Conversation
Several API response fields the plugin reads under their old names
were renamed by Metabase, and the newer native-question query format
("MBQL 5") wasn't handled at all:
- ordered_cards -> dashcards on GET /api/dashboard/:id
- sizeX/sizeY -> size_x/size_y on dashboard cards
- dataset_query.native.{query,template-tags} moved to
dataset_query.stages[0].{native,template-tags}
- getCards('root') never matched cards in the root collection, since
the API returns id:"root" for that collection but collection_id:null
on the cards themselves
All fixed with backward-compatible `??` fallbacks so older Metabase
instances keep working.
Also fixes a more severe regression introduced in 1.4.2: embedded_token
was added to secured_configs and is expected to be sodium-encrypted,
but the upgrade migration only flipped the is_embedded_token_encrypted
flag without ever actually encrypting the existing plain-text value.
dashboard.class.php unconditionally decrypts embedded_token before
signing the dashboard JWT, so any site that already had a token
configured before upgrading got an empty signing key and an uncaught
Lcobucci\JWT\Signer\InvalidKeyProvided exception on every visit to the
embedded dashboard tab. The migration now actually encrypts the value,
mirroring what the password migration a few lines above already does.
Fixes pluginsGLPI#148
stonebuzz
requested changes
Aug 10, 2026
Contributor
|
Can you adapt CHANGELOG.md ? |
2 tasks
Author
|
Added the CHANGELOG entry as requested. Also replied inline to the double-encryption question with a concrete trace through |
stonebuzz
approved these changes
Aug 28, 2026
stonebuzz
requested changes
Aug 28, 2026
Comment on lines
+12
to
+15
| - Fix question/dashboard extraction against current Metabase API versions (`ordered_cards` → `dashcards`, `sizeX`/`sizeY` → `size_x`/`size_y`, native question query moved to `dataset_query.stages[0].*`) | ||
| - Fix root collection questions never matching in `getCards('root')` | ||
| - Fix extraction AJAX URL resolving to the wrong host when `root_doc` is empty | ||
| - Fix `embedded_token` migration not actually encrypting the value on upgrade, breaking the embedded dashboard with an `InvalidKeyProvided` exception for any site that had a token configured before updating to 1.4.2 |
Contributor
There was a problem hiding this comment.
Suggested change
| - Fix question/dashboard extraction against current Metabase API versions (`ordered_cards` → `dashcards`, `sizeX`/`sizeY` → `size_x`/`size_y`, native question query moved to `dataset_query.stages[0].*`) | |
| - Fix root collection questions never matching in `getCards('root')` | |
| - Fix extraction AJAX URL resolving to the wrong host when `root_doc` is empty | |
| - Fix `embedded_token` migration not actually encrypting the value on upgrade, breaking the embedded dashboard with an `InvalidKeyProvided` exception for any site that had a token configured before updating to 1.4.2 | |
| - Fixed Metabase compatibility with current API versions | |
| - Fix `embedded-token` migration for existing configurations. |
Author
There was a problem hiding this comment.
Applied, thanks for confirming the encryption discussion too!
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Rom1-B
approved these changes
Sep 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #148
Adds backward-compatible
??fallbacks for a handful of Metabase API fields that got renamed in current versions (ordered_cards→dashcards,sizeX/sizeY→size_x/size_y, and the new MBQL 5dataset_query.stages[0].*shape for native questions), plus the root-collectioncollection_idnormalization described in the issue.Also fixes the more severe regression from
1.4.2: theembedded_tokenupgrade migration setsis_embedded_token_encrypted=1without ever actually encrypting the existing plain-text value, sodashboard.class.php's unconditionalGLPIKey()->decrypt()call returns an empty string and the JWT signer throwsInvalidKeyProvidedon every visit to the embedded dashboard tab. Fixed to actually encrypt, mirroring thepasswordmigration right above it.All of this has been running in production against a live Metabase v0.63.2 instance for a few days now (both the extraction features and the embedded dashboard), see the issue for full repro steps and context. Happy to adjust anything if you'd prefer a different approach.