Forwarded to devs Activity tracking while user login to admin panel

[Hangover2]

Username: Hangover2

TITLE

Activity tracking while user login to admin panel

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Plesk Obsidian 18.0.37 Update #2, Debian 10.10, x86-64

PROBLEM DESCRIPTION

Even though user activity tracking is disabled by panel configuration external requests are sent to sentrio.io in the moment someone logs into the Plesk admin panel:
https://sentry.io/api/1327420/envelope/?sentry_key=********************************&sentry_version=7

STEPS TO REPRODUCE

- Switch of user activity tracking in the panel configuration file (panel.ini).

[userActivityTracking]
enabled=false

- login to admin panel
- check network console for requests to sentry.io

ACTUAL RESULT

- external network request to sentry.io (user tracking)

EXPECTED RESULT

- no external network request to sentry.io (no user tracking)

ANY ADDITIONAL INFORMATION

- after login the Plesk panel takes care the setting and no more requests are sent

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug

 

[IgorG]

From the developer:

The sentry.io is not a UserTracking tool. Only anonymized information about errors in the frontend core is collected there, without any user data.

Plesk uses this system to get detailed information about product errors, which helps make the product more stable and reliable, and proactively react and fix some errors that might be even not yet noticed by a user.

The collected data is fully anonymized and GDPR-compliant and contains only error messages from the frontend core. No user data is included.

If you'd like to completely disable it and stop all requests to sentry.io, you can add the following configuration to your servers' /usr/local/psa/admin/conf/panel.ini file:

[feedback]
sentry.dsn = ""

 

[Hangover2]

Thanks for the info how to disable it. Nevertheless the requests are always sent, even when no errors occur. Just opening the login page of the admin panel is enough. The requests even indicate, that there are no errors:



For some admins and users those information + IP addresses are already sensitive data, that should not be shared on every visit - especially not by default without actively asking for it before. On top it can slow down the panel if network connectivity to sentry.io is not good.

I would recommend an opt-in for that feature. For sure many Plesk enthusiasts - including us - would activate it on their test servers to "make the product more stable and reliable".

 

[IgorG]

I would recommend an opt-in for that feature. For sure many Plesk enthusiasts - including us - would activate it on their test servers to "make the product more stable and reliable".

The opt-in feature already exists. Before start installation Plesk asking about that:

# wget https://installer.plesk.com/plesk-installer

chmod +x plesk-installer

./plesk-installer

...

Would you like to help Plesk make better products by sending information

about issues occurred, including installation and upgrade issues? [Y/n]:

If you select N, no requests will be sent to Sentry.

For some admins and users those information + IP addresses are already sensitive data, that should not be shared on every visit

Sentry does not collect IP addresses of the customers. Plesk is a GDPR compliant software and only anonymized technical data is gathered: How we moved towards full GDPR Compliance

On top it can slow down the panel if network connectivity to sentry.io is not good.

In case it slow down Plesk, disable Sentry requests using the suggested solution:

[feedback]

sentry.dsn = ""

During tests, developers found unexpected behaviour. If Plesk is installed via 1-click installer, the Sentry requests are sent without confirmation. Only on the next Plesk Installer run confirmation is requested. They've submitted a bug to fix such behaviour: PPPM-13177