Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New setting to disable all outgoing http requests from a Piwik server #6324

Closed
mattab opened this issue Sep 28, 2014 · 10 comments
Closed

New setting to disable all outgoing http requests from a Piwik server #6324

mattab opened this issue Sep 28, 2014 · 10 comments
Assignees
Labels
c: Platform For Matomo platform changes that aren't impacting any of our APIs but improve the core itself. c: Privacy For issues that impact or improve the privacy. c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc.
Milestone

Comments

@mattab
Copy link
Member

mattab commented Sep 28, 2014

The goal of this issue is to let Piwik admins easily disable all outgoing HTTP requests which makes Piwik much faster to load on a server that cannot access the Internet.

Edit: feature is available, click to see our FAQ

Imagine the use case of an Intranet where the Piwik server cannot connect to the Internet. Piwik is slow to load as it tries to make requests and requests take a while to timeout. There are many companies including Piwik installing Piwik in such environments. Another good use case is a user that wants to increase privacy of her Piwik server and she can just enable this setting which makes sure the Piwik server does not contact anyone on the Internet.

currently it's possible to disable some of the requests via settings as follows:

[General]
enable_marketplace = 0
enable_auto_update = 0
enable_update_communication = 0 

Proposed steps

  • New setting enable_internet_features or similar
    • this setting is the equivalent of setting other enable_* flags as above
  • when setting is set to 0 then disable the SEO widget (since it uses many web services)
  • check other uses of Http in piwik in case we missed any

Ideally: disabling phoning home and other outgoing HTTP should be one setting away for Piwik users.

@mattab mattab added Major Indicates the severity or impact or benefit of an issue is much higher than normal but not critical. Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. c: Privacy For issues that impact or improve the privacy. c: Platform For Matomo platform changes that aren't impacting any of our APIs but improve the core itself. labels Sep 28, 2014
@mattab mattab added this to the Short term milestone Sep 28, 2014
@gaumondp
Copy link

I didn't knew about enable_marketplace = 0, enable_auto_update = 0, enable_update_communication = 0 .

This could/should be added in the optimization page: http://piwik.org/docs/optimize-how-to/

@mattab
Copy link
Member Author

mattab commented Sep 30, 2014

see also #6348

@mathieubouchard
Copy link

Here's the list of all outgoing connections I currently identified in Piwik and some settings to modify to stop them:

builds.piwik.org :

  • In plugins/CoreUpdater/Updater.php
  • Set enable_auto_update = 0

api.piwik.org :

  • In core/UpdateCheck.php
  • In Set enable_auto_update = 0

plugins.piwik.org :

  • In plugins/CorePluginsAdmin/MarketplaceApiClient.php
  • In Set enable_marketplace = 0

Transifex :

Update spammer blacklist :

Update search engines :

Update socials :

Update GeoIP database :

Deactivate Feedback plugin
Deactivate ExampleRssWidget plugin
Deactivate SEO plugin
Deactivate MobileMessaging plugin

@ThaDafinser
Copy link
Contributor

After those settings, there are still a lot of problems.

enable_marketplace = 0
enable_auto_update = 0
enable_update_communication = 0 

image

Then i started disabling following plugins (to get piwik working)

  • Dashboard
  • ExampleAPI
  • ExamplePlugin (why those 2 are enabled per default?)
  • Feedback
  • MobileMessaging
  • RssWidget
  • SEO
  • ProfessionalServices

And there is still for example this request:
https://plugins.piwik.org/api/2.0/plugins?keywords=&purchase_type=paid&query=&sort=lastupdated&release_channel=latest_stable&prefer_stable=1&piwik=3.0.2&php=7.0.9&mysql=5.7.13&num_users=1&num_websites=1'

my workaround for now in Piwik\Plugins\Marketplace\Api\Service::fetch()

public function fetch($action, $params)
{
    $endpoint = sprintf('%s/api/%s/', $this->domain, $this->version);

    $query = Http::buildQuery($params);
    $url   = sprintf('%s%s?%s', $endpoint, $action, $query);

    throw new \Exception($url);
}

Then it does work fastly at least
image

@ThaDafinser
Copy link
Contributor

Side note

## Piwik 2.16.1

### Internal change
 * The setting `[General]enable_marketplace=0/1` was removed, instead the new plugin Marketplace can be disabled/enabled. The updater should automatically migrate an existing setting.

@sgiehl
Copy link
Member

sgiehl commented Jun 19, 2017

Remaining open tasks after #11465 :

  • When disabling internet connection and trying to install a plugin via marketplace the error message currently says You cannot install or update the plugin directly as automatic updates are disabled in the config. To enable automatic updates set '[General]enable_auto_update=1' in 'config/config.ini.php'.
    That might be a bit misleading. Not sure if we maybe should show another message in that case.
  • We maybe should hide the ´check for updates´ area in admin, as those check should not work.
  • SEO Rankings and Piwik Blog Widgets won't work without internet as well. Should we remove those widgets from the list?

@mattab
Copy link
Member Author

mattab commented Sep 11, 2017

Not sure if we maybe should show another message in that case.

Maybe we could say instead You cannot install or update the plugin directly as all features requiring Internet connection are disabled in the config. To enable connections from your Piwik to the Internet, set '[General]enable_internet_features=1

We maybe should hide the ´check for updates´ area in admin, as those check should not work.

Ideally we'd leave the box there but link instead to http://piwik.org/changelog/ so user can easily see the latest version

SEO Rankings and Piwik Blog Widgets won't work without internet as well. Should we remove those widgets from the list?

Sounds good to remove them from the list 👍

@mattab mattab added c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. and removed Lower priority labels Sep 11, 2017
@mattab
Copy link
Member Author

mattab commented May 30, 2018

  • We need to make sure that when enable_internet_features = 0 then there is no internet connection left in Matomo.

  • and document this setting in a new FAQ

@sgiehl
Copy link
Member

sgiehl commented Jul 10, 2018

With #13076 when internet connection is disabled in config it automatically

  • Disallows usage of Marketplace & Mobile Messaging (plugins are forced disabled)
  • Disables GeoIP Autoupdate tasks
  • Disables GeoLocation Auto Updater UI

Not sure if anything is still missing

@diosmosis diosmosis assigned diosmosis and unassigned diosmosis Jul 24, 2018
@diosmosis
Copy link
Member

@sgiehl did a quick test and looks like the only thing missing is the "check for updates" button. It doesn't fail when internet is disabled, but it does look like it succeeds. Should probably change to link to the matomo.org page w/ the latest version?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c: Platform For Matomo platform changes that aren't impacting any of our APIs but improve the core itself. c: Privacy For issues that impact or improve the privacy. c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc.
Projects
None yet
Development

No branches or pull requests

6 participants