Mike Cao
ade0819be1
Tighten API access checks by website section and share permissions
2026-06-02 15:29:23 -07:00
Mike Cao
8bc49a29e3
Fix share token confusion vulnerability
...
Cache tokens from /api/send and share tokens were both signed with the same secret and parsed without distinguishing claim types, allowing a public cache token to be replayed as x-umami-share-token to read any website's analytics. Add explicit token type claims (share/cache) and require the matching type when parsing each.
2026-06-02 14:45:21 -07:00
Mike Cao
c41bf7c93e
Enforce cloud website limits by subscription tier
2026-05-26 20:45:07 -07:00
Francis Cao
462be82782
swap out S3 for R2 for heatmap storage
2026-05-22 10:47:56 -07:00
Francis Cao
07e40db5f4
add clickhouse+s3 workflow for heatmaps
2026-05-19 22:41:59 -07:00
Francis Cao
5bd92ce950
implement sepearte replay/heatmap enabled routes and collection
2026-05-19 15:46:01 -07:00
Francis Cao
a7a0d73dd7
fix PieChart rendering issues by giving default height.
2026-05-18 23:06:47 -07:00
Mike Cao
b6a4c70a7a
Fix IntersectionObserver mock for updated lib.dom.d.ts
2026-05-17 22:34:47 -07:00
Mike Cao
5bcbdc8ced
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-17 21:04:46 -07:00
Mike Cao
0fff8fbb86
Merge branch 'fix-4123' of https://github.com/ElfenB/umami into ElfenB-fix-4123
2026-05-17 21:04:17 -07:00
Francis Cao
3230f6596f
add more truncation fields on save
2026-05-16 17:44:53 -07:00
Mike Cao
c0ea3aefbe
Migrate tests to Vitest
2026-05-14 22:05:34 -07:00
Mike Cao
a48f5aad5f
Merge pull request #4140 from seojcarlos/fix/firefox-events-nan
...
fix: prevent NaN timestamps from breaking event charts in Firefox
2026-05-14 23:28:51 -04:00
Francis Cao
cd20b3aafd
Heatmaps bug fixes, update schema to match overlay, use react-zen component to match ui/ux, polish
2026-05-14 14:23:41 -07:00
Mike Cao
985aa285b2
Merge pull request #4039 from God-2077/umami-v3-dev-2
...
fix: Optimize IP detection logic and add error handling
2026-05-14 05:53:05 -04:00
Mike Cao
0be5b5aa26
Route /auth and /config to local API; everything else uses API_URL
2026-05-13 00:07:30 -07:00
Francis Cao
21b56d2922
add LLM channel logic
2026-05-11 10:31:04 -07:00
Mike Cao
216cf6c448
Migrate test suite from Cypress and Jest to Playwright and Vitest
2026-05-09 01:23:20 -07:00
Mike Cao
2fd319f910
Add configurable internal API URL
2026-05-09 01:06:52 -07:00
Francis Cao
fa182d0947
implement URL pageview metric/expanded metric
2026-05-07 16:59:30 -07:00
Mike Cao
6c2155d496
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-07 14:54:25 -07:00
Mike Cao
9b18511af0
Merge branch 'heatmaps' into dev
...
# Conflicts:
# db/clickhouse/schema.sql
2026-05-07 14:49:21 -07:00
Mike Cao
6672ea04f0
Label generic browser as unknown
2026-05-07 14:30:43 -07:00
Francis Cao
9b099408c2
add share page options enable filtering and enforce theme
2026-05-07 13:24:45 -07:00
Francis Cao
5ccfb6d0a5
implement datatable sorting on non-analytics tables. (website/board/link/pixel/team/admin)
2026-05-07 10:46:03 -07:00
Mike Cao
1b69ce6e90
Add scroll heatmaps.
2026-05-05 10:43:39 -07:00
Mike Cao
2ffa655097
Merge pull request #4224 from JLUpengjiaji/V2.0
...
Flatten JSON data
2026-05-04 19:38:47 -04:00
Francis Cao
fbac7518fc
Add MAX_PAGING_RESULTS on hooks for performance improvements.
2026-05-04 15:43:05 -07:00
Francis Cao
a8c1f26775
remove duration from session property stats
2026-05-04 14:26:27 -07:00
Francis Cao
a113f5be79
query optimizations on session property filters
2026-05-04 12:42:25 -07:00
Francis Cao
d5c48ee75f
clean-up session property string charts and insights.
2026-05-01 12:09:22 -07:00
Francis Cao
ea52adea6b
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-04-29 13:11:06 -07:00
Francis Cao
680a1ca1a2
refactor Property components to be resused for both session/event data. Implement session-data screens + filtering. Remove all event-data specific compoenents/queries
2026-04-29 13:11:03 -07:00
JLUpengjiaji
f6703d3d6d
refactor(data): 重构 JSON 扁平化函数并添加测试
...
- 将 flattenJSON 重构为更简洁的递归实现
- 提取 KeyValueData 接口并导出 createKeyValue 函数
- 添加完整的单元测试覆盖所有功能
2026-04-29 15:04:08 +08:00
Mike Cao
3ebd5a44e8
Fix 500 on /api/send when client IP is malformed.
2026-04-28 19:47:38 -07:00
Mike Cao
a6b13b71db
Add click heatmaps report
...
Extracts click events from rrweb session-replay buffers at write time
into a new heatmap_event table (Prisma + ClickHouse). New /heatmaps
report shows a page picker plus an overlay of click density on the
dominant viewport, with an optional iframe of the live page behind.
2026-04-27 22:20:38 -07:00
Francis Cao
9da332c489
Add Property filters for booleans, dates, arrays
2026-04-27 13:31:47 -07:00
Francis Cao
5a1ef5e674
add event-data support and charts for arrays, booleans, dates
2026-04-24 15:04:59 -07:00
Francis Cao
43fb351ac7
add logic for booleans, dates, arrays
2026-04-24 13:48:28 -07:00
Francis Cao
77dda7268e
add event-data property filtering
2026-04-24 11:39:40 -07:00
Mike Cao
cc829c8f6f
Replace react-spring with motion, fix breaking changes in react-window/date-fns-tz/pure-rand.
2026-04-18 15:41:25 -07:00
Francis Cao
137fd6fd5c
fix ambiguoius session_id errors
2026-04-15 15:12:02 -07:00
Francis Cao
9d477b25b4
Fix share page permissions
2026-04-15 14:55:28 -07:00
Mike Cao
f41c0221c4
fix docker prisma migrate and remove stray query log
2026-04-15 14:22:04 -07:00
Francis Cao
04eb4b675e
3.1 relational bug fixes
2026-04-15 10:31:21 -07:00
Francis Cao
a87d899e17
fix sharetoken permissions on mixed boards
2026-04-13 11:32:47 -07:00
seojcarlos
2cd9657ae1
fix: prevent NaN timestamps from breaking event charts in Firefox
...
When date-fns-tz zonedTimeToUtc returns Invalid Date in Firefox,
the unary + operator produces NaN, which gets sent as "NaN" in
query parameters. Routes using z.coerce.number().int() validation
(events/series, event-data/properties) reject NaN as non-integer,
returning 400 errors and showing "Something went wrong".
This fix:
- Falls back to raw date timestamps when timezone conversion
produces NaN in useDateParameters
- Filters out NaN values in getQueryString to prevent invalid
parameters from reaching the server
Fixes #4121
2026-04-07 21:24:11 +02:00
Ben
3a5e3549d7
fix: include empty or null values
...
fixes #4123
2026-04-01 09:40:11 +00:00
Mike Cao
fb785180d5
Merge branch 'dev' into feat-funnel-per-step-filters
2026-03-25 13:40:12 -07:00
Mike Cao
7582aed67b
Update session replay payload to use { type, payload } format
2026-03-23 16:30:53 -07:00
Mike Cao