Skip to content

Simple Kuma V 1.1.5

Latest
Latest

Choose a tag to compare

View all tags
@kumatrk kumatrk released this 26 May 18:41
Simple_Kuma_V1.1.5
37eeca9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Here’s a GitHub release writeup you can paste for v1.1.5:

Simple Kuma Tracker v1.1.5

Release date: July 1, 2026
Package: simplekuma-v1.1.5.zip (document root = public/)

This release focuses on Google Safe Browsing hardening, cleaner tracking URLs for new installs, and API stats improvements. It is intended for fresh deployments and upgrades from v1.1.4.

Google Safe Browsing & admin hardening

Addresses false “Dangerous site” / social-engineering flags seen on fresh domains (e.g. index.php?page=campaigns on the same host as click tracking).

  • Campaigns route renamed: Admin UI uses ?page=campaign-list instead of the fingerprinted ?page=campaigns. Legacy GET requests to ?page=campaigns redirect to campaign-list.
  • Crawl discouragement: X-Robots-Tag: noindex, nofollow on admin pages; public/robots.txt disallows admin/auth/API surfaces.
  • No sensitive data in campaign list HTML: “Get tracking link” buttons only expose data-campaign-id. Tokens, macros, slugs, and URLs load on demand via authenticated api-campaign-tracking-link.php (401 when not logged in).
  • cloak.php deprecated: Open ?to= redirect removed; endpoint returns 410 Gone. Referrer privacy uses signed kumahop.php instead.
  • UI terminology: “Cloaking” renamed to referrer privacy / bear-hop language (migration 061: cloaking_mode → referrer_mode, backward compatible).
  • Installer guardrails: Warns/blocks same-host BASE_URL (admin + tracking on one domain) unless explicitly acknowledged; post-install Safe Browsing checklist on complete step.
  • Docs: docs/SAFE_BROWSING_CAMPAIGNS.md (operator root-cause guide; not shipped in production zip).

New default click URLs (go.php?k=)

Reduces the cross-install /km/{key} fingerprint for new installs while keeping legacy links working.

New installs Legacy / upgrades
Generated links https://track.example.com/go.php?k={campaign_key} /km/{key} if config constants unset
Legacy ads N/A /km/… still works via .htaccess
  • public/go.php — neutral entry point (shared handler with km.php)
  • ClickPath — central URL builder with CLICK_URL_STYLE (query | path), CLICK_ENTRY_SCRIPT, CLICK_PATH_PREFIX
  • Pretty mode (optional): CLICK_URL_STYLE=path → /go/{key}
  • Installer writes query-style defaults into new config.php
  • .htaccess — /go/ pretty rewrites; /km/ and /c/ kept for backward compatibility

API & stats

  • Grouped campaign stats: GET /api/v1/stats/campaigns/{id}?group_by=... — paginated breakdowns by date, country, browser, OS, ISP, landing page, offer, and traffic-source tokens (e.g. zoneid/subid). meta.totals matches the campaign summary for the same range.
  • lp_clicks metric: Summary and grouped stats include landing-page click counts alongside visits.
  • API docs: Kuma API reference updated for grouped stats parameters and response shapes.

Version display

  • Sidebar, login/forgot/reset footers, and Settings → About read version from version.php (no more hardcoded 1.1.4 strings).

Production packaging

  • Built with php scripts/create-deployment-package.php (allowlist-based; no dev/debug/repair scripts).
  • Ships: go.php, api-campaign-tracking-link.php, robots.txt, kumahop.php, REST API v1, etc.
  • Excludes: config/config.php, .env, demo landing pages under public/landing-pages/, docs, debug/test utilities.

Upgrade notes (v1.1.4 → v1.1.5)

  1. Back up DB and config/config.php.
  2. Deploy zip; point document root to public/.
  3. Run migrations (includes 061 if not already applied).
  4. Optional — adopt new click URL shape (add to config/config.php):
define('CLICK_URL_STYLE', 'query');
define('CLICK_ENTRY_SCRIPT', 'go.php');
define('CLICK_PATH_PREFIX', 'go');
  1. Recommended: Use a dedicated tracking subdomain for BASE_URL; do not run click traffic on the admin host.
  2. Existing /km/ ad links keep working — no need to change live campaigns unless you want new links to use go.php?k=.
  3. If previously flagged by Safe Browsing: migrate tracking to a clean subdomain, then request a review after deploy.
Assets 3
Loading