceVerification.Recommended(display-only, all writes go through nonce-protected admin-post endpoints). Annotated the duplicate-check$wpdb->get_var()inIngestService(table-name accessor, no user input). Gated theerror_log()call in the same file behindWP_DEBUG. Annotated$_FILES['invoice_file']inUploadHandler(cannot be sanitized like a string; validated by Parser + Validator downstream). Rewrote the uninstallDROP TABLEloop with a phpcs:ignore + rationale for uninstall-time schema removal.
- wp.org Plugin Review round 2: distribution ZIP no longer ships the schema assets (
*.xslt,*.sch,*.xmp) from the bundledhorstoeko/zugferdlibrary nor the Sphinx docs fromjms/serializer— they are not used at runtime by the free plugin (validation runs against KoSIT in the optional Pro backend). Removed the unused, outdated transitivesetasign/fpdf 1.9dependency entirely. Annotated the two remaining static SQL statements inInvoiceRepository::lastChainHash()andcountInvoices()with rationale.
- Plugin Check compliance pass: escape interpolated exception messages (
FormatDetector,Parser,Storage,InvoiceRepository), replaceis_writable()withwp_is_writable(),unlink()withwp_delete_file(),rmdir()withWP_Filesystem::rmdir(), drop best-effortchmod()on stored invoices, inline SQL inlistOpenInvoices()to satisfy the prepared-SQL sniff, annotate the dynamiclistForExportquery and the streamingreadfile()in the download endpoint. No behaviour change.
- New API:
InvoiceRepository::listOpenInvoices()andsummarizeOpenInvoices()for due-date reporting and aggregation by bucket (overdue / this week / this month / later / no date). Used by the optional Pro dashboard.
- New API:
InvoiceRepository::listForExport($from, $to, $status, $limit)with safe date range and status filter for CSV/DATEV exporters. Used by the optional Pro export module.
- New service class
IngestService::ingest($path, $name, $source, $actor)encapsulating the parse → validate → store → audit pipeline. UploadHandler refactored to use it. Enables add-ons (e.g. Pro IMAP import) to reuse the exact same processing chain that the browser upload uses, including the existing hooks.
- New filter
reing_applyable_fieldsand actionreing_apply_invoice_fields($id, $fields, $source)to allow add-ons to update invoice fields with type-safe sanitisation. AddsInvoiceRepository::applyableFields()andupdateFields()with date / amount / currency normalisation. Setsextracted_by = 'ai_draft'and writes a structured audit entry.
- Add-on integration hooks:
reing_after_validate($tmpPath, $report, $invoiceData),reing_after_invoice_insert($id, $invoiceData, $report)andreing_invoice_view_after_validation($invoice, $reportData)allow optional Pro extensions to plug in deep validation, AI explanations and extra UI cards without modifying the free core. Includes a small backup autoloader for the prefixed Smalot/PdfParser library that the Strauss-generated PSR-0 mapping does not resolve correctly.
- Initial release: parsing, validation, storage with hash chain, upload, inbox and single-invoice views, secure download endpoint, audit log.