Navigation Menu

Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

create-security-files should allow access to files that are needed by plugins to be publically accessible #19613

Closed
Hiradur opened this issue Aug 9, 2022 · 6 comments
Closed

create-security-files should allow access to files that are needed by plugins to be publically accessible #19613

Hiradur opened this issue Aug 9, 2022 · 6 comments
Labels
answered For when a question was asked and we referred to forum or answered it. Potential Bug Something that might be a bug, but needs validation and confirmation it can be reproduced.

Comments

@Hiradur
Copy link

Hiradur commented Aug 9, 2022

Summary

On our server, we currently run Matomo version 4.11.0. Matomo updates are managed using Ansible. After every update, ./console core:create-security-files is run. This has worked fine so far.
Recently, we installed the HeatmapSessionRecording plugin. For this plugin, the system check reported that plugins/HeatmapSessionRecording/configs.php is inaccessible and a manual check in the browser indeed revealed a 403 status code. Access to this file was blocked by the .htaccess file that was created by ./console core:create-security-files in the plugins directory. Even after installing the HeatmapSessionRecording plugin, activating it, and re-running ./console core:create-security-files, access to plugins/HeatmapSessionRecording/configs.php was still blocked. Deleting plugins/.htaccess allowed access in our case but is not an optimal solution.

It would be nice if core:create-security-files would create an .htaccess file in the plugins directory that would allow access to files that are needed to be publically accessible by plugins.
Perhaps there could be some facility for Matomo plugins to report which files they need to be publically accessible and core:create-security-files would generate the .htaccess file in the plugins directory accordingly.

Your Environment

  • Matomo Version: 4.11.0
  • PHP Version: 7.4.19
  • Server Operating System: Red Hat Enterprise Linux 8.6
  • Additionally installed plugins: FormAnalytics, HeatmapSessionRecording
@Hiradur Hiradur added the Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. label Aug 9, 2022
@bx80
Copy link
Contributor

bx80 commented Aug 9, 2022

@Hiradur, thanks for reporting this. The HeatmapSessionRecording plugin folder should contain it's own .htaccess file to allow access to plugins/HeatmapSessionRecording/configs.php. It sounds like this isn't working.

Could you please confirm that the plugins/HeatmapSessionRecording/.htaccess file is present on your server and post the contents? This will hopefully help us understand what is happening.

@bx80 bx80 added Potential Bug Something that might be a bug, but needs validation and confirmation it can be reproduced. and removed Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. labels Aug 9, 2022
@Hiradur
Copy link
Author

Hiradur commented Aug 12, 2022

There is no .htaccess file in plugins/HeatmapSessionRecording/. I think this is due to the way how we installed the plugin: we downloaded HeatmapSessionRecording-4.4.3.zip from https://plugins.matomo.org/download and extracted it to the matomo/plugins directory via Ansible.
I can see that there is an htaccessTemplate file in the HeatmapSessionRecording/Install directory. This file did not get templated since we bypassed any installation facilities for plugins provided by matomo. As a result, we seem lack the .htaccess file.

I'm wondering now if skipping the installation facilites provided by matomo for plugins like this could cause any other problems. We have chosen this approach to prevent potential problems with our SELinux configuration.

@bx80
Copy link
Contributor

bx80 commented Aug 16, 2022

Hi @Hiradur, thanks for the update.

Each individual plugin has an install function that will perform various actions to setup the plugin, this will be different depending on the plugin, so skipping the install function might not cause any problems with one plugin, but cause issues with another.

To be sure that the plugin is properly set up the install function needs to be run.

If a plugin is activated when it isn't listed as installed in the config.ini.php PluginsInstalled list then the install function will be run on activation. So a possible approach would be to download the zip file and extract the contents to the plugin folder manually, then add the config.ini.php Plugins[] = "pluginname" setting, but not the PluginsInstalled[] setting, then active the plugin using the Matomo UI (or ./console plugin:activate) which will then run the install function.

This might not help for .htaccess files if SELinux is preventing file creation, but would at least cover things like setting up initial values and database changes.

For the missing HeatmapSessionRecording .htaccess file you should be able to just copy plugins/HeatmapSessionRecording/Install/htaccessTemplate to plugins/HeatmapSessionRecording/.htaccess

It seems like you've figured out the issue, so I'll close this ticket 🙂

@bx80 bx80 closed this as completed Aug 16, 2022
@Hiradur
Copy link
Author

Hiradur commented Sep 8, 2022

Thank you very much for the detailed answer. These plugins recently received an update and I'd like to know whether running a plugin's install function is necessary after plugin updates as well.

@bx80
Copy link
Contributor

bx80 commented Sep 20, 2022

Hi @Hiradur,

It's possible that a plugin update might need the install function run again if there was a major change to the database tables, but in most cases this wouldn't be needed. Deactivating and then activating the plugin again will make sure the install function is run.

If the updated plugin is working without any issues then it's probably not necessary to do this.

@Hiradur
Copy link
Author

Hiradur commented Sep 21, 2022

Alright, thank you very much!

@justinvelluppillai justinvelluppillai added the answered For when a question was asked and we referred to forum or answered it. label Sep 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
answered For when a question was asked and we referred to forum or answered it. Potential Bug Something that might be a bug, but needs validation and confirmation it can be reproduced.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@justinvelluppillai @Hiradur @bx80