Merge pull request #9570 from ashleighpearson/9305

Show a warning when Piwik is used as a SuperUser via HTTP

2 files changed, 29 insertions, 0 deletions

diff --git a/core/Plugin/ControllerAdmin.php b/core/Plugin/ControllerAdmin.php
index 8e4715cfb9..37ce526b8b 100644
--- a/core/Plugin/ControllerAdmin.php
+++ b/core/Plugin/ControllerAdmin.php
@@ -21,6 +21,7 @@ use Piwik\Tracker\TrackerConfig;
 use Piwik\Url;
 use Piwik\Version;
 use Piwik\View;
+use Piwik\ProxyHttp;
 
 /**
  * Base class of plugin controllers that provide administrative functionality.
@@ -86,6 +87,31 @@ abstract class ControllerAdmin extends Controller
         self::setBasicVariablesAdminView($view);
     }
 
+    private static function notifyIfURLIsNotSecure()
+    {
+        $isURLSecure = ProxyHttp::isHttps();
+        if ($isURLSecure) {
+            return;
+        }
+
+        if (!Piwik::hasUserSuperUserAccess()) {
+            return;
+        }
+
+        $message = Piwik::translate('General_CurrentlyUsingUnsecureHttp');
+
+        $message .= " ";
+
+        $message .= Piwik::translate('General_ReadThisToLearnMore',
+            array('<a rel="noreferrer" target="_blank" href="https://piwik.org/faq/how-to/faq_91/">', '</a>')
+          );
+
+        $notification = new Notification($message);
+        $notification->context = Notification::CONTEXT_WARNING;
+        $notification->raw     = true;
+        Notification\Manager::notify('ControllerAdmin_HttpIsUsed', $notification);
+    }
+
     /**
      * @ignore
      */
@@ -104,6 +130,7 @@ abstract class ControllerAdmin extends Controller
         }
     }
 
+
     private static function notifyIfEAcceleratorIsUsed()
     {
         $isEacceleratorUsed = ini_get('eaccelerator.enable');
@@ -195,6 +222,7 @@ abstract class ControllerAdmin extends Controller
     {
         self::notifyWhenTrackingStatisticsDisabled();
         self::notifyIfEAcceleratorIsUsed();
+        self::notifyIfURLIsNotSecure();
 
         $view->topMenu  = MenuTop::getInstance()->getMenu();
         $view->userMenu = MenuUser::getInstance()->getMenu();
diff --git a/lang/en.json b/lang/en.json
index 8ba3ca134f..95556d3c8d 100644
--- a/lang/en.json
+++ b/lang/en.json
@@ -86,6 +86,7 @@
         "ConfigFileIsNotWritable": "The Piwik configuration file %s is not writable, some of your changes might not be saved. %s Please change permissions of the config file to make it writable.",
         "Continue": "Continue",
         "ContinueToPiwik": "Continue to Piwik",
+        "CurrentlyUsingUnsecureHttp": "You are currently using Piwik over unsecure HTTP, which can be risky. We recommend you set up Piwik to use SSL (HTTPS) for improved security.",
         "CurrentMonth": "Current Month",
         "CurrentWeek": "Current Week",
         "CurrentYear": "Current Year",