mirror of
https://github.com/blakeblackshear/frigate.git
synced 2026-10-30 05:40:05 -04:00
Josh Hawkins
94e570017c
* check ownership before stopping a camera watch from chat The stop_camera_watch chat tool cancelled the active VLM watch job without checking who started it, so any authenticated user could cancel another user's job by calling /chat/completion directly. The tool now uses the same admin-or-creator check as DELETE /vlm/monitor, and chat-started jobs record their creator so non-admins can still stop their own. * Added a test that calls `_execute_start_camera_watch` and checks `start_vlm_watch_job` receives the caller's username, so removing that argument now fails it.