Download Latest Version OpenConstructionERP_12.2.0_x64_en-US.msi (375.0 MB)
Email in envelope

Get an email when there's a new version of OpenConstructionERP

Home / v2.9.14
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-05-06 1.2 kB
0
v2.9.14 -- Wave 5 P0 IDOR fixes + Settings page redesign source code.tar.gz 2026-05-06 458.6 MB
0
v2.9.14 -- Wave 5 P0 IDOR fixes + Settings page redesign source code.zip 2026-05-06 460.3 MB
0
Totals: 3 Items   919.0 MB 0

Security (P0 IDOR fixes — Wave 5 audit)

  • Risk register cross-tenant leak. GET /api/v1/risk/, /risk/summary/, /risk/matrix/ now require risk.read and verify project ownership before reading.
  • Change-order cross-tenant leak. /changeorders/summary/ and /changeorders/?project_id=… now require changeorders.read + project-access verification.
  • Contacts export bypass. /contacts/export/ now scopes to the caller's tenant_id (with created_by fallback) — admins still see every row.

These three endpoints accepted any authenticated token + any project_id and leaked data across tenants. Patched with the same pattern used by every other module's read paths.

Changed

  • Settings page redesigned. Card grid + sticky vertical nav (desktop) / horizontal pills (mobile), profile hero card, real Danger Zone (red-tinted) for Sign Out + destructive actions, label-above forms with inline error states, BIM/CAD tab filled with link-cards, URL-synced ?tab=… for deep-linking. Every original setting preserved.

    :::bash pip install --upgrade openconstructionerp==2.9.14

PyPI: https://pypi.org/project/openconstructionerp/2.9.14/

Source: README.md, updated 2026-05-06