Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Matomo iframe widgets report “For embedding widgets super user token auths are not allowed” but auth token is read-only #17493

Closed
notken opened this issue Apr 23, 2021 · 4 comments
Closed

Matomo iframe widgets report “For embedding widgets super user token auths are not allowed” but auth token is read-only #17493

notken opened this issue Apr 23, 2021 · 4 comments
Labels
c: Usability For issues that let users achieve a defined goal more effectively or efficiently. duplicate For issues that already existed in our issue tracker and were reported previously.

Comments

@notken
Copy link

notken commented Apr 23, 2021

Expected Behavior

When providing a token in the URL for an embedded widget, I would expect the widget to use that token user for authorisation. The token I'm providing is for a read-only user.

Current Behavior

I have a superuser login and a cookie for that login. If I use the widget URL while logged in, it's using my cookie/session for authorisation, complaining that I can't use a super user for embedding widgets. It's not using the token I'm providing in the URL.

Possible Solution

If a token is provided in the URL this should always take priority over any session details the browser is sending.

Steps to Reproduce (for Bugs)

  1. Be logged in to the dashboard as a superuser.
  2. Create a readonly user and create a token.
  3. Add the token to the URL for an embedded widget. It will complain that you are using a super user token.
  4. Log out of the dashboard and use the URL again. This time it's fine.

Context

While it's possible to log out of the dashboard, it's inconvenient to have to do that to test embedded widgets, and I can't control what our users may have done. For some we will allow them to have access to the dashboard as well as embedding widgets in our own CMS. We can't expect them to have to log out of the matomo dashboard in order to use our CMS.

Your Environment

  • Matomo Version: 4.2.1
  • PHP Version: 7.4.1
  • Server Operating System: Win Server 2016
  • Additionally installed plugins: QueuedTracking
  • Browser:
  • Operating System:
@notken notken added the Potential Bug Something that might be a bug, but needs validation and confirmation it can be reproduced. label Apr 23, 2021
@sgiehl
Copy link
Member

sgiehl commented Apr 23, 2021

Hi @notken. Thanks for creating this report. That's indeed something we should improve. I guess any widgetized report should always only use the authentication for the given token_auth instead of any session.

@sgiehl sgiehl added c: Usability For issues that let users achieve a defined goal more effectively or efficiently. and removed Potential Bug Something that might be a bug, but needs validation and confirmation it can be reproduced. labels Apr 23, 2021
@diosmosis
Copy link
Member

diosmosis commented Apr 23, 2021 •
edited

@sgiehl I think this is a duplicate of #17335

@notken
Copy link
Author

notken commented Apr 23, 2021

I agree. It does seem identical. Can anyone merge them, or should I just close this one?

@diosmosis
Copy link
Member

I can close it. Regardless, thanks for taking the time to report the issue @notken!

@diosmosis diosmosis added the duplicate For issues that already existed in our issue tracker and were reported previously. label Apr 23, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
c: Usability For issues that let users achieve a defined goal more effectively or efficiently. duplicate For issues that already existed in our issue tracker and were reported previously.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@notken @diosmosis @sgiehl