Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When safe mode is displayed, and Super User was not logged in already, let Super User display the full safe mode to troubleshoot further #11082

Merged
merged 14 commits into from Dec 27, 2016

Conversation

mattab
Copy link
Member

@mattab mattab commented Dec 26, 2016

  • Allow not-logged in users, if they can prove they are super users, to view the full safe mode, and to deactivate plugins
  • Add a link to Login form
  • Display plugin versions in the safe mode
  • Added a text to indicate users to first disable third party plugins (If you don't know which plugin is causing this error, we recommend to first disable any plugin not created by "Piwik" and not created by "InnoCraft".)

@mattab mattab added this to the 3.0.1 milestone Dec 26, 2016
@mattab
Copy link
Member Author

mattab commented Dec 26, 2016

Feature looks like this for Anonymous users / non super users

safe-mode-troubleshoot-as-super-user

@mattab mattab added the Needs Review PRs that need a code review label Dec 26, 2016
@mattab mattab added c: Usability For issues that let users achieve a defined goal more effectively or efficiently. Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. labels Dec 26, 2016
@mattab
Copy link
Member Author

mattab commented Dec 27, 2016

Merging now before a code review because will be nice to have in a beta. Feedback welcome and i'll happily apply code review feedback later 👍

* Need to catch that PHP7 error object on php5
*/
if( !class_exists('\Error')) {
class Error {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hopefully it's the right way to define the PHP7 Error object in PHP5

echo $this->generateSafeModeOutputFromException($e);
exit;
} catch(\Error $e) {
echo $this->generateSafeModeOutputFromException($e);
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here we're catching errors such as: #10876 Call to undefined method Piwik\Menu\MenuTop::add() which should be displayed safe mode instead of a not-so-useful error page

@@ -133,6 +148,15 @@ public function dispatch($module = null, $action = null, $parameters = null)
* @param \Piwik\NoAccessException $exception The exception that was caught.
*/
Piwik::postEvent('User.isNotAuthorized', array($exception), $pending = true);
} catch (\Twig_Error_Runtime $e) {
echo $this->generateSafeModeOutputFromException($e);
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here we're catching the case of #10738 An exception has been thrown during the rendering of a template (".form-description is undefined: failed at .form-description; line: 6182") in "@CoreUpdater/runUpdaterAndExit_welcome.twig" at line 8.

$this->pluginManager->deactivatePlugin($pluginName);
$this->redirectAfterModification($redirectAfter);
if($this->isAllowedToTroubleshootAsSuperUser()) {
Piwik::doAsSuperUser(function() use ($redirectAfter) {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as a result of this code, anyone who knows the secret salt of a Piwik instance may be able to deactivate plugins, as long as they also know the Nonce so it should be very safe

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c: Usability For issues that let users achieve a defined goal more effectively or efficiently. Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. Needs Review PRs that need a code review
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant