mirror/zoneminder
1
0
Fork 0
mirror of https://github.com/ZoneMinder/zoneminder.git synced 2026-08-03 00:37:21 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: use method call for System permission check in ConfigsController

Browse Source 
The config-api RCE fix (b036408a5) guards edit() and delete() with
($user['System'] == 'Edit'), but $user is a ZM\User object that does
not implement ArrayAccess and whose System property is protected. Array
access on it raises "Error: Cannot use object of type ZM\User as array",
so the endpoint fatals with HTTP 500 for every authenticated user. This
blocks the RCE only by accident and also breaks config editing for
legitimate System=Edit admins.

Use $user->System(), matching the idiom in every other API controller
(States, Servers, Monitors, Users, etc.).

Refs GHSA-mvj8-mqqq-2w5f.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 2f57a4f606)
This commit is contained in:
Isaac Connor
2026-07-15 16:17:51 -04:00
parent d71fbb805e
commit bbb03d2d05
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
web/api/app/Controller/ConfigsController.php
View File

@@ -105,7 +105,7 @@ class ConfigsController extends AppController {
*/
public function edit($id = null) {
global $user;
$canEdit = (!$user) || ($user['System'] == 'Edit');
$canEdit = (!$user) || ($user->System() == 'Edit');
if (!$canEdit) {
throw new UnauthorizedException(__('Insufficient privileges'));
return;
@@ -143,7 +143,7 @@ class ConfigsController extends AppController {
*/
public function delete($id = null) {
global $user;
$canEdit = (!$user) || ($user['System'] == 'Edit');
$canEdit = (!$user) || ($user->System() == 'Edit');
if (!$canEdit) {
throw new UnauthorizedException(__('Insufficient privileges'));
return;