Mike Cao
0714ebdbe3
Merge pull request #4397 from Sagittarius/codex/clickhouse-22-date-format
...
fix: support ClickHouse 22 date formats
2026-07-24 21:26:39 -07:00
Francis Cao
f9850f02b3
add session delete feature to relational only. add test, share conditions, and permissions. Closes #2940
2026-07-24 15:47:01 -07:00
Mike Cao
0b31d3a274
Mark Hebrew locale as RTL
2026-07-24 14:36:54 -07:00
Mike Cao
65e810ec79
Add coverage for core utility behavior
2026-07-24 13:52:37 -07:00
Mike Cao
b70eda56e6
Merge pull request #4394 from luca-seemann/fix/client-ip-header-xff-chain
...
Fix client IP resolution when CLIENT_IP_HEADER is set to x-forwarded-for
2026-07-23 15:27:51 -07:00
Mike Cao
33ac648d1f
Merge pull request #4402 from sarmah-rup/fix/format-long-number-billions
...
fix: formatLongNumber shows billions ~1000x too large on metric tiles
2026-07-23 14:21:08 -07:00
Francis Cao
13d18c0880
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-07-23 11:50:39 -07:00
Francis Cao
d05d9c4f34
Session and event property filtering. Closes #2945 . Closes #4008 .
2026-07-23 11:50:35 -07:00
Mike Cao
aafe068bc1
Merge branch 'dev' into feat-2FA
2026-07-23 11:14:59 -07:00
Francis Cao
58ee28a55e
remove session recalculate and related queries
2026-07-21 12:33:41 -07:00
Rup Sarmah
0715aef477
fix(format): divide by 1e9 in formatLongNumber billions branch
...
The billions branch of formatLongNumber divided by 1000000 while
appending the 'b' suffix, so values >= 1e9 rendered about 1000x too
large (1000000000 became '1000.0b' instead of '1.0b'). Divide by
1000000000 to match the 'b' unit, consistent with the sibling
formatLongCurrency. Add regression tests for the billions branch.
2026-07-21 17:52:40 +05:30
Mike Cao
cb801230cc
Fix identified session ID generation
2026-07-19 10:43:21 -07:00
Mike Cao
4691a344c5
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-07-18 01:35:25 -07:00
Mike Cao
bc97f9f439
Enforce a per-plan team limit when creating teams in cloud mode
2026-07-18 01:35:13 -07:00
Vincent Chan
e7c18860f1
fix: support ClickHouse 22 date formats
2026-07-18 03:23:54 +08:00
Francis Cao
8004afe63d
Punycode support. Closes #2170
2026-07-17 10:22:37 -07:00
Luca Seemann
65b508c22a
Fix custom CLIENT_IP_HEADER not parsing x-forwarded-for/forwarded chains
2026-07-17 16:31:06 +02:00
Leon Acosta
2771abc6a7
verify Kafka broker TLS certificate by default
...
When SASL credentials are present, getClient() connected with
`rejectUnauthorized: false`, so the SASL password was sent over a TLS
connection whose broker certificate was never verified — a MITM could
present any certificate and capture the credentials.
Verify by default; set KAFKA_SSL_ALLOW_UNAUTHORIZED=true to opt out for
self-signed brokers.
2026-07-04 18:45:45 +07:00
Francis Cao
735d85c7af
fix channel attribution for organic Facebook traffic. Closes #4297
2026-07-02 11:51:46 -07:00
Francis Cao
4c4071b270
keep createSession raw writes on primary when replicas are enabled
2026-07-01 09:53:08 -07:00
Francis Cao
ab5b1bf354
Board component, security, test updates
2026-06-29 18:17:57 -07:00
Francis Cao
8a0bdc2727
heatmap migration/code clean-up
2026-06-23 15:01:00 -07:00
Francis Cao
3888ec6f4f
Allow legacy stateless tokens that were minted without a password fingerprint.
2026-06-23 13:24:55 -07:00
Francis Cao
9defe7e3e0
Only enforce password-change invalidation for sessions that include a password fingerprint.
2026-06-23 00:27:44 -07:00
Francis Cao
727490269b
Invalidate auth sessions after password changes
2026-06-22 23:31:12 -07:00
Francis Cao
2e74b3ebae
sanitize logging of sensitive info.
2026-06-22 23:03:01 -07:00
Francis Cao
129681ebd7
fix: harden analytics writes and hide internal server errors from client
2026-06-22 22:07:07 -07:00
Francis Cao
c61c01e3bb
implement session replay filters
2026-06-17 11:38:57 -07:00
Francis Cao
f3ce0e64ca
typescript fixes, replayer close error, show page toggle fix.
2026-06-17 10:02:12 -07:00
Mike Cao
05cce05a11
Batch Kafka messages and drop oversized payloads
2026-06-15 22:02:08 -07:00
Mike Cao
95ece5ba56
Normalize replay events for rrweb-player playback
2026-06-15 20:08:53 -07:00
Mike Cao
15038b09d9
Handle fragmented replay events in recording and playback
2026-06-15 13:46:24 -07:00
Mike Cao
f69f76b3b1
Handle invalid IPs and localhost lookup failures in location detection
2026-06-11 19:01:04 -07:00
Mike Cao
475d9548de
Reject oversized replay payloads and chunk recorder flushes
2026-06-10 23:18:50 -07:00
Mike Cao
db01e3a1bb
Lower cloud free website limit to 1
2026-06-09 14:58:10 -07:00
Mike Cao
0c0a3aee65
Propagate unlimited website entitlement through subscription checks
2026-06-09 13:32:52 -07:00
Mike Cao
d2eafd68f7
Allow unlimited cloud websites for subscribed accounts
2026-06-08 17:20:20 -07:00
Mike Cao
de487e572e
Merge branch 'analytics' into dev
2026-06-04 19:56:02 -07:00
Mike Cao
7de662a71e
Revert to external API url.
2026-06-04 17:32:25 -07:00
Francis Cao
4956380942
revert api url changes. exclude auth from API_URL
2026-06-04 14:45:50 -07:00
Francis Cao
8473dea1ca
fix self-hosting auth issue with API_URL missing
2026-06-04 10:19:23 -07:00
Mike Cao
306ca4a435
Lint format files. Updated rng function.
2026-06-02 22:35:07 -07:00
Mike Cao
46819a4443
Enforce team role hierarchy on user updates and removals
2026-06-02 21:32:34 -07:00
Mike Cao
0f36990040
Merge branch 'analytics' into dev
2026-06-02 20:22:32 -07:00
Mike Cao
ade0819be1
Tighten API access checks by website section and share permissions
2026-06-02 15:29:23 -07:00
Mike Cao
8bc49a29e3
Fix share token confusion vulnerability
...
Cache tokens from /api/send and share tokens were both signed with the same secret and parsed without distinguishing claim types, allowing a public cache token to be replayed as x-umami-share-token to read any website's analytics. Add explicit token type claims (share/cache) and require the matching type when parsing each.
2026-06-02 14:45:21 -07:00
Mike Cao
9ced9ac85a
Fixed API_URL handling.
2026-06-02 11:19:33 -07:00
Mike Cao
c41bf7c93e
Enforce cloud website limits by subscription tier
2026-05-26 20:45:07 -07:00
Francis Cao
462be82782
swap out S3 for R2 for heatmap storage
2026-05-22 10:47:56 -07:00
Francis Cao
07e40db5f4
add clickhouse+s3 workflow for heatmaps
2026-05-19 22:41:59 -07:00
Mike Cao