Propagate token auth in ajax requests for widgetized reports AND enable_framed_pages = 1. (#14133)

* Propagate token auth in ajax requests if something is widgetized OR if enable_framed_pages is set to 1.

* Add UI tests for embedding entire app.

* Forgot to add file.

* Adds missing UI file

4 files changed, 34 insertions, 2 deletions

diff --git a/plugins/Overlay/javascripts/Overlay_Helper.js b/plugins/Overlay/javascripts/Overlay_Helper.js
index 42ff388d81..c7fe53e986 100644
--- a/plugins/Overlay/javascripts/Overlay_Helper.js
+++ b/plugins/Overlay/javascripts/Overlay_Helper.js
@@ -27,6 +27,11 @@ var Overlay_Helper = {
             url += '&segment=' + encodeURIComponent(segment);
         }
 
+        var token_auth = piwik.broadcast.getValueFromUrl("token_auth");
+        if (token_auth.length && piwik.shouldPropagateTokenAuth) {
+            url += '&token_auth='  + encodeURIComponent(token_auth);
+        }
+
         if (link) {
             url += '#?l=' + Overlay_Helper.encodeFrameUrl(link);
         }
diff --git a/plugins/Overlay/templates/index.twig b/plugins/Overlay/templates/index.twig
index 60c64e0081..ff58a50803 100644
--- a/plugins/Overlay/templates/index.twig
+++ b/plugins/Overlay/templates/index.twig
@@ -68,6 +68,10 @@
             Piwik_Overlay.siteUrls = {{ siteUrls|json_encode|raw }};
 
             var iframeSrc = 'index.php?module=Overlay&action=startOverlaySession&idSite={{ idSite }}&period={{ period }}&date={{ rawDate }}&segment={{ segment }}';
+            if (piwik.shouldPropagateTokenAuth) {
+                iframeSrc += '&token_auth=' + piwik.token_auth;
+            }
+
             Piwik_Overlay.init(iframeSrc, '{{ idSite }}', '{{ period }}', '{{ rawDate }}', '{{ segment }}');
 
             window.Piwik_Overlay_Translations = {
diff --git a/plugins/Overlay/templates/index_noframe.twig b/plugins/Overlay/templates/index_noframe.twig
index f3c9e61579..78c18bf281 100644
--- a/plugins/Overlay/templates/index_noframe.twig
+++ b/plugins/Overlay/templates/index_noframe.twig
@@ -7,6 +7,9 @@
 
     <script type="text/javascript">
         var newLocation = 'index.php?module=Overlay&action=startOverlaySession&idSite={{ idSite }}&period={{ period }}&date={{ date }}&segment={{ segment }}';
+        if (piwik.shouldPropagateTokenAuth) {
+            newLocation += '&token_auth=' + piwik.token_auth;
+        }
 
         var locationParts = window.location.href.split('#');
         if (locationParts.length > 1) {
diff --git a/plugins/Overlay/tests/UI/Overlay_spec.js b/plugins/Overlay/tests/UI/Overlay_spec.js
index 9ac41c0e5c..e655f97202 100644
--- a/plugins/Overlay/tests/UI/Overlay_spec.js
+++ b/plugins/Overlay/tests/UI/Overlay_spec.js
@@ -11,6 +11,8 @@ describe("Overlay", function () {
 
     this.timeout(0);
 
+    var baseUrl;
+    var hash;
     var url = null;
     var urlWithSegment;
 
@@ -21,8 +23,8 @@ describe("Overlay", function () {
     }
 
     before(function (done) {
-        var baseUrl = '?module=Overlay&period=year&date=today&idSite=3';
-        var hash = '#?l=' + encodeURIComponent(testEnvironment.overlayUrl).replace(/[%]/g, "$");
+        baseUrl = '?module=Overlay&period=year&date=today&idSite=3';
+        hash = '#?l=' + encodeURIComponent(testEnvironment.overlayUrl).replace(/[%]/g, "$");
 
         url = baseUrl + hash;
         urlWithSegment = baseUrl + '&segment=' + encodeURIComponent('visitIp==20.56.34.67') + hash;
@@ -31,6 +33,12 @@ describe("Overlay", function () {
     });
 
     after(function (done) {
+        testEnvironment.testUseMockAuth = 1;
+        if (testEnvironment.configOverride.General && testEnvironment.configOverride.General.enable_framed_pages) {
+            delete testEnvironment.configOverride.General.enable_framed_pages;
+        }
+        testEnvironment.save();
+
         testEnvironment.callApi("SitesManager.setSiteAliasUrls", {idSite: 3, urls: []}, done);
     });
 
@@ -135,4 +143,16 @@ describe("Overlay", function () {
             removeOptOutIframe(page);
         }, done);
     });
+
+    it('should load correctly with token_auth if enable_framed_pages is set', function (done) {
+        testEnvironment.testUseMockAuth = 0;
+        testEnvironment.overrideConfig('General', 'enable_framed_pages', 1);
+        testEnvironment.save();
+
+        expect.screenshot("framed_loaded").to.be.capture(function (page) {
+            page.load(baseUrl + '&token_auth=' + testEnvironment.tokenAuth + hash);
+
+            removeOptOutIframe(page);
+        }, done);
+    });
 });
\ No newline at end of file