Impossible to install the Wordpress plugin on Elementor

ubanto · February 13, 2023, 4:31pm

Hi everyone, I have a personal website built on elementor cloud hosting and I’d like to track it with Matomo for Wordpress plugin but it’s impossible.
After the installation, clickin on Report brings to a 404 page. I reported to the hosting customer care and they say that the request is being blocked by our Cloudflare firewall because the plugin tries to access a PHP file in the plugin’s folder: they say this is not safe because it’s the way malwares get access to websites, and this is not the proper way a plugin should work.

Do you think what the Elementor’s customare care is true? Does anyone have a solution?

Victor_Green · February 14, 2023, 7:11pm

Same happened with my site when I tried to install and it was asking access to some files from server.

ubanto · February 15, 2023, 5:39pm

Did you find any solution?

heurteph-ei · February 28, 2023, 2:24pm

Hello @ubanto, @Victor_Green
Do you think this is related to:

github.com/matomo-org/matomo

Allow moving all files apart from assets out of web root

opened 11:30AM - 10 Jul 22 UTC

Findus23

Enhancement c: Security

this is a bit of a continuation of #8120 At the moment, Matomo can only be us…ed by settings the web root to the directory all Matomo files are in. This means additional web server configuration and precisely crafted rules are required so that security-relevant files (especially tmp/ and config/) are not publicly accessible. But as web server configurations vary widely and as the recent "private directories" system check shows, there are a lot of people for who these configurations don't work (most commonly because `AllowOverride` is disabled (#17819) and therefore the .htaccess files created by Matomo do nothing). And the system check that tries to access the URLs that should be private makes some people aware of this, but often confuses people (#18693) or creates new issues (#18182, #17589, #18967, #19149) either because the failing requests trigger things like fail2ban or because it exposes broken cacert-setups. And that is completely ignoring the question of people who don't use apache and then have to find out themselves that they need to block some file requests or their Matomo setup is insecure. To get to the point: I feel like offering a Matomo install which works similar to this (and how most modern PHP/laravel applications work) would solve a lot of complexity which gaining a lot of security: - Matomo would have a public/ directory - People could use Matomo by setting their webroot to this directory - public/index.php would be a simple script that imports the main index.php and probably fixes some path - and probably a config.ini.php option that would enable this mode (as otherwise "default" users would have duplicate URLs) - JS/CSS assets would work out of the box as they use index.php - other assets would need to be copied to a corresponding subpath in public/ either implicitly ("copy some directory in every plugin") or explicitly ("allow specifying a list of files that need to be public in the plugin description") - While I don't think large changes are needed, these changes still feel breaking enough for me that this would need to be part of Matomo 5 Also this would be an optional feature as there are still people who don't know what a web root is (even though a lot of PHP FOSS applications don't offer any other way to be used). In summary, I think this would make it a lot harder for people to accidentally shoot themselves into the foot in regard to security (it's not like I haven't noticed in the past that I had some important Matomo files accidentally public), but it also has the disadvantage of offering "one more way" to install Matomo.

ubanto · February 28, 2023, 3:10pm

Well, I’m not a developer but yes, it definitely seems to be the reason why we can’t install Matomo on our cloud hosting.

Since Elementor Cloud is a server that is gaining more success day after day, I think these security issues should be changed.