-
-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Closed
Labels
Help wantedBeginner friendly issues or issues where we'd highly appreciate community's help and involvement.Beginner friendly issues or issues where we'd highly appreciate community's help and involvement.c: SecurityFor issues that make Matomo more secure. Please report issues through HackerOne and not in Github.For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
Description
I just noticed that the Web Cron Docs recommends accessing this URL (I just updated it to include https)
https://matomo.your-server.example/path/to/piwik/misc/cron/archive.php?token_auth=XYZ
Sending the admin token via GET isn't ideal, but it seems to be hardcoded:
Line 60 in 7edf461
if(!isset($_GET['token_auth'])) { |
Would it be possible to update the script to support POST (and mention it in the docs) or maybe even recommend people to directly call CoreAdminHome.runCronArchiving
?
simivar
Metadata
Metadata
Assignees
Labels
Help wantedBeginner friendly issues or issues where we'd highly appreciate community's help and involvement.Beginner friendly issues or issues where we'd highly appreciate community's help and involvement.c: SecurityFor issues that make Matomo more secure. Please report issues through HackerOne and not in Github.For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.