matomo-org / matomo

Empowering People Ethically with the leading open source alternative to Google Analytics that gives you full control over your data. Matomo lets you easily collect data from websites & apps and visualise this data and extract insights. Privacy is built-in. Liberating Web Analytics. Star us on Github? +1. And we love Pull Requests!
https://matomo.org/
GNU General Public License v3.0
19.68k stars 2.62k forks source link

Ensure parameters used by API methods are read from both GET and POST #3506

Open anonymous-matomo-user opened 11 years ago

anonymous-matomo-user commented 11 years ago

filter_limit is ignored and the default is used when searching with Live.getLastVisitsDetails via POST (and POST is listed as valid method in the API documentation http://piwik.org/docs/analytics-api/reference/ ).

the problem is only GET parameters are checked here:

/plugins/API/Controller.php

/**
 * 
 * @package Piwik_API
 */
class Piwik_API_Controller extends Piwik_Controller
{
    function index()
    {
        // when calling the API through http, we limit the number of returned results
        if(!isset($_GET['filter_limit']))

        {
            $_GET['filter_limit'] = Piwik_Config::getInstance()->General['API_datatable_default_limit'];
        }

array concatenation with + does not seem to work the way it did during the olden times (keys from the array on the right replacing keys in the array on the left, the way it was explained in the old "PHP Cookbook" by David Sklar and Adam Trachtenberg, for example), but the keys from the array on the right are ignored if the key exists in the array on the left, which you can test with this simple script:

<?php
$a = array('a' => 'a', 'b' => 'a');
$b = array('a' => 'b');
$c = $a + $b;
$d = array('c' => 'd');
$e = $a + $d;

print_r($a + $b);
print_r($c);
print_r($a + $b + $d);
print_r($e);
?>

so in /core/API/Request.php, in function getRequestArrayFromString, this line

 $defaultRequest = $_GET + $_POST;

does not work as hoped, and the value that was set to the default in $_GET stays the default.

problem present at least in 1.8.3 and 1.9.1 tested with PHP 5.3.2-1ubuntu4.18 with Suhosin-Patch (cli) (built: Sep 12 2012 19:12:47) on Ubuntu 10.04.4 LTS.

Keywords: filter_limit

mattab commented 10 years ago

Broadening scope as to check all parameters are read from GET, POST.