Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Super User should not be able to see token_auth of other users #10938

Closed
mattab opened this issue Dec 1, 2016 · 0 comments
Closed

Super User should not be able to see token_auth of other users #10938

mattab opened this issue Dec 1, 2016 · 0 comments
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
Milestone
3.0.0-b4

Comments

@mattab
Copy link
Member

mattab commented Dec 1, 2016

For advanced security, we choose that Super Users should not see the token_auth of other users.

After this change, if you need to find out which Piwik user has issued a particular API request with a given token_auth value, you need to match the token_auth against the database table piwik_user.token_auth

This was initially implemented in: #4616 but we decided to revert it back in #10926 #10740 #5728
@mattab mattab added the c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. label Dec 1, 2016
@mattab mattab added this to the 3.0.0-b4 milestone Dec 1, 2016
@mattab mattab closed this as completed Dec 1, 2016
@mattab mattab mentioned this issue Dec 1, 2016
Closed
@davorminchorov davorminchorov mentioned this issue Jan 9, 2017
Closed
This was referenced Mar 27, 2017
Closed
Closed
@Amunak Amunak mentioned this issue Apr 17, 2019
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
Projects
None yet
Milestone
3.0.0-b4
Development

No branches or pull requests
1 participant
@mattab