Api commands with different users

Support & Bugs
#1

Hi
I have a problem with execution of API commands with different token_auths.

I’m writing a simple admin panel for users that are not superusers.

To add a site I run:

  1. addSite with superuser’s token_auth
  2. setUserAccess to view added site for the user with superuser’s token_auth
  3. getSitesWithViewAccess with user’s token_auth

The problem is after first execution of a command with superuser’s token_auth system keeps superuser as a current user - Piwik::getCurrentUserTokenAuth() returns superuser’s token_auth. After second execution of a command with user’s token_auth the Piwik::getCurrentUserTokenAuth() correctly returns user’s token_auth, but the Piwik::isUserIsSuperUser() returns TRUE!!! What the hell?? Is this a bug? Can you help?

#2

Can you please post the code you use ? so I can try and reproduce the issue, thanks!

#3

The function is executed by the logged-in user that with the View rights only.


function addSiteAndGetList($siteName, $redir_url, $user_token_auth, $admin_token_auth, $userLogin) {

  echo Piwik::getCurrentUserTokenAuth();  // returns user_token_auth
  echo Piwik::isUserIsSuperUser();        // returns false

  $request = new Piwik_API_Request('
        method=SitesManager.addSite
        &siteName='.$siteName.'
        &urls='.$redir_url.'
        &format=XML
        &token_auth='.$admin_token_auth
  );
  $result = $request->process();
  $result_xml = simplexml_load_string($result);
  if ( (string)$result_xml->error['message'] != '')
    return 'Error addSite: '.$result_xml->error['message'];
  else
    echo 'idSite: '.$result_xml;
    
  echo Piwik::getCurrentUserTokenAuth();  // returns admin_token_auth
  echo Piwik::isUserIsSuperUser();        // returns true
    
  $request = new Piwik_API_Request('
        method=UsersManager.setUserAccess
        &userLogin='.$userLogin.'
        &access=view
        &idSites='.$idSite.'
        &format=XML
        &token_auth='.$admin_token_auth
  );
  $result = $request->process();
  $result_xml = simplexml_load_string($result);
  if ( (string)$result_xml->error['message'] != '')
    return 'Error setUserAccess: '.$result_xml->error['message'];
  else
    echo $result_xml->result->success['message'];

  echo Piwik::getCurrentUserTokenAuth();  // returns admin_token_auth
  echo Piwik::isUserIsSuperUser();        // returns true


  $request = new Piwik_API_Request('
        method=SitesManager.getSitesWithViewAccess
        &format=XML
        &token_auth='.$user_token_auth
  );
  $result = $request->process();
  $result_xml = simplexml_load_string($result);
  if ( (string)$result_xml->error['message'] != '')
    return 'Error getSitesWithAtLeastViewAccess: '.$result_xml->error['message'];

  echo Piwik::getCurrentUserTokenAuth();  // [b]returns user_token_auth[/b]
  echo Piwik::isUserIsSuperUser();        // [b]returns true !!!!![/b]


  return $result_xml;

}
#4

so, any idea?

#5

Thanks for the code!

Can you please try the following patch: http://dev.piwik.org/trac/changeset/5528

Does it work after applying it?

#6

/ Unfortunately it doesn’t work. Any other idea will be very helpfull.