Skip to content

inweb_config, application configuration

System: global configuration, cross-cutting.

How this page was verified

The key catalog was traced on Medco in June 2026. On 2026-09-06 the seed, the defaults in getInwebConfigList(), the catalog groups and the editor gate were re-checked on master, and the key list below was rebuilt from master's seed. Keys that exist only in one fork are marked.

This page has two halves. Part 1 explains what the configuration is and how you see and change it inside the app, no code needed. Part 2 is the technical reference: how it loads, where it is read, and a key-by-key catalog grouped by what each setting does.

Part 1: what it is and how you see it in the app

What it is

inweb_config is the application's installation-wide settings store: a single table of name → value pairs that controls how this INACT install looks and behaves. Branding (app name, logos, footer), which features are switched on, document-numbering rules, tax and currency, timezone, default form values, and more.

  • One setting, one value, for the whole installation. These are not per-project or per-user settings. Those live elsewhere: project reference tables, user profiles. Every instance gets its own values.
  • Two installs can look and behave very differently purely from these settings: different logo, different menus, different columns on a grid, without any code change.
  • It is not where secrets live. Database passwords and connection details are in .env and db_config.php, not here.

How configuration shows up in the app

You rarely see the config table directly. You see its effects:

What you noticeDriven by, examples
Different logo, app name, report title, footerlogo1, logo2, logo333, appname, report_title, footertext
A menu item present or missingfeature flags like enable_afe, plus the module being installed and your role
An extra or missing column on a document gridenable_show_mdr_or_non_mdr, enable_doclib_retention
A field appearing or hidden on MDR and document formsthe DMS enable_* reference-field flags, for example enable_well_site
Document numbers formatted differentlynumber_prefix, number_digit, show_project_code, show_month
A tax label ("PPN" or "VAT") on printed quotations and POsgst_label
New forms pre-filled with a default currency or incotermbase_currency, incoterms_default
Getting logged out when idleenable_auto_logout, auto_logout_default
Being logged out when you log in elsewhereenable_last_login_wins, master and JOTRE only

If a feature seems missing, it is often a config or role thing, not a bug. The module may not be installed, a feature flag may be off, or your role may not have it. See the menu logic in _menu.php.

Where you change it in the app

There is no single Settings screen for everything. Configuration is edited in several places, and the most powerful one is locked down:

In-app locationWhat it changesWho can use it
License Entity and Configuration, the generic editor (editdataConfig in company_address.php)Any managed setting, all $INACT_CONFIG groupsOnly the super-admin, and only when enable_demo_config = 1. See the gate.
Reference, Number Setting (number_setting.php)Document-numbering rulesper privilege
Reference, License (license.php)License active, start and due datesper privilege
Procurement Reference, GST (gst.php)Tax (gst, gst_label) and default currencyper privilege
Reference, Doc Template and the per-module template_*_updates.php pagesPrint-layout blobs (so_templates and friends)per privilege
First-run setup wizard (registration/setup_*, modules/user_registration/setup_*)Timezone, tax, numbering, currency at install timeduring setup

Because the generic editor is gated behind enable_demo_config plus super-admin, in normal operation most settings are changed through the purpose-built pages above, or directly in the database. The editor and the gate exist in all five forks.

Part 2: technical reference

Data model

inweb_config
├── config_name   VARCHAR  NOT NULL   (indexed; treated as the logical PK)
└── config_value  VARCHAR  NOT NULL
  • Created with ['id' => false]: no surrogate id. config_name is indexed but not UNIQUE, so duplicates are possible at the database level. Code assumes uniqueness; the last row wins when loaded into a keyed array.
  • config_value is always a string. Booleans are '1' / '0' for feature flags or 'yes' / 'no' for legacy keys like bilingual. Numbers, CSV (dms_action_reject = '12,15,16') and JSON-ish blobs (so_templates) are all stringified.

How config is loaded, two layers

Layer 1, $rconfig and the $inweb_* globals, raw, at bootstrap. setting.php runs once per request:

php
$q = $pdo->query("SELECT * FROM inweb_config");
while ($r = $q->fetch()) { $rconfig[$r['config_name']] = $r['config_value']; }

$rconfig is the verbatim table, no defaults, no normalisation. setting.php then maps about fifteen hot keys to $inweb_* globals, for example $inweb_baseurl from baseurl, $inweb_appname from appname, $inweb_diruploadfile from fileupload, and drives date_default_timezone_set() from time_zone_default.

Layer 2, $INWEB_CONFIG, curated, via the helper. main.php sets $INWEB_CONFIG = getInwebConfigList();, the array most application code reads. getInwebConfigList() in reference_function.inc.php:

  1. Selects all rows into $data[name] = value.
  2. Computes defaults: every $INACT_CONFIG key plus a hard-coded list, see Defaults and self-healing.
  3. Re-initialises any value that is missing, an invalid feature flag, or an empty or zero auto_logout_default.
  4. Adds the convenience key dms_action_reject_array (CSV to array).
  5. Persists re-initialised keys back to the table, then returns $data.

Prefer $INWEB_CONFIG when a key has a code-defined default or normalisation. It guarantees the key exists and is well-formed. $rconfig is fine for always-seeded raw keys but is unset for code-default-only keys until the helper has back-filled them.

A third access pattern, direct SQL. Some keys are read straight from the table where they are needed, bypassing both arrays: notably gst_label (about fifty sites), baseurl, so_templates, emailsender (getEmailSender()), and the cron flags enable_routing_overdue_notif_digest. When tracing a key, search all three: $INWEB_CONFIG[...], $rconfig[...] or $inweb_*, and where config_name='...'.

The catalog, $INACT_CONFIG

additional_global_variables.inc.php defines $INACT_CONFIG, a grouped map of config_name => human label. It is the canonical list of managed keys: the ones the helper guarantees to exist and the generic editor knows how to render. Five groups:

GroupPurpose
basicBranding (appname, report_title, logo1/2/333).
licenseLicense display metadata. See the two-license warning.
featureAbout fifty on/off flags, value '1' or '0'.
defaultValue settings with hard-coded fallbacks (timezone, currency, defaults).
customThe print-flavour selector Feature\PrintDoc\Html.

The DMS enable_* flags in the feature group also key two companion maps in the same file: $KEYCONFIG_DOCMASTER_COLNAME (flag to ts_documents_master column) and $KEYCONFIG_MODREF (flag to reference module). Turning a flag off hides the corresponding DMS column and module. See section 7.

Defaults and self-healing

Hard-coded defaults live at the top of getInwebConfigList(). In master: auto_logout_default = 5, inact_operator_role = 'contractor', inact_super_admin = '[email protected]'. A key is rewritten into the table by the helper when it is missing, is a feature flag whose value is not exactly '0' or '1', or is an auto_logout_default that is empty or 0. Re-init is a DELETE ... WHERE config_name IN (...) plus a batched INSERT.

All feature flags default '1' except enable_watermark and consolidated_routing_view, which default '0'.

To change the effective default of a managed key you must edit both the seed (fresh installs) and the hard-coded default in getInwebConfigList() (existing installs that self-heal). Editing only one diverges.

Database tables affected

TableOperationBy
inweb_configselectsetting.php (bootstrap), getInwebConfigList(), direct-SQL readers
inweb_configinsert / deletegetInwebConfigList() self-heal
inweb_configupdatethe editor pages in Part 1

Reading config in code

  • Earliest bootstrap code: $rconfig['key'] or the $inweb_* globals.
  • Application code: $INWEB_CONFIG['key'] or $GLOBALS['INWEB_CONFIG']['key'].
  • Fresh or filtered read: getInwebConfigList(['filter_by' => ['column' => 'config_name', 'value' => 'x']]).
  • A key's label and group: $INACT_CONFIG[<group>][<key>].

Configuration keys reference

Master's seed holds 107 keys. Grouped here by what each key does. Default is the effective default: the getInwebConfigList() code default where one exists, else the seed value. Procurement reference-ID defaults (currency, incoterm) are installation-specific foreign keys; treat the numbers as examples.

1. App identity and branding

KeyControlsDefault
appnameApp or company name in UI and reportsINACT
report_titleTitle on printed reports and headersINACT
logo1 / logo2 / logo333Header logo image filenames. Irregular: logo333, not logo3.inact_blue.png
footertextApp-wide HTML footer (support line)support line
baseurlBase URL for links, redirects, email links. Also what the QA hostnames on the instance pages were read from.https://inact.test
accnameAccount short code, drives the account-prefix feature(none)
admintemplatesAdmin template set name, mostly vestigialinweb
imagetemplatesTemplate image asset pathinweb/ae/img

2. Filesystem and paths

KeyControlsDefault
installdirApp root path. Config value ignored, overridden by dirname(__FILE__).
fileuploadUpload subdirectory namedocUpload
filetempTemp-document subdirectory namedocTemp
galleryfolderGallery or media foldergallery
gallerythumbnailGallery thumbnail size (px)120
main_dav_pathWebDAV sync path(empty)

3. Localisation and language

KeyControlsDefault
bilingualDual-language UI on or off (yes / no)yes
defaultlangDefault UI language(empty)
time_zone_defaultPHP and session timezone. Silently ignored if not a valid PHP timezone.Asia/Jakarta

4. Document numbering

Combined in generateDocNumber() in numbering_function.inc.php, read via getNumberSettings(). Edited at number_setting.php.

KeyControlsDefault
number_prefixPrefix prepended to numbersME
number_digitZero-pad width of the sequence5
number_resetReset counter per year or continuous1
show_project_codeInclude project code1
show_dept_codeInclude department code0
show_monthInclude two-digit month0

5. Routing and document-workflow toggles

KeyControlsDefaultRead in
enable_autopublishApprover sign-off auto-publishes the reviewed PDF to the library1upload handler, routing.inc.php
enable_next_issue_codeEnforce uploaded revision equals the next-expected issued code; also gates the Next Expected field at sign-off1upload handler, routing_resp.htm
consolidated_routing_viewShow routing across all projects in one inbox and outbox0routing.php, routing.inc.php. Master, Jadestone, Medco only.
enable_routing_notif_digestSuppress immediate routing emails; collect for a digest0routing.inc.php, cron/inact_routing_digest.php. Not in JOTRE, Timas.
enable_routing_overdue_notif_digestOverdue digest cron on or off0cron/inact_routing_overdue_digest.php. Master, Jadestone only.
inact_operator_roleWhich party operates this INACT: company or contractor. Decides which Project Organization side is the project owner.contractorreference_function.inc.php helpers. Master, Jadestone, Medco only. See Users and Privileges.
mdr_matrix_typeGlobal default MDR matrix grouping, overridden per project by ts_projects.matrix_type(commented in $INACT_CONFIG)setting.php
dms_action_rejectCSV of routing action IDs counted as rejected; also dms_action_reject_array12,15,16reference_function.inc.php, routing.inc.php
review_time_defaultDefault review duration (days) for due-date calculation3routing_handler_post.php

6. Document Library: folders, access and publishing

KeyControlsDefaultNotes
autopublish_auto_folder_creationUse the per-project folder tree during auto-publish0Master, Jadestone, Medco only. See Auto Folder Creation.
enable_autocreation_subfolder_deliverableAuto-create "Deliverables" subfolders1
enable_autocreation_subfolder_customEnable custom-subfolder logic, uses subfolder_custom_default0
subfolder_custom_defaultWhich custom-subfolder template to usedefault
enable_autocreation_subfolder_projectIntended project-level auto-subfolders1Not read, seeded only
library_folder_access_defaultNew folders auto-get access records1
enable_auto_doc_numberingInternal auto numbering on library folders0Not in Timas, KTP. Prima Energy since INA30-2 (September 2026), where a migration seeds the row as 0 so the feature-key default of 1 never applies. See Document Library.
enable_doclib_retentionDocument retention and expiration tracking0Cron inact_doclib_retention.php. Not in Timas, KTP.
enable_show_mdr_or_non_mdrShow MDR / Non-MDR column in document lists1
enable_doclib_sendby_attachment"Send by attachment" option1Not in KTP
enable_doclib_sendby_link"Send by link" option1Not in KTP
annotation_rev_indicatorSuffix marking the reviewed copy (R0A to R0A_R)_R

7. DMS reference field toggles

Each enable_* flag shows or hides a DMS metadata field across the MDR, the register and the library tree, and keys $KEYCONFIG_DOCMASTER_COLNAME (to a ts_documents_master column) and $KEYCONFIG_MODREF (to a reference module). All default 1. This is where the forks differ most: the set of flags follows the client's reference tables.

Master's twelve:

KeyDMS fieldts_documents_master column
enable_area_numberArea / Facilitydm_facility_code
enable_well_siteWell Sitewell_site
enable_disciplineDisciplinedm_discipline_identifier
enable_doc_typeDocument Typedm_document_type
enable_doc_subtypeDocument Subtypedm_document_subtype
enable_doc_categoryDocument Categorydm_doc_category
enable_doc_classificationDocument Classificationdm_doc_classifications
enable_drawing_categoryDrawing Categorydm_category
enable_contract_po_numberContract / PO Numberdm_contract_number
enable_system_codeSystem Codedm_system_code
enable_weight_factorMDR Weight Factordm_weight_factor
enable_ctrMDR CTRdm_ctr_number

Per-fork additions and removals, from the seeds on 2026-09-05:

InstanceAddsLacks, of master's twelve
Medcoenable_location, enable_ref_business_unit, enable_region, enable_sdrl_code, enable_code_package_identifier, enable_vendor_package
Jadestoneenable_ref_field_code, enable_ref_group_codeenable_well_site
JOTREenable_well_site
Timasenable_publish_to_correspondence, enable_routing_slipenable_well_site, enable_system_code, enable_doc_classification
Tomorienable_contractorenable_system_code, enable_doc_classification
KTPenable_well_site, enable_system_code, enable_doc_classification

8. Transmittal and return

KeyControlsDefaultNotes
enable_transmittalEnable transmittal generation and tracking1documents.inc.php, routing_handler_ajax.php
enable_return_on_auditEnable the "return on audit" workflow: in/out transmittal columns, returned status, Ready to Return0Master, Jadestone, Medco only. See Return.
main_entity_transmittal_codeEntity code prefix in transmittal numberingRES (example)routing_handler_transmittal.class.php
routing_return_formatIntended return output formatpdfNot read, seeded only. Not in the forks.

9. Procurement and purchasing defaults

Pre-fill values for new RFQ, PO, SPB and Rekom Handak forms. Applied only when the field is empty; user selection overrides. Values are foreign-key IDs.

KeyPre-fillsReference tableDefault (seed)
incoterms_defaultIncoterm on PO and RFQts_incoterms20
mode_transport_defaultMode of transportts_mode_transport54
packing_type_defaultPacking typets_packing_types73
deliver_to_defaultDelivery location (Rekom Handak)ts_deliver_to1
contract_payment_days_defaultContract payment-term days30. Falls back to 1 if empty in procure_function.inc.php.
procure_print_template_codePrint template for procurement documentsmeindo
enable_report_procure_stat_simple_filterSimplified filter UI on the Procurement Status report1

10. Finance: tax and currency

KeyControlsDefaultNotes
gstTax or VAT percentage10setting.php to $inweb_basegst, mostly setup-phase
gst_labelTax label printed on documents (PPN, VAT, GST)PPNDirect SQL in about fifty places
base_currencyDefault currency ID for new procurement documents (ts_currency)77 (IDR)

gst_label is the single most SQL-queried config key. Each procurement print path re-reads it directly rather than via $INWEB_CONFIG.

11. Budgeting, WBS and cost control

KeyControlsDefaultNotes
enable_afeShow the AFE (Authorization For Expenditure) menu and feature1_menu.php hides afe_skk when not '1'
enable_contract_folderShow contract-level folders in the budget expense tree0budget.inc.php
enable_wbs_show_level1_treeShow the full WBS level-1 descendant tree in reports1reference_function.inc.php
enable_show_item_under_wbsIntended: items under WBS1Not read, seeded only

12. Dashboards and dashlets

Feature flags read by the dashboard and dashlet renderer. All default 1 unless noted.

KeyControls
dashboard_defaultDefault dashboard on login (string, default dashboard_general)
enable_refreshable_dashboardDashboard auto-refresh
enable_customizable_dashboardUser can customise the dashboard layout
enable_downloadable_dashboardDashboard export or download
enable_refreshable_dashletPer-dashlet refresh
enable_filterable_dashletPer-dashlet filter controls
enable_draggable_dashletDrag to reorder dashlets
enable_resizable_dashletResize dashlets
enable_echart_color_accentAccent colour theme on EChart visualisations
enable_approved_rejected_notificationApproved and rejected badges in the notification dashlet

13. Notifications and email

KeyControlsDefaultNotes
emailsenderFrom-address on system emails(empty)getEmailSender() in tracking_function.inc.php, direct SQL
enable_routing_notif_digestDigest mode, see section 50
routing_notif_digest_hourHours (CSV, 0-23) the digest cron sends8cron/inact_routing_digest.php exits if empty. Not in JOTRE, Timas, KTP.
enable_routing_overdue_notif_digestOverdue digest, see section 50Master, Jadestone only

14. Session, security and auth

KeyControlsDefaultNotes
enable_auto_logoutEnable idle auto-logout0auto_logout.php, member_login.inc.php
auto_logout_defaultIdle timeout (minutes)5, re-initialised if empty or 0auto_logout.php, times 60 to seconds
enable_last_login_winsSingle Session: a new login supersedes the older one (person_session_token, iw_is_session_superseded())seed valueMaster and JOTRE only. Not in the other forks, neither in code nor in the table.
enable_ldap_loginAllow LDAP authentication0Master and Medco only. See Users and Privileges.
enable_ldap_browseAllow LDAP directory browsing0Master and Medco only
useractiveMax active users (license cap)20setting.php to $inweb_totalactiveuser

LDAP connection settings live in a separate inweb_ldap table and seed (DefaultInwebLdap.php), present in master and Medco.

15. License, setup and demo

KeyControlsDefaultNotes
license_number, active_date, maintenance_expired_date, date_limit_month$INACT_CONFIG["license"] metadata(empty)Display only, not used for runtime gating
license_active, license_start_date, license_due_dateWritten and read only by license.php(unseeded)Separate key set, not in $INACT_CONFIG
setupOnboarding-complete marker1written by setup_bank_account_handler_post.php; the main gate is commented out
enable_demo_configUnlock demo and debug features for the super-admin, and the in-app config editor0main.php, company_address.php
demo_idDemo or trial instance id (archival)(unseeded)written by demo_creator.php; not in the catalog

Two "license" key families

The $INACT_CONFIG["license"] group is display metadata and is not what the license page edits. The license page reads and writes license_active, license_start_date and license_due_date. Neither family was found to hard-block access in the traced code. Confirm before relying on license enforcement.

16. Super-admin and the config-editor gate

KeyControlsDefault
inact_super_adminThe super-admin user id (email). Gates admin-only menu items, the License and Config pages, and the generic config editor.[email protected]

The generic config editor (editdataConfig in company_address.php) runs only when enable_demo_config == '1' and the user equals inact_super_admin. Both keys together gate who can edit $INACT_CONFIG from the UI.

17. UI layout and print flavour

KeyControlsDefault
ui_codeUI layout variant (form2018 or layout2021)form2018
so_templatesSales-Order print layout (JSON box and grid)layout blob
Feature\PrintDoc\HtmlSelects the print "flavour" class (Resindo, Minerba, Basic) under src/Resindo
project_company_internal_labelUI caption for a project's owner company (ts_projects.owner_id): Projects form field label, Projects-grid owner_name column header, the default organization_name for a new resource, and organization_name_main_entity in the sign-off formMain Company
project_company_external_labelUI caption for a project's external company (ts_projects.company_id): Projects form field label plus company_name column headerThird Party

These are display captions for a project's two company roles. Their defaults, Main Company / Third Party, match the Project Organization values in $LIST_ORGANIZATION, so the sign-off "main entity" check compares like for like. See Users and Privileges, Project Organization and the sign-off Next Expected gating. If you rename one, update both the labels and the stored organization_name values.

Known issue

project_company_internal_label is supposed to be display-only but currently leaks into routing logic: it gates the sign-off Next Expected field and the Sign Off / Return buttons, and seeds a new resource's organization_name. Renaming the label can break that gating. Details under Users and Privileges, known issue.

Backslashes in the Feature\PrintDoc\Html key name need care in SQL and shell quoting.

18. Reporting and per-user dashboard filters

KeyControlsDefault
year_document_figureYear filter for the "Document Comparison" widget2018
year_sales_funnelYear filter for the "Sales Funnel" widget2018

These are per-user preferences stored in ts_org_person's dashboard JSON. The inweb_config rows only seed the initial default.

19. Account-prefixed dynamic config

After loading, setting.php turns any config key beginning with the account name (accname) into a $inweb_<key> global:

php
foreach ($rconfig as $key => $value) {
    $k = explode('_', $key);
    if ($k[0] == $inweb_accname) {        // accname='cis' + key='cis_foo'
        ${"inweb_" . $key} = $value;       // → $inweb_cis_foo
    }
}

This lets a deployment add account-specific settings as manually inserted rows without code changes. Variable-variables are invisible to static analysis and IDEs.

20. Appendix: seeded-but-unused and special keys

KeyStatus
enable_autocreation_subfolder_projectSeeded, never read
routing_return_formatSeeded (pdf), never read
enable_show_item_under_wbsSeeded (1), never read
mdr_matrix_typeCommented out in $INACT_CONFIG; read globally but superseded by per-project ts_projects.matrix_type
installdirStored but ignored, overridden by dirname(__FILE__)
admintemplatesLargely vestigial, real value from the inweb_templates table
defaultlang, imagetemplates, galleryfolder, gallerythumbnail, main_dav_pathSeeded; little or no active read
license_number, active_date, maintenance_expired_date, date_limit_monthDisplay only; no runtime gating

"Never read" means no read was found across $INWEB_CONFIG, $rconfig and direct-SQL searches at verification time. Frontend JS or external scripts could still reference a key. Re-check before deleting one.

Gotchas and known issues

  • Two arrays, easy to confuse. $rconfig (raw, every seeded row) versus $INWEB_CONFIG (curated, code defaults, normalised flags). A code-default-only key such as inact_super_admin is absent from $rconfig until the helper back-fills it.
  • The helper writes on read. getInwebConfigList() can DELETE plus INSERT rows. It is not a pure getter; do not call it in a tight loop.
  • Feature flags must be exactly '0' or '1'. Any other value is silently reset to the default on the next read.
  • Changing a default requires two edits, seed plus helper.
  • config_name is not UNIQUE. Duplicate rows load unpredictably; code assumes one row per name.
  • Irregular key names. logo333, not logo3; Feature\PrintDoc\Html contains backslashes.
  • Two "license" key families, see section 15. License enforcement is unverified.
  • contract_payment_days_default falls back to 1, not 30, if empty.
  • SQL injection. Editor pages interpolate $_POST values and field names directly into UPDATE inweb_config ..., for example number_setting.php and company_address.php.
  • The generic editor is gated behind enable_demo_config plus super-admin. If enable_demo_config != '1' it silently does nothing. Change config via the per-feature pages or the database.
  • Secrets are not here. Database credentials come from .env and db_config.php.
  • Confirm a key against the live database, not only the seed. A fork's seed says what a fresh install gets; the instance's table says what it runs with. See the instance pages for each fork's key diff.

Instance differences

Checked on 2026-09-05 (seeds) and 2026-09-06 (code).

InstanceDifference
Jadestone104 keys. Adds enable_ref_field_code, enable_ref_group_code. Lacks enable_last_login_wins, enable_ldap_browse, enable_ldap_login, enable_well_site, routing_return_format.
Medco111 keys. Adds the six DMS flags in section 7. Lacks enable_last_login_wins, enable_routing_overdue_notif_digest.
JOTRE96 keys. Lacks eleven, among them consolidated_routing_view, enable_return_on_audit, inact_operator_role, the digest keys and autopublish_auto_folder_creation. Has enable_last_login_wins.
Timas92 keys. Adds enable_publish_to_correspondence, enable_routing_slip. Lacks seventeen, including retention, watermark, auto numbering and classification.

The full key lists per fork are on the instance pages.