add token_auth to overlay requests where necessary

core/View.php

@@ -11,6 +11,7 @@
 use Exception;
 use Piwik\AssetManager\UIAssetCacheBuster;
 use Piwik\Container\StaticContainer;
+use Piwik\Session\SessionAuth;
 use Piwik\View\ViewInterface;
 use Piwik\View\SecurityPolicy;
 use Twig\Environment;
@@ -465,7 +466,19 @@ public static function singleReport($title, $reportHtml)
     private function shouldPropagateTokenAuthInAjaxRequests()
     {
         $generalConfig = Config::getInstance()->General;
-        return Common::getRequestVar('module', false) == 'Widgetize' || $generalConfig['enable_framed_pages'] == '1';
+        return Common::getRequestVar('module', false) == 'Widgetize' ||
+            $generalConfig['enable_framed_pages'] == '1' ||
+            $this->validTokenAuthInUrl();
+    }
+
+    /**
+     * @return bool
+     * @throws Exception
+     */
+    private function validTokenAuthInUrl()
+    {
+        $tokenAuth = Common::getRequestVar('token_auth', '', 'string', $_GET);
+        return ($tokenAuth && $tokenAuth === Piwik::getCurrentUserTokenAuth());
     }
 
     /**

plugins/Annotations/javascripts/annotations.js

@@ -112,6 +112,7 @@
 
             var ajaxRequest = new ajaxHelper();
             ajaxRequest.addParams(ajaxParams, 'get');
+            ajaxRequest.withTokenInUrl();
             ajaxRequest.setFormat('html');
             ajaxRequest.setCallback(callback);
             ajaxRequest.send();

plugins/CoreHome/angularjs/common/services/piwik-api.js

@@ -338,7 +338,7 @@ var hasBlockedContent = false;
         }
 
         return {
-            withTokenInUrl: withTokenInUrl,
+            withTokenInUrl: withTokenInUrl, // technically should probably be called withTokenInPost
             bulkFetch: bulkFetch,
             post: post,
             fetch: fetch,

plugins/CoreHome/angularjs/widget-loader/widgetloader.directive.js

@@ -114,7 +114,10 @@
                         }
 
                         if (piwik.shouldPropagateTokenAuth && broadcast.getValueFromUrl('token_auth')) {
-                            url += '&force_api_session=1&token_auth=' + broadcast.getValueFromUrl('token_auth');
+                            if (!piwik.broadcast.isWidgetizeRequestWithoutSession()) {
+                                url += '&force_api_session=1';
+                            }
+                            url += '&token_auth=' + encodeURIComponent(broadcast.getValueFromUrl('token_auth'));
                         }
 
                         url += '&random=' + parseInt(Math.random() * 10000);

plugins/CoreHome/javascripts/broadcast.js

@@ -176,7 +176,6 @@ var broadcast = {
             }
         }
     },
-
     isWidgetizedDashboard: function() {
         return broadcast.getValueFromUrl('module') == 'Widgetize' && broadcast.getValueFromUrl('moduleToWidgetize') == 'Dashboard';
     },

plugins/CoreHome/javascripts/dataTable_rowactions.js

@@ -474,6 +474,7 @@ DataTable_RowActions_RowEvolution.prototype.showRowEvolution = function (apiMeth
 
     var ajaxRequest = new ajaxHelper();
     ajaxRequest.addParams(requestParams, 'get');
+    ajaxRequest.withTokenInUrl();
     ajaxRequest.setCallback(callback);
     ajaxRequest.setFormat('html');
     ajaxRequest.send();

plugins/Live/javascripts/SegmentedVisitorLog.js

@@ -135,6 +135,7 @@ var SegmentedVisitorLog = function() {
 
         var ajaxRequest = new ajaxHelper();
         ajaxRequest.addParams(requestParams, 'get');
+        ajaxRequest.withTokenInUrl();
         ajaxRequest.setCallback(callback);
         ajaxRequest.setFormat('html');
         ajaxRequest.send();

plugins/Live/javascripts/visitorProfile.js

@@ -156,7 +156,10 @@
             $element.on('mousedown', '.visitor-profile-export', function (e) {
                 var url = $(this).attr('href');
                 if (url.indexOf('&token_auth=') == -1) {
-                    $(this).attr('href', url + '&force_api_session=1&token_auth=' + piwik.token_auth);
+                    if (!piwik.broadcast.isWidgetizeRequestWithoutSession()) {
+                        url += '&force_api_session=1';
+                    }
+                    $(this).attr('href', url + '&token_auth=' + piwik.token_auth);
                 }
             });
 

plugins/Overlay/javascripts/Overlay_Helper.js

@@ -29,7 +29,10 @@ var Overlay_Helper = {
 
         var token_auth = piwik.broadcast.getValueFromUrl("token_auth");
         if (token_auth.length && piwik.shouldPropagateTokenAuth) {
-            url += '&force_api_session=1&token_auth='  + encodeURIComponent(token_auth);
+            if (!piwik.broadcast.isWidgetizeRequestWithoutSession()) {
+                url += '&force_api_session=1';
+            }
+            url += '&token_auth='  + encodeURIComponent(token_auth);
         }
 
         if (link) {

plugins/Overlay/javascripts/Piwik_Overlay.js

@@ -50,6 +50,7 @@ var Piwik_Overlay = (function () {
         globalAjaxQueue.abort();
         var ajaxRequest = new ajaxHelper();
         ajaxRequest.addParams(params, 'get');
+        ajaxRequest.withTokenInUrl(); // needed because it is calling a controller and not the API
         ajaxRequest.setCallback(
             function (response) {
                 hideLoading();

plugins/Overlay/templates/index.twig

@@ -73,7 +73,10 @@
 
             var iframeSrc = 'index.php?module=Overlay&action=startOverlaySession&idSite={{ idSite }}&period={{ period }}&date={{ rawDate }}&segment={{ segment }}';
             if (piwik.shouldPropagateTokenAuth) {
-                iframeSrc += '&force_api_session=1&token_auth=' + piwik.token_auth;
+                if (!piwik.broadcast.isWidgetizeRequestWithoutSession()) {
+                    iframeSrc += '&force_api_session=1';
+                }
+                iframeSrc += '&token_auth=' + piwik.token_auth;
             }
 
             Piwik_Overlay.init(iframeSrc, '{{ idSite }}', '{{ period }}', '{{ rawDate }}', '{{ segment }}');

plugins/Overlay/templates/index_noframe.twig

@@ -8,7 +8,10 @@
     <script type="text/javascript">
         var newLocation = 'index.php?module=Overlay&action=startOverlaySession&idSite={{ idSite }}&period={{ period }}&date={{ date }}&segment={{ segment }}';
         if (piwik.shouldPropagateTokenAuth) {
-            newLocation += '&force_api_session=1&token_auth=' + piwik.token_auth;
+            if (!piwik.broadcast.isWidgetizeRequestWithoutSession()) {
+                newLocation += '&force_api_session=1';
+            }
+            newLocation += '&token_auth=' + piwik.token_auth;
         }
 
         var locationParts = window.location.href.split('#');