piwik.js can't be loaded due to the CSP (Content Security Policy) about cloud_piwik HOT 13 CLOSED

Hi,

hit the same bug.

Notice: i host nextcloud / owncloud and piwik on the same domain.

first i noticed there is no 'self' in the CSP header so i looked how to fix this issue
found some infos in the nextcloud community forums: https://help.nextcloud.com/t/content-security-policy-in-nextcloud/5288/4

tried tweaking the piwik\appinfo\app.php :

 if (array_key_exists('HTTP_HOST', $_SERVER) && $_SERVER['HTTP_HOST'] !== $url) {
      $policy = new OCP\AppFramework\Http\ContentSecurityPolicy ();
      $policy->addAllowedScriptDomain($url);
      $policy->addAllowedImageDomain($url);
      \OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy);
   } else {
      $policy = new OCP\AppFramework\Http\ContentSecurityPolicy ();
      $policy->addAllowedScriptDomain('\'self\'');
      $policy->addAllowedImageDomain('\'self\'');
      \OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy);
   }

unfortunately this doesn't has the desired effect (no self in the CSP Header)

so i ended up with this tweak:

#   if (array_key_exists('HTTP_HOST', $_SERVER) && $_SERVER['HTTP_HOST'] !== $url) {
      $policy = new OCP\AppFramework\Http\ContentSecurityPolicy ();
      $policy->addAllowedScriptDomain($url);
      $policy->addAllowedImageDomain($url);
      \OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy);
#   }

aka commented the HTTP_HOST header check in app.php

maybe someone knows an better solution for this issue :-)

regards Alex

from cloud_piwik.

Hey Alex,
thank you! Finally I can track my NextCloud ;)
Thanks for sharing your solution!

Regards, Nils

from cloud_piwik.

Mh. I think the cleaner solution would be to improve the host/url check. But anyway I am wondering, why self is missing in the csp header...

from cloud_piwik.

I also encounter this issue on Nextcloud 11, but the effect depends on the browser...with the default code, tracking works on Safari, IE and Edge but fails with Firefox and Chrome. Modifying the code like Alex-Ba suggests "works" but I'm really not skilled enough to track the root cause and fix anything.

from cloud_piwik.

The problem comes from the parse_url

   $piwik = json_decode(OCP\Config::getAppValue('piwik', 'piwik'));
# Comment out the parse url and add your URL here   
# $url = parse_url($piwik->url, PHP_URL_HOST);
   $url = 'piwik.MY_URL.cc';

#   if (array_key_exists('HTTP_HOST', $_SERVER) && $_SERVER['HTTP_HOST'] !== $url) {
      $policy = new OCP\AppFramework\Http\ContentSecurityPolicy ();
      $policy->addAllowedScriptDomain($url);
      $policy->addAllowedImageDomain($url);
      \OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy);
#   }
}

from cloud_piwik.

@Xqua can you explain that in more detail? What is the value of $piwik->url and the corresponding return value of parse_url?

from cloud_piwik.

I did this a while back ... I think it was returning a nil or some sort.

from cloud_piwik.

Hope the fix works for you guys.

from cloud_piwik.

I'll try it next week and get back to you !

from cloud_piwik.

The errors re-appears in Nextcloud 16.

• PHP7.3
• MariaDB
• Debian 9.9 stretch
• NGINX 1.16 TLSv1.2

All of your mentioned fixes causes the app to change its state from being enabled to disabled.
May i ask and please you to re-investigate further? If you are interested in - let me know how to assist you or grant access to my environment.

Cheers, Carsten (https://www.c-rieger.de)

from cloud_piwik.

I gave up on NextCloud, sorry I won't be able to help.

from cloud_piwik.

@criegerde #70 should fix it, please let me know if it doesn't.

The addon will be disabled if the app is not marked as compliant (e.g. error in code)

from cloud_piwik.

@MinIsMin : Great, it works with #70
Many THANKS!

from cloud_piwik.