Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions config/global.ini.php
Original file line number Diff line number Diff line change
Expand Up @@ -586,7 +586,7 @@
; standard email name displayed when sending emails. If not set, a default name will be used.
noreply_email_name = ""

; email address to use when an administrator should be contacted. If not set, email addresses of all super users will be used instead.
; email address to use when an administrator should be contacted. If not set, email addresses of all superusers will be used instead.
; To use multiple addresses simply concatenate them with a ','
contact_email_address = ""

Expand Down Expand Up @@ -835,19 +835,19 @@
; By setting this option to 0 the websites management will be disabled
enable_sites_admin = 1

; By setting this option to 1, it will be possible for Super Users to upload Matomo plugin ZIP archives directly in Matomo Administration.
; By setting this option to 1, it will be possible for Superusers to upload Matomo plugin ZIP archives directly in Matomo Administration.
; Enabling this opens a remote code execution vulnerability where
; an attacker who gained Super User access could execute custom PHP code in a Matomo plugin.
; an attacker who gained Superuser access could execute custom PHP code in a Matomo plugin.
enable_plugin_upload = 0

; By setting this option to 0 (e.g. in common.config.ini.php) the installer will be disabled.
enable_installer = 1

; By setting this option to 0, you can prevent Super User from editing the Geolocation settings.
; By setting this option to 0, you can prevent Superuser from editing the Geolocation settings.
enable_geolocation_admin = 1

; By setting this option to 0, the old raw data and old report data purging features will be hidden from the UI
; Note: log purging and old data purging still occurs, just the Super User cannot change the settings.
; Note: log purging and old data purging still occurs, just the Superuser cannot change the settings.
enable_delete_old_data_settings_admin = 1

; By setting this option to 0, the following settings will be hidden and disabled from being set in the UI:
Expand Down
2 changes: 1 addition & 1 deletion core/API/DocumentationGenerator.php
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
*
* @hide -> Won't be shown in list of all APIs but is also not possible to be called via HTTP API
* @hideForAll Same as @hide
* @hideExceptForSuperUser Same as @hide but still shown and possible to be called by a user with super user access
* @hideExceptForSuperUser Same as @hide but still shown and possible to be called by a user with superuser access
* @internal -> Won't be shown in list of all APIs but is possible to be called via HTTP API
*/
class DocumentationGenerator
Expand Down
4 changes: 2 additions & 2 deletions core/API/Request.php
Original file line number Diff line number Diff line change
Expand Up @@ -322,8 +322,8 @@ private function restoreAuthUsingTokenAuth(
$tokenToRestore,
$hadSuperUserAccess
) {
// if we would not make sure to unset super user access, the tokenAuth would be not authenticated and any
// token would just keep super user access (eg if the token that was reloaded before had super user access)
// if we would not make sure to unset superuser access, the tokenAuth would be not authenticated and any
// token would just keep superuser access (eg if the token that was reloaded before had superuser access)
Access::getInstance()->setSuperUserAccess(false);

// we need to restore by reloading the tokenAuth as some permissions could have been removed in the API
Expand Down
14 changes: 7 additions & 7 deletions core/Access.php
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,10 @@
* - **no access**: Users with this access level cannot view the resource.
* - **view access**: Users with this access level can view the resource, but cannot modify it.
* - **admin access**: Users with this access level can view and modify the resource.
* - **Super User access**: Only the Super User has this access level. It means the user can do
* - **Superuser access**: Only the Superuser has this access level. It means the user can do
* whatever they want.
*
* Super user access is required to set some configuration options.
* Superuser access is required to set some configuration options.
* All other options are specific to the user or to a website.
*
* Access is granted per website. Uses with access for a website can view all
Expand Down Expand Up @@ -65,7 +65,7 @@ class Access
protected $token_auth = null;

/**
* Defines if the current user is the Super User
* Defines if the current user is the Superuser
* @see hasSuperUserAccess()
*
* @var bool
Expand Down Expand Up @@ -137,7 +137,7 @@ private function resetSites()
* We load the access levels for this user for all the websites.
*
* @param null|Auth $auth Auth adapter
* @return bool true on success, false if reloading access failed (when auth object wasn't specified and user is not enforced to be Super User)
* @return bool true on success, false if reloading access failed (when auth object wasn't specified and user is not enforced to be Superuser)
*/
public function reloadAccess(?Auth $auth = null)
{
Expand Down Expand Up @@ -231,7 +231,7 @@ public static function getSqlAccessSite($select)
protected function makeSureLoginNameIsSet(): void
{
if (empty($this->login)) {
// flag to force non empty login so Super User is not mistaken for anonymous
// flag to force non empty login so Superuser is not mistaken for anonymous
$this->login = 'super user was set';
}
}
Expand Down Expand Up @@ -308,7 +308,7 @@ protected function loadSitesIfNeeded()
}

/**
* We bypass the normal auth method and give the current user Super User rights.
* We bypass the normal auth method and give the current user Superuser rights.
* This should be very carefully used.
*
* @param bool $bool
Expand All @@ -325,7 +325,7 @@ public function setSuperUserAccess($bool = true)
}

/**
* Returns true if the current user is logged in as the Super User
* Returns true if the current user is logged in as the Superuser
*
* @return bool
*/
Expand Down
2 changes: 1 addition & 1 deletion core/AssetManager/UIAssetCacheBuster.php
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ class UIAssetCacheBuster extends Singleton
* Cache buster based on
* - Piwik version
* - Loaded plugins (name and version)
* - Super user salt
* - Superuser salt
* - Latest
*
* @param string[] $pluginNames
Expand Down
2 changes: 1 addition & 1 deletion core/AuthResult.php
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ public function getCode()
}

/**
* Returns true if the user has Super User access, false otherwise.
* Returns true if the user has Superuser access, false otherwise.
*
* @return bool
*/
Expand Down
2 changes: 1 addition & 1 deletion core/Console.php
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ private function doRunImpl(InputInterface $input, OutputInterface $output)
if ($exitCode === null) {
$self = $this;
/*
* Ensure to run console command with super user permission. Otherwise any permission check would fail,
* Ensure to run console command with superuser permission. Otherwise any permission check would fail,
* as we do not have any user session or authentication in place.
*/
$exitCode = Access::doAsSuperUser(function () use ($input, $output, $self) {
Expand Down
2 changes: 1 addition & 1 deletion core/CronArchive.php
Original file line number Diff line number Diff line change
Expand Up @@ -1337,7 +1337,7 @@ private function initWebsiteIds($allWebsites)
private function logInitInfo()
{
$this->logSection("INIT");
$this->logger->info("Running Matomo " . Version::VERSION . " as Super User");
$this->logger->info("Running Matomo " . Version::VERSION . " as Superuser");
}

private function logArchiveTimeoutInfo()
Expand Down
2 changes: 1 addition & 1 deletion core/CronArchive/SegmentArchiving.php
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,7 @@ public function reArchiveSegment($segmentInfo)
$idSite = !empty($segmentInfo['enable_only_idsite']) ? $segmentInfo['enable_only_idsite'] : 'all';

/*
* Done as super user, to ensure we are able to receive all site ids, even if the current user
* Done as superuser, to ensure we are able to receive all site ids, even if the current user
* does not have access to all of them.
*/
$idSites = Access::doAsSuperUser(function () use ($idSite) {
Expand Down
4 changes: 2 additions & 2 deletions core/FrontController.php
Original file line number Diff line number Diff line change
Expand Up @@ -383,7 +383,7 @@ public function init()
throw $exception;
}

// Init the Access object, so that eg. core/Updates/* can enforce Super User and use some APIs
// Init the Access object, so that eg. core/Updates/* can enforce Superuser and use some APIs
Access::getInstance();

/**
Expand Down Expand Up @@ -716,7 +716,7 @@ private function throwIfPiwikVersionIsOlderThanDBSchema()
$messages = array(
Piwik::translate('General_ExceptionDatabaseVersionNewerThanCodebase', array($current, $dbSchemaVersion)),
Piwik::translate('General_ExceptionDatabaseVersionNewerThanCodebaseWait'),
// we cannot fill in the Super User emails as we are failing before Authentication was ready
// we cannot fill in the Superuser emails as we are failing before Authentication was ready
Piwik::translate('General_ExceptionContactSupportGeneric', array('', '')),
);
throw new DatabaseSchemaIsNewerThanCodebaseException(implode(" ", $messages));
Expand Down
12 changes: 6 additions & 6 deletions core/Piwik.php
Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,7 @@ public static function getCurrentUserLastSeen()
}

/**
* Returns the email addresses configured as contact. If none is configured the mail addresses of all super users will be returned instead.
* Returns the email addresses configured as contact. If none is configured the mail addresses of all superusers will be returned instead.
*
* @return array
*/
Expand All @@ -222,7 +222,7 @@ public static function getContactEmailAddresses(): array
}

/**
* Get a list of all email addresses having Super User access.
* Get a list of all email addresses having Superuser access.
*
* @return array
*/
Expand Down Expand Up @@ -271,7 +271,7 @@ public static function getCurrentUserTokenAuth()
}

/**
* Returns `true` if the current user is either the Super User or the user specified by
* Returns `true` if the current user is either the Superuser or the user specified by
* `$theUser`.
*
* @param string $theUser A username.
Expand Down Expand Up @@ -317,14 +317,14 @@ public static function doesUserRequirePasswordConfirmation(string $login)
* Check that the current user is either the specified user or the superuser.
*
* @param string $theUser A username.
* @throws NoAccessException If the user is neither the Super User nor the user `$theUser`.
* @throws NoAccessException If the user is neither the Superuser nor the user `$theUser`.
* @api
*/
public static function checkUserHasSuperUserAccessOrIsTheUser($theUser)
{
try {
if (Piwik::getCurrentUserLogin() !== $theUser) {
// or to the Super User
// or to the Superuser
Piwik::checkUserHasSuperUserAccess();
}
} catch (NoAccessException $e) {
Expand Down Expand Up @@ -410,7 +410,7 @@ public static function hasTheUserSuperUserAccess($theUser)
}

/**
* Returns true if the current user has Super User access.
* Returns true if the current user has Superuser access.
*
* @return bool
* @api
Expand Down
8 changes: 4 additions & 4 deletions core/Plugin/Controller.php
Original file line number Diff line number Diff line change
Expand Up @@ -776,7 +776,7 @@ protected function setBasicVariablesNoneAdminView($view)
$view->isMultiSitesEnabled = $pluginManager->isPluginActivated('MultiSites');

/*
* Executed as super user, so we are able to check if there are other sites (the current user might not have access to)
* Executed as superuser, so we are able to check if there are other sites (the current user might not have access to)
*/
$view->isSingleSite = Access::doAsSuperUser(function () {
$allSites = Request::processRequest('SitesManager.getAllSitesId', [], []);
Expand All @@ -795,7 +795,7 @@ protected function setBasicVariablesNoneAdminView($view)
*
* The following variables assigned:
*
* **isSuperUser** - True if the current user is the Super User, false if otherwise.
* **isSuperUser** - True if the current user is the Superuser, false if otherwise.
* **hasSomeAdminAccess** - True if the current user has admin access to at least one site,
* false if otherwise.
* **isCustomLogo** - The value of the `branding_use_custom_logo` option.
Expand Down Expand Up @@ -862,7 +862,7 @@ protected function showWhatIsNew(View $view): void
* - **isValidHost** - true if host is valid, false if otherwise
* - **invalidHostMessage** - message to display if host is invalid (only set if host is invalid)
* - **invalidHost** - the invalid hostname (only set if host is invalid)
* - **mailLinkStart** - the open tag of a link to email the Super User of this problem (only set
* - **mailLinkStart** - the open tag of a link to email the Superuser of this problem (only set
* if host is invalid)
*
* @param View $view
Expand Down Expand Up @@ -930,7 +930,7 @@ public static function setHostValidationVariablesView($view)
'</a>',
));
}
$view->invalidHostMessageHowToFix = '<p><b>How do I fix this problem and how do I login again?</b><br/> The Matomo Super User can manually edit the file /path/to/matomo/config/config.ini.php
$view->invalidHostMessageHowToFix = '<p><b>How do I fix this problem and how do I login again?</b><br/> The Matomo Superuser can manually edit the file /path/to/matomo/config/config.ini.php
and add the following lines: <pre>[General]' . "\n" . 'trusted_hosts[] = "' . $invalidHost . '"</pre>After making the change, you will be able to login again.</p>
<p>You may also <i>disable this security feature (not recommended)</i>. To do so edit config/config.ini.php and add:
<pre>[General]' . "\n" . 'enable_trusted_host_check=0</pre>';
Expand Down
2 changes: 1 addition & 1 deletion core/Plugin/Manager.php
Original file line number Diff line number Diff line change
Expand Up @@ -1147,7 +1147,7 @@ private function reloadActivatedPlugin($pluginName, $pluginsToPostPendingEventsT
if ($newPlugin->hasMissingDependencies()) {
$this->unloadPluginFromMemory($pluginName);

// at this state we do not know yet whether current user has super user access. We do not even know
// at this state we do not know yet whether current user has superuser access. We do not even know
// if someone is actually logged in.
$message = Piwik::translate('CorePluginsAdmin_WeCouldNotLoadThePluginAsItHasMissingDependencies', array($pluginName, $newPlugin->getMissingDependenciesAsString()));
$message .= ' ';
Expand Down
2 changes: 1 addition & 1 deletion core/Plugin/Report.php
Original file line number Diff line number Diff line change
Expand Up @@ -254,7 +254,7 @@ protected function init()
/**
* Defines whether a report is enabled or not. For instance some reports might not be available to every user or
* might depend on a setting (such as Ecommerce) of a site. In such a case you can perform any checks and then
* return `true` or `false`. If your report is only available to users having super user access you can do the
* return `true` or `false`. If your report is only available to users having superuser access you can do the
* following: `return Piwik::hasUserSuperUserAccess();`
* @return bool
* @api
Expand Down
2 changes: 1 addition & 1 deletion core/Plugin/Segment.php
Original file line number Diff line number Diff line change
Expand Up @@ -339,7 +339,7 @@ public function setNeedsMostFrequentValues(bool $value)

/**
* You can restrict the access to this segment by passing a boolean `false`. For instance if you want to make
* a certain segment only available to users having super user access you could do the following:
* a certain segment only available to users having superuser access you could do the following:
* `$segment->setPermission(Piwik::hasUserSuperUserAccess());`
* @param bool $permission
* @api
Expand Down
2 changes: 1 addition & 1 deletion core/Segment.php
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,7 @@ public function __construct($segmentCondition, $idSites, ?Date $startDate = null
!SettingsPiwik::isSegmentationEnabled()
&& !empty($segmentCondition)
) {
throw new Exception("The Super User has disabled the Segmentation feature.");
throw new Exception("The Superuser has disabled the Segmentation feature.");
}

$this->originalString = $segmentCondition;
Expand Down
2 changes: 1 addition & 1 deletion core/Settings/Plugin/SystemConfigSetting.php
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
use Piwik\Settings\Setting;

/**
* Describes a system wide setting. Only the Super User can change this type of setting by d efault and
* Describes a system wide setting. Only the Superuser can change this type of setting by d efault and
* the value of this setting will affect all users.
*
* See {@link \Piwik\Settings\Setting}.
Expand Down
2 changes: 1 addition & 1 deletion core/Settings/Plugin/SystemSetting.php
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
use Piwik\Settings\Setting;

/**
* Describes a system wide setting. Only the Super User can change this type of setting by default and
* Describes a system wide setting. Only the Superuser can change this type of setting by default and
* the value of this setting will affect all users.
*
* See {@link \Piwik\Settings\Setting}.
Expand Down
4 changes: 2 additions & 2 deletions core/Tracker/Cache.php
Original file line number Diff line number Diff line change
Expand Up @@ -111,8 +111,8 @@ public static function updateCacheWebsiteAttributes($idSite)

$content = [];
/*
* Updating cached websites attributes might be triggered by various events, including actions performed by non super users.
* Therefore we execute below code as super user, to ensure the cache is built without restrictions.
* Updating cached websites attributes might be triggered by various events, including actions performed by non superusers.
* Therefore we execute below code as superuser, to ensure the cache is built without restrictions.
*/
Access::doAsSuperUser(function () use (&$content, $idSite) {
/**
Expand Down
4 changes: 2 additions & 2 deletions core/Tracker/Failures.php
Original file line number Diff line number Diff line change
Expand Up @@ -89,8 +89,8 @@ private function hasLoggedFailure($idSite, $idFailure)
private function getParamsWithTokenAnonymized(Request $request)
{
// eg if there is a typo in the token auth we want to replace it as well to not accidentally leak a token
// eg imagine a super user tries to issue an API request for a site and sending the wrong parameter for a token...
// an admin may have view access for this and can see the super users token
// eg imagine a superuser tries to issue an API request for a site and sending the wrong parameter for a token...
// an admin may have view access for this and can see the superusers token
$token = $request->getTokenAuth();
$params = $request->getRawParams();
foreach (array('token_auth', 'token', 'tokenauth', 'token__auth') as $key) {
Expand Down
4 changes: 2 additions & 2 deletions core/Tracker/Request.php
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ public function isAuthenticated()

/**
* This method allows to set custom IP + server time + visitor ID, when using Tracking API.
* These two attributes can be only set by the Super User (passing token_auth).
* These two attributes can be only set by the Superuser (passing token_auth).
*/
protected function authenticateTrackingApi(
#[\SensitiveParameter]
Expand Down Expand Up @@ -255,7 +255,7 @@ public static function authenticateSuperUserOrAdminOrWrite(
return true;
}

Common::printDebug("WARNING! token_auth = $tokenAuth is not valid, Super User / Admin / Write was NOT authenticated");
Common::printDebug("WARNING! token_auth = $tokenAuth is not valid, Superuser / Admin / Write was NOT authenticated");

/**
* @ignore
Expand Down
4 changes: 2 additions & 2 deletions core/Updater.php
Original file line number Diff line number Diff line change
Expand Up @@ -251,7 +251,7 @@ public function getSqlQueriesToExecute()
$classNames[] = $className;

/*
* Fetch available migrations as super user, to ensure having access to everything.
* Fetch available migrations as superuser, to ensure having access to everything.
* Otherwise migrations iterating e.g. over available sites or similar, might only update those the
* current user has permission for.
*/
Expand Down Expand Up @@ -483,7 +483,7 @@ public function updateComponents($componentsWithUpdateFile)

if (!empty($componentsWithUpdateFile)) {
/*
* Perform updates as super user, so we bypass any permission checks and are able to change anything.
* Perform updates as superuser, so we bypass any permission checks and are able to change anything.
*/
Access::doAsSuperUser(function () use ($componentsWithUpdateFile, &$coreError, &$deactivatedPlugins, &$errors, &$warnings) {

Expand Down
Loading
Loading