Recherche avancée

Sur d’autres sites (10206)

• Anomalie #3632 : Login rester connecté sans intervention humaine égale faille de sécurité

  5 janvier 2016, par JF dogliani

  Merci pour le code mais je ne suis pas informaticien. Mon boulot consistait à voir comment entrer dans une application sans droits en tant qu’utilisateur lambda (ex sessions qui traine...) et sans connaissance particulière.
  Ce que je constate grosso modo (spip 3.0.21)
  Navigation privée
  La coche est systématiquement activée dans le passage entre le champ login/password. Le choix n’est donc pas enregistré dans les préférences du compte puisque non récupéré.
  Du coup, on ne reste pas connecté même si cochée...
  Navigation normale

  Oui, c’est le cas si tu as déjà coché l’option lors du précédent login,

  Non, la coche n’est pas activé lors de la connexion suivante, seul le login est complété
  La coche est systématiquement activée dans le passage entre le champ login/password dès lors qu’on a saisi dans le login (ex on se trompe et on rajoute /efface son mp dans le login) y compris lors du premier login
  De plus, Une fois la case cochée lors d’un login, même si elle apparait décochée, on continue à rester connecté après avoir quitté le navigateur jusqu’à ce qu’on se déconnecte volontairement. On est donc connecté sans le savoir.
  Je comprend bien qu’il faudrait que j’affine, mais je n’ai pas internet chez moi...
  redmin et les autres ne cochent jamais cette foutue case en automatique...

• Revision 100529 : Éviter lorsqu’il n’y a pas de compression JS/CSS activée, que le ...

  16 novembre 2016, par marcimat@… — Log

  Éviter lorsqu’il n’y a pas de compression JS/CSS activée, que le navigateur redemande les fichiers css et js du porte plume qui sont compilés par SPIP.
  On ajoute cache-client sur le cache de ces fichiers. C’est presque suffisant, mais il faut aussi les recalculer lorsqu’un plugin qui modifie les fichiers
  de porte-plume s’active ou se désactive. Du coup, on calcule un hash et un fond statique pour ces 2 fichiers, qui dépend du code variable de ces fichiers.
  Bon du coup on peut éviter quelques hits sur le serveur, mais la contrepartie, c’est qu’il faut calculer ces hash, parfois inutilement j’imagine, au calcul d’une page.
  À voir.

• Q&A : An interview with Matomo founder, Matthieu Aubry

  20 novembre 2018, par Joselyn Khor — About, Community

  Hey everyone ! Joselyn here. As always the views of our community remain top of mind. So to make sure you guys know the thinking behind these new projects, we reached out to Matomo’s founder, Matthieu, to ask questions you might want answered. Please check it out below !

  Hi guys, it’s Matthieu ! Here to answer some questions about the rebrand and the future of Matomo and Innocraft.

  What’s upcoming ?

  We’ve been busy implementing our rebrand into all aspects of Matomo and there’s also our new website, which is launching today ! The new website will help people better understand what Matomo is and how they can benefit from using modern web analytics.

  Why was Matomo and Innocraft brought onto one website ?

  In the past the separation caused a bit of confusion so we’re taking this as a chance to unite both the business brand, Innocraft and community brand, Matomo, on one website. Putting our focus on one brand, Matomo, makes it easier for people to see us with fresh eyes. We have a community side as well as a business side and while the community is still incredibly important to us, we find we have a powerful analytics tool that is capable of helping businesses too.

  Is Matomo becoming commercial or turning corporate ?

  No. nothing is changing. Matomo is still an open-source project and community. Although we’ll have a pricing page and “start free trial” on the new website brought over from Innocraft.cloud, the Matomo community will still play the biggest part on the Matomo website. We have dedicated sections focused on Community and On-Premise.

  The rebrand exercise helped us gain a refreshed perspective. After reflecting on how far we’ve come, we can feel more confident about Matomo Analytics itself as a platform. We believe it’s a great chance to bring that confidence into the brand and vision. We are proud that it’s an awesome open-source platform and at the same time it’s also powerful as a tool for businesses.

  Why is there no ‘download for free’ button on the homepage ?

   

  
  We feel many users coming to the site will get confused about our hosting options (Cloud and On-Premise) which is something you don’t usually consider when choosing an analytics tool.

  The reason for us to not have that button is when people see a “download for free” button on the homepage next to a “try it for free” button, it creates confusion. For those who do choose to download Matomo often become confused when they are left with a .zip file unaware how to install it and the technical requirements of self-hosting. We feel presenting our users with the simplest installation option first will give them the best chance possible to try Matomo to its full potential, without cost.

  And you can still find the link to Download Matomo in the footer of each page.
  

   

  Is Matomo still free to download and have forever ?

  Absolutely. The free open-source download can be found on the On-Premise section of the website, or download Matomo here.

  Why is it important to have a business behind the project ?

  There’s the reality that we have to make money in order for the Matomo project to survive … and thrive. The reason we still need a business side (Innocraft) is to fund and sustain the Matomo project. Whenever people purchase premium features, this helps finance the development of Matomo for our community.

  Because of the business we’re able to continually maintain and develop Matomo for you guys as well as future users. For example, the next release Matomo 3.8.0 is already mostly developed and will bring lots of interesting features too, like the two-factor authentication, Brute Force Protection, failed tracking requests reporting, lots of JavaScript tracker improvements, a new total summary row below reports, and many more security fixes, bug fixes, and other new features.

  So we see a business being very helpful in supporting our open-source community. Without a business side, our free, open-source project would not be able to survive.

  How will you protect the Matomo project ?

  We’ve ensured the Matomo project will be protected for the future as we wish to turn it into a not-for-profit foundation.

  We’ve also got a safeguard where the open-source code will stay under a GPL license forever. This is so we can guarantee, that no matter what happens, the Matomo project itself will stay completely free software.

  Is there a way for people to help ?

  There are heaps of ways to help ! You can help other Matomo users in the forums, contribute to fixes on GitHub, leave a great review (e.g. alternativeTo), help look for bugs with our Security Bounty Programme or participate and spread the word about Matomo in our community social media pages – Mastodon, Facebook, Twitter. Telling your friends about us would be very helpful too !

  What’s planned for the future ?
  We’ve worked hard to become the #1 open-source analytics platform (1.4 million websites use Matomo today), but now we need to empower even more individuals and businesses to take back control of their own data.

  Showing our community that we have a powerful platform is crucial, but alongside that our values are what define us. User privacy is still of utmost importance and we’re here to make it known that power needs to rest in the hands of people and not large corporations.

  You can rest easy knowing you’re doing your part in using trustworthy and dependable tools. By joining many other companies who are growing this movement to decentralise the Internet, we can build a safer, online world together.

  Join this analytics revolution and let us know what you think about Matomo !