Own It 4.1.3 is a security update for all 47 apps. It is free for everyone who owns a tool. Update from the app's Updates page (Check for updates, then Back up and update), or download the 4.1.3 files again from your purchase. Your data, config.php and the data/ folder are not touched by the update. Nothing else changed: no feature, screen, setting or database table.
Bought on Codester? Your copy has no Updates page. Download 4.1.3 from your Codester account, back up, and replace the files.
No other site can frame your pages
Any website could show an app's pages in a hidden frame and trick a signed-in person into pressing a button there. Now every page tells the browser that only the app itself may frame it, and the installer that nothing may. If you had an app framed inside another site of your own, that frame now stays empty; link to it instead. Three things made to be framed keep working: Privara's embeddable request form (the sites you list in Settings), and the RevUp and Votera widgets on your own site.
The /mcp address refuses other sites
A request whose Origin header names another site now gets 403 before anything is read, so a page on another site cannot reach your app's /mcp from a visitor's browser. Your AI's desktop or server client sends no Origin and works as before.
Company sign-in is stricter
Single sign-on now uses PKCE (S256), so an intercepted sign-in code is of no use on its own. With Google as the provider, a company address needs a Google Workspace account of that same domain, and Google must report the address as verified: a personal Google account made with a work address no longer gets in. Gmail addresses work as before, other providers are unchanged, and password sign-in is not affected.
Smaller fixes for every app
- The audit CSV writes a cell that starts with a carriage return as text, as it already did for = + - @ and TAB.
- The Docker image installs PHP's zip extension, so a Docker install can make the backup with files.
App by app
- Slotly: the leftover
seed.phppage is gone. Anyone who asked for it, signed in or not, could replace all of an install's data with sample data and lock out its owner. Updating removes it. If you replace files by hand, deleteseed.phpyourself. - Approva: switching a person off refuses their API keys at once and revokes them; the audit line says how many. Switching them on again does not bring the old keys back.
- RevUp and Packora: a person who is switched off can no longer sign in, and an open session ends at their next page.
- Waiverly: "Export selected" on the waivers register writes what a signer typed as text, never as a spreadsheet formula.
- Extracta: a Factur-X PDF's embedded data is unpacked with a 10 MB limit, so a small PDF built to expand to hundreds of megabytes can no longer stop the request.
- Assetora: the audit CSV at
/audit/export.csvwrites formula characters as text. - Deliora: a few descriptions, the classic home and its drawing named a product of ours that has nothing to do with your store; they no longer do. The classic home's price range was typed and now reads your own editions.
Also changed, with no effect on a running install: the corner card on a public demo offers only the purchase, and API.md no longer shows the config example of a product we retired.