From 3b2f1b4fb28318ee91ce36e0eac0657b59ed85c8 Mon Sep 17 00:00:00 2001
From: IgorA100 <igora100@gmail.com>
Date: Thu, 28 May 2026 12:38:16 +0300
Subject: [PATCH 01/12] Optimized the drop-down list of found monitors.
 (onvifprobe.php)

- In the drop-down list of found monitors, select those monitors that are already added to the system.
- Sort the list of found monitors by hostname.
---
 web/skins/classic/views/onvifprobe.php | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/web/skins/classic/views/onvifprobe.php b/web/skins/classic/views/onvifprobe.php
index b9311d575..6cdd413dd 100644
--- a/web/skins/classic/views/onvifprobe.php
+++ b/web/skins/classic/views/onvifprobe.php
@@ -169,7 +169,19 @@ if (!isset($_REQUEST['step']) || ($_REQUEST['step'] == '1')) {
     }
   }
 
+  $monitors = dbFetchAll('SELECT Path FROM Monitors WHERE Deleted=false');
+  if ($monitors) {
+    $monitorHosts = [];
+    foreach ($monitors as $monitor) {
+      if (preg_match('/\/\/([\w\-.]+)[\/|:|\?]/', $monitor['Path'], $matches)) {
+        $monitorHosts[] = $matches[1];
+      }
+    }
+  }
+  $monitorHosts = array_unique($monitorHosts);
+
   $detcameras = probeCameras('');
+  usort($detcameras, fn($a, $b) => $a['monitor']['Host'] <=> $b['monitor']['Host']);
   foreach ($detcameras as $camera) {
     if (preg_match('|([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)|', $camera['monitor']['Host'], $matches)) {
       $ip = $matches[1];
@@ -177,7 +189,13 @@ if (!isset($_REQUEST['step']) || ($_REQUEST['step'] == '1')) {
     $host = $ip;
     $sourceDesc = base64_encode(json_encode($camera['monitor']));
     $sourceString = $camera['model'].' @ '.$host.' using version '.$camera['monitor']['SOAP'];
-    $cameras[$sourceDesc] = $sourceString;
+
+    $_host = (preg_match('/\/\/([\w\-.]+)[\/|:|\?]/', $camera['monitor']['Host'], $matches)) ? $matches[1] : '';
+    if ($_host && in_array($_host, $monitorHosts, true)) {
+      $cameras[$sourceDesc] = ['Name'=> $sourceString, 'class'=> 'monitor-added'];
+    } else {
+      $cameras[$sourceDesc] = $sourceString;
+    }
   }
 
   if (count($cameras) <= 0)

From 9eddec677ec6ed722ed18e09bb45450676ae3a15 Mon Sep 17 00:00:00 2001
From: IgorA100 <igora100@gmail.com>
Date: Thu, 28 May 2026 12:41:07 +0300
Subject: [PATCH 02/12] Added a style (onvifprobe.css)

---
 web/skins/classic/css/base/views/onvifprobe.css | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 web/skins/classic/css/base/views/onvifprobe.css

diff --git a/web/skins/classic/css/base/views/onvifprobe.css b/web/skins/classic/css/base/views/onvifprobe.css
new file mode 100644
index 000000000..40bc5a4dd
--- /dev/null
+++ b/web/skins/classic/css/base/views/onvifprobe.css
@@ -0,0 +1,3 @@
+.monitor-added {
+  opacity: 0.4;
+}

From c2ebbc7ed5840564ff8a9ea6617c8b5775e2c58e Mon Sep 17 00:00:00 2001
From: IgorA100 <igora100@gmail.com>
Date: Thu, 28 May 2026 12:44:59 +0300
Subject: [PATCH 03/12] Added the ability to specify a class for
 <select><option> in the htmlSelect() function (functions.php)

---
 web/includes/functions.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/web/includes/functions.php b/web/includes/functions.php
index 4d5ad44a3..9fea87df6 100644
--- a/web/includes/functions.php
+++ b/web/includes/functions.php
@@ -424,7 +424,7 @@ function htmlOptions($options, $values) {
   $has_selected = false;
   foreach ( $options as $value=>$option ) {
     $disabled = 0;
-    $text = '';
+    $text = $class = '';
     if ( is_array($option) ) {
 
       if ( isset($option['Name']) )
@@ -435,6 +435,9 @@ function htmlOptions($options, $values) {
       if ( isset($option['disabled']) ) {
         $disabled = $option['disabled'];
       }
+      if ( isset($option['class']) ) {
+        $class = $option['class'];
+      }
     } else if ( is_object($option) ) {
       $text = $option->Name();
     } else {
@@ -450,6 +453,7 @@ function htmlOptions($options, $values) {
     $options_html .= '<option value="'.htmlspecialchars($value, ENT_COMPAT | ENT_HTML401, ini_get('default_charset'), false).'"'.
       ($selected?' selected="selected"':'').
       ($disabled?' disabled="disabled"':'').
+      ($class?' class='.$class:'').
       '>'.htmlspecialchars($text, ENT_COMPAT | ENT_HTML401, ini_get('default_charset'), false).'</option>'.PHP_EOL;
   } # end foreach options
   if ( $values and ((!is_array($values)) or count($values) ) and ! $has_selected ) {

From 4f9c905f643c5a78658190f080f2df39652039a9 Mon Sep 17 00:00:00 2001
From: IgorA100 <igora100@gmail.com>
Date: Fri, 29 May 2026 12:10:39 +0300
Subject: [PATCH 04/12] The added class must be escaped using
 htmlspecialchars() (functions.php)

---
 web/includes/functions.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/includes/functions.php b/web/includes/functions.php
index 9fea87df6..2e5589729 100644
--- a/web/includes/functions.php
+++ b/web/includes/functions.php
@@ -453,7 +453,7 @@ function htmlOptions($options, $values) {
     $options_html .= '<option value="'.htmlspecialchars($value, ENT_COMPAT | ENT_HTML401, ini_get('default_charset'), false).'"'.
       ($selected?' selected="selected"':'').
       ($disabled?' disabled="disabled"':'').
-      ($class?' class='.$class:'').
+      ($class?' class='.htmlspecialchars($class, ENT_COMPAT | ENT_HTML401, ini_get('default_charset'), false):'').
       '>'.htmlspecialchars($text, ENT_COMPAT | ENT_HTML401, ini_get('default_charset'), false).'</option>'.PHP_EOL;
   } # end foreach options
   if ( $values and ((!is_array($values)) or count($values) ) and ! $has_selected ) {

From 8620d8a556ff47d29e49f218f08df177266887f0 Mon Sep 17 00:00:00 2001
From: IgorA100 <igora100@gmail.com>
Date: Fri, 29 May 2026 12:30:39 +0300
Subject: [PATCH 05/12] Use "parse_url" instead of "preg_match" when
 determining hosts (onvifprobe.php)

The $monitorHosts definition was taken out of the above conditions.
---
 web/skins/classic/views/onvifprobe.php | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/web/skins/classic/views/onvifprobe.php b/web/skins/classic/views/onvifprobe.php
index 6cdd413dd..0957d7ce0 100644
--- a/web/skins/classic/views/onvifprobe.php
+++ b/web/skins/classic/views/onvifprobe.php
@@ -170,11 +170,12 @@ if (!isset($_REQUEST['step']) || ($_REQUEST['step'] == '1')) {
   }
 
   $monitors = dbFetchAll('SELECT Path FROM Monitors WHERE Deleted=false');
+  $monitorHosts = [];
   if ($monitors) {
-    $monitorHosts = [];
     foreach ($monitors as $monitor) {
-      if (preg_match('/\/\/([\w\-.]+)[\/|:|\?]/', $monitor['Path'], $matches)) {
-        $monitorHosts[] = $matches[1];
+      $_host = parse_url($monitor['Path'], PHP_URL_HOST);
+      if ($_host) {
+        $monitorHosts[] = $_host;
       }
     }
   }
@@ -190,7 +191,7 @@ if (!isset($_REQUEST['step']) || ($_REQUEST['step'] == '1')) {
     $sourceDesc = base64_encode(json_encode($camera['monitor']));
     $sourceString = $camera['model'].' @ '.$host.' using version '.$camera['monitor']['SOAP'];
 
-    $_host = (preg_match('/\/\/([\w\-.]+)[\/|:|\?]/', $camera['monitor']['Host'], $matches)) ? $matches[1] : '';
+    $_host = parse_url($camera['monitor']['Host'], PHP_URL_HOST);
     if ($_host && in_array($_host, $monitorHosts, true)) {
       $cameras[$sourceDesc] = ['Name'=> $sourceString, 'class'=> 'monitor-added'];
     } else {

From 90539982477e97fd4d02b29f24070656fe47ecfd Mon Sep 17 00:00:00 2001
From: IgorA100 <igora100@gmail.com>
Date: Sat, 30 May 2026 11:08:01 +0300
Subject: [PATCH 06/12] Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 web/includes/functions.php             | 2 +-
 web/skins/classic/views/onvifprobe.php | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/web/includes/functions.php b/web/includes/functions.php
index 2e5589729..19b3cf11c 100644
--- a/web/includes/functions.php
+++ b/web/includes/functions.php
@@ -453,7 +453,7 @@ function htmlOptions($options, $values) {
     $options_html .= '<option value="'.htmlspecialchars($value, ENT_COMPAT | ENT_HTML401, ini_get('default_charset'), false).'"'.
       ($selected?' selected="selected"':'').
       ($disabled?' disabled="disabled"':'').
-      ($class?' class='.htmlspecialchars($class, ENT_COMPAT | ENT_HTML401, ini_get('default_charset'), false):'').
+      ($class?' class="'.htmlspecialchars($class, ENT_COMPAT | ENT_HTML401, ini_get('default_charset'), false).'"':'').
       '>'.htmlspecialchars($text, ENT_COMPAT | ENT_HTML401, ini_get('default_charset'), false).'</option>'.PHP_EOL;
   } # end foreach options
   if ( $values and ((!is_array($values)) or count($values) ) and ! $has_selected ) {
diff --git a/web/skins/classic/views/onvifprobe.php b/web/skins/classic/views/onvifprobe.php
index 0957d7ce0..8ddd37edc 100644
--- a/web/skins/classic/views/onvifprobe.php
+++ b/web/skins/classic/views/onvifprobe.php
@@ -182,7 +182,9 @@ if (!isset($_REQUEST['step']) || ($_REQUEST['step'] == '1')) {
   $monitorHosts = array_unique($monitorHosts);
 
   $detcameras = probeCameras('');
-  usort($detcameras, fn($a, $b) => $a['monitor']['Host'] <=> $b['monitor']['Host']);
+  usort($detcameras, function($a, $b) {
+    return strcasecmp(parse_url($a['monitor']['Host'], PHP_URL_HOST) ?: '', parse_url($b['monitor']['Host'], PHP_URL_HOST) ?: '');
+  });
   foreach ($detcameras as $camera) {
     if (preg_match('|([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)|', $camera['monitor']['Host'], $matches)) {
       $ip = $matches[1];

From d77585cb08657cc8850d1988bc7ff217549d799e Mon Sep 17 00:00:00 2001
From: IgorA100 <igora100@gmail.com>
Date: Sat, 30 May 2026 22:24:11 +0300
Subject: [PATCH 07/12] Use hostname obtained via "parse_url", do not use
 regular expression to obtain IPv4 (onvifprobe.php)

---
 web/skins/classic/views/onvifprobe.php | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/web/skins/classic/views/onvifprobe.php b/web/skins/classic/views/onvifprobe.php
index 96b8ebbb1..6f62fd07e 100644
--- a/web/skins/classic/views/onvifprobe.php
+++ b/web/skins/classic/views/onvifprobe.php
@@ -186,15 +186,11 @@ if (!isset($_REQUEST['step']) || ($_REQUEST['step'] == '1')) {
     return strcasecmp(parse_url($a['monitor']['Host'], PHP_URL_HOST) ?: '', parse_url($b['monitor']['Host'], PHP_URL_HOST) ?: '');
   });
   foreach ($detcameras as $camera) {
-    if (preg_match('|([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)|', $camera['monitor']['Host'], $matches)) {
-      $ip = $matches[1];
-    }
-    $host = $ip;
+    $host = parse_url($camera['monitor']['Host'], PHP_URL_HOST);
     $sourceDesc = base64_encode(json_encode($camera['monitor']));
-    $sourceString = $camera['model'].' @ '.$host.' using version '.$camera['monitor']['SOAP'];
+    $sourceString = htmlspecialchars($camera['model'].' @ '.$host.' using version '.$camera['monitor']['SOAP']);
 
-    $_host = parse_url($camera['monitor']['Host'], PHP_URL_HOST);
-    if ($_host && in_array($_host, $monitorHosts, true)) {
+    if ($host && in_array($host, $monitorHosts, true)) {
       $cameras[$sourceDesc] = ['Name'=> $sourceString, 'class'=> 'monitor-added'];
     } else {
       $cameras[$sourceDesc] = $sourceString;

From 8ecad0d28ebbdc799f997faf7ff1ade976bc9380 Mon Sep 17 00:00:00 2001
From: IgorA100 <igora100@gmail.com>
Date: Sun, 31 May 2026 17:46:02 +0300
Subject: [PATCH 08/12] If the requested Object isn't found in the database,
 generate a Warning instead of an Error. (Object.php)

---
 web/includes/Object.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/includes/Object.php b/web/includes/Object.php
index 3db86f641..b29d0c191 100644
--- a/web/includes/Object.php
+++ b/web/includes/Object.php
@@ -24,7 +24,7 @@ class ZM_Object {
         $table = $class::$table;
         $row = dbFetchOne("SELECT * FROM `$table` WHERE `Id`=?", NULL, array($IdOrRow));
         if (!$row) {
-          Error("Unable to load $class record for Id=$IdOrRow");
+          Warning("Unable to load $class record for Id=$IdOrRow");
           return;
         }
       } else {

From 2012619dbf3564ef6dc8a93e576ea2ae706c7397 Mon Sep 17 00:00:00 2001
From: IgorA100 <igora100@gmail.com>
Date: Tue, 2 Jun 2026 14:43:02 +0300
Subject: [PATCH 09/12] When executing the streamCmdStop() command, always stop
 the stream regardless of the passed "action" parameter.  (watch.js)

---
 web/skins/classic/views/js/watch.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/web/skins/classic/views/js/watch.js b/web/skins/classic/views/js/watch.js
index 5c10aece6..54fdf93f5 100644
--- a/web/skins/classic/views/js/watch.js
+++ b/web/skins/classic/views/js/watch.js
@@ -222,8 +222,9 @@ function streamCmdStop(action) {
     setButtonState('fastRevBtn', 'unavail');
   }
   if (action) {
-    monitorStream.stop();
+
   }
+  monitorStream.stop();
   //setButtonState('stopBtn', 'unavail');
   //setButtonState('playBtn', 'active');
   setButtonStateWatch('playBtn', 'inactive');

From ad18228b2e07c45b63743112d6f2ac5e0a56f545 Mon Sep 17 00:00:00 2001
From: IgorA100 <igora100@gmail.com>
Date: Tue, 2 Jun 2026 16:12:07 +0300
Subject: [PATCH 10/12] Removed "action" parameter from streamCmdStop() as
 deprecated (watch.js)

---
 web/skins/classic/views/js/watch.js | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/web/skins/classic/views/js/watch.js b/web/skins/classic/views/js/watch.js
index 54fdf93f5..ff8e3e905 100644
--- a/web/skins/classic/views/js/watch.js
+++ b/web/skins/classic/views/js/watch.js
@@ -210,7 +210,7 @@ function streamCmdPlay(action) {
   }
 }
 
-function streamCmdStop(action) {
+function streamCmdStop() {
   monitorStream.onplay = false; //Without this line, "onPlay" is triggered immediately due to "if (this.onplay) this.onplay();" in MonitorStream.js
   //setButtonState('pauseBtn', 'inactive');
   //setButtonState('playBtn', 'unavail');
@@ -220,11 +220,9 @@ function streamCmdStop(action) {
     setButtonState('slowFwdBtn', 'unavail');
     setButtonState('slowRevBtn', 'unavail');
     setButtonState('fastRevBtn', 'unavail');
-  }
-  if (action) {
-
   }
   monitorStream.stop();
+
   //setButtonState('stopBtn', 'unavail');
   //setButtonState('playBtn', 'active');
   setButtonStateWatch('playBtn', 'inactive');
@@ -1064,7 +1062,7 @@ function initPage() {
 
       function stopPlayback() {
         idleTimeoutTriggered = true;
-        streamCmdStop(true);
+        streamCmdStop();
         const cycle_was = cycle;
         cyclePause();
         let ayswModal = $j('#AYSWModal');
@@ -1360,7 +1358,7 @@ function monitorChangeStreamChannel() {
   monitorStream.currentChannelStream = streamChannel;
   setCookie('zmStreamChannel', streamChannel);
   if ((monitorStream.activePlayer) && (-1 !== monitorStream.activePlayer.indexOf('go2rtc') || -1 !== monitorStream.activePlayer.indexOf('rtsp2web'))) {
-    streamCmdStop(true);
+    streamCmdStop();
     setTimeout(function() {
       monitorStream.start(streamChannel);
       onPlay();
@@ -1376,7 +1374,7 @@ function changePlayer() {
   if (monitorStream.audioMotion && monitorStream.audioMotion.destroy) monitorStream.audioMotion.destroy();
 
   monitorStream.destroyVolumeSlider();
-  streamCmdStop(true); // takes care of button state and calls stream.kill()
+  streamCmdStop(); // takes care of button state and calls stream.kill()
   console.log('setting to ', $j('#player').val());
   monitorStream.setPlayer($j('#player').val());
   setChannelStream();

From ad1e9c23a68125f59120e99321d556b60835a440 Mon Sep 17 00:00:00 2001
From: Isaac Connor <isaac@zoneminder.com>
Date: Fri, 29 May 2026 08:47:10 -0400
Subject: [PATCH 11/12] fix: enforce per-event ACL on direct media endpoints
 (GHSA-vj5r-pc2v-gfwv)

image.php, view_video.php and view_hls.php previously checked only the
coarse canView('Events') / canView('Snapshots') role before streaming
media for a user-supplied event id. An authenticated user denied access
to a monitor could still fetch event snapshots, captured frames,
recorded MP4s and HLS manifests for events belonging to that monitor by
calling the direct endpoints with the event id.

Call Event->canView() after loading the event and return 404 on denial
so the event id cannot be enumerated. view_video also validates
Event->Id() so unknown ids return 404 instead of an empty 200 body.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 web/views/image.php      | 14 ++++++++++++++
 web/views/view_hls.php   |  8 ++++++++
 web/views/view_video.php | 28 ++++++++++++++++++++--------
 3 files changed, 42 insertions(+), 8 deletions(-)

diff --git a/web/views/image.php b/web/views/image.php
index 4bb7619ad..a1b825cc3 100644
--- a/web/views/image.php
+++ b/web/views/image.php
@@ -231,6 +231,13 @@ if ( empty($_REQUEST['path']) ) {
       ZM\Error('Event '.$_REQUEST['eid'].' Not found');
       return;
     }
+    // Per-event ACL: coarse Events/Snapshots role isn't enough, must also check
+    // monitor-level permission (GHSA-vj5r-pc2v-gfwv). 404 to avoid leaking the id.
+    if (!$Event->canView()) {
+      header('HTTP/1.0 404 Not Found');
+      ZM\Warning('Event '.$_REQUEST['eid'].' access denied');
+      return;
+    }
 
     if ( $_REQUEST['fid'] == 'objdetect' ) {
       // if animation file is found, return that, else return image
@@ -418,6 +425,13 @@ if ( empty($_REQUEST['path']) ) {
       ZM\Error('Event ' . $Frame->EventId() . ' Not Found');
       return;
     }
+    // Per-event ACL: see GHSA-vj5r-pc2v-gfwv. The frame id is user-supplied so the
+    // event/monitor it resolves to may be one the user is denied from viewing.
+    if (!$Event->canView()) {
+      header('HTTP/1.0 404 Not Found');
+      ZM\Warning('Event '.$Frame->EventId().' access denied via frame '.$_REQUEST['fid']);
+      return;
+    }
     $path = $Event->Path().'/'.sprintf('%0'.ZM_EVENT_IMAGE_DIGITS.'d',$Frame->FrameId()).'-'.$show.'.jpg';
   } # end if have eid
     
diff --git a/web/views/view_hls.php b/web/views/view_hls.php
index 8b5c63a59..c95be02d3 100644
--- a/web/views/view_hls.php
+++ b/web/views/view_hls.php
@@ -22,6 +22,14 @@ if (!$Event->Id()) {
   header('HTTP/1.1 404 Not Found');
   die('Event not found');
 }
+// Per-event ACL: coarse canView('Events') isn't enough — the user may be denied
+// access to the monitor that owns this event (GHSA-vj5r-pc2v-gfwv). Return the
+// same 404 as a missing event so the id isn't leaked.
+if (!$Event->canView()) {
+  ZM\Warning('Event '.$_REQUEST['eid'].' HLS access denied');
+  header('HTTP/1.1 404 Not Found');
+  die('Event not found');
+}
 
 $m3u8_path = $Event->Path() . '/index.m3u8';
 
diff --git a/web/views/view_video.php b/web/views/view_video.php
index ea825e2a3..f657e35a0 100644
--- a/web/views/view_video.php
+++ b/web/views/view_video.php
@@ -40,15 +40,27 @@ $mode = (!empty($_REQUEST['mode'])) ? $_REQUEST['mode'] : '';
 
 $Event = null;
 
-if ( ! empty($_REQUEST['eid']) ) {
-  $Event = new ZM\Event($_REQUEST['eid']);
-  if (!empty($_REQUEST['file'])) {
-    $path = $Event->Path().'/'.basename($_REQUEST['file']);
-  } else {
-    $path = $Event->Path().'/'.$Event->DefaultVideo();
+$event_id = !empty($_REQUEST['eid']) ? $_REQUEST['eid']
+  : (!empty($_REQUEST['event_id']) ? $_REQUEST['event_id'] : null);
+
+if ($event_id !== null) {
+  $Event = new ZM\Event($event_id);
+  // Validate the event actually loaded — the constructor silently produces an
+  // empty object for unknown ids. Without this check view_video previously
+  // returned HTTP 200 with an empty body for nonexistent ids.
+  if (!$Event->Id()) {
+    header('HTTP/1.0 404 Not Found');
+    ZM\Error('Event '.$event_id.' Not found');
+    die();
+  }
+  // Per-event ACL: coarse canView('Events') isn't enough — the user may be
+  // denied access to the monitor that owns this event (GHSA-vj5r-pc2v-gfwv).
+  // 404 matches the missing-event response so the id isn't leaked.
+  if (!$Event->canView()) {
+    header('HTTP/1.0 404 Not Found');
+    ZM\Warning('Event '.$event_id.' access denied');
+    die();
   }
-} else if ( ! empty($_REQUEST['event_id']) ) {
-  $Event = new ZM\Event($_REQUEST['event_id']);
   if (!empty($_REQUEST['file'])) {
     $path = $Event->Path().'/'.basename($_REQUEST['file']);
   } else {

From 51e8a4571cb94ef7f6038d8a42e0626fd6bed8d9 Mon Sep 17 00:00:00 2001
From: Isaac Connor <isaac@zoneminder.com>
Date: Fri, 29 May 2026 19:31:21 -0400
Subject: [PATCH 12/12] fix: stop pinning libcurl4-gnutls-dev, fixing curl -dev
 conflict

The zoneminder runtime Depends listed libcurl4-gnutls-dev, a build-time
-dev package. The curl -dev flavors (gnutls/openssl/nss) are mutually
exclusive, so installing zoneminder forced the gnutls dev flavor and
conflicted with packages requiring libcurl4-openssl-dev.

Remove the explicit curl entries from the runtime Depends: ZoneMinder
links libcurl directly, so ${shlibs:Depends} already generates the
correct runtime library dependency for the flavor it was built against.

Offer libcurl4-gnutls-dev | libcurl4-openssl-dev | libcurl4-nss-dev in
Build-Depends (matching distros/debian/control) so the build env can
satisfy a co-installed package needing libcurl4-openssl-dev.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 428b9d64d02db333ceab302db76a6f31902e38f5)
---
 distros/beowulf/control    | 2 +-
 distros/ubuntu2004/control | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/distros/beowulf/control b/distros/beowulf/control
index fbb35a0f3..36cfd982f 100644
--- a/distros/beowulf/control
+++ b/distros/beowulf/control
@@ -13,7 +13,7 @@ Build-Depends: debhelper, sphinx-doc, dh-linktree, dh-apache2
               ,ffmpeg
               ,net-tools
               ,libbz2-dev
-              ,libcurl4-gnutls-dev
+              ,libcurl4-gnutls-dev | libcurl4-openssl-dev | libcurl4-nss-dev
               ,libturbojpeg0-dev
               ,default-libmysqlclient-dev | libmysqlclient-dev | libmariadbclient-dev-compat
               ,libpcre2-dev
diff --git a/distros/ubuntu2004/control b/distros/ubuntu2004/control
index af002893d..4dcb3b486 100644
--- a/distros/ubuntu2004/control
+++ b/distros/ubuntu2004/control
@@ -14,7 +14,7 @@ Build-Depends: debhelper (>= 11), sphinx-doc, python3-sphinx, python3-sphinx-rtd
               ,arp-scan
               ,net-tools, iproute2
               ,libbz2-dev
-              ,libcurl4-gnutls-dev
+              ,libcurl4-gnutls-dev | libcurl4-openssl-dev | libcurl4-nss-dev
               ,libjpeg-turbo8-dev | libjpeg62-turbo-dev | libjpeg8-dev | libjpeg9-dev
               ,libturbojpeg0-dev
               ,default-libmysqlclient-dev | libmysqlclient-dev | libmariadbclient-dev-compat
@@ -47,7 +47,6 @@ Depends: ${shlibs:Depends}, ${misc:Depends}, ${perl:Depends}
         ,libswscale9|libswscale8|libswscale7|libswscale6|libswscale5|libswscale4
         ,libswresample6|libswresample5|libswresample4|libswresample3|libswresample2
         ,ffmpeg
-        ,libcurl4, libcurl4-gnutls-dev
         ,libdatetime-perl, libdate-manip-perl, libmime-lite-perl, libmime-tools-perl
         ,libdbd-mysql-perl
         ,libphp-serialization-perl