Francis Cao
0a7bd7e6c1
heatmap css fixes
2026-06-16 12:25:32 -07:00
Francis Cao
b51e4b5d12
first pass for self-hosted heatmap rrweb
2026-06-15 10:54:45 -07:00
Mike Cao
475d9548de
Reject oversized replay payloads and chunk recorder flushes
2026-06-10 23:18:50 -07:00
Mike Cao
1118f4b28e
Upgrade rrweb and rrweb-player to 2.0.1
2026-06-10 21:41:24 -07:00
Mike Cao
c80e35efd7
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-06-10 20:26:09 -07:00
Mike Cao
38b5a8d25b
Flush replay events on pagehide with a shorter interval
2026-06-10 20:25:19 -07:00
Francis Cao
6837825512
Fix multiple rows per session bug. Add guard rails for bad data.
2026-06-10 09:44:48 -07:00
Francis Cao
f9cf213261
Add Session Activity guards for showing multiple records per result
2026-06-10 09:18:25 -07:00
Mike Cao
8227589ad9
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-06-09 23:07:24 -07:00
Mike Cao
db01e3a1bb
Lower cloud free website limit to 1
2026-06-09 14:58:10 -07:00
Mike Cao
0c0a3aee65
Propagate unlimited website entitlement through subscription checks
2026-06-09 13:32:52 -07:00
Francis Cao
2df051e216
fix sharetoken permissions for pixels,links,boards, and failed routes
2026-06-08 19:16:01 -07:00
Mike Cao
d2eafd68f7
Allow unlimited cloud websites for subscribed accounts
2026-06-08 17:20:20 -07:00
Francis Cao
264466191e
deterministic order for getReports. Closes #4323
2026-06-05 09:53:45 -07:00
Mike Cao
f09df3cf14
Remove unused config property.
2026-06-04 20:15:57 -07:00
Mike Cao
de487e572e
Merge branch 'analytics' into dev
2026-06-04 19:56:02 -07:00
Mike Cao
7de662a71e
Revert to external API url.
2026-06-04 17:32:25 -07:00
Francis Cao
4956380942
revert api url changes. exclude auth from API_URL
2026-06-04 14:45:50 -07:00
Francis Cao
8473dea1ca
fix self-hosting auth issue with API_URL missing
2026-06-04 10:19:23 -07:00
Mike Cao
a52f32604a
Fixed channel metrics queries.
2026-06-04 02:08:01 -07:00
Mike Cao and GitHub
8a39e98961
Merge pull request #4283 from mturac/fix/3549-runtime-login-env
...
fix: evaluate login mode env at runtime
2026-06-03 23:51:21 -04:00
Mike Cao and GitHub
dc7c4f0246
Merge pull request #4292 from umami-software/blacksmith-migration-c0ea3ae
...
.github/workflows: Migrate workflows to Blacksmith runners
2026-06-03 23:47:25 -04:00
Mike Cao and GitHub
d659c5746b
Merge pull request #4317 from umami-software/opencode/nimble-planet
...
Fix board share entity authorization
2026-06-03 23:43:48 -04:00
Mike Cao
c0193ad7cd
Address board share review feedback
2026-06-03 20:29:08 -07:00
Mike Cao
a5f4a39f2b
Fix board share entity authorization
2026-06-03 00:02:54 -07:00
Mike Cao
e9925f2e4e
Sanitize CSV exports against formula injection
2026-06-03 00:00:37 -07:00
Mike Cao
0c08a27a81
Updated lock file.
2026-06-02 23:24:07 -07:00
Mike Cao
306ca4a435
Lint format files. Updated rng function.
2026-06-02 22:35:07 -07:00
Mike Cao
5bf1792b38
Restrict team owner assignment to admins
2026-06-02 22:17:10 -07:00
Mike Cao
44c6b4427f
Add schema to realtime route.
2026-06-02 22:07:46 -07:00
Mike Cao
46819a4443
Enforce team role hierarchy on user updates and removals
2026-06-02 21:32:34 -07:00
Mike Cao
0f36990040
Merge branch 'analytics' into dev
2026-06-02 20:22:32 -07:00
Mike Cao
fded75f940
Use authenticated Redis key on logout
2026-06-02 17:46:08 -07:00
Mike Cao
a9beebf1a9
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-06-02 17:26:59 -07:00
Mike Cao
d44592ddb5
Validate SSO redirect URLs before setting auth token
2026-06-02 17:26:48 -07:00
Mike Cao and GitHub
72611027b7
Merge pull request #4316 from umami-software/codex/umami-GHSA-w7hf-qxh9-2cm3
...
Limit batch API payloads to 500 items
2026-06-02 19:59:21 -04:00
Mike Cao and GitHub
7161d83382
Merge pull request #4315 from umami-software/codex/umami-GHSA-jmch-5jr7-62q9
...
Tighten API access checks by website section and share permissions
2026-06-02 19:55:55 -04:00
Mike Cao
9ba5fb7c1b
Limit batch API payloads to 500 items
2026-06-02 16:54:35 -07:00
Mike Cao
f366d946e8
Allow unrestricted access when share token has no section flags
2026-06-02 16:28:30 -07:00
Mike Cao
ade0819be1
Tighten API access checks by website section and share permissions
2026-06-02 15:29:23 -07:00
Mike Cao
8bc49a29e3
Fix share token confusion vulnerability
...
Cache tokens from /api/send and share tokens were both signed with the same secret and parsed without distinguishing claim types, allowing a public cache token to be replayed as x-umami-share-token to read any website's analytics. Add explicit token type claims (share/cache) and require the matching type when parsing each.
2026-06-02 14:45:21 -07:00
Mike Cao
9ced9ac85a
Fixed API_URL handling.
2026-06-02 11:19:33 -07:00
Mike Cao
f985b4f9a5
Use next rewrites for API_URL.
2026-06-02 11:12:48 -07:00
Francis Cao
c4b1452c29
apply path filter to heatmap pages
2026-06-01 14:23:27 -07:00
Francis Cao
4d831a97a4
Merge branch 'analytics' of https://github.com/umami-software/umami into dev
2026-06-01 12:43:57 -07:00
Francis Cao
169387958e
fix snapshot URL builder
2026-06-01 09:44:37 -07:00
Francis Cao
60ec6d2e91
fix snapshot retrieval URL
2026-06-01 09:26:31 -07:00
Mike Cao and GitHub
4772c702b5
Merge pull request #4294 from swayam-mishra/dev
...
fix: update broken demo link from analytics.umami.is to cloud.umami.is
2026-05-29 14:11:14 -04:00
Mike Cao
18b72d3008
fix(tracker): restore link navigation when tracking fails
...
Use .finally() instead of .then() so internal link navigation is
always restored after e.preventDefault(), even if the tracking
request rejects (e.g. server down or a throwing beforeSend callback).
Fixes #4304
2026-05-29 10:58:11 -07:00
Mike Cao
10f6ee27da
Merge branch 'dev' of https://github.com/umami-software/umami into dev
2026-05-29 10:54:25 -07:00
Francis Cao
Mike Cao
