Update analytics code.

This commit is contained in:
James Cole 2020-01-17 04:30:44 +01:00
parent 3852dbeacc
commit ff44dbaea0
No known key found for this signature in database
GPG Key ID: C16961E655E74B5E
9 changed files with 73 additions and 63 deletions

View File

@ -110,7 +110,8 @@ CER_PROVIDER=fixer
FIXER_API_KEY=
# If you wish to track your own behavior over Firefly III, set a valid analytics tracker ID here.
ANALYTICS_ID=
TRACKER_SITE_ID=
TRACKER_URL=
# Most parts of the database are encrypted by default, but you can turn this off if you want to.
# This makes it easier to migrate your database. Not that some fields will never be decrypted.

View File

@ -117,9 +117,6 @@ CER_PROVIDER=ratesapi
# the free API up to the point where you might as well offer nothing.
FIXER_API_KEY=
# If you wish to track your own behavior over Firefly III, set a valid analytics tracker ID here.
ANALYTICS_ID=
# Firefly III has two options for user authentication. "eloquent" is the default,
# and "ldap" for LDAP servers.
# For full instructions on these settings please visit:
@ -171,6 +168,13 @@ DISABLE_FRAME_HEADER=false
# This is at your own risk.
DISABLE_CSP_HEADER=false
# If you wish to track your own behavior over Firefly III, set valid analytics tracker information here.
# Nobody uses this except for me on the demo site. But hey, feel free to use this if you want to.
# Do not prepend the TRACKER_URL with http:// or https://
# The only tracker supported is Matomo.
TRACKER_SITE_ID=
TRACKER_URL=
# You can fine tune the start-up of a Docker container by editing these environment variables.
# Use this at your own risk. Disabling certain checks and features may result in lost of inconsistent data.
# However if you know what you're doing you can significantly speed up container start times.

View File

@ -16,11 +16,10 @@ I am running Firefly III version x.x.x, and my problem is:
<!-- Please add extra info here, such as OS, browser, and the output from the /debug page of your Firefly III installation (click the version at the bottom). -->
**Bonus points**
<!-- Earn bonus points by:
<!-- Earn bonus points by checking the boxes -->
- Post a stacktrace from your log files
- Add a screenshot
- Make a drawing
- Donate money (just kidding ;)
- Replicate the problem on the demo site https://demo.firefly-iii.org/
-->
- [ ] Nobody reported this bug before
- [ ] I have added a stack trace from my log files.
- [ ] I have added a screenshot.
- [ ] I was able to replicate it on the demo site https://demo.firefly-iii.org/
<!-- - [ ] I donated money (this is a joke :wink:)-->

View File

@ -47,18 +47,17 @@ class SecureHeaders
$nonce = base64_encode(random_bytes(16));
app('view')->share('JS_NONCE', $nonce);
$response = $next($request);
$googleScriptSrc = $this->getGoogleScriptSource();
$googleImgSrc = $this->getGoogleImgSource();
$csp = [
$response = $next($request);
$trackingScriptSrc = $this->getTrackingScriptSource();
$csp = [
"default-src 'none'",
"object-src 'self'",
sprintf("script-src 'unsafe-inline' 'nonce-%1s' %2s", $nonce, $googleScriptSrc),
sprintf("script-src 'unsafe-inline' 'nonce-%1s' %2s", $nonce, $trackingScriptSrc),
"style-src 'self' 'unsafe-inline'",
"base-uri 'self'",
"font-src 'self' data:",
"connect-src 'self'",
sprintf("img-src 'self' data: https://api.tiles.mapbox.com %s", $googleImgSrc),
sprintf("img-src 'self' data: https://api.tiles.mapbox.com %s", $trackingScriptSrc),
"manifest-src 'self'",
];
@ -99,27 +98,15 @@ class SecureHeaders
return $response;
}
/**
* @return string
*/
private function getGoogleImgSource(): string
{
if ('' !== config('firefly.analytics_id')) {
return 'www.google-analytics.com';
}
return '';
}
/**
* Return part of a CSP header allowing scripts from Google.
*
* @return string
*/
private function getGoogleScriptSource(): string
private function getTrackingScriptSource(): string
{
if ('' !== config('firefly.analytics_id')) {
return 'www.googletagmanager.com www.google-analytics.com';
if ('' !== (string)config('firefly.tracker_site_id') && '' !== (string)config('firefly.tracker_url')) {
return (string)config('firefly.tracker_url');
}
return '';

View File

@ -152,7 +152,8 @@ return [
'trusted_proxies' => env('TRUSTED_PROXIES', ''),
'search_result_limit' => env('SEARCH_RESULT_LIMIT', 50),
'send_report_journals' => envNonEmpty('SEND_REPORT_JOURNALS', true),
'analytics_id' => env('ANALYTICS_ID', ''),
'tracker_site_id' => env('TRACKER_SITE_ID', ''),
'tracker_url' => env('TRACKER_URL', ''),
'disable_frame_header' => env('DISABLE_FRAME_HEADER', false),
'disable_csp_header' => env('DISABLE_CSP_HEADER', false),
'login_provider' => envNonEmpty('LOGIN_PROVIDER', 'eloquent'),

View File

@ -204,18 +204,22 @@
{% endif %}
{% block scripts %}{% endblock %}
{% if config('firefly.analytics_id') != '' %}
<!-- Global site tag (gtag.js) - Google Analytics -->
<!-- This tag is only here because this instance of Firefly III was purposefully configured to include it -->
<!-- Your own installation will NOT include it -->
<script type="text/javascript" async src="https://www.googletagmanager.com/gtag/js?id={{ config('firefly.analytics_id') }}" nonce="{{ JS_NONCE }}"></script>
{% if config('firefly.tracker_site_id') != '' and config('firefly.tracker_url') != '' %}
<!-- This tracker tag is only here because this instance of Firefly III was purposefully configured to include it -->
<!-- Your own installation will NOT include it, unless you explicitely configure it to have it. -->
<script type="text/javascript" nonce="{{ JS_NONCE }}">
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', '{{ config('firefly.analytics_id') }}');
var _paq = window._paq || [];
_paq.push(['trackPageView']);
_paq.push(['enableLinkTracking']);
(function() {
var u="//{{ config('firefly.tracker_url') }}/";
_paq.push(['setTrackerUrl', u+'matomo.php']);
_paq.push(['setSiteId', '{{ config('firefly.tracker_site_id') }}']);
var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
g.type='text/javascript'; g.async=true; g.defer=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s);
})();
</script>
<noscript><p><img src="//{{ config('firefly.tracker_url') }}/matomo.php?idsite=1&amp;rec=1" style="border:0;" alt="" /></p></noscript>
{% endif %}
</body>

View File

@ -42,18 +42,24 @@
</div>
<script src="v1/js/app.js?v={{ FF_VERSION }}" type="text/javascript" nonce="{{ JS_NONCE }}"></script>
{% if config('firefly.analytics_id') != '' %}
<!-- Global site tag (gtag.js) - Google Analytics -->
<!-- This tag is only here because this instance of Firefly III was purposefully configured to include it -->
<!-- Your own installation will NOT include it -->
<script type="text/javascript" async src="https://www.googletagmanager.com/gtag/js?id={{ config('firefly.analytics_id') }}" nonce="{{ JS_NONCE }}"></script>
<script type="text/javascript" nonce="{{ JS_NONCE }}">
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', '{{ config('firefly.analytics_id') }}');
{% if config('firefly.tracker_site_id') != '' and config('firefly.tracker_url') != '' %}
<!-- This tracker tag is only here because this instance of Firefly III was purposefully configured to include it -->
<!-- Your own installation will NOT include it, unless you explicitely configure it to have it. -->
<script type="text/javascript" nonce="{{ JS_NONCE }}">
var _paq = window._paq || [];
_paq.push(['trackPageView']);
_paq.push(['enableLinkTracking']);
(function() {
var u="//{{ config('firefly.tracker_url') }}/";
_paq.push(['setTrackerUrl', u+'matomo.php']);
_paq.push(['setSiteId', '{{ config('firefly.tracker_site_id') }}']);
var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
g.type='text/javascript'; g.async=true; g.defer=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s);
})();
</script>
<noscript><p><img src="//{{ config('firefly.tracker_url') }}/matomo.php?idsite=1&amp;rec=1" style="border:0;" alt="" /></p></noscript>
{% endif %}
</body>
</html>

View File

@ -57,18 +57,24 @@
</div>
<script src="v1/js/app.js?v={{ FF_VERSION }}" type="text/javascript" nonce="{{ JS_NONCE }}"></script>
<script type="text/javascript" src="v1/js/ff/guest.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
{% if config('firefly.analytics_id') != '' %}
<!-- Global site tag (gtag.js) - Google Analytics -->
<!-- This tag is only here because this instance of Firefly III was purposefully configured to include it -->
<!-- Your own installation will NOT include it -->
<script type="text/javascript" async src="https://www.googletagmanager.com/gtag/js?id={{ config('firefly.analytics_id') }}" nonce="{{ JS_NONCE }}"></script>
<script type="text/javascript" nonce="{{ JS_NONCE }}">
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', '{{ config('firefly.analytics_id') }}');
{% if config('firefly.tracker_site_id') != '' and config('firefly.tracker_url') != '' %}
<!-- This tracker tag is only here because this instance of Firefly III was purposefully configured to include it -->
<!-- Your own installation will NOT include it, unless you explicitely configure it to have it. -->
<script type="text/javascript" nonce="{{ JS_NONCE }}">
var _paq = window._paq || [];
_paq.push(['trackPageView']);
_paq.push(['enableLinkTracking']);
(function() {
var u="//{{ config('firefly.tracker_url') }}/";
_paq.push(['setTrackerUrl', u+'matomo.php']);
_paq.push(['setSiteId', '{{ config('firefly.tracker_site_id') }}']);
var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
g.type='text/javascript'; g.async=true; g.defer=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s);
})();
</script>
<noscript><p><img src="//{{ config('firefly.tracker_url') }}/matomo.php?idsite=1&amp;rec=1" style="border:0;" alt="" /></p></noscript>
{% endif %}
</body>
</html>

View File

@ -71,6 +71,8 @@ class SecureHeadersTest extends TestCase
}
/**
* TODO this test tests nothing.
*
* @covers \FireflyIII\Http\Middleware\SecureHeaders
*/
public function testMiddlewareGoogleAnalytics(): void