MedMatomoPro - Matomo Analytics tracking for PrestaShop

Changelog

2.0.0 - 05/05/2026

Major rewrite — overview

• Full PrestaShop 1.6 → 9.x compatibility, PHP 5.6 → 8.4. ps_versions_compliancy extended to 9.99.99.
• Configuration storage migrated from a single JSON blob (1.x) to 29 discrete Configuration entries, fully multistore-aware via Configuration::updateValue.
• Six back-office tabs: Dashboard, Configuration, Information & support, Diagnostic, FAQ, Security Policy. The Information tab follows the medmathcaptcha identity-card pattern.
• No additional database table — every option lives in the standard Configuration store, multistore-aware, removed at uninstall.

New tracking features

• Server-side e-commerce tracking via the actionValidateOrder hook — recovers conversions otherwise lost to ad-blockers, JS-disabled browsers and Safari ITP. Self-contained mini tracker (PHP 5.6+ compatible, curl with file_get_contents fallback).
• First-party proxy: optional front controllers serve matomo.js and matomo.php from your shop domain, defeating hostname-based ad-blockers.
• Custom Dimensions auto-mapping (customer group, currency, language, device type, shop ID/name, payment method, carrier).
• Matomo Tag Manager mode as an alternative to the direct tracker.
• Core Web Vitals reporting (LCP, INP, CLS, FCP, TTFB) via the official web-vitals.js, asynchronous.
• Bot/crawler filtering for server-side hits (Googlebot, AhrefsBot, Lighthouse, etc.).
• Customer login/logout events via actionAuthentication and actionCustomerLogoutAfter hooks.
• Site search tracking via actionSearch — feeds the Matomo Site Search report.
• Server-side cart-save tracking via actionCartSave so abandoned carts are still attributed when JS is blocked.
• Checkout funnel tracking: each PrestaShop 1.7+ checkout step (Authentication / Addresses / Delivery / Payment) reported as a Matomo event.
• JS feature toggles: enableJSErrorTracking and enableHeartBeatTimer (configurable delay 5–300 seconds).
• setUserId support for logged-in customers, with optional SHA-256 hashing for stronger GDPR posture.

Embedded back-office dashboard

• New Dashboard tab with 12 opt-in widgets (visits, unique visitors, top pages, traffic sources, engagement KPIs, revenue, top products, top categories, conversion + AOV + orders, devices, top countries, site search keywords, real-time visitors). Each widget is independently toggleable in the Configuration tab.
• Server-side data fetching via the Matomo Reporting API (POST), rendered with Chart.js v4 (vendored locally as a UMD bundle, ~200 KB). No iframe, no cross-origin issue, no token in URL — works behind ad-blockers.
• Smart caching: 5-minute cache on regular widgets, 30-second cache on the live counter — keeps the BO snappy without hammering Matomo.
• Real-time visitors widget: AJAX auto-refresh every N seconds (configurable 10–300, default 30) with a countdown indicator and a manual Refresh button (icon-only, in the panel header).
• Back-office home widgets: optional live visitor counters (dashboardZoneOne) and 30-day visits chart (dashboardZoneTwo), rendered server-side, with a Refresh button each. Visible on every BO login without opening the module.
• Dashboard tab is hidden when the embedded dashboard is disabled, so the UI never shows an unusable area.

Privacy & GDPR

• Optional cookieless mode (disableCookies).
• Explicit consent gate with a window.MedMatomoConsent() bridge for any CMP (klaro, didomi, cookiebot, custom banners).
• Native Do Not Track honoring.
• Visitor opt-out front controller (/module/medmatomopro/optout) wrapping the native Matomo CoreAdminHome opt-out widget. Cross-version template (PS 1.6 + 1.7 + 8 + 9).
• Customer-account opt-out shortcut: a Manage analytics tracking link rendered on the customer account page (displayCustomerAccount and displayMyAccountBlock hooks).

Diagnostic & troubleshooting

• Health-check tab with 9 server-side checks (URL, site ID, reachability, ping, server-side prerequisites, proxy, matomo.js content-type, auth token, PHP extensions).
• Sequential AJAX re-run: clicking "Re-run all checks" refreshes each row one by one with per-row visual feedback (spinner + soft yellow background during, green flash after), no full page reload.
• Auth token validation detects super-user tokens (Matomo blocks them for widget embedding) and brute-force lockouts, with explicit remediation steps.
• Comprehensive FAQ tab covering setup, GDPR, ad-blockers, performance, multistore and troubleshooting.

Security

• Removed the 1.x unprotected debug front controller (hardcoded MD5 password backdoor exposing module configuration).
• Module enrolled under the TouchWeb responsible cybersecurity charter (FR/EN), with CVE publication policy. See the Security Policy tab.
• Module root .htaccess switched to a deny-all + extension allowlist pattern, hardened against direct access to PHP files outside whitelisted entry points.

PrestaShop 9 compatibility

• Replaced the removed _PS_PRICE_COMPUTE_PRECISION_ constant with a version-agnostic helper (PS 1.6 → 9).
• Reporting API token sent via POST (Matomo 5+ requirement).
• vendor/css/ps9.css conditionally loaded on PrestaShop 9 to fix tab link styling.
• Added the config.xml manifest for fast back-office discovery.

PrestaShop 1.6 compatibility

• Cross-version optout template: PS 1.7+ extends page.tpl from the Classic theme; PS 1.6 falls back to a plain HTML wrapper. The setTemplate call resolves the right path for each version.
• getCheckoutProcess (PS 1.7+) is invoked through method_exists(), so the checkout funnel feature degrades silently on PS 1.6 instead of failing.
• Hooks displayBeforeBodyClosingTag and actionCustomerLogoutAfter (PS 1.7+) registered without breaking 1.6 — the related features (Core Web Vitals, logout event) just stay inactive.

Bug fixes (over 1.x)

• Cart.js currency-stripping regex was matching the literal string "€,$,£" instead of the individual symbols, breaking parseFloat for non-dot decimal separators.
• Hook now registered as canonical "displayHeader" instead of "displayheader"; the legacy hookHeader alias was removed.
• Removed dead SKU assignment in the product hook.

Bug fixes during the 2.0.0 stabilization

• Live AJAX URL was built with HTML-encoded ampersands (&), which broke the PrestaShop admin token parameter when consumed by the JS — the endpoint was rejected with a security error. Fixed by html_entity_decode before json_encode.
• Diagnostic AJAX inline script and stylesheet originally lived inside the PrestUI tab, but Riot.js scans children for curly-brace expressions and choked on JS function blocks and CSS rules. Moved JS and CSS to external files (medmatomopro-diag-VERSION.js, medmatomopro-VERSION.css) and pass config via discrete data-* attributes (no JSON object literals in attribute values).
• Tooltips on the dashboard widget header and BO home reload buttons were not showing — switched to Bootstrap tooltips with data-toggle="tooltip" and explicit init via jQuery.
• Iframe-based dashboard mode removed entirely (failed for super-user tokens, brute-force lockouts and DOMException on PS9). Replaced by server-side data fetching with Chart.js v4.
• Custom dateFormat Smarty plugin removed — PrestaShop ships one natively in config/smarty.config.inc.php; the redefinition raised "Plugin tag dateFormat already registered".

Refactor & cleanup

• New helper classes: MedMatomoProServerTracker, MedMatomoProDiagnostic, MedMatomoProConsent, MedMatomoProDimensions, MedMatomoProReports.
• JS and CSS files versioned in their filename (medmatomopro-VERSION.js/css) for proper cache busting on upgrades.
• Renamed the third-party libraries directory from libraries/ to vendor/ to align with PHP/Composer conventions.
• Tab templates moved into views/templates/admin/tabs/ for clearer file layout.
• Replaced the inline medDisplayDate calls with the native PrestaShop dateFormat Smarty plugin; MedMatomoProClass is now a pure static helper.
• Translations rebuilt from scratch — 333+ entries in fr.php sourced directly from the templates and PHP, no orphans, no English left over.
• Dead-code purge: removed orphan MedMatomoProConsent::policyText / host helpers, MedMatomoProDimensions::SOURCES catalog, and three unused Smarty assigns (ps_version, widget_catalog, live_ajax_url) — about 50 lines of unreferenced code.
• Removed dead 1.x code: medGetLanguageCode, medJsonFeedFile, medJsonModuleFile, thirty-bees branching, redundant inherited public properties, addons/prestatoolbox image assets.

Upgrade

• upgrade-2.0.0.php migrates the legacy single-JSON Configuration entry to the 29 discrete keys, registers the 12 hooks, drops obsolete cache keys (MED_FEED_*, MED_JSON_*) and removes obsolete files and folders (cart.js, back.css, libraries/, controllers/debug.php) using Tools::deleteDirectory.

1.0.0 - 08/17/2023

• Version initiale