Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Require authentication when sending custom ip with tracking requests #15888

Merged
merged 2 commits into from May 6, 2020

Conversation

sgiehl
Copy link
Member

@sgiehl sgiehl commented Apr 30, 2020

fixes #13471

Note: matomo-php-tracker already only sends cip param when token_auth is provided. See https://github.com/matomo-org/matomo-php-tracker/blob/ed2de26b2a5710292d09436a246998d1e28b5760/MatomoTracker.php#L1737,L1739

@sgiehl sgiehl added not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org. Needs Review PRs that need a code review labels Apr 30, 2020
@sgiehl sgiehl added this to the 4.0.0 milestone Apr 30, 2020
@tsteur
Copy link
Member

tsteur commented Apr 30, 2020

@sgiehl are there other things in the tracker that need to be checked? Eg cdt? But I suppose some CDT is valid vs some other isn't so it is tricky

@sgiehl
Copy link
Member Author

sgiehl commented May 5, 2020

@tsteur haven't checked all parameters. but cdt isn't easy. We would need to check the config for tracking_requests_require_authentication_when_custom_timestamp_newer_than and compare it with the value to say if a token auth is required or not.

@tsteur
Copy link
Member

tsteur commented May 5, 2020

Thought it wouldn't be easy. All good shouldn't be needed I suppose

tsteur and others added 2 commits May 6, 2020 11:17
…id token is used (#13675)

* Always fail during tracking when authentication is required but invalid token used

* fix tests
@sgiehl
Copy link
Member Author

sgiehl commented May 6, 2020

Fixed the failing test. @tsteur is that good to merge then?

@tsteur tsteur merged commit 53f3e32 into 4.x-dev May 6, 2020
@tsteur tsteur deleted the reqauthtracking branch May 6, 2020 21:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Needs Review PRs that need a code review not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org.
Projects
None yet
2 participants