Fix GLPI 11 compatibility with current Metabase API versions - #150
Open
whamulti wants to merge 1 commit into
Open
Fix GLPI 11 compatibility with current Metabase API versions#150whamulti wants to merge 1 commit into
whamulti wants to merge 1 commit into
Conversation
Several API response fields the plugin reads under their old names
were renamed by Metabase, and the newer native-question query format
("MBQL 5") wasn't handled at all:
- ordered_cards -> dashcards on GET /api/dashboard/:id
- sizeX/sizeY -> size_x/size_y on dashboard cards
- dataset_query.native.{query,template-tags} moved to
dataset_query.stages[0].{native,template-tags}
- getCards('root') never matched cards in the root collection, since
the API returns id:"root" for that collection but collection_id:null
on the cards themselves
All fixed with backward-compatible `??` fallbacks so older Metabase
instances keep working.
Also fixes a more severe regression introduced in 1.4.2: embedded_token
was added to secured_configs and is expected to be sodium-encrypted,
but the upgrade migration only flipped the is_embedded_token_encrypted
flag without ever actually encrypting the existing plain-text value.
dashboard.class.php unconditionally decrypts embedded_token before
signing the dashboard JWT, so any site that already had a token
configured before upgrading got an empty signing key and an uncaught
Lcobucci\JWT\Signer\InvalidKeyProvided exception on every visit to the
embedded dashboard tab. The migration now actually encrypts the value,
mirroring what the password migration a few lines above already does.
Fixes pluginsGLPI#148
stonebuzz
requested changes
Aug 10, 2026
| // Encrypt embedded_token, previously stored in plain text | ||
| if (!array_key_exists('is_embedded_token_encrypted', $current_config) || !$current_config['is_embedded_token_encrypted']) { | ||
| if (!empty($current_config['embedded_token'])) { | ||
| $current_config['embedded_token'] = (new GLPIKey())->encrypt($current_config['embedded_token']); |
Contributor
There was a problem hiding this comment.
Rather than securing the token directly here, since this class extends GLPI's Config class, you can simply use the Hooks::SECURED_CONFIGS hook.
For example, add the following to the plugin's setup.php file:
$PLUGIN_HOOKS[Hooks::SECURED_CONFIGS]['metabase'] = [
'embedded_token',
];This allows GLPI to handle the token as a secured configuration value using the standard mechanism.
Contributor
|
Can you adapt CHANGELOG.md ? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #148
Adds backward-compatible
??fallbacks for a handful of Metabase API fields that got renamed in current versions (ordered_cards→dashcards,sizeX/sizeY→size_x/size_y, and the new MBQL 5dataset_query.stages[0].*shape for native questions), plus the root-collectioncollection_idnormalization described in the issue.Also fixes the more severe regression from
1.4.2: theembedded_tokenupgrade migration setsis_embedded_token_encrypted=1without ever actually encrypting the existing plain-text value, sodashboard.class.php's unconditionalGLPIKey()->decrypt()call returns an empty string and the JWT signer throwsInvalidKeyProvidedon every visit to the embedded dashboard tab. Fixed to actually encrypt, mirroring thepasswordmigration right above it.All of this has been running in production against a live Metabase v0.63.2 instance for a few days now (both the extraction features and the embedded dashboard), see the issue for full repro steps and context. Happy to adjust anything if you'd prefer a different approach.