Configuration Overrides

CartThrob’s normal store settings belong in CartThrob → Settings. The supported runtime policies on this page belong in ExpressionEngine’s system/user/config/config.php file.

Do not add an override merely because it exists. Retain the secure default when no exception is required.

Temporary settings used only while upgrading to CartThrob 10 are deliberately not listed here. See Upgrading to CartThrob 10 and Version Review and compatibility messages for cartthrob_legacy_custom_js_checkout and cartthrob_legacy_download_sources.

Download validation

ExpressionEngine File and CartThrob Download fields work without an override. Add the settings below only for an intentional Text/custom field, raw local path, external origin, or local-development URL. See Downloadable products for the complete validation and authorization model.

cartthrob_download_fields

Allows specific Text or other custom fields to supply a download value. The value maps channel IDs to lists of field IDs:

$config['cartthrob_download_fields'] = [
    7 => [42, 43],
];

For MSM, wrap the channel map in a site-ID map. Use field-ID lists in the MSM form, even when a channel has only one approved field:

$config['cartthrob_download_fields'] = [
    1 => [
        7 => [42, 43],
    ],
    2 => [
        12 => [81],
    ],
];

This setting approves where a value may come from. The stored value must still pass the source rules below.

cartthrob_download_roots

Allows readable raw local files inside the listed absolute directories and their subdirectories:

$config['cartthrob_download_roots'] = [
    '/srv/private-downloads',
];

Use the narrowest practical directory. CartThrob resolves the real path and rejects traversal, missing or unreadable files, and links that escape an approved root. Do not approve the web root broadly.

For MSM, a site may have its own list:

$config['cartthrob_download_roots'] = [
    1 => ['/srv/site-one-downloads'],
    2 => ['/srv/site-two-downloads'],
];

cartthrob_download_origins

Allows external public HTTP(S) download origins. Each value is an exact scheme, host, and nondefault port when present—not a wildcard or URL prefix:

$config['cartthrob_download_origins'] = [
    'https://downloads.example.com',
    'https://media.example.net:8443',
];

For MSM, a site may have its own list:

$config['cartthrob_download_origins'] = [
    1 => ['https://downloads.example.com'],
    2 => ['https://downloads.example.net'],
];

Credentials in URLs and private, loopback, link-local, metadata, or reserved network destinations remain blocked. An origin entry does not override those checks.

cartthrob_download_allow_local_site_url

Allows this installation’s exact configured site origin when it resolves to a private or local address. This exists for local development only:

$config['cartthrob_download_allow_local_site_url'] = true;

Leave it absent or false in normal production use. It does not permit other private addresses.

Price Modifier Configurator limit

cartthrob_max_configurator_combinations

Sets the maximum number of combinations a Price Modifier Configurator field may generate. The default is 5000; the value must be a positive integer:

$config['cartthrob_max_configurator_combinations'] = 7500;

Raising the limit increases CPU, memory, database, and Control Panel rendering work. Prefer fewer option groups or values when possible.

Serialized cart-data redaction exception

cartthrob_non_sensitive_serialized_paths

CartThrob removes values whose keys look like credentials before serializing cart and order payloads. Use this exception only when a trusted extension deliberately stores non-credential business data under a reserved name such as security_code or routing_number and the value must survive later cart/order processing.

List exact, audited paths in system/user/config/config.php:

$config['cartthrob_non_sensitive_serialized_paths'] = [
    'custom_data.security_code',
    'items.[item].item_options.security_code',
];

The exception applies only to trusted cart/order serialization. It cannot preserve the same key in raw request or asynchronous POST data. [item] may replace a changing item ID only in an items or order.items path ending in an exact item_options or meta key; arbitrary wildcards, regular expressions, and partial paths do not match.

Never exempt a real password, payment-card value, bank account/routing value, CVV/CVC, or other credential. Rename a non-sensitive integration field instead whenever possible. This key is intentionally read only from config.php, not from CartThrob’s Control Panel settings or browser input.

Legacy gateway cURL proxy

ExpressionEngine’s config.php supports cartthrob:curl_proxy and cartthrob:curl_proxy_port for CartThrob’s legacy cURL gateway helper:

<?php

$config['cartthrob:curl_proxy'] = '127.0.0.1';
$config['cartthrob:curl_proxy_port'] = 8888;

Use these only for an intentional HTTP debugging or network proxy. The settings affect gateway traffic that uses the legacy helper, may expose sensitive payment requests to that proxy, and do not guarantee that every modern SDK-backed gateway uses it. Disable them outside the controlled diagnostic/network environment.