Francis Cao
8a75208d5b
fix permissions loop for charts route
2026-07-14 15:23:32 -07:00
Francis Cao
28230ee471
sync bucket labeling
2026-07-08 10:32:16 -07:00
Francis Cao
86b35475c0
Add sparklines to Website, Pixel, Link tables
2026-07-08 10:03:08 -07:00
Francis Cao
7bdc2f215e
harden report references in boards
2026-07-06 10:58:43 -07:00
Francis Cao
a4a0167515
enforce minimum 8 character slug on create/update. Closes #4376
2026-07-04 08:44:23 -07:00
Francis Cao
2efe6297be
implement board clone feature
2026-06-30 08:50:33 -07:00
Francis Cao
ab5b1bf354
Board component, security, test updates
2026-06-29 18:17:57 -07:00
Francis Cao
8a0bdc2727
heatmap migration/code clean-up
2026-06-23 15:01:00 -07:00
Francis Cao
727490269b
Invalidate auth sessions after password changes
2026-06-22 23:31:12 -07:00
Francis Cao
86485e8b52
fix paths to orphaned team-owner
2026-06-22 22:13:55 -07:00
Francis Cao
129681ebd7
fix: harden analytics writes and hide internal server errors from client
2026-06-22 22:07:07 -07:00
Francis Cao
bf886d6224
Merge pull request #4348 from KadirFiratFTW/fix/4347-information-disclosure-returned-in-response
...
fix: Information Disclosure: Internal Prisma & Database Errors Return…
2026-06-22 16:39:10 -07:00
kadirfiratftw
173f28c677
fix: Information Disclosure: Internal Prisma & Database Errors Returned in API Response
2026-06-23 01:51:44 +03:00
Francis Cao
c61c01e3bb
implement session replay filters
2026-06-17 11:38:57 -07:00
Francis Cao
f3ce0e64ca
typescript fixes, replayer close error, show page toggle fix.
2026-06-17 10:02:12 -07:00
Mike Cao
15038b09d9
Handle fragmented replay events in recording and playback
2026-06-15 13:46:24 -07:00
Mike Cao
475d9548de
Reject oversized replay payloads and chunk recorder flushes
2026-06-10 23:18:50 -07:00
Mike Cao
8227589ad9
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-06-09 23:07:24 -07:00
Mike Cao
0c0a3aee65
Propagate unlimited website entitlement through subscription checks
2026-06-09 13:32:52 -07:00
Francis Cao
2df051e216
fix sharetoken permissions for pixels,links,boards, and failed routes
2026-06-08 19:16:01 -07:00
Mike Cao
f09df3cf14
Remove unused config property.
2026-06-04 20:15:57 -07:00
Mike Cao
8a39e98961
Merge pull request #4283 from mturac/fix/3549-runtime-login-env
...
fix: evaluate login mode env at runtime
2026-06-03 23:51:21 -04:00
Mike Cao
d659c5746b
Merge pull request #4317 from umami-software/opencode/nimble-planet
...
Fix board share entity authorization
2026-06-03 23:43:48 -04:00
Mike Cao
c0193ad7cd
Address board share review feedback
2026-06-03 20:29:08 -07:00
Mike Cao
a5f4a39f2b
Fix board share entity authorization
2026-06-03 00:02:54 -07:00
Mike Cao
e9925f2e4e
Sanitize CSV exports against formula injection
2026-06-03 00:00:37 -07:00
Mike Cao
306ca4a435
Lint format files. Updated rng function.
2026-06-02 22:35:07 -07:00
Mike Cao
5bf1792b38
Restrict team owner assignment to admins
2026-06-02 22:17:10 -07:00
Mike Cao
44c6b4427f
Add schema to realtime route.
2026-06-02 22:07:46 -07:00
Mike Cao
46819a4443
Enforce team role hierarchy on user updates and removals
2026-06-02 21:32:34 -07:00
Mike Cao
fded75f940
Use authenticated Redis key on logout
2026-06-02 17:46:08 -07:00
Mike Cao
72611027b7
Merge pull request #4316 from umami-software/codex/umami-GHSA-w7hf-qxh9-2cm3
...
Limit batch API payloads to 500 items
2026-06-02 19:59:21 -04:00
Mike Cao
9ba5fb7c1b
Limit batch API payloads to 500 items
2026-06-02 16:54:35 -07:00
Mike Cao
ade0819be1
Tighten API access checks by website section and share permissions
2026-06-02 15:29:23 -07:00
Mike Cao
8bc49a29e3
Fix share token confusion vulnerability
...
Cache tokens from /api/send and share tokens were both signed with the same secret and parsed without distinguishing claim types, allowing a public cache token to be replayed as x-umami-share-token to read any website's analytics. Add explicit token type claims (share/cache) and require the matching type when parsing each.
2026-06-02 14:45:21 -07:00
Mike Cao
c41bf7c93e
Enforce cloud website limits by subscription tier
2026-05-26 20:45:07 -07:00
Francis Cao
b5d56a2a29
remove unused replay snapshot path before merge
2026-05-22 11:09:57 -07:00
Francis Cao
5bd92ce950
implement sepearte replay/heatmap enabled routes and collection
2026-05-19 15:46:01 -07:00
Francis Cao
6de5adaefc
POC for playwright based screenshots for heatmaps
2026-05-19 11:32:15 -07:00
Francis Cao
1f3f805a30
WIP heatmap full-page coordinate and replay rendering work
2026-05-19 09:05:11 -07:00
mehmet turac
65c46968ad
fix: evaluate login mode env at runtime
2026-05-17 04:52:02 +03:00
Mike Cao
1dda7bddcd
Merge pull request #4142 from nielskaspers/fix/issue-3981-case-insensitive-login
...
fix: make username login case-insensitive
2026-05-14 23:49:04 -04:00
Francis Cao
cd20b3aafd
Heatmaps bug fixes, update schema to match overlay, use react-zen component to match ui/ux, polish
2026-05-14 14:23:41 -07:00
Mike Cao
c6733897b4
Fetch recorder settings from website config endpoint
2026-05-14 03:26:24 -07:00
Francis Cao
b7e1d902f4
seperate revenue queries for better api/performance. Fix realtime css/ui issues.
2026-05-12 16:44:12 -07:00
Mike Cao
6c2155d496
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-07 14:54:25 -07:00
Mike Cao
9b18511af0
Merge branch 'heatmaps' into dev
...
# Conflicts:
# db/clickhouse/schema.sql
2026-05-07 14:49:21 -07:00
Francis Cao
9b099408c2
add share page options enable filtering and enforce theme
2026-05-07 13:24:45 -07:00
Francis Cao
5ccfb6d0a5
implement datatable sorting on non-analytics tables. (website/board/link/pixel/team/admin)
2026-05-07 10:46:03 -07:00
Francis Cao
f463a4ce3f
rename propertyName parameter
2026-05-05 10:48:56 -07:00
Francis Cao