Skip to content
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 46 additions & 3 deletions core/Archive.php
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,9 @@
use Piwik\ArchiveProcessor\Rules;
use Piwik\Container\StaticContainer;
use Piwik\DataAccess\ArchiveSelector;
use Piwik\DataAccess\ArchiveTableCreator;
use Piwik\DataAccess\ArchiveWriter;
use Piwik\Period\Day;
use Piwik\Plugins\CoreAdminHome\API;

/**
Expand Down Expand Up @@ -283,9 +285,50 @@ public static function factory(

public static function shouldSkipArchiveIfSkippingSegmentArchiveForToday(Site $site, Period $period, Segment $segment)
{
$now = Date::factory('now', $site->getTimezone());
return !$segment->isEmpty()
&& $period->getDateStart()->toString() === $now->toString();
if ($segment->isEmpty()) {
return false;
}

// is today the first day of the period?
$today = Date::factory('today', $site->getTimezone());
if ($period->getDateStart()->toString() === $today->toString()) {
return true;
}

// if not today and we have a day period, don't skip
if ($period->getId() === Day::PERIOD_ID) {
return false;
}

// was a usable archive created today already?
$sql = sprintf(
'SELECT ts_archived
FROM %s
WHERE
name = ? AND
idsite = ? AND
period = ? AND
date1 = ? AND
date2 = ?
',
ArchiveTableCreator::getNumericTable($period->getDateStart())
Copy link

@aikido-pr-checks aikido-pr-checks bot Sep 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential SQL injection via string-based query concatenation - high severity
SQL injection might be possible in these locations, especially if the strings being concatenated are controlled via user input.

Remediation: If possible, rebuild the query to use prepared statements or an ORM. If that is not possible, make sure the user input is verified or sanitized. As an added layer of protection, we also recommend installing a WAF that blocks SQL injection attacks.
View details in Aikido Security

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In this case there's no user input, so this should be fine.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's also used all over the codebase, so adding another use of the same pattern should be fine.

);
$bind = [
Rules::getDoneFlagArchiveContainsAllPlugins($segment),
$site->getId(),
$period->getId(),
$period->getDateStart(),
$period->getDateEnd(),
];

$lastArchived = Db::get()->fetchOne($sql, $bind);

// is ts_archived NOT earlier than today (i.e. it is equal or later than today)?
if ($lastArchived && !Date::factory($lastArchived, $site->getTimezone())->isEarlier($today)) {
return true;
}

return false;
}

/**
Expand Down
Loading