Dashboard & Sparklines should work when embedded with token_auth

[mattab]

Bugs/limitations in "Widgets/Embed" feature:

• Dashboard widgets not working with token_auth http://forum.piwik.org/read.php?2,36811
• Clicks on icon don't forward token_auth: http://forum.piwik.org/read.php?2,42091#entry42151
• Sparklines don't work in embedded reports containing sparklines
  • the token_auth parameter is not set in the sparkline URL
  • AND token_auth won't actually authenticate the sparkline
    Report in http://forum.piwik.org/read.php?2,84098

See other report in duplicated #2451

See also related feature request #283

[mattab]

Also, embed widgets switch to Graph (Pie or vertical bar) always show "No data for this graph" while tag clouds and table work.

Probably token_auth not forwarded correctly or something similar..

[mattab]

(In [2875]) Refs #1353 Switching to display graph now work

[jonpasquier]

Here is a patch that forward the token_auth to the Live widget.

With this patch AJAX calls made from the Live widget are made with the token_auth parameter.

This allows embedding the Live widget into a page without having to grant anonymous view permission.

[jonpasquier]

Attachment:
live_plugin_with_token_forwarding.pacth

[anonymous-matomo-user]

Is this problem just about some widgets? I think the token_auth function is generally not working and not only a widget here and there. In my case it is absolutly important, because I include Piwik in my project as a suubstantial part and I think the developers outside won't include Piwik, if the option to include Piwik as a part of their services isn't working. So I really hope that this fdeature will be fixed in the near future.

[robocoder]

The Live widget can be fixed.

The Dashboard isn't a widget, and wasn't designed to be embedded outside of Piwik.

[mattab]

jpasquier, thanks for your patch. I created a ticket at: #2068

bronco, all widgets should work with token_auth except Live and Dashboard. Let us know if you have issues.

vipsoft, Dashboard is not a widget, but because we display the link to the embeddable dashboard in the Widgets page, users might expect it to work with token_auth. This is low priority though (in particular, fixing Live! to work with token_auth is more important)

[anonymous-matomo-user]

Hello vipsoft,

I think I have to disagree. The dashboard is maybe not a widget but it has the potential to grow the usability of piwik.

I work on a project where users can create domains and organise them as well. One of the parts of the service is the own piwik user tracker similar to google. I try to make it easy as possible for the webmaster to do his business. So he see on the domain node all his informations included under several tabs. Also the piwik dashboard is a tab for easy using.

I can't tell the webmaster hey sorry I can't make it easy to show you your personal domain user data and statistics you have to klick -> piwik autologin(for easy login) -> landing on the website overview -> choose there your domain.???

I think in my personal opinion piwik is made for webmaster and I also think they got enough work to do so why should I make it more complicated then nessesary??

I mean Piwik is great absolutely but this small feature that auth tokens should just work enhances the flexibility,usability of piwik and for the user of piwik the webmaster.

This thread has now his age to make a desicion what should happen with this request? Maybe others would also like to include piwik in his programms but they can't of this security bug.

I hope really you could understand my point of view and tell me that u will try to spend a little time on that. I can't believe that this is really a big problem? Or can you offer a secure workaround to make it work?

best wishes bronco

[mattab]

bronco, according to our no bug policy we should indeed fix this issue, my bad. Increasing priority...

[anonymous-matomo-user]

Thx matt for your obligation in this case.

[anonymous-matomo-user]

By the way this bug #2058 is also still open and hopefully gets included in the next updates.

[anonymous-matomo-user]

We are also experiencing this problem, and would love a resolution or patch if possible. Just adding this entry in the hopes of adding weight to the issue.

[anonymous-matomo-user]

Also, in the "Evolution over the last days graph" the selection icon of which values to show doesn't work as a widget also. Same issue, it redirects to the login screen. It would be REALLY nice to fix this since these token_auth issues are unresolved since a long time.

[mattab]

Should be fixed asap now that we have an amazing Dashboard to embed thanks to Stefan great new feature!!

[anonymous-matomo-user]

my fast and dirty fix for graphs of "Evolution graphs" (and others..) is :

File : piwik/plugins/API/API.php

#line 91 aprox.

Replace:

return self::$instance;

for

Piwik_API_Request::reloadAuthUsingTokenAuth(@$_GET);
        return self::$instance;

I Attachment the patch in need case