Own It 4.1.2 is a security update for all 47 apps. It is free for everyone who owns a tool. Update from the app's Updates page (Check for updates, then Back up and update), or download the 4.1.2 files again from your purchase. Your data, config.php and the data/ folder are not touched by the update.
Two-step codes are limited
If someone had your password, the two-step code step let them try codes without any limit. Now wrong codes are counted per person and per address: after 10 wrong codes in 10 minutes the code step answers "Too many wrong codes. Wait ten minutes, then sign in again. A recovery code works in place of the code." even for the right code, and the password is asked again. The right code clears that person's count.
Locked out? Wait ten minutes and sign in again with a current code or one of your recovery codes. If you lost both the authenticator and the recovery codes, whoever runs the server can turn two-step sign-in off for you in the app's database; each manual's "New in 4.1.2: sign-in limits" shows the one line.
Wrong passwords count per account too
Wrong passwords were counted per address only, so a new address brought new tries for the same account. Now they are counted per account as well: after 10 wrong passwords in 10 minutes that account's password sign-in waits ten minutes, from any address. A right password clears the count.
Every sign-in starts a fresh session
Accepting an invite (Confida, Expensa, Specta, Assetora, Votera, Warrantora, Fleetora, Helpora), single sign-on (the same apps plus RevUp, Consigna, Fixora and Jobora) and, on Ownware Cloud, opening an app from the console now start a fresh session, as the password sign-in already did.
The installer stays closed while the database is down
With config.php in place, the web installer (/install) used to show the install form whenever the database did not answer (an outage, or a SQLite file that went missing), and whoever found it could set up a new administrator. Now it answers "This app is already installed (config.php exists), but its database is not answering, so the installer stays closed." and writes nothing. Check the database and reload. To install again from scratch, remove config.php first.
App by app
- Slotly: turning two-step sign-in off asks for a current code. The public booking form is guarded (30 posts per address in 10 minutes, posts from other sites refused, a hidden field that catches form robots); ending a recurring series works on MySQL 8; behind Cloudflare or a load balancer, set
trusted_proxies(the manual shows how). - Gymora: a recognized kiosk code no longer resets the kiosk's wrong-code count.
- Visitora: a matched staff code no longer resets the kiosk's wrong-code count.
- Deliora:
/webhook/demono longer takes posts from outside. While a store was still on the install default ("demo"), an unsigned "paid" post there could fulfil an order. The simulated checkout works as before. With Stripe, an order is fulfilled only once Stripe reports it paid (a bank debit that settles later waits for Stripe's "payment succeeded"), and a Stripe refund now finds its order, marks it refunded and revokes its licenses. - Jobora: a quote or invoice saved from the form no longer gains four empty $0.00 lines.
- Rentara: the daily reminders cron address works on Apache and with the manual's Nginx sample.