Send analytics via Plausible's Events API directly instead of its script - #7
Merged
Merged
Conversation
The official Plausible tracking script hard-blocks localhost/private-IP
hostnames client-side, to stop developers polluting their own stats while
building a site. That's the wrong default here: a large share of self-hosted
installs are opened via exactly http://localhost:port or a bare LAN IP, on the
same machine running the panel, in real production use - not dev noise.
Confirmed directly against telemetry.xenne.eu that the block is script-side
only - POSTing straight to its Events API with a localhost URL is accepted
(202 ok) regardless of hostname. Switched index.html to do exactly that: no
more loading the official script tag, just a small fetch() POST for both the
install check-in ("pageview") and the existing server-stats custom event.
Domain is now rustrconservermanager.xenne.eu, matching the dedicated Plausible
site created for this panel (rather than the general xenne.eu site used
during initial testing).
Verified: direct POST to the Events API succeeds with a localhost URL, the
rebuilt container serves the updated script, and the dedicated Plausible
dashboard registers a pageview when opening the panel over plain localhost.
Xenne93
added a commit
that referenced
this pull request
Aug 16, 2026
* Fix GitHub Code Scanning alerts (Security and quality) - Add explicit permissions blocks to build-check.yml and remove-old-packages.yml workflows (actions/missing-workflow-permissions) - Add missing admin check to PanelSettingsController.PurgeData, which previously let any authenticated user (including moderators) purge all logged data including audit logs - Add path-containment validation to MapStorageService (GetServerImageFilePath) using Path.GetFullPath + base-directory prefix check, closing an unauthenticated arbitrary-file-read via PublicImagesController's fast disk-read path using an unvalidated instanceHash route parameter (cs/path-injection) - Harden Discord webhook URL validation in ServerWebhookController.TestWebhook to check uri.Host/AbsolutePath explicitly instead of a raw substring .Contains() match - Clean up RconController.DeleteServer to return NotFound on a missing/ non-owned server instead of relying on a NullReferenceException falling through to a broad catch block - Add a shared LogSanitizer helper and use it to strip CR/LF from every user-controlled string value before it reaches a logger call across 18 files (cs/log-forging), converting any remaining string-interpolated log calls to structured logging with named placeholders along the way - Replace User.GetEmail() with a non-PII user identifier (resolved user object's Id, or the NameIdentifier claim) in every log call that previously logged the user's email address (cs/exposure-of-sensitive-information) - Mask the recipient address in EmailService's log calls instead of logging it in full - Dismiss 4 alerts confirmed as false positives via the Code Scanning API, each with a documented reason (cs/cleartext-storage-of-sensitive-information #7, cs/user-controlled-bypass #4, #5, #6) * test: inline Replace() sanitizer instead of helper method to validate CodeQL barrier recognition * Replace LogSanitizer helper with inline .Replace() calls CodeQL's cs/log-forging barrier recognition requires the sanitizing .Replace() call to appear directly in the tainted expression, not routed through a custom static helper method - validated empirically via a live re-scan (helper-based fix cleared only 1/65 alerts, one inlined call site cleared immediately). Converted every remaining call site accordingly and removed the now-dead LogSanitizer helper. * Fix remaining 4 alerts: sanitize steamId logging, drop email from EmailService diagnostics - PanelSettingsController: sanitize steamId in VAC-ban override log calls (cs/log-forging) - EmailService: stop logging even a masked form of the recipient address, since CodeQL treats any value derived from the tainted parameter as still-sensitive regardless of transformation (cs/exposure-of-sensitive-information); removed the now-unused MaskEmail helper
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The official Plausible script hard-blocks localhost/private-IP hostnames client-side, but a large share of self-hosted installs are opened via exactly that. Confirmed the block is script-side only - Plausible's Events API accepts a localhost URL fine (202 ok). Switched to POSTing directly to the Events API instead of loading the official script.
Also updates the tracked domain to rustrconservermanager.xenne.eu (the dedicated Plausible site), replacing the xenne.eu default used during initial testing.
Verified: direct API POST with a localhost URL succeeds, and the dedicated Plausible dashboard registers a pageview when opening the panel over plain localhost.