Mike Cao
e9925f2e4e
Sanitize CSV exports against formula injection
2026-06-03 00:00:37 -07:00
Mike Cao
306ca4a435
Lint format files. Updated rng function.
2026-06-02 22:35:07 -07:00
Mike Cao
5bf1792b38
Restrict team owner assignment to admins
2026-06-02 22:17:10 -07:00
Mike Cao
44c6b4427f
Add schema to realtime route.
2026-06-02 22:07:46 -07:00
Mike Cao
46819a4443
Enforce team role hierarchy on user updates and removals
2026-06-02 21:32:34 -07:00
Mike Cao
fded75f940
Use authenticated Redis key on logout
2026-06-02 17:46:08 -07:00
Mike Cao
a9beebf1a9
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-06-02 17:26:59 -07:00
Mike Cao
d44592ddb5
Validate SSO redirect URLs before setting auth token
2026-06-02 17:26:48 -07:00
Mike Cao
72611027b7
Merge pull request #4316 from umami-software/codex/umami-GHSA-w7hf-qxh9-2cm3
...
Limit batch API payloads to 500 items
2026-06-02 19:59:21 -04:00
Mike Cao
9ba5fb7c1b
Limit batch API payloads to 500 items
2026-06-02 16:54:35 -07:00
Mike Cao
ade0819be1
Tighten API access checks by website section and share permissions
2026-06-02 15:29:23 -07:00
Mike Cao
8bc49a29e3
Fix share token confusion vulnerability
...
Cache tokens from /api/send and share tokens were both signed with the same secret and parsed without distinguishing claim types, allowing a public cache token to be replayed as x-umami-share-token to read any website's analytics. Add explicit token type claims (share/cache) and require the matching type when parsing each.
2026-06-02 14:45:21 -07:00
Mike Cao
e28309f8f7
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-28 13:37:42 -07:00
Francis Cao
5565182f3b
fix heatmap viewport stretching. Polish UI/tooltips
2026-05-28 10:40:07 -07:00
Mike Cao
aba1fea238
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-26 20:45:25 -07:00
Mike Cao
c41bf7c93e
Enforce cloud website limits by subscription tier
2026-05-26 20:45:07 -07:00
Francis Cao
7ac3f1eecc
fix export build errors
2026-05-26 16:00:46 -07:00
Francis Cao
a63c769ab6
fix error messaging.
2026-05-26 15:57:00 -07:00
Mike Cao
454e53dd48
Rename website chart board component
2026-05-25 02:49:13 -07:00
Francis Cao
b5d56a2a29
remove unused replay snapshot path before merge
2026-05-22 11:09:57 -07:00
Francis Cao
462be82782
swap out S3 for R2 for heatmap storage
2026-05-22 10:47:56 -07:00
Francis Cao
5bd92ce950
implement sepearte replay/heatmap enabled routes and collection
2026-05-19 15:46:01 -07:00
Francis Cao
4b40be6b5a
fix overlay for 0%
2026-05-19 12:13:31 -07:00
Francis Cao
afab485874
polish UI/UX color bands, add install-heatmap command
2026-05-19 12:11:48 -07:00
Francis Cao
6de5adaefc
POC for playwright based screenshots for heatmaps
2026-05-19 11:32:15 -07:00
Francis Cao
1f3f805a30
WIP heatmap full-page coordinate and replay rendering work
2026-05-19 09:05:11 -07:00
Mike Cao
1dda7bddcd
Merge pull request #4142 from nielskaspers/fix/issue-3981-case-insensitive-login
...
fix: make username login case-insensitive
2026-05-14 23:49:04 -04:00
Mike Cao
5e39485313
Merge pull request #4236 from SAYOUNCDR/fix/firefox-autofill-login-fields
...
fix: normalize autofill styles across browsers
2026-05-14 23:23:53 -04:00
Mike Cao
c7515ff230
fix: merge DataGrid layout + add min width to sessions location column
2026-05-14 20:10:10 -07:00
Francis Cao
aa9b6c0ca3
heatmaps UI polish, finish feature gate + messaging, overlay bug fixes
2026-05-14 15:18:29 -07:00
Francis Cao
cd20b3aafd
Heatmaps bug fixes, update schema to match overlay, use react-zen component to match ui/ux, polish
2026-05-14 14:23:41 -07:00
Francis Cao
483b0619d2
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-14 09:51:30 -07:00
Francis Cao
3f3000c2fd
Fix LinksTable merge
2026-05-14 09:51:28 -07:00
Mike Cao
a9a4ad0f68
Reset event property state when event changes
2026-05-14 09:45:34 -07:00
Mike Cao
c6733897b4
Fetch recorder settings from website config endpoint
2026-05-14 03:26:24 -07:00
Mike Cao
c724f42daf
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-14 03:02:48 -07:00
Mike Cao
a47b32718d
Merge branch 'dev' into fix/links-table-truncate-urls
2026-05-14 06:02:14 -04:00
Mike Cao
0157c23922
Merge branch 'master' into dev
2026-05-14 02:56:13 -07:00
Mike Cao
9c1db27218
Merge pull request #4099 from sputnik-mac/fix/redirect-logged-in-user-from-login-4094
...
fix: redirect logged-in users from login page to dashboard
2026-05-14 05:55:33 -04:00
Francis Cao
b7e1d902f4
seperate revenue queries for better api/performance. Fix realtime css/ui issues.
2026-05-12 16:44:12 -07:00
Francis Cao
c6ec8385c9
Add revenue chart cumulative mode.
2026-05-12 10:32:43 -07:00
Francis Cao
fa182d0947
implement URL pageview metric/expanded metric
2026-05-07 16:59:30 -07:00
Mike Cao
6c2155d496
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-07 14:54:25 -07:00
Mike Cao
9b18511af0
Merge branch 'heatmaps' into dev
...
# Conflicts:
# db/clickhouse/schema.sql
2026-05-07 14:49:21 -07:00
Mike Cao
6be5b61442
Wait for heatmap snapshot before overlay
2026-05-07 14:06:49 -07:00
Mike Cao
923b94ae8e
Render heatmaps from replay snapshots
2026-05-07 13:59:30 -07:00
Francis Cao
b7084bb90a
Merge branch 'dev' into fix/delete-cascade
2026-05-07 13:58:29 -07:00
Mike Cao
9c31e7b601
Fix heatmap iframe sizing
2026-05-07 13:52:41 -07:00
Francis Cao
9b099408c2
add share page options enable filtering and enforce theme
2026-05-07 13:24:45 -07:00
Francis Cao
5ccfb6d0a5
implement datatable sorting on non-analytics tables. (website/board/link/pixel/team/admin)
2026-05-07 10:46:03 -07:00
Mike Cao