| Age | Commit message (Collapse) | Author |
|---|
|
* Add [tests] config option to enable logging in tests.
* Allow tests:run/tests:run-ui commands to enable logging for individual runs + during tests only log to file.
* Remove Fixture field
* fix failing test
* fixing build
* Fix another failure.
* Fix an other test.
|
|
* Initial code to gather performance measurements across processes.
* Get proof of concept to work.
* couple tweaks
* Modified to use a custom log file instead of option table.
* add peak memory value
|
|
* Translate currency names
* Update tests
* Fix more tests
* Use plural form in config key name
* Update screenshots
|
|
* Modifying "cookie authentication" to be more secure.
Instead of authenticating by token auth if it exists in the cookie, validate an existing session. If the session
has the user name stored as a session var, it has been authenticated. If the request has the same IP address and
user agent as the request that created the session, the request is from the user that created the session. If
both of these are true, then the session is valid, and we don't need a token auth to authenticate.
If the session is deleted before the Piwik auth cookie expires (due to garbage collection), we attempt to
re-authenticate using a secure hash of the token auth. We don't do this on every request since password_verify()
will, at BEST, add 3.5ms to every request.
* Invalidate existing sessions after user password change.
Invalidation is accomplished w/o having to individually touch sessions by:
1. Using the password hash as the piwik_auth key secret, instead of the token auth. So when a password changes, existing piwik_auth keys are no longer valid. This affects session re-authentication.
2. Saving the session start time & the last time a user's password was modified, and checking that the session start time is always newer than the password modification time.
* Set session.gc_maxlifetime to login_cookie_expire time so session data does not disappear, remove session re-auth functionality & tie cookie hash to password modified time instead of password hash to retain automatic session invalidation on password change.
* In SessionInitializer, clear other cookie values so previously stored token auths will be removed.
* Make sure anonymous user is still default user whan authenticating.
* fixing test failures
* Remove hash checking in piwik_auth cookie.
piwik_auth cookie still required since it's presence indicates we should use SessionAuth instead of the normal authentication mechanism. Since there's always a session, even if you're not logged in, PIWIK_SESSID can't be used by itself to determine this.
* Make sure session auth doesnt break in edge case where ts_password_modified column does not exist.
* Clarify session destruction/invalidation logic in SessionAuth.
* Make UsersManagerTest slightly more comprehensive.
* Use Date::now()->getTimestampUTC() instead of time() in SessionFingerprint::initialize().
* Check getUser returns correct user info in SessionAuth for sanity.
* Add SessionInitializer::getAuthCookie() back since it is @api.
* Remove IP address from session auth info + check.
* Refactor session start changes so it is started in one place only.
* Remove SessionAuthCookieFactory & deprecate auth cookie INI config vars (still needed for SessionInitializer deprectaed method).
* Make sure user can still login if ts_password_modified column is not present in database.
* Rename ts_password_modified Update class.
* Update comment in SessionAuth to include why Piwik tries to create another session.
* Restore 3.x-dev SessionInitializer for BC (deprecated), move new SessionInitializer to core, add tests for both SessionInitializers.
* Change update to 3.5 version.
* Make sure normal auth implementation is used if sessionauth fails so anonymous user can be logged in.
* On logout clear session fingerprint so same session cannot be used to login.
* Change update name + bump version, and make sure Session::rememberMe() is called before session is started (otherwise it has no effect).
* Fixing tests.
* apply review fixes
* remove test
|
|
* started working on some ACL concept
* acl implementation
* add category
* small tweaks
* more tweaks
* more api methods and fixes
* cache capabilities
* various enhancements, fixes, tweaks
* more tweaks
* added more tests and fixed some bugs
* fix parameter
* make sure to be BC
* make sure to be BC
* fix some tests
* more apis, translations, changelog entry, ...
* update db
* correct error message
* fix capabilities were not detected in tests
* directly access provider
* fix and add test
* JS api to check capabilities, better structure for capabilities in tests
* add ability to inject permissions
* apply review changes
* fix test
|
|
* Allow hostnames to be configured in login whitelist
May be useful in combination with for example DynDNS providers. Or should we rather have a `login.whitelist.hostnames`?
* Add test for resolving hostnames
* document new hostname option for the login whitelist
* updates UI file
|
|
|
|
* Added feature to optionally disable Schedule old data deletion feature
* Update screenshot
|
|
|
|
* Adds message about data retention on gdpr overview
* Adds additional information about gdpr relevant data retention
* replace log data with raw data
* review adjustments
* adds ui test
* review adjustments
* update UI files
|
|
|
|
|
|
* require geoip2/geoip2 composer package
* Determine region name based on Location Provider
* Adds empty GeoIp2 plugin
* move location_region column definition to GeoIp2 plugin
so it's get changed as soon as the plugin is activated
* Adds GeoIP2 location providers
* ignore GeoIP2 mmdb files
* Adds script to generate GeoIP2 test databases
* Adds Command to convert region codes from FIPS to ISO for old log table records
* Adds GeoIP2 AutoUpdater
* Use GeoIP2 in tests
* update test files
* code fixes
* adds tests
* rename old GeoIP providers to Legacy
* Let GeoIP autoupdater UI handle GeoIp2 as well
* convert region codes to ISO in API after switch to GeoIP2
* do not show GeoIP providers if GeoIP2 plugin is enabled an no GeoIP Legacy provider is still in use
* small fixes
* review changes
* Use correct region translations
* Show correct message if no database can be found
* if log tables have been converted, use archive date to check if region codes still need to be converted to iso
* fix tests
* Improves extracting GeoIP2 databases
* Adjust GeoLocation diagnostics
* readds old taiwan fixes
* Assume all third party location providers as 'recommended'
* Download database over HTTPS
* remove outdated comment (see https://github.com/matomo-org/matomo/issues/12411)
* Remove indication that Geoip2 may be slow, since we found it should be quite fast and this should not be an issue in theory
* skip detection if IP is empty & do not try convert IP to IPv4
* remove downloaded file if an error occurs while extracting
* command should be runnable multiple times
* use ISO codes for suggested region codes
* reload after wizard success
* Drop table if exists.
* Fix two translation keys.
* add special region handling for UK
* update system test
* update UI files
* submodule update
* update test files
|
|
100 is too limited when it comes especially to tracking event names by event action or event category. 500 will cover a lot more use cases without compromising performance.
|
|
* Mysql SSL connection support from pull request #8049
* updated minified js
* Add ssl_no_verify config option for skipping certificate verification (works only on some PHP setups).
* Remove TODO comment from DbOverSSLCheck diagnostic, will create issue.
* Skip test if SSL is not enabled
* Undo changes to piwik.js for tests.
* Tweak to DbSSLTest.
|
|
* Added cookie_domain setting for third party cookie
* update UI tests
|
|
* ignore common files on shared hoster in Integrity Check
* don't change use
|
|
* Replace all occurences of Piwik in english translations of Actions plugin
* translation update
* Replace all occurences of Piwik in english translations of API plugin
* translation update
* Replace all occurences of Piwik in english translations of core
* replace Piwik occurrences
* Rename widget piwik.org blog => matomo.org blog
* fix widget name
* replaced some more piwik mentions
* Renamed to Matomo a few strings
* Replaced more strings to Matomo in JSON files, twig templates
* Replaced more strings to Matomo in INI file
* Replaced more strings to Matomo in API docs, error messages, feedback forms
* introduce API.getMatomoVersion and ExampleAPI.getMatomoVersion API + deprecate old ones
|
|
* renaming more Piwik mentions
* some more updates
* fix some tests
* support matomo partially as require string
* fix tests
* fix failing system test
* fix tests
* fix system test
* fix test
|
|
|
|
file (#12189)
|
|
* add possibility to restrict piwik login by ip
* better whitelist implementation
* move classes to corehome
* better error message
* better config
* make sure ips can be overwritten via DI
* fix ui tests
|
|
InvalidateReports plugin (#12286)
* Minor changes to wording
* Add a mention to the InvalideReports plugin
|
|
"rewrite ^/piwik/(.*)$ /$1 break;" (nginx.conf), you can provide a header "proxy_set_header X-Forwarded-Uri /piwik;" which will be considered to the current script name. (#12011)
It's necessary, because the redirect after login and links e.g. the logo are not working correctly without.
|
|
|
|
* Introduce config setting to show update notifications to superusers only. Fixes #7930
* By default, all users should see the update notification
* Changed description of config param
* Updates changelog
|
|
visitor profile (#12212)
* Make it possible to change the number af maximum visits aggregated for visitor profile
* update expected screenshot
|
|
|
|
* column tweak
* fix install
* more tweaks
* rename column to dimension
* various fixes
* added new control expandable select
* starting to refactor segment selector
* make segment editor work again
* use translation keys
* defined some metrics
* set types
* simplify
* simplify
* fix join generator
* add possibility to use custom join table names when using query builder and it uses an inner query
* fix bug in query selector when selecting same field name from different tables twice
* more metadata
* more tweaks
* improve selector
* add possibility to use custom entity names
* also processed archived metrics
* generate sql filter, suggested values callback, and accept values automatically for columns with enums
* several tweaks
* focus search field when opening it
* various tweaks
* added missing method
* format and fix more metadata
* more fixes
* better definition
* define custom filter
* fix definition
* fix various tests
* fix more tests
* fix bug in logquery builder
* fix referrerurl segment was missing
* fix some tests
* fix more tests
* add group
* refactor for better definition
* fix a bug in log query builder when similar columns are used in archiver
* add goal metrics
* various fixes
* make datatable row more flexible
* various fixes and visualization enhancements
* simply segment editor and make it smaller
* remove trailing comma
* various fixes and added new dimension
* fix formatting of returning customer
* added missing primary key
* fixes
* various fixes and improvements
* make sure to update segment definition when selecting a value from auto complete list
* various fixes and more metrics
* more metrics
* more dimensions and fixes
* fix some tests
* fix some integration tests
* update submodule
* fix some system tests
* fix ui tests
* trigger new test run
* fix more ui tests
* fix system tests
* update submodule
* fix categories
* sort segments by category for more consistency
* add custom variables
* some translations and fixes
* add minute segment
* more segments
* added plurals
* added some docs
* fix test
* fix tests
* fix tests
* added suggested values
* fix some tests
* various fixes
* fix more tests
* allow to select segments on any site
* make sure to include file
* added doc block
* fix some system tests
* fix most system tests
* fix ui test
* fix system test
* adjust examples
* added more tests and docs
* no metrics for these dimensions
* added developer changelog and made some classes public api
* some fixes for entity names
* add possibility to set format metrics in test
* more consistency in defining the name
* get idsites only if provided
* fix integration tests
* added another segment for visit start hour and visit start minute
* more clear name for segment
* use old segment name to not break bc
* various fixes
* more test fixes
* fix no suggested values for new segment
* add event value
* for boolean dimensions only sum metric
* update available widgets when updating reporting menu
* Add new segments in developer changelog + typo
* fix system tests
* fix screenshot test
|
|
* Separate Archive query creation responsibility from Archive class.
* Add ability for plugins to define custom period types.
* Make period responsible for determining start/end time of periods, not LogAggregator.
* Allow specifying custom archive writer in PluginsArchiver.
|
|
* Allow different reports pre-archiving frequency for each period
* Add new config settings for archive frequency
* added default config for range dates
* print changed archive periods
* minor change to log output
* Clarify wording, processed != requested.
* Fix integration test
|
|
|
|
* disable outgoing communication with one setting
* disabled piwik blog if isInternetEnabled=0
* better description for enable_internet_features
* reenable plugin
|
|
|
|
* introduces new config setting to enabled plugin upload (disabled by default)
* updates changelog
* updates expected screenshot
* improve message
|
|
* Cross Domain: forward pk_vid parameter when the clicked element is not directly a link but is within the link <a> element itself
* Add custom commands when Piwik is not installed yet
* Use config file to define Plugin names
* minor
* clean code
|
|
* some work on tracking cross domain
* fix some bugs
* fix some edge cases
* fixed tests and added more new tests
* we also need a device specific id to avoid when time is not correct on a different computer etc
* more tests
* minified piwikjs
* use only one parameter and validate values
* fix tests
* improve code
* Re-generated piwik.js
* UI Test
* Comments
|
|
* Change to gender neutral phrasing in user-facing text
* Switch to gender neutral wording in docs/comments
|
|
token_auth, don't track the request (#10899)
* refs #10890 ignore tracking requests with custom timestamp, accept timestamps up to 1 day in past, added config for timestamps that require auth
* fix test
* update travis yml
* update travis
* update travis
* fix test
* added changelog entry
* .travis.yml file is out of date, auto-updating .travis.yml file.
* .travis.yml file is out of date, auto-updating .travis.yml file.
* .travis.yml file is out of date, auto-updating .travis.yml file.
* .travis.yml file is out of date, auto-updating .travis.yml file.
* .travis.yml file is out of date, auto-updating .travis.yml file.
* .travis.yml file is out of date, auto-updating .travis.yml file.
* New config.ini.php setting: `tracking_requests_require_authentication_when_custom_timestamp_newer_than`
|
|
|
|
* starting to port marketplace to piwik 3
* updating tests
* fix translation key
* fix various issues
* use material select
* fix plugin upload
* deprecate license_homepage plugin metadata and link to a LICENSE[.md|.txt] file if found (#10756)
* deprecate license_homepage plugin metadata, and link to a LICENSE[.md|.txt] file if found
* Make license view HTML only without menu
* fix tests and update
* fix some links did not work
* we need to show warnings even when plugin is installed, not only when activated. otherwise it is not clear why something is not downloadable
* fix install was not working
* improved responsiveness of marketplace
* fix more tests
* fix search was shown when only a few plugins are there
* fix ui tests
* fix some translations
* fix tests and remove duplicated test
|
|
|
|
|
|
writable, display a useful error message
If Piwik is not installed yet, it's possible the tmp/ folder is not writable
we prevent failing with an unclear message eg. coming from doctrine-cache
by forcing to use a cache backend which always works ie. array
|
|
* Renamed plugin ExampleRssWidget -> RssWidget
* Activate file on upgrade to 3.0.0-b1
* Fix system test
|
|
HTTP_CF_CONNECTING_IP and HTTP_X_FORWARDED_HOST when there is more than one IP (#10404)
* Extract the first IP from HTTP_X_FORWARDED_FOR when there is more than one
Fixes #10342
* Fetch the first IP from a list of IPs
* Return the first non empty IP
|
|
refs #6106
|
|
|
|
|
|
|
