Installing and running TaxiCRM

Requirements

PHP	8.0 or newer, with pdo_mysql, mbstring and fileinfo (and gd recommended)
Database	MySQL 5.7+ / 8.x, or MariaDB 10.4+
Web server	Apache 2.4 with AllowOverride All, nginx + PHP-FPM, or IIS
Disk	A few MB for the app, plus space for uploaded documents

TaxiCRM was developed and tested on PHP 8.5 with MySQL 8.4, under Apache 2.4 (mod_php) and PHP's built-in server. It is written for PHP 8.0 and newer, but earlier versions have not been exercised.

Install with the installer

1. Upload the contents of the unzipped taxicrm folder to your web server, for example /var/www/taxicrm or your host's public_html.
2. Create an empty database and a database user with full rights on it. If your database user is allowed to create databases, the installer can create it for you.
3. Open the site in your browser. You are taken to the installer, which will:
   1. check that your server meets the requirements;
   2. ask for your database details and write config.php;
   3. create the tables;
   4. ask you to create the main administrator account (the Director) and enter your company name, and offer the optional public demo mode;
   5. delete itself.
4. Sign in, open Settings, and enter your company details, invoice prefix and currency.
5. Still in Settings, check the Server security check panel. Every line should be green; if one is not, it tells you what to fix.

Install by hand

If you would rather not use the installer, create the database, load the schema, and write config.php yourself:

mysql -u root -p -e "CREATE DATABASE taxicrm CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci"
mysql -u root -p taxicrm < schema.sql
cp config.sample.php config.php      # then edit the database details

Then create the first Director. Generate a password hash and insert the user:

php -r 'echo password_hash("choose-a-long-password", PASSWORD_DEFAULT), "\n";'

INSERT INTO users (username, password, first_name, last_name, user_type)
VALUES ('admin', '<paste the hash>', 'Your', 'Name', 'director');

Finally delete install.php.

First steps

1. Add your vehicles. Registration documents are required, so every vehicle has proof on file from day one.
2. Add the compliance records on each vehicle page: taxi permit, technical inspection and insurance, each with an expiry date.
3. Add your drivers. The Driver ID is also their portal username; give each a password if they should sign in.
4. Import your first CSV export, or log a private ride.
5. Open Users and add an Accountant login, then show them Reports.

Roles

Director	Everything: fleet, drivers, rides, imports, invoices, settings, users and uploaded documents.
Accountant	Read-only: financial reports and the monthly CSV export. Cannot open driver documents or change anything.
Driver	Read-only portal: their own trips, earnings and leave, plus uploading their own documents.

Changing or resetting a password, deleting a user, or switching off a driver's portal login signs out every session that account had open, immediately.

Web server setup

Apache

Works out of the box if AllowOverride All is enabled for the folder, which is the default on most shared hosts. The shipped .htaccess files block direct access to uploads/, includes/, schema.sql and other private files, and add security headers.

nginx

nginx ignores .htaccess, so the same protections must be repeated in your server block. A complete example, including PHP-FPM, is in the download as docs/nginx.conf.sample. The essential rule is to deny /uploads/ and /includes/:

location ^~ /uploads/  { deny all; return 403; }
location ^~ /includes/ { deny all; return 403; }
location ~* \.(sql|md|log|bak|ini)$ { deny all; return 404; }

IIS

Use the included web.config, which hides the same folders and file types and sets the headers.

Backups

Back up both the database and the uploads/ folder, together, and try restoring them.

mysqldump -u USER -p taxicrm > taxicrm-$(date +%F).sql
tar czf uploads-$(date +%F).tar.gz uploads/

Your data lives only on your server. There is no copy with us to fall back on.

Upgrading

Take a backup, then copy the new files over the old ones, keeping your config.php and the uploads/ folder. Read the changelog in the download for any database changes.

Running a public demo

To show TaxiCRM off on a website, tick Install as a public demo on the administrator step of the installer. Leave it unticked for your own company. The installer then:

• loads a fictional taxi company — vehicles, drivers, about 1,500 trips, private rides, invoices and sample documents — and refreshes its dates once a day so the demo always looks current;
• makes the whole app read-only: visitors can look at everything and sign in, but nothing can be saved, uploaded, deleted or changed in Settings;
• shows the public demo logins on the sign-in pages, with a banner explaining that it is a demo;
• still creates your administrator account, which stays private and is not listed in the demo.

It does this by adding one line to config.php:

define('DEMO_MODE', true);

Turning demo mode off is only possible from that file: open config.php in your hosting file manager and delete the line (or change true to false). PHP notices the change within a few seconds. Nothing inside the app can switch it off, so neither a visitor nor a signed-in demo user can ever do it. If you turn it off to use the installation for real, first delete or change the demo accounts, because their passwords are published — Settings → Server security check warns you for as long as they still work.

Security

TaxiCRM stores personal data, so it is built to be safe by default:

• Passwords are hashed; sign-in is throttled after repeated failures; the session id is regenerated on login.
• Every form is protected against cross-site request forgery, including logout.
• Uploads are checked by their content, not just their extension, stored under random names, and served only to people allowed to see them.
• A strict Content-Security-Policy with no third-party origins. No analytics, CDNs, web fonts or validation services; IBAN checks and QR codes are computed locally.
• Spreadsheet-formula injection is neutralised in CSV exports, and all output is HTML-escaped.

What is left to you:

1. Use HTTPS. Free certificates are available from Let's Encrypt.
2. Delete install.php if the installer did not remove itself.
3. Confirm uploads/ is not directly reachable (see Web server setup).
4. Keep config.php private and out of version control.
5. Take and test backups, and keep PHP and your database patched.

To report a vulnerability, please contact By Trends LTD through bytrendsltd.com rather than opening a public issue.

Troubleshooting

Blank page or HTTP 500	Check your web server's PHP error log. Set APP_ENV to development in config.php to show errors in the browser while troubleshooting, and never leave it that way on a public server.
"Database connection failed"	Wrong credentials in config.php, or the database server is not running.
Uploads fail	uploads/ is not writable by the web server user, or upload_max_filesize / post_max_size is too small.
Pages have no styling	Apache is ignoring .htaccess, or the files were uploaded to the wrong folder.
"Request rejected" on a form	The session expired or cookies are blocked. Reload the page and try again.
A button does nothing (e.g. the installer's "Test connection and continue")	Your server, or an .htaccess file in a folder above TaxiCRM, sends a Content-Security-Policy header with form-action, so the browser refuses to submit forms. TaxiCRM never sends it; the installer shows "Your browser blocked this form" when it happens. Remove the header or exclude TaxiCRM's folder from it.
Locked out after failed sign-ins	Wait 15 minutes, or run DELETE FROM login_attempts; in the database.
Forgot the Director password	Replace the hash in users.password using the password_hash command above.