[4.0][API][com_actionslogs] keep track of API requests by alikon · Pull Request #27094 · joomla/joomla-cms

alikon · 2019-11-17T10:12:55Z

Summary of Changes

listen event onAfterDispatch to keep track of API requests on actionlogs

Testing Instructions

make some requests GET for example:
/api/index.php/v1/plugins
/api/index.php/v1/users
/api/index.php/v1/config/application
/api/index.php/v1/content/article
....
etc...

test other verbs as welll

Expected result

API requests logged
something like

Actual result

N/A

Documentation Changes Required

maybe

mbabker · 2019-11-17T14:52:52Z

Does this REALLY need a new event? Couldn’t onAfterDispatch work just as well here? You’d just need to check context if using that event.

alikon · 2019-11-17T15:38:32Z

yes again 😄
there is no need for a new event onAfterDispatch does already the job

wilsonge · 2019-11-18T19:29:10Z

Looks good to me. Just needs some tests

Quy · 2019-12-03T08:23:19Z

Please fix conflicts.

alikon · 2019-12-03T08:47:09Z

conflict solved

Quy · 2019-12-03T18:07:53Z

User admin performed a GET on index.php/v1/modules/site?language=%2A&state=0

* is displayed as %2A

Quy · 2019-12-03T20:44:50Z

 			'username'    => $user->username,
 			'accountlink' => 'index.php?option=com_users&task=user.edit&id=' . $user->id,
-			'url'         => $this->app->get('uri.route'),
+			'url'         => urldecode($this->app->get('uri.route')),


This can output potential XSS.

any suggestions ?
what about

urldecode(htmlspecialchars($this->app->get('uri.route'), ENT_QUOTES, 'UTF-8'));

chmst · 2020-03-20T12:45:30Z

Tested with different words, for example

chmst · 2020-03-20T12:46:15Z

I have tested this item ✅ successfully on afb8f8f

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/27094.}

wilsonge · 2020-03-20T14:56:50Z

Having thought about this I think we probably want to have an additional flag for this API setting. Because in the case you have mobile apps using the API actively you're going to end up having too many entries in action logs. But you might well still want other actions logged in the component.

N6REJ · 2020-03-20T21:01:09Z

Tests ran:

Results:

I have tested this item ✅ successfully on afb8f8f

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/27094.}

alikon · 2020-03-21T08:38:40Z

ok i've fine grained the api logging

now you can disable the api logging
you can enable only some verbs to be logged
and of course only on some "Events"

alikon · 2020-03-21T08:45:39Z

@chmst, @N6REJ another round of tests please

Co-Authored-By: Quy <quy@fluxbb.org>

Razzo1987 · 2020-03-24T11:32:15Z

I have tested this item ✅ successfully on 4a38077

GET: ok
POST: ok
DELETE: ok
PUT: not tested (if someone have an example I try it)
PATCH: non listed in "Verds to log" ( I test this example: https://docs.joomla.org/J4.x:Joomla_Core_APIs#Update_Article)

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/27094.}

wilsonge · 2020-03-24T11:38:16Z

Thanks!

alikon · 2020-03-24T12:16:12Z

thanks folks + thanks to covid19 for lockdown
😄

alikon added 3 commits November 17, 2019 11:00

keep track of API requests

42defb2

keep track of API requests

0c95330

keep track of API requests

2c7e2ed

joomla-cms-bot added Language Change This is for Translators PR-4.0-dev labels Nov 17, 2019

mbabker reviewed Nov 17, 2019

View reviewed changes

Comment thread plugins/actionlog/joomla/joomla.php Outdated

mbabker reviewed Nov 17, 2019

View reviewed changes

Comment thread plugins/actionlog/joomla/joomla.php Outdated

alikon added 2 commits November 17, 2019 16:31

no need for a new event

3b025c5

NO superglobals

bdba97b

wilsonge reviewed Nov 18, 2019

View reviewed changes

Comment thread plugins/actionlog/joomla/joomla.php Outdated

wilsonge reviewed Nov 18, 2019

View reviewed changes

Comment thread plugins/actionlog/joomla/joomla.php Outdated

feedback

daf2eae

more informative endpoint

cde4f65

mbabker reviewed Nov 18, 2019

View reviewed changes

Comment thread plugins/actionlog/joomla/joomla.php Outdated

2in1row

de8fefe

Quy mentioned this pull request Nov 20, 2019

[4.0][webservice][com_actionlogs] - actionlogs api endpoint #26850

Closed

Merge branch '4.0-dev' into patch-122

6912364

Quy added the Conflicting Files label Dec 2, 2019

alikon added 2 commits December 3, 2019 09:30

rename of lang file

12a72df

Merge branch '4.0-dev' into patch-122

6721ffa

Quy removed the Conflicting Files label Dec 3, 2019

alikon added 2 commits December 3, 2019 21:08

urldecode

7c81acd

Merge branch '4.0-dev' into patch-122

afb8f8f

Quy reviewed Dec 3, 2019

View reviewed changes

alikon added the GSoC label Jan 15, 2020

alikon closed this Feb 12, 2020

alikon reopened this Feb 20, 2020

alikon removed the GSoC label Feb 23, 2020

alikon added 4 commits March 21, 2020 09:24

new lnag strings

a104eb6

api logging flags

50ddada

check api flags

b892d02

Merge branch '4.0-dev' into patch-122

3ba979f

Quy reviewed Mar 23, 2020

View reviewed changes

Comment thread administrator/language/en-GB/com_actionlogs.ini Outdated

Quy reviewed Mar 23, 2020

View reviewed changes

Comment thread administrator/language/en-GB/com_actionlogs.ini Outdated

alikon and others added 2 commits March 23, 2020 19:30

Update administrator/language/en-GB/com_actionlogs.ini

1075927

Co-Authored-By: Quy <quy@fluxbb.org>

Update administrator/language/en-GB/com_actionlogs.ini

7701150

Co-Authored-By: Quy <quy@fluxbb.org>

Quy reviewed Mar 23, 2020

View reviewed changes

Comment thread plugins/actionlog/joomla/joomla.php Outdated

Quy reviewed Mar 24, 2020

View reviewed changes

Comment thread administrator/components/com_actionlogs/config.xml

alikon and others added 2 commits March 24, 2020 07:34

Update plugins/actionlog/joomla/joomla.php

6ed70d0

Co-Authored-By: Quy <quy@fluxbb.org>

Update administrator/components/com_actionlogs/config.xml

4a38077

Co-Authored-By: Quy <quy@fluxbb.org>

wilsonge merged commit c3aa06a into joomla:4.0-dev Mar 24, 2020

zero-24 added this to the Joomla 4.0 milestone Mar 24, 2020

zero-24 mentioned this pull request Mar 24, 2020

[4.0][API][com_actionslogs] keep track of API requests #27094 joomlagerman/joomla#968

Closed

alikon deleted the patch-122 branch March 24, 2020 12:16

Kostelano mentioned this pull request Apr 24, 2025

Лог действий пользователей - Лог API запросов JPathRu/localisation#123

Closed

Uh oh!

Conversation

alikon commented Nov 17, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of Changes

Testing Instructions

Expected result

Actual result

Documentation Changes Required

Uh oh!

Uh oh!

Uh oh!

mbabker commented Nov 17, 2019

Uh oh!

alikon commented Nov 17, 2019

Uh oh!

Uh oh!

Uh oh!

wilsonge commented Nov 18, 2019

Uh oh!

Uh oh!

Quy commented Dec 3, 2019

Uh oh!

alikon commented Dec 3, 2019

Uh oh!

Quy commented Dec 3, 2019

Uh oh!

Quy Dec 3, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alikon Dec 4, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chmst commented Mar 20, 2020

Uh oh!

chmst commented Mar 20, 2020

Uh oh!

wilsonge commented Mar 20, 2020

Uh oh!

N6REJ commented Mar 20, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alikon commented Mar 21, 2020

Uh oh!

alikon commented Mar 21, 2020

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Razzo1987 commented Mar 24, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wilsonge commented Mar 24, 2020

Uh oh!

alikon commented Mar 24, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

alikon commented Nov 17, 2019 •

edited

Loading

Quy Dec 3, 2019 •

edited

Loading

alikon Dec 4, 2019 •

edited

Loading

N6REJ commented Mar 20, 2020 •

edited

Loading

Razzo1987 commented Mar 24, 2020 •

edited

Loading