refs #4996 allow redirects to subdomains of known hosts

core/Url.php

@@ -630,8 +630,9 @@ class Url
                     return true;
                 }
 
-                if (Common::stringEndsWith($siteHost, $host)) {
-                    return;
+                if (Common::stringEndsWith($siteHost, '.' . $host)) {
+                    // allow subdomains
+                    return true;
                 }
             }
         }

misc/internal-docs/content-tracking.md

@@ -429,15 +429,12 @@ Yes it seems most logical to create an action entry for each Content.
 Nothing special here I think. We would probably automatically detect the type of content (image, video, text, sound, ...) depending on the content eg in case it ends with [.jpg, .png, .gif] it could be recognized as image content and show a banner in the report.
 
 ## TODO
-* Redirect to URL in piwik.php only if a known site (site table in Piwik)
 * Would content impressions be tracked in overlay session?
   * Overlay session should not trigger a content impression
 * Test scroll event in ie9, ie10, ie11, opera
-* Run JS tests  in ff3, ie7, ie8, ie9, ie10, ie11, opera, android, iphone, ms phone, safari
-* Write PHP tests
+* Run JS tests  in ff3, ie7, ie8, ie9, ie11, android, iphone, ms phone
+* Write UI test
 * Show images on hover in report
-* Better position #contenttest in JS tests to make isNodeVisible work on all platforms
-* makeNodesUnique should return same result on all browsers. It does currently but different order which is no problem at all but makes test work in all browsers
 * When a user clicks on an interaction, we should check whether we have already tracked the impression as the content is visible now. If not tracked before, we should track the impression as well
   * There can be a scroll or timer event that detects the same content became visible as well. This would not be a problem since we do not track same content block twice
   * Maybe v2

tests/PHPUnit/Core/UrlTest.php

@@ -320,12 +320,17 @@ class UrlTest extends PHPUnit_Framework_TestCase
             array(false, 'http://', array()),
             array(false, 'example.com', array()),
             array(false, 'www.example.com', array()),
-            array(false, 'example.com', array('www.example.com')),
-            array(false, 'example.com', array('http://www.example.com')),
+            array(false, 'example.com', array('www.example.com')), // not a domain so no "host"
             array(true, 'example.com', array('example.com')),
             array(true, 'eXamPle.com', array('exaMple.com')),
             array(true, 'eXamPle.com', array('http://exaMple.com')),
-            array(true, 'example.com', array('http://example.com/test')),
+            array(true, 'eXamPle.com', array('http://piwik.org', 'http://www.exaMple.com', 'http://exaMple.com')), // multiple urls one or more are valid but not first one
+            array(true, 'example.com', array('http://example.com/test')), // url with path but correct host
+            array(true, 'example.com', array('http://www.example.com')), // subdomains are allowed
+            array(false, 'example.com', array('http://wwwexample.com')), // it should not be possible to create a similar host and make redirects work again. we allow only subdomains
+            array(true, 'example.com', array('http://ftp.exAmple.com/test')),
+            array(true, 'example.com', array('http://www.exAmple.com/test')),
+            array(false, 'ftp.example.com', array('http://www.example.com/test')),
             array(true, '127.0.0.1', array()), // always trusted host
         );
     }