Open-Web-Analytics

Breaking Changes

• PHP tracker client has been removed. As mentioned in prior releases please use OWA's PHP SDK to add a tracker to your PHP based apps. https://github.com/Open-Web-Analytics/owa-php-sdk. If you have not migrated over to using the PHP SDK then this release will cause your PHP tracker to no longer work.

What's Changed

• Bump minimist from 1.2.5 to 1.2.6 by @dependabot in https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/833
• Bump terser from 5.10.0 to 5.14.2 by @dependabot in https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/848
• Maksbotan/fix domstream clicks play by @maksbotan in https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/822
• Remove trailing whitespace by @l2dy in https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/836
• add PHPMailer options arguments to mailer. by @xiaobolinet in https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/787
• No "FROM" in Password Reset emails by @padams https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/845
• Analyst not authorized to view_reports, lost site ID between dashboard and visit clickstream by @padams at https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/834
• Adding better checks for search engines and social networks by @padams
• Various PHP 8 compatibilities by @padams
• Refactored installer flow to avoid premature database access by @padams
• Added Mysql error mode compatibility for PHP 8.1 by @padams
• setting proper path to combined admin JS in new dist folder by @padams
• Changed the way REST API auth works from within the admin interface by @padams
• Fixed Filter in Report doesn't work issues @padams

New Contributors

• @dependabot made their first contribution in https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/833
• @maksbotan made their first contribution in https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/822
• @xiaobolinet made their first contribution in https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/787

Full Changelog: https://github.com/Open-Web-Analytics/Open-Web-Analytics/compare/1.7.7...1.7.8

Fix for broken domstream playback under certain circumstances.

Fix for IP address validation and support for anonymizing ipv6 addresses.

Fix for the incorrect tracker location in JS tracker tag generated by admin interface.

This release makes breaking changes when updating from Git. See below for updating instructions.

CRITICAL SECURITY FIX

1. fixes an exploit where it’s possible predetermine cache hashes in come cases.

Major Changes:

1. We now use npm / webpack to build the tracker #693
2. File cache is now it’s own module and disabled by default
3. We’ve replaced a number of dependancies with composer packages. #587
4. Search engine identification has moved to the server side #812

Refactoring:

1. Modules can now have their own composer dependancies and composer.json files. #805

Bug Fixes:

#795
#809
#808
#700

Updating

This release requires an update package (base.011) be installed which can be done from the command line or via the admin interface.

To update grab the fully packaged tarball attached to the release below.

Alternatively, If you are updating from Git see the new updating instructions here: https://github.com/Open-Web-Analytics/Open-Web-Analytics/wiki/Updating . You now need to install and run npm in order to build the tracker... so do not just do a git pull and think you are done!

NOTE: This release contains a breaking change to API authentication. Read the release notes, new documentation on the wiki and test your API code in a staging environment before upgrading to this release in production.

NOTE: The old bundled WordPress plugin will not work with this release. You must update to the official integration plugin which should be installed from the Wordpress plugin repository.

NEW FEATURES

• Signed Requests to REST Endpoints. A calculated signature must now be added to REST requests that use "API Key" based authentication. The signature relies on the secret OWA_AUTH_KEY contained in your config file. See the updated REST-API page on the wiki for how to manually compute the signature or use the latest version of the OWA PHP SDK when making your requests.
• reset-secrets CLI command. There is now a new API command that you can use to reset the secrets contained in your config file.

BUG FIXES:

• #769
• #763
• #637
• #761
• Added proper sort to geolocation report

REFACTORING

• Refactored result set generation for better code reuse and separation of concerns
• Standardized all result set to use paginated result set
• Refactored heatmap and domstream JS libraries to use pre-signed URLs for REST calls instead of assembling their own request urls.
• Added a more sane approach to controller registration within modules.

Security and bug fix release.

Bug Fixes:

• Improve calling context checks on cli.php #694
• install endpoint is not disabled after install #691
• Undefined variable warning for remote_host #689
• Funnel Visualization report not working #688
• Issue with registration of new user #606
• Issue with WordPress plugin and OWA admin user names getting out of sync.

• BUG: Fix for broken login cookie handling under chrome.

! IMPORTANT: This release requires a schema update. The update can be applied via the browser (you will be prompted when viewing analytics/reporting) or you can use the command line interface (CLI). You must apply the update in order for API's and tracking to work.

! IMPORTANT: The WordPress plugin and integration have changed! As of this release, new installs must do a standalone install of OWA first before activating the WordPress plugin. Also, existing users of the plugin will need to reset their OWA admin user password in order for tracking to work properly.

! IMPORTANT: The API endpoint has changed!. This release changes the API endpoint, request methods, and response formats. It's a major change. If you rely on the existing endpoint for data access you will need to update your API calls before upgrading to this release! The good news is that you can do a lot more via the API and we won't have breaking changes like this anymore. see: https://github.com/Open-Web-Analytics/Open-Web-Analytics/wiki/REST-API

Reminder: You must install and run Composer to download dependencies when checking out code from GitHub. See https://github.com/Open-Web-Analytics/Open-Web-Analytics/wiki/Installing-from-Github for more details.

For a fully packaged distribution use: owa_1.6.9_packaged.tar

This release contains numerous changes to OWA's APIs and

• Feature: Javascript Tracker Hooks Framework #579
• Feature: Clean URLs under Apache for for REST API #563
• Feature: WordPress Plugin Changes #560
• Feature: Reporting Pages Design Refresh #557
• Feature: CLI command to re-crawl document URLs. #523
• Feature: Added Search engine duckduckgo #533
• Feature: Domstream Screen resolution #534
• Feature: More REST API Routes and Changes #535 #536
• Bugfix: Clickstream timestamp zeros not get displayed #550
• Bugifx: Proper link to P3P policy website. #551
• Bugfix: Heatmap and Domstream fixes #567
• Bugfix: Fixing random notice and adding admin notices to WP Plugin

IMPORTANT: OWA's PHP requirements have changed. PHP 5.6 is the new minimum and PHP 7.x is highly recommended.

NOTE: As of this release you must install and run Composer to download dependencies when checking out code from GitHub. See https://github.com/Open-Web-Analytics/Open-Web-Analytics/wiki/Installing-from-Github for more details.

For a fully packaged distribution use: owa_1.6.8_packaged.tar

• Bugfix: WordPress install not working #525

IMPORTANT: OWA's PHP requirements have changed. PHP 5.6 is the new minimum and PHP 7.x is highly recommended.

NOTE: As of this release you must install and run Composer to download dependencies when checking out code from GitHub. See https://github.com/Open-Web-Analytics/Open-Web-Analytics/wiki/Installing-from-Github for more details.

For a fully packaged distribution use: owa_1.6.7_packaged.tar

• Feature: CLI Command to re-crawl Referring URLs #502
• Feature: MySQL port option #500
• Feature: REST API endpoint and new route for adding new site profile #516
• Bugfix: Support for "SameSite" origin changes #505
• Bugfix: Updated repository api url and request logic #501
• Bugfix: Vertical Scrollbar flickering during tracking #498
• Bugfix: Unable to update new WordPress Installation #525
• Bugfix: Referral content showing in crawl results #521

NOTE: As of this release you must install and run Composer to download dependencies when checking out code from GitHub. See https://github.com/Open-Web-Analytics/Open-Web-Analytics/wiki/Installing-from-Github for more details.

IMPORTANT: OWA's PHP requirements have changed. PHP 5.6 is the new minimum and PHP 7.x is highly recommended.

For a fully packaged distribution use: owa_1.6.6_packaged.tar

Bug Fixes:

• #491 Setting Options from WordPress admin page is broken
• #477 Update user parser to latest version

Features:

• Added support for using Composer to manage dependencies.

Bug fix and minor feature release:

• Bugfix: referring URL doc titles are not getting fetched #484
• Bugfix: hide admin links when user has no permissions #465
• Bugfix: visitor avatar not showing #456
• Bugfix: tracking params being escaped incorrectly #459
• Bugfix: PHP 7.4 comparability #461
• Bugfix: fix visit announcement emails: #463
• Bugfix: Fix for secondary dimension joins #473
• Feature: global cookie persistence setting. #472
• Feature: ability to override location param in tracker #471
• Feature: ability to add custom user name for default admin
• Feature: change user password CLI command. #487

Many thanks to @Maaiins for all the hard work on this release!!

• Added support for proxy servers that may pass multiple IP addresses to OWA
• fixing broken tracking tag output
• fixed warnings for use of deprecated functions in the WordPress plugin
• fixed issue with MySQL table creation failing due to redundant primary key definition.

Bug fixes and better alignment with GDPR.

Multiple fixes for PHP 7 and 7.1 compatibility.

Fixes install bug.

• Fixes potential XSS exploit reported by @0xMitsurugi
• Fixes broken heat map and domstream playback
• Converted owa_overlay cookie store to JSON string for uniformity with other cookies.
• removes the use of antiquated input filter class for input sanitization.
• Removes hostip as the default geolocation provider

This release fixes numerous bugs including a XSS vulnerability reported by @strukt93.

In addtion, this is the first release that includes a refactoring of the core event processing pipeline which includes the following features:

• PHP 5.3 is now a requirement.
• All event properties are now filterable.
• Events processing can be hooked in several places in order to operate on the event before/during/after processing
• When events are queued, OWA does does the absolute minimum to new events before writing them to the incoming_tracking_events queue.