@carlgrundberg opened this Issue on March 11th 2021

As your documentation says I have created a view-only user with a token and when using that token to show a widget I'm getting an error saying "This user has superuser access". It works if I load the same url while logged out or in another browser. Seems odd if it shouldn't work since this should be a fairly common case.

Example url: http://localhost:8000/index.php?module=Widgetize&action=iframe&forceView=1&disableLink=1&token_auth=xxx&moduleToWidgetize=VisitsSummary&actionToWidgetize=getEvolutionGraph&viewDataTable=graphEvolution&idSite=1&date=2021-02-09,2021-03-10&period=range

Expected Behavior

It should be possible to show the widget even if you are currently logged in as a super user in the same browser.

Current Behavior

Error message saying
"This user has super user access. For embedding widgets super user token auths are not allowed. See our faq for more information."

Possible Solution

I have tried to follow the code and it seems that when using the token_auth parameter there is a call to the method Request::reloadAuthUsingTokenAuth eventually landing in Access::reloadAccess, however it return without reloading since $this->hasSuperUserAccess is still true from the session auth.

Steps to Reproduce (for Bugs)

  1. Create user with view permissions and generate a token
  2. Create a widgetized url and add the token to the url
  3. Load the url in a browser where you are logged in as a super user


We are trying to embed widgets in an external dashboard.

Your Environment

I'm running your latest docker image.

  • Matomo Version: 4.2.1
@flamisz commented on March 11th 2021 Contributor

Hi @carlgrundberg, thanks for creating this issue. Very appreciated.
I've just tried it and I was able to reproduce this.
It is definitely a bug. Sorry about it, we’ll do our best so we can hopefully get things sorted soon.

@flamisz commented on March 11th 2021 Contributor

I tried it with admin user as well and got another error message:

This user has at least some write access. Only tokens of users who have only view access can be used.

The token I used was a view token.

@carlgrundberg commented on March 12th 2021

Thanks for confirming. I guess it would make more sense to check if a token-param exists before setting up the session auth, to avoid authenticating twice. But maybe it's hard to change in the current execution flow.

This Issue was closed on May 11th 2021
Powered by GitHub Issue Mirror