In the documentation http://piwik.org/docs/setup-auto-archiving/ should be a hint to place the archive.sh on another place than the document root. If it is in the document root everybody can download it and get the secret(?) api key.
Attachment: first step is to get php5 path, or? :)
Attachment: here's a new version of archive.sh file, please review it. if i should create a patch, please ask.
Should also add a .htaccess file (Deny from all) for those who don't RTM.
Also, in misc/cron/archive.sh, add 'month' to:
for period in day week year; do
"Deny from all" only restricts access on servers that recognise .htaccess. But better than nothing ...
I totally agree with this and this should be fixed in the next release.
Ideally we shouldn't need to edit this file at all, so the file wouldn't contain any sensitive info:
if you want to submit a patch to do that in shell in archive.sh that would be great :-)
vipsoft, we don't need to add month as year archives all month and them sum months in the year to get the year data.
also we should update the documentation on http://piwik.org/docs/setup-auto-archiving/ when done (and clarify the last section, now override config file values should be done in config.ini.php
to get current path of archive script automatically (to read config file)
what i dont like on my version is getting username and password but not found an easier way yet...
Assuming the superuser section appears first in the config file, an alternative is to use sed, e.g.,
PIWIK_SUPERUSER=`sed '/^login = /!d;s///;q' $PIWIK_CONFIG` PIWIK_SUPERUSER_PASSWORD=`sed '/^password = /!d;s///;q' $PIWIK_CONFIG`
Or if these are double quoted:
PIWIK_SUPERUSER=`sed '/^login = "*/!d;s///;s/"$//;q' $PIWIK_CONFIG` PIWIK_SUPERUSER_PASSWORD=`sed '/^password = "*/!d;s///;s/"$//;q' $PIWIK_CONFIG`
code should be solid indeed, works for
login=root login = root login = "root" login =root (with tab)
grep, then grepping content from this line number using
tail -n+15 file # returns all lines after 15th line
also, code could error if login is empty, or if password length <> 32
This delays the match until it sees the [superuser] section, and ignores whitespace and double quotes.
PIWIK_SUPERUSER=`sed '/^\[superuser\]/,$!d;/^login[ \t]*=[ \t]*"*/!d;s///;s/"*[ \t]*$//;q' $PIWIK_CONFIG` PIWIK_SUPERUSER_PASSWORD=`sed '/^\[superuser\]/,$!d;/^password[ \t]*=[ \t]*"*/!d;s///;s/"*[ \t]*$//;q' $PIWIK_CONFIG`
It's not bulletproof, but if the [superuser] section isn't properly configured, the user has a bigger problem than archive.sh not working.
(In ) - fixes #599 Make archive.sh not accessible via http; patch by pebosi and vipsoft!
thanks guys, and well done pebosi for your first patch :)
Just a final comment to clarify this issue, classified by others as an "access vulnerability".
Piwik is secure by default. Up to and including 0.2.32, archive.sh does not ship with the superuser's API key and Piwik never configures this file with the superuser's API key. Not through the installer, not through the admin panel (no faciliy provided to do this). archive.sh requires a Unix (or Unix-like) environment (i.e., bash script), and command line php5 to be installed.
By default, archiving is an internal Piwik process. The external archive.sh file is not required by default.
To a certain degree, this vulnerability is user error. To expose the API key, the user knowingly edits this file manually, and assumed to have sufficient Unix knowledge to set up a cron job, change file permissions, etc.