Open-Web-Analytics/Open-Web-Analytics 1.12.0

Release 1.12.0

on GitHub

Overview

This is a bug fix and maintenance release that ships with an optional maintenance CLI command for improving key generation. The optional CLI step is essential for long term data quality on large installs.

Upgrading

Schema 15 → 16. Run cmd=update (or visit the admin UI, which prompts). The update writes a single setting and takes no locks, so it does not require CLI mode.

One optional manual step, at your convenience. Dimension ids are 63-bit from this version on. A new installation gets that immediately. An existing installation keeps deriving the old 32-bit ids until you run:

php cli.php cmd=rederive-dimension-ids

Ids stay internally consistent either way, so there is no rush and nothing breaks if you never run it — but until you do, the installation carries use_32bit_hash and the wider id space is not in use. The migration is deliberately a command you run when it suits you rather than something an upgrade does to you.

Partition your fact tables first — this is a prerequisite, not a tuning tip. The rewrite is issued one partition at a time; on an unpartitioned table it becomes one unbounded statement per key column across the whole table, holding a single long lock while tracking continues. There is no hurry to convert ids, so partition first and convert afterwards.

Read Converting Dimension Ids before you start — it covers the preparation, timing and performance (about 8 minutes for 136,000 ids and 2.5 million fact rows on storage sustaining 3,000 IOPS; the work is I/O-bound, so sustained IOPS decides the duration), and what the conversion deliberately leaves behind.

No new cron entry. The scheduler's single entry from 1.11.0 is unchanged.

Security

Domstreamand heatmap playback The overlay uses a new short lived token and no longer relies on the overlay cookie.

JSONP is gone, client and server. the two cross site overlays that needed it now fetch over CORS.

Tracking events for unregistered sites are refused. Your site_id must be the in the owa_sites table prior to the recording of tracking events.

Fixed

• CORS requests addCorsHeaders() compared site row arrays against the Origin string, so no Access-Control-Allow-Origin was ever sent. Origins now match on host, so an install storing http://example.com while serving over https still works. Vary: Origin is always sent.
• The heatmap reported fixed Overlay API links lost their siteId; the player failed loudly with a 422 but the heatmap returned 200 for a query with no site filter and a defaulted period.
• Event queues could stop draining permanently. Messages queued before the PSR-4 relocation named the pre-namespace class and could not be decoded properly.
• Site access UI The UI arround adding per site permissions has been totally reworked to avoid accidental user errors.
• A refused database connection took down the whole request instead of degrading.
• A robot token at the start of a user agent was not counted as a robot.
• Asset URLs were built with a doubled slash.
• Partition-rotate's refusal message read "no fact table is not partitioned".

Changed

• Two goal types are removed. visit_duration and pages_per_visit were never reachable — the dispatcher sent visit_duration to the pages-per-visit checker, neither npvs nor session_duration was ever written, and both switches lacked a break. Only url_destination was ever functional. Existing goals of the removed types were already inert.