Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When embedding reports (widgets) into a site, it is no longer possible to use authentication tokens of users with at least write access #16264

Merged
merged 1 commit into from Aug 7, 2020

Conversation

tsteur
Copy link
Member

@tsteur tsteur commented Aug 6, 2020

Added missing changelog entry and translation key.

It's based on #16263 which I don't get to pass right now so thought to create this simpler change extra while figuring out how to make the other one work

@tsteur tsteur added the Needs Review PRs that need a code review label Aug 6, 2020
@tsteur tsteur added this to the 4.0.0 milestone Aug 6, 2020
@tsteur
Copy link
Member Author

tsteur commented Aug 6, 2020

@diosmosis splitted the other PR #16263 so it's easier to merge this separate change (which is required change compared to the other which isn't 100% required)

@diosmosis diosmosis merged commit a3864f4 into 4.x-dev Aug 7, 2020
@diosmosis diosmosis deleted the widgetviewaccess2 branch August 7, 2020 07:31
@mattab mattab changed the title Require only view access for embedded widgets when using tokens When embedding reports (widgets) into a site, it is no longer possible to use authentication tokens of users with at least write access Sep 29, 2020
@mattab mattab added the c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. label Sep 29, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. Needs Review PRs that need a code review
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants