lly/umami
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
6,436 Commits 1 Branch 0 Tags
d659c5746b47cb81efc2b4dc6208a0ddd11d2d5a
Commit Graph
6436 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike CaoandGitHub d659c5746b Merge pull request #4317 from umami-software/opencode/nimble-planet 
Fix board share entity authorization
 2026-06-03 23:43:48 -04:00
Mike Cao c0193ad7cd Address board share review feedback 2026-06-03 20:29:08 -07:00
Mike Cao a5f4a39f2b Fix board share entity authorization 2026-06-03 00:02:54 -07:00
Mike Cao e9925f2e4e Sanitize CSV exports against formula injection 2026-06-03 00:00:37 -07:00
Mike Cao 0c08a27a81 Updated lock file. 2026-06-02 23:24:07 -07:00
Mike Cao 306ca4a435 Lint format files. Updated rng function. 2026-06-02 22:35:07 -07:00
Mike Cao 5bf1792b38 Restrict team owner assignment to admins 2026-06-02 22:17:10 -07:00
Mike Cao 44c6b4427f Add schema to realtime route. 2026-06-02 22:07:46 -07:00
Mike Cao 46819a4443 Enforce team role hierarchy on user updates and removals 2026-06-02 21:32:34 -07:00
Mike Cao 0f36990040 Merge branch 'analytics' into dev 2026-06-02 20:22:32 -07:00
Mike Cao fded75f940 Use authenticated Redis key on logout 2026-06-02 17:46:08 -07:00
Mike Cao a9beebf1a9 Merge branch 'dev' of https://github.com/umami-software/umami into dev 2026-06-02 17:26:59 -07:00
Mike Cao d44592ddb5 Validate SSO redirect URLs before setting auth token 2026-06-02 17:26:48 -07:00
Mike CaoandGitHub 72611027b7 Merge pull request #4316 from umami-software/codex/umami-GHSA-w7hf-qxh9-2cm3 
Limit batch API payloads to 500 items
 2026-06-02 19:59:21 -04:00
Mike CaoandGitHub 7161d83382 Merge pull request #4315 from umami-software/codex/umami-GHSA-jmch-5jr7-62q9 
Tighten API access checks by website section and share permissions
 2026-06-02 19:55:55 -04:00
Mike Cao 9ba5fb7c1b Limit batch API payloads to 500 items 2026-06-02 16:54:35 -07:00
Mike Cao f366d946e8 Allow unrestricted access when share token has no section flags 2026-06-02 16:28:30 -07:00
Mike Cao ade0819be1 Tighten API access checks by website section and share permissions 2026-06-02 15:29:23 -07:00
Mike Cao 8bc49a29e3 Fix share token confusion vulnerability 
Cache tokens from /api/send and share tokens were both signed with the same secret and parsed without distinguishing claim types, allowing a public cache token to be replayed as x-umami-share-token to read any website's analytics. Add explicit token type claims (share/cache) and require the matching type when parsing each.
 2026-06-02 14:45:21 -07:00
Mike Cao 9ced9ac85a Fixed API_URL handling. 2026-06-02 11:19:33 -07:00
Mike Cao f985b4f9a5 Use next rewrites for API_URL. 2026-06-02 11:12:48 -07:00
Francis Cao c4b1452c29 apply path filter to heatmap pages 2026-06-01 14:23:27 -07:00
Francis Cao 4d831a97a4 Merge branch 'analytics' of https://github.com/umami-software/umami into dev 2026-06-01 12:43:57 -07:00
Francis Cao 169387958e fix snapshot URL builder 2026-06-01 09:44:37 -07:00
Francis Cao 60ec6d2e91 fix snapshot retrieval URL 2026-06-01 09:26:31 -07:00
Mike CaoandGitHub 4772c702b5 Merge pull request #4294 from swayam-mishra/dev 
fix: update broken demo link from analytics.umami.is to cloud.umami.is
 2026-05-29 14:11:14 -04:00
Mike Cao 18b72d3008 fix(tracker): restore link navigation when tracking fails 
Use .finally() instead of .then() so internal link navigation is
always restored after e.preventDefault(), even if the tracking
request rejects (e.g. server down or a throwing beforeSend callback).

Fixes #4304
 2026-05-29 10:58:11 -07:00
Mike Cao 10f6ee27da Merge branch 'dev' of https://github.com/umami-software/umami into dev 2026-05-29 10:54:25 -07:00
Mike CaoandGitHub 8ddc959b3f Merge pull request #4018 from ip00/patch-1 
Update hr-HR.json
 2026-05-29 13:48:07 -04:00
Ivan PletenacandIvan Pletenac c4a0c906bf Update hr-HR.json - added labels previously missing from file 2026-05-29 08:25:38 +02:00
Ivan PletenacandIvan Pletenac 7f0a744bd0 fix(lang): remove trailing space in label.back (inherited from original file) 2026-05-29 08:25:38 +02:00
Ivan PletenacandIvan Pletenac 71ab5857bc Update hr-HR.json 
Completed full Croatian translation for Umami.
Reviewed, modernized, and aligned with existing i18n structure.
 2026-05-29 08:23:40 +02:00
Mike Cao e28309f8f7 Merge branch 'dev' of https://github.com/umami-software/umami into dev 2026-05-28 13:37:42 -07:00
Francis Cao 5565182f3b fix heatmap viewport stretching. Polish UI/tooltips 2026-05-28 10:40:07 -07:00
Francis Cao 1a6f494754 add back PLAYWRIGHT_URL implementation 2026-05-27 16:24:01 -07:00
Francis Cao cf7b722fe6 revert playwright core changes 2026-05-27 16:21:31 -07:00
Francis Cao 84e14981c2 serverExternalPackages: ['playwright-core'] 2026-05-27 16:14:07 -07:00
Francis Cao d803eb7210 fix import errors for playwright test 2026-05-27 16:04:39 -07:00
Francis Cao c3cddcb774 fix playwright service createSnapshotBrowser 2026-05-27 16:00:28 -07:00
Francis Cao 39ef9a757b capture heatmap snapshot error 2026-05-27 15:52:46 -07:00
Francis Cao 824b3ff966 update playwright as seperate service 2026-05-27 15:35:07 -07:00
Francis Cao bb31fc7388 implement fix for playwright docker build 2026-05-27 13:46:14 -07:00
Francis Cao e916426315 revert changes 2026-05-27 12:39:38 -07:00
Francis Cao 3c59f63425 fix GET/POST route in recorder 2026-05-27 12:20:07 -07:00
Mike Cao 1d91b81f24 Merge branch 'dev' of https://github.com/umami-software/umami into dev 2026-05-27 10:14:44 -07:00
Francis Cao e068471f9c install heatmaps image 2026-05-27 09:26:24 -07:00
Mike Cao f145b75cb3 Merge branch 'dev' of https://github.com/umami-software/umami into dev 2026-05-26 20:48:54 -07:00
Mike CaoandGitHub 77886a32cc Merge pull request #4300 from yancat160/feat/datagrid-view-toggle-i18n 
i18n: translate DataGrid view-toggle tooltips
 2026-05-26 23:48:46 -04:00
Mike Cao aba1fea238 Merge branch 'dev' of https://github.com/umami-software/umami into dev 2026-05-26 20:45:25 -07:00
Mike Cao c41bf7c93e Enforce cloud website limits by subscription tier 2026-05-26 20:45:07 -07:00