diff --git a/.github/workflows/ci-homoglyphs.yml b/.github/workflows/ci-homoglyphs.yml new file mode 100644 index 000000000..b6ebea583 --- /dev/null +++ b/.github/workflows/ci-homoglyphs.yml @@ -0,0 +1,20 @@ +name: CI Homoglyphs + +on: + push: + branches: + - '*' + pull_request: + branches: [ master ] + +permissions: + contents: read + +jobs: + homoglyphs: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v7 + - name: Check for Cyrillic/Greek homoglyphs in first-party source + run: python3 utils/check-homoglyphs.py diff --git a/distros/redhat/common/zoneminder.service.in b/distros/redhat/common/zoneminder.service.in index f4b3aad9b..e96ee2c94 100644 --- a/distros/redhat/common/zoneminder.service.in +++ b/distros/redhat/common/zoneminder.service.in @@ -13,6 +13,10 @@ ExecStart=@BINDIR@/zmpkg.pl start ExecReload=@BINDIR@/zmpkg.pl restart ExecStop=@BINDIR@/zmpkg.pl stop PIDFile=@ZM_RUNDIR@/zm.pid +# ZoneMinder shuts down many capture/analysis daemons on stop; allow ample time. +# Without this, Fedora's short DefaultTimeoutStopSec combined with its global +# TimeoutStopFailureMode=abort drop-in SIGABRTs zmpkg.pl mid-shutdown. +TimeoutSec=60 Environment=TZ=/etc/localtime RuntimeDirectory=zoneminder RuntimeDirectoryMode=0755 diff --git a/docs/userguide/definemonitor/definemonitor_recording.rst b/docs/userguide/definemonitor/definemonitor_recording.rst index bc3bdd050..d6e309197 100644 --- a/docs/userguide/definemonitor/definemonitor_recording.rst +++ b/docs/userguide/definemonitor/definemonitor_recording.rst @@ -32,5 +32,12 @@ Recording Tab - **Output Container**: Leaving at Auto allows ZoneMinder to use mp4. Other choices are mkv and webm. - **Optional Encoding Parameters**: Mostly useful when encoding as each encoder takes different parameters. Consult the `FFmpeg documentation `__ for available parameters for each encoder. - **Recording Audio**: Check the box in order to save audio (if available) when events are recorded. -- **Event Start Command**: When a recording event starts, you can run a system command. The parameters to the command will be the event id and the monitor id. -- **Event End Command**: When a recording event ends, you can run a system command. The parameters to the command will be the event id and the monitor id. +- **Event Start Command**: When a recording event starts, you can run a system command. +- **Event End Command**: When a recording event ends, you can run a system command. It runs after the event has been finalized, so the event's video file is complete and its database records are in place. + + How these commands are executed depends on whether the command string contains a ``%`` character: + + - **Without** ``%``, the whole string is treated as the path of a single executable (no shell is involved), and two arguments are appended to it: the event id and the monitor id. You cannot pass your own arguments this way — a value like ``/usr/local/bin/notify.sh start`` is looked up as one file named ``notify.sh start`` and fails. + - **With** ``%``, the string is run through ``/bin/sh -c`` after token substitution, and no arguments are appended automatically. Available tokens are ``%EID%`` (event id), ``%MID%`` (monitor id) and, for the start command only, ``%EC%`` (the shell-escaped event cause). So to combine your own arguments with the event id, write e.g. ``/usr/local/bin/notify.sh start %EID%``. + + The command runs in the background as the same user as the capture process (normally the web user), with all file descriptors closed — anything it prints goes nowhere, so redirect output inside your script if you need to see it. A failure to execute the command is logged by the capture process (zmc). diff --git a/scripts/ZoneMinder/lib/ZoneMinder/Event.pm b/scripts/ZoneMinder/lib/ZoneMinder/Event.pm index 6a9b7ad15..30fd7a1b9 100644 --- a/scripts/ZoneMinder/lib/ZoneMinder/Event.pm +++ b/scripts/ZoneMinder/lib/ZoneMinder/Event.pm @@ -861,7 +861,7 @@ sub recover_timestamps { Debug('Have ' . @contents . ' files in '.$path); closedir(DIR); - my @mp4_files = grep(/^\d+\-video\.\w+\.mp4$/, @contents); + my @mp4_files = grep(/^\d+\-video\.(?:\w+\.)?mp4$/, @contents); if ( @mp4_files ) { $$Event{DefaultVideo} = $mp4_files[0]; } @@ -880,7 +880,6 @@ sub recover_timestamps { my $first_file = "$path/$capture_jpgs[0]"; ( $first_file ) = $first_file =~ /^(.*)$/; my $first_timestamp = (stat($first_file))[9]; - $starttime = $first_timestamp if $first_timestamp < $starttime; my $last_file = $path.'/'.$capture_jpgs[@capture_jpgs-1]; ( $last_file ) = $last_file =~ /^(.*)$/; @@ -922,24 +921,27 @@ sub recover_timestamps { my $file = $path.'/'.$mp4_files[0]; ( $file ) = $file =~ /^(.*)$/; # de-taint - my $first_timestamp = (stat($file))[9]; - $starttime = $first_timestamp if $first_timestamp < $starttime; - my $seconds = mp4_duration($file); if ( !defined $seconds ) { Warning("Unable to determine duration of $file from ffprobe. Defaulting Length to 0."); $seconds = 0; } - Debug("From mp4 have duration $seconds seconds, start: $first_timestamp"); + # The mp4 is written as the event records, so its mtime is when recording + # finished. The event therefore started $seconds before that. + my $last_timestamp = (stat($file))[9]; + my $first_timestamp = $last_timestamp - $seconds; + Debug("From mp4 have duration $seconds seconds, start: $first_timestamp end: $last_timestamp"); $Event->Length(sprintf('%.2f', $seconds)); $Event->StartDateTime( Date::Format::time2str('%Y-%m-%d %H:%M:%S', $first_timestamp) ); - $Event->EndDateTime( Date::Format::time2str('%Y-%m-%d %H:%M:%S', $first_timestamp+$seconds) ); + $Event->EndDateTime( Date::Format::time2str('%Y-%m-%d %H:%M:%S', $last_timestamp) ); + } else { + # Nothing to derive the times from, so fall back to the directory's mtime. + $Event->StartDateTime( Date::Format::time2str('%Y-%m-%d %H:%M:%S', $starttime) ); } if ( @mp4_files ) { $Event->DefaultVideo($mp4_files[0]); } - $Event->StartDateTime( Date::Format::time2str('%Y-%m-%d %H:%M:%S', $starttime) ); } # Return the duration of a video file in seconds (float), or undef if it @@ -988,7 +990,7 @@ sub fix_DefaultVideo { Debug('Have ' . @contents . ' files in '.$path); closedir(DIR); - my @mp4_files = grep(/^\d+\-video\.\w+\.mp4$/, @contents); + my @mp4_files = grep(/^\d+\-video\.(?:\w+\.)?mp4$/, @contents); if ( @mp4_files ) { $$event{DefaultVideo} = $mp4_files[0]; } diff --git a/scripts/ZoneMinder/lib/ZoneMinder/Filter.pm b/scripts/ZoneMinder/lib/ZoneMinder/Filter.pm index dcc0db6e5..d71bf421c 100644 --- a/scripts/ZoneMinder/lib/ZoneMinder/Filter.pm +++ b/scripts/ZoneMinder/lib/ZoneMinder/Filter.pm @@ -214,7 +214,19 @@ sub Sql { } elsif ( $term->{attr} eq 'CurrentDate' ) { $self->{Sql} .= 'to_days(NOW())'; } elsif ( $term->{attr} eq 'DateTime' ) { - $self->{Sql} .= 'E.StartDateTime'; + # Mirror web/includes/FilterTerm.php: DateTime is an "event overlaps + # this instant/window" idiom, not a plain StartDateTime comparison. A + # lower bound (>=/>) is satisfied by an event still running at that + # time, so compare against EndDateTime (NULL end = ongoing = never + # ends). An upper bound (<=/{op}//'') eq '>=' or ($term->{op}//'') eq '>' ) { + $self->{Sql} .= "COALESCE(E.EndDateTime, '9999-12-31 23:59:59')"; + } else { + $self->{Sql} .= 'E.StartDateTime'; + } } elsif ( $term->{attr} eq 'Date' ) { # column emitted as part of range expression below } elsif ( $term->{attr} eq 'StartDate' ) { diff --git a/scripts/ZoneMinder/t/event_recover_timestamps.t b/scripts/ZoneMinder/t/event_recover_timestamps.t new file mode 100644 index 000000000..0cf44c063 --- /dev/null +++ b/scripts/ZoneMinder/t/event_recover_timestamps.t @@ -0,0 +1,36 @@ +use strict; +use warnings; +use Test::More; +use File::Temp qw(tempdir); +use Date::Parse; + +plan skip_all => 'ffmpeg not available' if system('ffmpeg -version >/dev/null 2>&1'); +eval { require ZoneMinder::Event; 1 } or plan skip_all => "cannot load ZoneMinder::Event: $@"; +plan tests => 6; + +# An event directory holding only an mp4 (no capture jpgs), as produced when +# ZM_SAVE_JPEGS is off. Duration is 3 seconds. +my $dir = tempdir(CLEANUP => 1); +my $mp4 = "$dir/1-video.h264.mp4"; +is(system("ffmpeg -v error -y -f lavfi -i testsrc=duration=3:size=64x64:rate=10 '$mp4' >/dev/null 2>&1"), + 0, 'built a 3 second test mp4'); + +# mtime of the mp4 is when recording finished. +my $end = 1700000000; +utime($end, $end, $mp4) or die "utime: $!"; +# Make the directory itself much older, so a fallback to its mtime is visible. +utime($end - 3600, $end - 3600, $dir) or die "utime: $!"; + +my $Event = new ZoneMinder::Event(); +$Event->recover_timestamps($dir); + +cmp_ok(abs($Event->Length() - 3), '<', 0.5, 'Length comes from the mp4 duration'); +is($Event->DefaultVideo(), '1-video.h264.mp4', 'DefaultVideo is the mp4 we found'); + +my $start = Date::Parse::str2time($Event->StartDateTime()); +my $stop = Date::Parse::str2time($Event->EndDateTime()); +is($stop, $end, 'EndDateTime is the mp4 mtime, when recording finished'); +cmp_ok(abs($start - ($end - 3)), '<=', 1, + 'StartDateTime is duration before the end, not the dir mtime'); +cmp_ok(abs(($stop - $start) - $Event->Length()), '<=', 1, + 'Length agrees with EndDateTime - StartDateTime'); diff --git a/src/zm_db.cpp b/src/zm_db.cpp index 195e0eacc..d1d5a3649 100644 --- a/src/zm_db.cpp +++ b/src/zm_db.cpp @@ -22,6 +22,7 @@ #include "zm_signal.h" #include #include +#include #include #include @@ -267,7 +268,7 @@ int zmDbDo(const std::string &query) { return 1; } -int zmDbDoInsert(const std::string &query) { +uint64_t zmDbDoInsert(const std::string &query) { std::lock_guard lck(db_mutex); if (!zmDbConnected and !zmDbConnect()) return 0; @@ -282,9 +283,8 @@ int zmDbDoInsert(const std::string &query) { return 0; } } - // Might not be an int... FIXME - int id = mysql_insert_id(&dbconn); - Debug(2, "Success running sql insert %s. Resulting id is %d", query.c_str(), id); + uint64_t id = mysql_insert_id(&dbconn); + Debug(2, "Success running sql insert %s. Resulting id is %" PRIu64, query.c_str(), id); return id; } diff --git a/src/zm_db.h b/src/zm_db.h index 5f1e75db5..eed3e1e08 100644 --- a/src/zm_db.h +++ b/src/zm_db.h @@ -21,6 +21,7 @@ #define ZM_DB_H #include +#include #include #include #include @@ -70,7 +71,7 @@ extern bool zmDbConnected; bool zmDbConnect(); void zmDbClose(); int zmDbDo(const std::string &query); -int zmDbDoInsert(const std::string &query); +uint64_t zmDbDoInsert(const std::string &query); int zmDbDoUpdate(const std::string &query); MYSQL_RES * zmDbFetch(const std::string &query); diff --git a/src/zm_event.cpp b/src/zm_event.cpp index 120d53498..1fb1b2ac6 100644 --- a/src/zm_event.cpp +++ b/src/zm_event.cpp @@ -153,24 +153,24 @@ Event::Event( /* None of these are crucial, and are simple when done as individual transactions */ sql = stringtf("INSERT INTO `Events_Hour` (EventId,MonitorId,StartDateTime,DiskSpace)" - " VALUES (%" PRId64 ",%u,'%s',NULL)", + " VALUES (%" PRIu64 ",%u,'%s',NULL)", id, monitor->Id(), now_str.c_str()); dbQueue.push(std::move(sql)); sql = stringtf("INSERT INTO `Events_Day` (EventId,MonitorId,StartDateTime,DiskSpace)" - " VALUES (%" PRId64 ",%u,'%s',NULL)", + " VALUES (%" PRIu64 ",%u,'%s',NULL)", id, monitor->Id(), now_str.c_str()); dbQueue.push(std::move(sql)); sql = stringtf("INSERT INTO `Events_Week` (EventId,MonitorId,StartDateTime,DiskSpace)" - " VALUES (%" PRId64 ",%u,'%s',NULL)", + " VALUES (%" PRIu64 ",%u,'%s',NULL)", id, monitor->Id(), now_str.c_str()); dbQueue.push(std::move(sql)); sql = stringtf("INSERT INTO `Events_Month` (EventId,MonitorId,StartDateTime,DiskSpace)" - " VALUES (%" PRId64 ",%u,'%s',NULL)", + " VALUES (%" PRIu64 ",%u,'%s',NULL)", id, monitor->Id(), now_str.c_str()); dbQueue.push(std::move(sql)); /* sql = stringtf("INSERT INTO `Events_Year` (EventId,MonitorId,StartDateTime,DiskSpace)" - " VALUES (%" PRId64 ",%u,'%s',NULL)", + " VALUES (%" PRIu64 ",%u,'%s',NULL)", id, monitor->Id(), now_str.c_str()); dbQueue.push(std::move(sql)); */ @@ -469,7 +469,7 @@ void Event::AddPacket_(const std::shared_ptrpacket) { tag->save(); Debug(1, "Created new Tag %s", cls.c_str()); tags.emplace(std::make_pair(cls, *tag)); - int tag_id = tag->Id(); + uint64_t tag_id = tag->Id(); delete tag; // Delete after copying into map tag = nullptr; diff --git a/src/zm_event_tag.cpp b/src/zm_event_tag.cpp index 3e4d6ac59..cd702f884 100644 --- a/src/zm_event_tag.cpp +++ b/src/zm_event_tag.cpp @@ -78,7 +78,7 @@ Event_Tag::Event_Tag(uint64_t p_tag_id, uint64_t p_event_id, SystemTimePoint p_a Event_Tag::~Event_Tag() { } -int Event_Tag::save() { +uint64_t Event_Tag::save() { std::string sql = stringtf("INSERT INTO `Events_Tags` (`TagId`, `EventId`, `AssignedDate`, `AssignedBy`)" " VALUES (%" PRIu64 ", %" PRIu64 ", from_unixtime(%" PRId64 "), %d)", tag_id, @@ -86,7 +86,7 @@ int Event_Tag::save() { static_cast(std::chrono::system_clock::to_time_t(assigned_on)), assigned_by ); - int rc; + uint64_t rc; //do { rc = zmDbDoInsert(sql); //} while (!rc and !zm_terminate); diff --git a/src/zm_event_tag.h b/src/zm_event_tag.h index 1f5c16089..fa855349d 100644 --- a/src/zm_event_tag.h +++ b/src/zm_event_tag.h @@ -56,7 +56,7 @@ class Event_Tag { unsigned int AssignedBy() { return assigned_by; }; unsigned int AssignedBy(unsigned int p_assigned_by) { return assigned_by = p_assigned_by; }; - int save(); + uint64_t save(); }; #endif // ZM_EVENT_TAG_H diff --git a/src/zm_ffmpeg.cpp b/src/zm_ffmpeg.cpp index 20cc6b8b4..e34ad8624 100644 --- a/src/zm_ffmpeg.cpp +++ b/src/zm_ffmpeg.cpp @@ -149,6 +149,33 @@ std::list get_decoder_data(int wanted_codec, const std::string return results; } +AVCodecContext *open_fallback_decoder(const AVCodecParameters *codecpar, const AVCodec **codec_out) { + const AVCodec *codec = avcodec_find_decoder(codecpar->codec_id); + if (!codec) { + Debug(1, "No fallback decoder available for codec %s", + avcodec_get_name(codecpar->codec_id)); + return nullptr; + } + Debug(1, "Trying fallback decoder %s for codec %s", + codec->name, avcodec_get_name(codecpar->codec_id)); + AVCodecContext *ctx = avcodec_alloc_context3(codec); + if (!ctx) { + Error("Failed to allocate context for fallback decoder %s", codec->name); + return nullptr; + } + avcodec_parameters_to_context(ctx, codecpar); + zm_dump_codec(ctx); + int ret = avcodec_open2(ctx, codec, nullptr); + if (ret < 0) { + Error("Could not open fallback decoder %s (error '%s')", + codec->name, av_make_error_string(ret).c_str()); + avcodec_free_context(&ctx); + return nullptr; + } + if (codec_out) *codec_out = codec; + return ctx; +} + #if HAVE_LIBAVUTIL_HWCONTEXT_H #if LIBAVCODEC_VERSION_CHECK(57, 89, 0, 89, 0) diff --git a/src/zm_ffmpeg.h b/src/zm_ffmpeg.h index 1879eea04..070f2c3ba 100644 --- a/src/zm_ffmpeg.h +++ b/src/zm_ffmpeg.h @@ -332,6 +332,11 @@ struct CodecData { }; std::list get_encoder_data(const std::string & wanted_codec, const std::string &wanted_coder) ; std::list get_decoder_data(int wanted_codec, const std::string &wanted_coder) ; +// When none of the preferred decoders in dec_codecs are usable, fall back to +// whatever decoder this ffmpeg build actually provides for codecpar->codec_id. +// Returns an opened AVCodecContext (caller frees with avcodec_free_context) or +// nullptr. When non-null, *codec_out receives the chosen AVCodec. +AVCodecContext *open_fallback_decoder(const AVCodecParameters *codecpar, const AVCodec **codec_out = nullptr); int setup_hwaccel(AVCodecContext *codec_ctx, const CodecData *codec_data,AVBufferRef * &hw_device_ctx, const std::string &device, int width, int height); int libjpeg_to_ffmpeg_qv(int libjpeg_quality); enum AVPixelFormat get_hw_format(AVCodecContext *ctx, const enum AVPixelFormat *pix_fmts); diff --git a/src/zm_ffmpeg_camera.cpp b/src/zm_ffmpeg_camera.cpp index 31eb51bec..6f3d620a0 100644 --- a/src/zm_ffmpeg_camera.cpp +++ b/src/zm_ffmpeg_camera.cpp @@ -27,6 +27,7 @@ #include "url.hpp" #include +#include extern "C" { #include @@ -671,73 +672,85 @@ int FfmpegCamera::OpenFfmpeg() { #if HAVE_LIBAVUTIL_HWCONTEXT_H // 3.2 doesn't seem to have all the bits in place, so let's require 3.4 and up #if LIBAVCODEC_VERSION_CHECK(57, 107, 0, 107, 0) - // Print out available types - enum AVHWDeviceType type = AV_HWDEVICE_TYPE_NONE; - while ((type = av_hwdevice_iterate_types(type)) != AV_HWDEVICE_TYPE_NONE) - Debug(1, "%s", av_hwdevice_get_type_name(type)); - - const char *hw_name = hwaccel_name.c_str(); - type = av_hwdevice_find_type_by_name(hw_name); - if (type == AV_HWDEVICE_TYPE_NONE) { - Debug(1, "Device type %s is not supported.", hw_name); - } else { - Debug(1, "Found hwdevice %s", av_hwdevice_get_type_name(type)); + // Build the list of hw device types to try. A DecoderHWAccelName of + // "auto" probes every hwaccel libav offers and uses the first that both + // the decoder supports and whose device can be created; any other value + // is a comma-separated priority list of device-type names, tried in + // order (e.g. "cuda,vaapi"; a single name like "vaapi" is just the + // one-element case and behaves as before). If nothing usable is found + // we transparently fall back to software. + std::vector candidate_types; + bool auto_detect = (hwaccel_name == "auto"); + enum AVHWDeviceType it = AV_HWDEVICE_TYPE_NONE; + while ((it = av_hwdevice_iterate_types(it)) != AV_HWDEVICE_TYPE_NONE) { + Debug(1, "Available hwdevice type %s", av_hwdevice_get_type_name(it)); + if (auto_detect) candidate_types.push_back(it); + } + if (!auto_detect) { + for (const std::string &token : Split(hwaccel_name, ',')) { + std::string name = TrimSpaces(token); + if (name.empty()) continue; + enum AVHWDeviceType named = av_hwdevice_find_type_by_name(name.c_str()); + if (named == AV_HWDEVICE_TYPE_NONE) + Warning("Unknown hwaccel device type '%s', skipping.", name.c_str()); + else + candidate_types.push_back(named); + } } + for (enum AVHWDeviceType type : candidate_types) { + Debug(1, "Trying hwdevice %s", av_hwdevice_get_type_name(type)); + hw_pix_fmt = AV_PIX_FMT_NONE; #if LIBAVUTIL_VERSION_CHECK(56, 22, 0, 14, 0) - // Get hw_pix_fmt - for (int i = 0;; i++) { - const AVCodecHWConfig *config = avcodec_get_hw_config(mVideoCodec, i); - if (!config) { - Debug(1, "Decoder %s does not support config %d.", - mVideoCodec->name, i); - break; - } - if ((config->methods & AV_CODEC_HW_CONFIG_METHOD_HW_DEVICE_CTX) - && (config->device_type == type) - ) { - hw_pix_fmt = config->pix_fmt; - Debug(1, "Decoder %s does support our type %s.", - mVideoCodec->name, av_hwdevice_get_type_name(type)); - //break; - } else { - Debug(1, "Decoder %s hwConfig doesn't match our type: %s != %s, pix_fmt %s.", - mVideoCodec->name, - av_hwdevice_get_type_name(type), - av_hwdevice_get_type_name(config->device_type), - zm_get_pix_fmt_name(config->pix_fmt) - ); - } - } // end foreach hwconfig + // Does this decoder advertise a hw config for this device type? + for (int i = 0;; i++) { + const AVCodecHWConfig *config = avcodec_get_hw_config(mVideoCodec, i); + if (!config) break; + if ((config->methods & AV_CODEC_HW_CONFIG_METHOD_HW_DEVICE_CTX) + && (config->device_type == type)) { + hw_pix_fmt = config->pix_fmt; + Debug(1, "Decoder %s supports type %s (pix_fmt %s).", + mVideoCodec->name, av_hwdevice_get_type_name(type), + zm_get_pix_fmt_name(hw_pix_fmt)); + } + } // end foreach hwconfig #else - hw_pix_fmt = find_fmt_by_hw_type(type); + hw_pix_fmt = find_fmt_by_hw_type(type); #endif - if (hw_pix_fmt != AV_PIX_FMT_NONE) { - Debug(1, "Selected hw_pix_fmt %d %s", - hw_pix_fmt, zm_get_pix_fmt_name(hw_pix_fmt)); - - mVideoCodecContext->hwaccel_flags |= AV_HWACCEL_FLAG_IGNORE_LEVEL; - //if (!lavc_param->check_hw_profile) - mVideoCodecContext->hwaccel_flags |= AV_HWACCEL_FLAG_ALLOW_PROFILE_MISMATCH; + if (hw_pix_fmt == AV_PIX_FMT_NONE) { + Debug(1, "Decoder %s has no hw_pix_fmt for %s, skipping.", + mVideoCodec->name, av_hwdevice_get_type_name(type)); + continue; + } ret = av_hwdevice_ctx_create(&hw_device_ctx, type, (hwaccel_device != "" ? hwaccel_device.c_str() : nullptr), nullptr, 0); - if (ret < 0 and hwaccel_device != "") { + if (ret < 0 and hwaccel_device != "") ret = av_hwdevice_ctx_create(&hw_device_ctx, type, nullptr, nullptr, 0); - } if (ret < 0) { - Error("Failed to create hwaccel device. %s", av_make_error_string(ret).c_str()); + Warning("Failed to create %s hwaccel device: %s", + av_hwdevice_get_type_name(type), av_make_error_string(ret).c_str()); hw_pix_fmt = AV_PIX_FMT_NONE; - use_hwaccel = false; - } else { - Debug(1, "Created hwdevice for %s", hwaccel_device.c_str()); - // Set opaque to point to our hw_pix_fmt so callback can access it - mVideoCodecContext->opaque = &hw_pix_fmt; - mVideoCodecContext->get_format = get_hw_format; - mVideoCodecContext->hw_device_ctx = av_buffer_ref(hw_device_ctx); + hw_device_ctx = nullptr; + continue; // try the next candidate } - } else { - Debug(1, "Failed to find suitable hw_pix_fmt."); + + // Success: wire up hardware decoding and stop searching. + Info("Using %s hardware decoding for %s", + av_hwdevice_get_type_name(type), mVideoCodec->name); + mVideoCodecContext->hwaccel_flags |= AV_HWACCEL_FLAG_IGNORE_LEVEL; + //if (!lavc_param->check_hw_profile) + mVideoCodecContext->hwaccel_flags |= AV_HWACCEL_FLAG_ALLOW_PROFILE_MISMATCH; + // Set opaque to point to our hw_pix_fmt so callback can access it + mVideoCodecContext->opaque = &hw_pix_fmt; + mVideoCodecContext->get_format = get_hw_format; + mVideoCodecContext->hw_device_ctx = av_buffer_ref(hw_device_ctx); + break; + } // end foreach candidate type + + if (hw_pix_fmt == AV_PIX_FMT_NONE) { + Debug(1, "No usable hardware decoder found; falling back to software decoding."); + use_hwaccel = false; } #else Debug(1, "AVCodec not new enough for hwaccel"); @@ -766,6 +779,11 @@ int FfmpegCamera::OpenFfmpeg() { break; } // end foreach codec + if (!mVideoCodecContext) { + Debug(1, "Failed with known codecs, trying harder"); + mVideoCodecContext = open_fallback_decoder(mVideoStream->codecpar, &mVideoCodec); + } + if (!mVideoCodecContext) { Warning("Failed to open codec"); return -1; diff --git a/src/zm_ffmpeg_input.cpp b/src/zm_ffmpeg_input.cpp index 51d6e7a37..5ba4b7a7d 100644 --- a/src/zm_ffmpeg_input.cpp +++ b/src/zm_ffmpeg_input.cpp @@ -129,20 +129,8 @@ int FFmpeg_Input::Open(const char *filepath) { if (!streams[i].context) { Debug(1, "Failed with known codecs, trying harder"); - if ((streams[i].codec = avcodec_find_decoder(input_format_context->streams[i]->codecpar->codec_id))) { - Debug(1, "Using codec (%s) for stream %d", streams[i].codec->name, i); - streams[i].context = avcodec_alloc_context3(streams[i].codec); - avcodec_parameters_to_context(streams[i].context, input_format_context->streams[i]->codecpar); - - zm_dump_codec(streams[i].context); - - error = avcodec_open2(streams[i].context, streams[i].codec, nullptr); - if (error < 0) { - Error("Could not open input codec (error '%s')", av_make_error_string(error).c_str()); - avcodec_free_context(&streams[i].context); - streams[i].context = nullptr; - } - } + streams[i].context = open_fallback_decoder( + input_format_context->streams[i]->codecpar, &streams[i].codec); } if (!streams[i].context) { diff --git a/src/zm_image.cpp b/src/zm_image.cpp index b54034227..15a107917 100644 --- a/src/zm_image.cpp +++ b/src/zm_image.cpp @@ -2392,6 +2392,15 @@ bool Image::Delta(const Image &image, Image* targetimage) const { return false; } + // DumpImgBuffer() nulls buffer while leaving width/height/colours intact, so + // the size check above is no guarantee the pixels are present. Without this a + // dumped reference image (e.g. dropped on resume) walks the delta helpers from + // a null base pointer and faults at address 0 on the first row (refs #4983). + if ( buffer == nullptr || image.buffer == nullptr ) { + Error("Attempt to get delta with a null buffer (this %p, other %p)", buffer, image.buffer); + return false; + } + uint8_t *pdiff = targetimage->WriteBuffer(width, height, ZM_COLOUR_GRAY8, ZM_SUBPIX_ORDER_NONE); if ( pdiff == nullptr ) { Error("Failed requesting writeable buffer for storing the delta image"); diff --git a/src/zm_monitor.cpp b/src/zm_monitor.cpp index 5ae420cc0..f6fd22dce 100644 --- a/src/zm_monitor.cpp +++ b/src/zm_monitor.cpp @@ -2004,7 +2004,9 @@ void Monitor::CheckAction() { if ( Enabled() && !Active() ) { Info("Received resume indication at count %d", shared_data->image_count); shared_data->analysing = analysing; - ref_image.DumpImgBuffer(); // Will get re-assigned by analysis thread + // Analysis thread owns ref_image; ask it to drop the pre-suspend + // reference rather than freeing the buffer under it here (refs #4983). + ref_image_reset_ = true; shared_data->alarm_x = shared_data->alarm_y = -1; } shared_data->action &= ~RESUME; @@ -2017,7 +2019,8 @@ void Monitor::CheckAction() { Info("Auto resuming at count %d", shared_data->image_count); auto_resume_time = {}; shared_data->analysing = analysing; - ref_image.DumpImgBuffer(); // Will get re-assigned by analysis thread + // See RESUME above: defer the reference-image reset to the analysis thread. + ref_image_reset_ = true; } } } @@ -2138,6 +2141,15 @@ bool Monitor::Analyse() { } std::shared_ptr packet = packet_lock.packet_; + // The capture thread requested that we drop the pre-suspend reference image. + // Do it here, on the thread that owns ref_image, so the buffer is never freed + // out from under an in-flight Delta/Blend (refs #4983). The subsequent + // !ref_image.Buffer() checks re-seed it from the next frame. + if (ref_image_reset_.exchange(false)) { + Debug(1, "Resetting reference image on resume"); + ref_image.DumpImgBuffer(); + } + // Is it possible for packet->score to be ! -1 ? Not if everything is working correctly if (packet->score != -1) { Error("Packet score was %d at index %d, should always be -1!", packet->score, packet->image_index); diff --git a/src/zm_monitor.h b/src/zm_monitor.h index dd9cb05e3..0078fb681 100644 --- a/src/zm_monitor.h +++ b/src/zm_monitor.h @@ -34,6 +34,7 @@ #include "zm_utils.h" #include "zm_zone.h" +#include #include #include #include @@ -727,6 +728,12 @@ class Monitor : public std::enable_shared_from_this { Image delta_image; Image ref_image; + // ref_image is owned by the analysis thread (Analyse/DetectMotion). The + // capture thread (CheckAction) must not touch its buffer directly; on + // suspend-resume it sets this flag instead and the analysis thread drops the + // stale reference itself on its next pass. Prevents a use-after-free/null + // deref race in Image::Delta (refs #4983). + std::atomic ref_image_reset_{false}; // Analysis image ring: the annotated/analysis image is published into a ring // of image_buffer_count slots living in the alarm_images SHM region. Readers // pick up the newest via shared_data->last_analysis_index. Replaces the diff --git a/src/zma.cpp b/src/zma.cpp index 9424bca87..8fef16a62 100644 --- a/src/zma.cpp +++ b/src/zma.cpp @@ -623,10 +623,10 @@ int main(int argc, char *argv[]) { monitor->Id(), storage_id, event_id, static_cast(std::chrono::duration_cast(fd.timestamp.time_since_epoch()).count()), scheme_str.c_str(), monitor->Width(), monitor->Height()); - int new_event_id = zmDbDoInsert(sql); - if (new_event_id > 0) { + uint64_t new_event_id = zmDbDoInsert(sql); + if (new_event_id) { current_event->db_event_id = new_event_id; - Info("Created new event %d from re-analysis of event %" PRIu64, new_event_id, event_id); + Info("Created new event %" PRIu64 " from re-analysis of event %" PRIu64, new_event_id, event_id); // Create directory and copy video files to new event std::string new_event_path = BuildNewEventPath( diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 9007f279d..c7fc55499 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -29,8 +29,10 @@ set(TEST_SOURCES zm_utils.cpp zm_vector2.cpp zm_zone.cpp + zm_zone_stride.cpp zm_image_linesize.cpp - zm_ffmpeg_camera.cpp) + zm_ffmpeg_camera.cpp + zm_ffmpeg_fallback.cpp) add_executable(tests main.cpp ${TEST_SOURCES}) diff --git a/tests/php/test_filter_canedit_autoexecute.php b/tests/php/test_filter_canedit_autoexecute.php new file mode 100644 index 000000000..b2e6f186f --- /dev/null +++ b/tests/php/test_filter_canedit_autoexecute.php @@ -0,0 +1,135 @@ + RCE). +// * AutoExecute (arbitrary OS command via zmfilter.pl) requires System edit +// permission, not merely Events edit. +// * Ownership is enforced: a non-System user can only act on their own filter. +// +// Run as: php tests/php/test_filter_canedit_autoexecute.php +// +// The real Filter class pulls in database.php / FilterTerm.php / Monitor.php via +// require_once, but canEdit() itself only uses ZM_Object's magic accessors (the +// `defaults` array, no DB) plus the passed-in user. So we stub the require-only +// dependencies, keep the real Object.php + Filter.php, and drive canEdit() +// directly. + +namespace ZM; + +// ---- test harness (top-level namespace-free helpers) ----------------------- + +$failures = 0; +$passes = 0; + +function check($name, $got, $want) { + global $failures, $passes; + if ($got === $want) { + $passes++; + echo "ok - $name\n"; + } else { + $failures++; + echo "FAIL - $name (got ".var_export($got, true).", want ".var_export($want, true).")\n"; + } +} + +// ---- stub the require-only dependencies of Filter.php ---------------------- + +$stubdir = sys_get_temp_dir().'/zm_filter_canedit_stubs_'.getmypid(); +@mkdir($stubdir, 0700, true); +foreach (array('database.php', 'FilterTerm.php', 'Monitor.php') as $stub) { + file_put_contents($stubdir.'/'.$stub, " level ('None'|'View'|'Edit') + public function __construct($id, $perms) { $this->id = $id; $this->perms = $perms; } + public function Id() { return $this->id; } + private function level($area) { return isset($this->perms[$area]) ? $this->perms[$area] : 'None'; } + public function canView($area) { $l = $this->level($area); return $l == 'View' || $l == 'Edit'; } + public function canEdit($area) { return $this->level($area) == 'Edit'; } +} + +// Helper: build a Filter owned by $ownerId with the given auto-flags set. +function make_filter($ownerId, array $flags) { + $f = new Filter(); + $f->UserId($ownerId); + foreach ($flags as $k => $v) { + $f->$k($v); + } + return $f; +} + +$systemAdmin = new TestUser(1, array('System' => 'Edit')); +$eventsEditor = new TestUser(2, array('Events' => 'Edit')); +$eventsViewer = new TestUser(3, array('Events' => 'View')); + +// ---- the reported vulnerability: view-only user + AutoExecute -------------- + +$f = make_filter(3, array('AutoExecute' => 1, 'AutoExecuteCmd' => '/bin/sh -c "id"')); +check('Events=View owner CANNOT edit AutoExecute filter', $f->canEdit($eventsViewer), false); + +// Each side-effect alone must block a view-only user (the `and` -> `or` fix). +foreach (array('AutoExecute','AutoDelete','AutoUnarchive','AutoArchive', + 'AutoMove','AutoCopy','AutoVideo','AutoUpload', + 'AutoEmail','AutoMessage') as $flag) { + $f = make_filter(3, array($flag => 1)); + check("Events=View owner blocked when only $flag set", $f->canEdit($eventsViewer), false); +} + +// A pure query filter (no auto actions) is fine for a view-only owner. +$f = make_filter(3, array()); +check('Events=View owner CAN edit plain query filter', $f->canEdit($eventsViewer), true); + +// ---- AutoExecute requires System edit, not just Events edit ---------------- + +$f = make_filter(2, array('AutoExecute' => 1, 'AutoExecuteCmd' => '/bin/sh -c "id"')); +check('Events=Edit owner CANNOT edit AutoExecute filter', $f->canEdit($eventsEditor), false); + +// Events editor may still run event-changing filters. +$f = make_filter(2, array('AutoDelete' => 1)); +check('Events=Edit owner CAN edit AutoDelete filter', $f->canEdit($eventsEditor), true); +$f = make_filter(2, array('AutoMove' => 1, 'AutoMoveTo' => 5)); +check('Events=Edit owner CAN edit AutoMove filter', $f->canEdit($eventsEditor), true); + +// System editor can do anything, including AutoExecute. +$f = make_filter(999, array('AutoExecute' => 1, 'AutoExecuteCmd' => '/bin/sh -c "id"')); +check('System editor CAN edit AutoExecute filter (any owner)', $f->canEdit($systemAdmin), true); + +// ---- ownership enforcement ------------------------------------------------- + +$f = make_filter(1, array()); // owned by someone else +check('Events=Edit user CANNOT edit filter owned by another user', $f->canEdit($eventsEditor), false); +check('Events=View user CANNOT edit filter owned by another user', $f->canEdit($eventsViewer), false); + +// A user with no Events permission at all cannot edit even their own filter. +$noPerm = new TestUser(4, array()); +$f = make_filter(4, array()); +check('User with no Events perm CANNOT edit own plain filter', $f->canEdit($noPerm), false); + +// ---- cleanup --------------------------------------------------------------- + +@unlink($stubdir.'/database.php'); +@unlink($stubdir.'/FilterTerm.php'); +@unlink($stubdir.'/Monitor.php'); +@rmdir($stubdir); + +echo "\n$passes passed, $failures failed.\n"; +exit($failures ? 1 : 0); diff --git a/tests/zm_ffmpeg_fallback.cpp b/tests/zm_ffmpeg_fallback.cpp new file mode 100644 index 000000000..0c4737bed --- /dev/null +++ b/tests/zm_ffmpeg_fallback.cpp @@ -0,0 +1,83 @@ +/* + * This file is part of the ZoneMinder Project. See AUTHORS file for Copyright information + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +#include "zm_catch2.h" + +#include "zm_ffmpeg.h" + +// open_fallback_decoder() is the "try whatever ffmpeg actually has" path used +// when none of the preferred decoders in dec_codecs are available. The +// hard-coded table is only a preference list; a codec present in the ffmpeg +// build but absent from the table must still open. + +static AVCodecParameters *make_video_par(enum AVCodecID id) { + AVCodecParameters *par = avcodec_parameters_alloc(); + par->codec_type = AVMEDIA_TYPE_VIDEO; + par->codec_id = id; + par->width = 1280; + par->height = 720; + par->format = AV_PIX_FMT_YUV420P; + return par; +} + +TEST_CASE("open_fallback_decoder: opens a decoder not listed in dec_codecs") { + // MPEG2VIDEO has a native ffmpeg decoder that is always compiled in, and it is + // deliberately not in the preferred dec_codecs table, so it only resolves via + // the fallback. If this build somehow lacks it, skip rather than false-fail. + if (!avcodec_find_decoder(AV_CODEC_ID_MPEG2VIDEO)) { + WARN("mpeg2video decoder not present in this ffmpeg build; skipping"); + return; + } + + AVCodecParameters *par = make_video_par(AV_CODEC_ID_MPEG2VIDEO); + const AVCodec *codec = nullptr; + AVCodecContext *ctx = open_fallback_decoder(par, &codec); + + REQUIRE(ctx != nullptr); + REQUIRE(codec != nullptr); + REQUIRE(codec->id == AV_CODEC_ID_MPEG2VIDEO); + + avcodec_free_context(&ctx); + avcodec_parameters_free(&par); +} + +TEST_CASE("open_fallback_decoder: codec_out is optional") { + if (!avcodec_find_decoder(AV_CODEC_ID_MPEG2VIDEO)) { + WARN("mpeg2video decoder not present in this ffmpeg build; skipping"); + return; + } + + AVCodecParameters *par = make_video_par(AV_CODEC_ID_MPEG2VIDEO); + AVCodecContext *ctx = open_fallback_decoder(par); // default nullptr codec_out + + REQUIRE(ctx != nullptr); + + avcodec_free_context(&ctx); + avcodec_parameters_free(&par); +} + +TEST_CASE("open_fallback_decoder: returns nullptr when no decoder exists") { + AVCodecParameters *par = make_video_par(AV_CODEC_ID_NONE); + const AVCodec *codec = reinterpret_cast(0x1); + AVCodecContext *ctx = open_fallback_decoder(par, &codec); + + REQUIRE(ctx == nullptr); + // codec_out must be left untouched on failure. + REQUIRE(codec == reinterpret_cast(0x1)); + + avcodec_parameters_free(&par); +} diff --git a/tests/zm_zone_stride.cpp b/tests/zm_zone_stride.cpp new file mode 100644 index 000000000..5fae44b58 --- /dev/null +++ b/tests/zm_zone_stride.cpp @@ -0,0 +1,243 @@ +/* + * This file is part of the ZoneMinder Project. See AUTHORS file for Copyright information + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along + * with this program. If not, see . + */ + +#include "zm_catch2.h" + +#include "zm_config.h" +#include "zm_image.h" +#include "zm_monitor.h" +#include "zm_rgb.h" +#include "zm_zone.h" + +#include + +// Motion analysis on a portrait monitor (refs #4983). ZM allocates images with +// linesize = FFALIGN(width, 32). Every width in the CaptureResolution dropdown +// (1920, 1280, 2560, 1440, 704, 640, ...) is already a multiple of 32, so +// linesize == width and any code that uses width as a row stride works by +// accident. A portrait monitor is 1080 wide; FFALIGN(1080,32) == 1088, so it is +// the first common config where linesize != width and those paths are exercised +// for real. Each case below runs the same assertion at a padded width and at an +// aligned width, so a failure tells us whether the stride is the culprit or +// whether the geometry is wrong independent of it. +namespace { + +// No zm.conf is loaded under the test harness, so config strings are null. +// Image::Initialise() dereferences config.font_file_location and the Monitor +// constructor strcmp()s config.event_close_mode; both segfault on null. +void EnsureConfig() { + if (!config.font_file_location) config.font_file_location = ""; + if (!config.event_close_mode) config.event_close_mode = "idle"; +} + +// Monitor's width/height are protected and normally come from the database. +// Expose them so a zone can be set up against arbitrary dimensions without a DB. +class TestMonitor : public Monitor { + public: + TestMonitor(unsigned int w, unsigned int h) : Monitor() { + width = w; + height = h; + colours = ZM_COLOUR_GRAY8; + // >1 is what gates the blob/filter masking path in Zone::CheckAlarms. + savejpegs = 2; + } +}; + +std::shared_ptr MakeMonitor(unsigned int w, unsigned int h) { + return std::static_pointer_cast(std::make_shared(w, h)); +} + +// Rectangle covering the whole frame, in pixel coordinates. +Polygon FullFramePolygon(unsigned int w, unsigned int h) { + std::vector vertices = { + Vector2(0, 0), + Vector2(w - 1, 0), + Vector2(w - 1, h - 1), + Vector2(0, h - 1), + }; + return Polygon(vertices); +} + +// A GRAY8 delta image where every pixel reads as maximum difference, written +// through Buffer(x, y) so the fill itself is stride-correct regardless of +// padding. +std::unique_ptr MakeSaturatedDelta(unsigned int w, unsigned int h) { + auto img = std::unique_ptr(new Image(w, h, ZM_COLOUR_GRAY8, ZM_SUBPIX_ORDER_NONE)); + for (unsigned int y = 0; y < h; y++) + for (unsigned int x = 0; x < w; x++) + *img->Buffer(x, y) = 255; + return img; +} + +} // namespace + +TEST_CASE("Image: a 1080-wide GRAY8 image is stride-padded, a 1920-wide one is not", "[Zone]") { + EnsureConfig(); + + // This is the premise the rest of the cases rest on. If FFALIGN ever stops + // padding 1080, these tests stop testing what they claim to. + Image portrait(1080, 1920, ZM_COLOUR_GRAY8, ZM_SUBPIX_ORDER_NONE); + REQUIRE(portrait.Width() == 1080); + REQUIRE(portrait.LineSize() == 1088); + + Image landscape(1920, 1080, ZM_COLOUR_GRAY8, ZM_SUBPIX_ORDER_NONE); + REQUIRE(landscape.Width() == 1920); + REQUIRE(landscape.LineSize() == 1920); +} + +// refs #4983. DumpImgBuffer() nulls buffer but leaves +// width/height/colours/subpixelorder/linesize intact, so Delta's "different +// sized images" guard still passes and, without a buffer check, it walks the +// delta helpers from a null base: buffer + 0*linesize is address 0 on the first +// row. That reproduced the reported "Fault address: (nil)" inside the gray8 +// delta helper. Delta must reject a null buffer on either operand instead of +// dereferencing it. (The originating race — the capture thread dumping +// ref_image under the analysis thread — is fixed separately in Monitor; this is +// the defensive backstop, and the only half unit-testable without a live race.) +TEST_CASE("Image::Delta rejects an operand whose buffer has been dumped", "[Image]") { + EnsureConfig(); + + auto make = []() { return Image(1080, 1920, ZM_COLOUR_GRAY8, ZM_SUBPIX_ORDER_NONE); }; + + SECTION("source (this) buffer dumped") { + Image ref = make(); + Image comp = make(); + Image delta; + + ref.DumpImgBuffer(); + + // Dimensions survive the dump, which is exactly why the size check is no + // protection here. + REQUIRE(ref.Buffer() == nullptr); + REQUIRE(ref.Width() == comp.Width()); + REQUIRE(ref.Height() == comp.Height()); + REQUIRE(ref.Colours() == comp.Colours()); + + REQUIRE(ref.Delta(comp, &delta) == false); + } + + SECTION("comparison (other) buffer dumped") { + Image ref = make(); + Image comp = make(); + Image delta; + + comp.DumpImgBuffer(); + + REQUIRE(ref.Delta(comp, &delta) == false); + } +} + +TEST_CASE("Zone::Setup derives per-row ranges correctly at a padded width", "[Zone]") { + EnsureConfig(); + + auto check = [](unsigned int w, unsigned int h) { + auto monitor = MakeMonitor(w, h); + Zone zone(monitor, 1, "full", Zone::ACTIVE, FullFramePolygon(w, h), kRGBRed, + Zone::ALARMED_PIXELS, + /*min_pixel_threshold*/ 10, /*max_pixel_threshold*/ 0, + /*min_alarm_pixels*/ 1, /*max_alarm_pixels*/ static_cast(w * h)); + + const Image *pg = zone.getPgImage(); + REQUIRE(pg != nullptr); + REQUIRE(pg->Width() == w); + REQUIRE(pg->Height() == h); + + // Setup() scans pg_image row by row to find each row's polygon extent. A + // full-frame polygon must mark every row from column 0 to the last column. + // A stride bug shows as a wrong extent on the rows past the padding + // boundary, so sample the first row, the last row, and a spread in between + // rather than asserting on all ~2000 (which bloats the suite and hides the + // failing row). Zone::Range is protected; getRanges() hands it out publicly, + // so let the type be deduced rather than naming it. + const auto *ranges = zone.getRanges(); + REQUIRE(ranges != nullptr); + for (unsigned int y : {0u, 1u, h / 2, h - 2, h - 1}) { + INFO("row y=" << y << " at " << w << "x" << h); + REQUIRE(ranges[y].lo_x == 0); + REQUIRE(ranges[y].hi_x == static_cast(w - 1)); + } + }; + + SECTION("1080x1920 portrait (linesize 1088 != width 1080)") { + check(1080, 1920); + } + SECTION("1920x1080 landscape (linesize == width)") { + check(1920, 1080); + } +} + +// ALARMED_PIXELS returns before the filter and blob stages. Real monitors +// commonly run BLOBS with SaveJPEGs>1, which additionally walks the diff buffer +// for filtering, runs blob detection, and builds an alarm highlight image. +TEST_CASE("Zone::CheckAlarms survives the blob path on a full-frame delta", "[Zone]") { + EnsureConfig(); + + auto check = [](unsigned int w, unsigned int h) { + const int frame_pixels = static_cast(w * h); + auto monitor = MakeMonitor(w, h); + // The filter/blob maxima default to values far below a full frame (50000), + // which would reject this delta before the code under test runs. Size every + // limit to the frame so the alarm survives to the blob stage. + Zone zone(monitor, 1, "full", Zone::ACTIVE, FullFramePolygon(w, h), kRGBRed, + Zone::BLOBS, + /*min_pixel_threshold*/ 10, /*max_pixel_threshold*/ 0, + /*min_alarm_pixels*/ 1, /*max_alarm_pixels*/ frame_pixels, + /*filter_box*/ Vector2(3, 3), + /*min_filter_pixels*/ 1, /*max_filter_pixels*/ frame_pixels, + /*min_blob_pixels*/ 1, /*max_blob_pixels*/ 0, + /*min_blobs*/ 1, /*max_blobs*/ 0); + + std::unique_ptr delta = MakeSaturatedDelta(w, h); + + REQUIRE(zone.CheckAlarms(delta.get()) == true); + REQUIRE(zone.GetStats().alarm_pixels_ == w * h); + }; + + SECTION("1080x1920 portrait (linesize 1088 != width 1080)") { + check(1080, 1920); + } + SECTION("1920x1080 landscape (linesize == width)") { + check(1920, 1080); + } +} + +TEST_CASE("Zone::CheckAlarms counts every pixel of a saturated full-frame delta", "[Zone]") { + EnsureConfig(); + + auto check = [](unsigned int w, unsigned int h) { + auto monitor = MakeMonitor(w, h); + Zone zone(monitor, 1, "full", Zone::ACTIVE, FullFramePolygon(w, h), kRGBRed, + Zone::ALARMED_PIXELS, + /*min_pixel_threshold*/ 10, /*max_pixel_threshold*/ 0, + /*min_alarm_pixels*/ 1, /*max_alarm_pixels*/ static_cast(w * h)); + + std::unique_ptr delta = MakeSaturatedDelta(w, h); + + REQUIRE(zone.CheckAlarms(delta.get()) == true); + // Every pixel is above threshold and every pixel is inside the polygon, so + // the alarmed count must be the whole frame. A stride mismatch shows up + // here as a short count. + REQUIRE(zone.GetStats().alarm_pixels_ == w * h); + }; + + SECTION("1080x1920 portrait (linesize 1088 != width 1080)") { + check(1080, 1920); + } + SECTION("1920x1080 landscape (linesize == width)") { + check(1920, 1080); + } +} diff --git a/utils/check-homoglyphs.py b/utils/check-homoglyphs.py new file mode 100755 index 000000000..34d9ef108 --- /dev/null +++ b/utils/check-homoglyphs.py @@ -0,0 +1,89 @@ +#!/usr/bin/env python3 +"""Fail if first-party source contains Cyrillic/Greek homoglyphs. + +Contributors occasionally paste characters that look like ASCII letters but are +not, e.g. Cyrillic Es (U+0421) instead of Latin C. These break identifier and +translation-key lookups, and the multi-byte UTF-8 sequences are corrupted by +some reverse proxies (ZoneMinder discussions #4993, #4678). This scans the +git-tracked source tree for characters in the Cyrillic (U+0400-U+04FF) and +Greek (U+0370-U+03FF) blocks and exits non-zero if any are found. + +Translations (web/lang/) and vendored/minified assets legitimately contain +these characters and are excluded. Run from the repo root: + + python3 utils/check-homoglyphs.py +""" +import re +import subprocess +import sys + +# Only these extensions are scanned; everything else (images, fonts, binaries) +# is ignored. +SCANNED_EXT = ( + '.php', '.js', '.cpp', '.h', '.hpp', '.c', '.cc', + '.pl', '.pm', '.pl.in', '.pm.in', '.in', + '.css', '.sql', '.py', '.sh', +) + +# Paths where non-ASCII letters are legitimate (translations) or not ours to +# fix (vendored, minified, generated). Matched as a case-insensitive substring +# of the repo-relative path. +EXCLUDE = re.compile( + r'(?:' + r'/lang/' # translation catalogues + r'|\.min\.' # minified vendored bundles + r'|/assets/' # bundled third-party skin assets + r'|/vendor/|/dist/|/lib/' # vendored libraries + r'|node_modules/' + r'|jquery|bootstrap|chosen|moment|video\.js|audiomotion' + r'|pro-sidebar|dygraph|packery|flatpickr' + r')', + re.IGNORECASE, +) + +# Cyrillic (U+0400-U+04FF) and Greek (U+0370-U+03FF) letter blocks. These are +# what homoglyph attacks and accidental paste-ins draw from; ZoneMinder code is +# otherwise ASCII. Written with \u escapes so this script is itself ASCII and +# passes its own check. +HOMOGLYPH = re.compile("[\u0400-\u04ff\u0370-\u03ff]") + + +def tracked_files(): + out = subprocess.check_output(['git', 'ls-files'], text=True) + return out.splitlines() + + +def main(): + violations = [] + for path in tracked_files(): + if EXCLUDE.search(path): + continue + if not path.endswith(SCANNED_EXT): + continue + try: + with open(path, encoding='utf-8') as handle: + lines = handle.readlines() + except (OSError, UnicodeDecodeError): + continue + for lineno, line in enumerate(lines, 1): + for match in HOMOGLYPH.finditer(line): + char = match.group() + violations.append( + (path, lineno, match.start() + 1, ord(char), line.rstrip('\n')) + ) + + if not violations: + print('OK: no Cyrillic/Greek homoglyphs in first-party source.') + return 0 + + print('Found {} homoglyph character(s) in first-party source:\n'.format(len(violations))) + for path, lineno, col, cp, text in violations: + print(' {}:{}:{} U+{:04X}'.format(path, lineno, col, cp)) + print(' {}'.format(text.strip())) + print('\nReplace each with its ASCII equivalent (e.g. Cyrillic Es U+0421 -> Latin C).') + print('If a character is genuinely required, add its path to EXCLUDE in {}.'.format(sys.argv[0])) + return 1 + + +if __name__ == '__main__': + sys.exit(main()) diff --git a/web/ajax/add_monitors.php b/web/ajax/add_monitors.php index 0e466bcca..786d03772 100644 --- a/web/ajax/add_monitors.php +++ b/web/ajax/add_monitors.php @@ -144,51 +144,80 @@ if (canEdit('Monitors')) { } // end case url_probe case 'import': { - + if ( !isset($_FILES['import_file']) ) { + ajaxError('No file was uploaded.'); + return; + } $file = $_FILES['import_file']; if ( $file['error'] > 0 ) { - ajaxError($file['error']); + ajaxError('File upload failed with error code '.$file['error']); return; - } else { - $filename = $file['name']; - - $available_streams = array(); - $row = 1; - if ( ($handle = fopen($file['tmp_name'], 'r')) !== FALSE ) { - while ( ($data = fgetcsv($handle, 1000, ',')) !== FALSE ) { - $name = $data[0]; - $url = $data[1]; - $group = $data[2]; - ZM\Info("Have the following line data $name $url $group"); - - $url_bits = null; - if ( preg_match('/(\d+)\.(\d+)\.(\d+)\.(\d+)/', $url) ) { - $url_bits = array('host'=>$url, 'scheme'=>'http'); - } else { - $url_bits = parse_url($url); - } - if ( ! $url_bits ) { - ZM\Info("Bad url, skipping line $name $url $group"); - continue; - } - - $available_streams += probe($url_bits); - - //$url_bits['url'] = unparse_url( $url_bits ); - //$url_bits['Monitor'] = $defaultMonitor; - //$url_bits['Monitor']->Name( $name ); - //$url_bits['Monitor']->merge( $_POST['newMonitor'] ); - //$available_streams[] = $url_bits; - - } // end while rows - fclose($handle); - ajaxResponse(array('Streams'=>$available_streams)); - } else { - ajaxError('Uploaded file does not exist'); - return; - } } + if ( !is_uploaded_file($file['tmp_name']) ) { + ajaxError('Uploaded file does not exist'); + return; + } + + if ( ($handle = fopen($file['tmp_name'], 'r')) === FALSE ) { + ajaxError('Unable to open uploaded file'); + return; + } + + $available_streams = array(); + $row = 0; + while ( ($data = fgetcsv($handle, 1000, ',')) !== FALSE ) { + $row ++; + if ( count($data) < 2 ) { + ZM\Info("Skipping line $row, expected at least Name,URL columns"); + continue; + } + $name = trim($data[0]); + $url = trim($data[1]); + $group = isset($data[2]) ? trim($data[2]) : ''; + + // Skip an optional header row (Name,URL,Group) + if ( $row == 1 and !strcasecmp($name, 'Name') and !strcasecmp($url, 'URL') ) { + ZM\Debug('Skipping header row'); + continue; + } + if ( $url === '' ) { + ZM\Info("Skipping line $row, no URL"); + continue; + } + ZM\Info("Importing line $row: $name $url $group"); + + $url_bits = parse_url($url); + $host = ($url_bits and isset($url_bits['host'])) ? $url_bits['host'] : ''; + + # If a monitor already exists for this url, offer to edit it instead of adding a duplicate. + $monitor = null; + $existing = ZM\Monitor::find(array('Path'=>$url)); + if ( count($existing) ) $monitor = $existing[0]; + + $available_streams[] = array( + 'mac' => '', + 'description' => $name.' - '.$url, + 'url' => $url, + 'IP' => $host, + 'Group' => $group, + 'camera' => array( + 'Name' => $name, + 'ip' => $host, + 'Manufacturer' => '', + 'Model' => '', + 'monitor' => array( + 'Type' => 'Ffmpeg', + 'Path' => $url, + 'Name' => $name, + ), + ), + 'Monitor' => $monitor, + ); + } // end while rows + fclose($handle); + + ajaxResponse(array('Streams'=>$available_streams)); break; } // end case import default: diff --git a/web/ajax/events.php b/web/ajax/events.php index d6eea18aa..06698a68c 100644 --- a/web/ajax/events.php +++ b/web/ajax/events.php @@ -29,11 +29,19 @@ if ($message) { } require_once('includes/Filter.php'); +require_once getSkinFile('views/_monitor_filters.php'); // getFilteredMonitorIds() $filter = isset($_REQUEST['filter']) ? ZM\Filter::parse($_REQUEST['filter']) : new ZM\Filter(); if (count( $user->unviewableMonitorIds())) { $filter = $filter->addTerm(array('cnj'=>'and', 'attr'=>'MonitorId', 'op'=>'IN', 'val'=>$user->viewableMonitorIds())); // $filter = $filter->addTerm(array('cnj'=>'and', 'attr'=>'MonitorId', 'op'=>'IN', 'val'=>'5')); } +# Constrain to the monitors selected by the shared monitor-attribute filters +# (Status/Capturing/Server/Storage/Name/Source) which have no Events column and so +# can't be expressed as event terms. Null = no such filter active. refs #4976 +$attr_monitor_ids = getFilteredMonitorIds(); +if ($attr_monitor_ids !== null) { + $filter = $filter->addTerm(array('cnj'=>'and', 'attr'=>'MonitorId', 'op'=>'IN', 'val'=>$attr_monitor_ids)); +} // TODO: Why is $user->viewableMonitorIds() returning $user->unviewableMonitorIds() // Error('$user->viewableMonitorIds(): '.print_r($user->viewableMonitorIds())); if (!empty($_REQUEST['StartDateTime'])) { @@ -224,20 +232,22 @@ function queryRequest($filter, $search, $advsearch, $sort, $offset, $order, $lim // For events that never wrote EndDateTime (zmc killed/crashed mid-event), // fall back to StartDateTime + Length. Length is flushed to the DB every // few seconds during recording, so it reflects the actual recorded - // duration even when zmc died without closing the event. Falling back to - // NOW() would otherwise extend the event across all the down-time. + // duration even when zmc died without closing the event. When Length is 0 + // too (an empty crash-orphaned event), fall back to StartDateTime so the + // event has no span; NOW() would otherwise extend it across all the + // down-time and overlap every later event. $col_str = ' E.*, UNIX_TIMESTAMP(E.StartDateTime) AS StartTimeSecs, CASE WHEN E.EndDateTime IS NOT NULL THEN E.EndDateTime WHEN E.Length > 0 THEN DATE_ADD(E.StartDateTime, INTERVAL FLOOR(E.Length) SECOND) - ELSE NOW() + ELSE E.StartDateTime END AS EndDateTime, CASE WHEN E.EndDateTime IS NOT NULL THEN UNIX_TIMESTAMP(E.EndDateTime) WHEN E.Length > 0 THEN UNIX_TIMESTAMP(E.StartDateTime) + E.Length - ELSE UNIX_TIMESTAMP(NOW()) + ELSE UNIX_TIMESTAMP(E.StartDateTime) END AS EndTimeSecs, M.Name AS Monitor, GROUP_CONCAT(T.Name SEPARATOR ", ") AS Tags'; diff --git a/web/ajax/modals/server.php b/web/ajax/modals/server.php index c6152458c..f902daecb 100644 --- a/web/ajax/modals/server.php +++ b/web/ajax/modals/server.php @@ -20,7 +20,7 @@ if ( $sid and ! $Server->Id() ) return;
-
Name() ?>
+
Name()) ?>
diff --git a/web/ajax/monitor.php b/web/ajax/monitor.php index 271325879..1341b82f5 100644 --- a/web/ajax/monitor.php +++ b/web/ajax/monitor.php @@ -38,5 +38,5 @@ if ( canView('Monitors') || (isset($_REQUEST['mid']) && $_REQUEST['mid'] !== '' } // end switch action } // end if canView('Monitors') -ajaxError(translate('UnrecognisedAction').' "'.validHtmlStr($_REQUEST['action'] ?? '').'" '.translate('СonjOr').' '.translate('insufficientPermissionsUser').' "'.validHtmlStr($user->Username()).'"'); +ajaxError(translate('UnrecognisedAction').' "'.validHtmlStr($_REQUEST['action'] ?? '').'" '.translate('ConjOr').' '.translate('insufficientPermissionsUser').' "'.validHtmlStr($user->Username()).'"'); ?> diff --git a/web/api/app/Controller/ConfigsController.php b/web/api/app/Controller/ConfigsController.php index 8ef062fae..b6a10c7ea 100644 --- a/web/api/app/Controller/ConfigsController.php +++ b/web/api/app/Controller/ConfigsController.php @@ -105,7 +105,7 @@ class ConfigsController extends AppController { */ public function edit($id = null) { global $user; - $canEdit = (!$user) || ($user['System'] == 'Edit'); + $canEdit = (!$user) || ($user->System() == 'Edit'); if (!$canEdit) { throw new UnauthorizedException(__('Insufficient privileges')); return; @@ -143,7 +143,7 @@ class ConfigsController extends AppController { */ public function delete($id = null) { global $user; - $canEdit = (!$user) || ($user['System'] == 'Edit'); + $canEdit = (!$user) || ($user->System() == 'Edit'); if (!$canEdit) { throw new UnauthorizedException(__('Insufficient privileges')); return; diff --git a/web/api/app/Controller/EventsController.php b/web/api/app/Controller/EventsController.php index ab027ed35..3798acb27 100644 --- a/web/api/app/Controller/EventsController.php +++ b/web/api/app/Controller/EventsController.php @@ -348,6 +348,18 @@ class EventsController extends AppController { throw new NotFoundException(__('Invalid event')); } + # Events=Edit is coarse. Enforce the per-monitor ACL too, otherwise a user + # denied a monitor can still mutate that monitor's events by direct Id. + $this->Event->recursive = -1; + $event = $this->Event->find('first', array( + 'conditions' => array('Event.' . $this->Event->primaryKey => $id) + )); + $EventObj = new ZM\Event($event['Event']); + if ( !$EventObj->canEdit() ) { + throw new UnauthorizedException(__('Insufficient Privileges')); + return; + } + if ( $this->Event->save($this->request->data) ) { $message = 'Saved'; } else { @@ -379,6 +391,19 @@ class EventsController extends AppController { throw new NotFoundException(__('Invalid event')); } $this->request->allowMethod('post', 'delete'); + + # Events=Edit is coarse. Enforce the per-monitor ACL too, otherwise a user + # denied a monitor can still delete that monitor's events by direct Id. + $this->Event->recursive = -1; + $event = $this->Event->find('first', array( + 'conditions' => array('Event.' . $this->Event->primaryKey => $id) + )); + $EventObj = new ZM\Event($event['Event']); + if ( !$EventObj->canEdit() ) { + throw new UnauthorizedException(__('Insufficient Privileges')); + return; + } + if ( $this->Event->delete() ) { //$this->loadModel('Frame'); //$this->Event->Frame->delete(); diff --git a/web/api/app/Controller/FramesController.php b/web/api/app/Controller/FramesController.php index b9374b316..7aca5d6ce 100644 --- a/web/api/app/Controller/FramesController.php +++ b/web/api/app/Controller/FramesController.php @@ -26,6 +26,40 @@ class FramesController extends AppController { } } + # Frames are addressed by their own Id, so the parent Event's per-monitor ACL + # has to be resolved explicitly. Without this a user denied a monitor can + # reach that monitor's frames by guessing frame Ids. + private function eventForFrame($id) { + $this->Frame->recursive = -1; + $frame = $this->Frame->find('first', array( + 'conditions' => array('Frame.' . $this->Frame->primaryKey => $id) + )); + if (!$frame) { + throw new NotFoundException(__('Invalid frame')); + } + $this->loadModel('Event'); + $this->Event->recursive = -1; + $event = $this->Event->find('first', array( + 'conditions' => array('Event.Id' => $frame['Frame']['EventId']) + )); + if (!$event) { + throw new NotFoundException(__('Invalid event')); + } + return new ZM\Event($event['Event']); + } + + # Frame mutation is an Event mutation, so require Events=Edit as well as the + # per-monitor ACL. beforeFilter() only guarantees Events != None. + private function requireFrameEdit($id) { + global $user; + if ($user and ($user->Events() != 'Edit')) { + throw new UnauthorizedException(__('Insufficient Privileges')); + } + if (!$this->eventForFrame($id)->canEdit()) { + throw new UnauthorizedException(__('Insufficient Privileges')); + } + } + /** * index method * @return void @@ -67,6 +101,9 @@ class FramesController extends AppController { if (!$this->Frame->exists($id)) { throw new NotFoundException(__('Invalid frame')); } + if (!$this->eventForFrame($id)->canView()) { + throw new UnauthorizedException(__('Insufficient Privileges')); + } $options = array('conditions' => array('Frame.' . $this->Frame->primaryKey => $id)); $frame = $this->Frame->find('first', $options); $this->set(array( @@ -102,6 +139,7 @@ class FramesController extends AppController { if (!$this->Frame->exists($id)) { throw new NotFoundException(__('Invalid frame')); } + $this->requireFrameEdit($id); if ($this->request->is(array('post', 'put'))) { if ($this->Frame->save($this->request->data)) { return $this->flash(__('The frame has been saved.'), array('action' => 'index')); @@ -127,6 +165,7 @@ class FramesController extends AppController { throw new NotFoundException(__('Invalid frame')); } $this->request->allowMethod('post', 'delete'); + $this->requireFrameEdit($id); if ($this->Frame->delete()) { return $this->flash(__('The frame has been deleted.'), array('action' => 'index')); } else { diff --git a/web/api/app/Controller/ZonesController.php b/web/api/app/Controller/ZonesController.php index a10780694..9d51d3d61 100644 --- a/web/api/app/Controller/ZonesController.php +++ b/web/api/app/Controller/ZonesController.php @@ -31,6 +31,19 @@ class ZonesController extends AppController { if ( !$this->Monitor->exists($id) ) { throw new NotFoundException(__('Invalid monitor')); } + + # Monitors=View is coarse. Enforce the per-monitor ACL so zones of a monitor + # the user is denied are not listed by direct monitor Id. + $this->Monitor->recursive = -1; + $monitor = $this->Monitor->find('first', array( + 'conditions' => array('Monitor.Id' => $id) + )); + $MonitorObj = new ZM\Monitor($monitor['Monitor']); + if ( !$MonitorObj->canView() ) { + throw new UnauthorizedException(__('Insufficient Privileges')); + return; + } + $this->Zone->recursive = -1; $zones = $this->Zone->find('all', array( 'conditions' => array('MonitorId' => $id) diff --git a/web/api/app/Model/Event.php b/web/api/app/Model/Event.php index 6cef2e40f..12670a277 100644 --- a/web/api/app/Model/Event.php +++ b/web/api/app/Model/Event.php @@ -39,7 +39,7 @@ class Event extends AppModel { // from painting an event bar across hours/days of no real recording. public $virtualFields = array( 'StartTimeSecs' => 'UNIX_TIMESTAMP(StartDateTime)', - 'EndTimeSecs' => '(CASE WHEN Event.EndDateTime IS NOT NULL THEN UNIX_TIMESTAMP(Event.EndDateTime) WHEN Event.Length > 0 THEN UNIX_TIMESTAMP(Event.StartDateTime) + Event.Length ELSE UNIX_TIMESTAMP(NOW()) END)', + 'EndTimeSecs' => '(CASE WHEN Event.EndDateTime IS NOT NULL THEN UNIX_TIMESTAMP(Event.EndDateTime) WHEN Event.Length > 0 THEN UNIX_TIMESTAMP(Event.StartDateTime) + Event.Length ELSE UNIX_TIMESTAMP(Event.StartDateTime) END)', 'StartTime' => 'StartDateTime', 'EndTime' => '(CASE WHEN Event.EndDateTime IS NOT NULL THEN Event.EndDateTime WHEN Event.Length > 0 THEN DATE_ADD(Event.StartDateTime, INTERVAL FLOOR(Event.Length) SECOND) ELSE NOW() END)' ); diff --git a/web/includes/Filter.php b/web/includes/Filter.php index 384cb1a75..6d3bda6b5 100644 --- a/web/includes/Filter.php +++ b/web/includes/Filter.php @@ -1142,6 +1142,22 @@ class Filter extends ZM_Object { return $html; } # end function widget() + // Decode a multi-value term value or cookie into an array of ids/strings. + // Cookies are written JSON-encoded by skin.js setCookie(), but legacy cookies + // (and pasted values) may be plain comma-separated, so fall back to explode. + static function decode_multi($raw) { + if ($raw === null or $raw === '') + return array(); + if (is_array($raw)) + return $raw; + $decoded = json_decode($raw, true); + if (is_array($decoded)) + return $decoded; + if ($decoded !== null) # scalar JSON value like a bare number + return array($decoded); + return explode(',', $raw); + } + // // This displays filters from the events page. // @@ -1269,11 +1285,17 @@ class Filter extends ZM_Object { $html .= $this->addButtonForFilterSelect("filter[Query][terms][$i][val]"); $html .= ''; } else if ( $term['attr'] == 'Group') { + $selected = self::decode_multi($term['val']); + $attrs = ['class'=>'term-value chosen chosen-auto-width', + 'multiple'=>'multiple', + 'data-placeholder'=>translate('All Groups')]; + if (isset($term['cookie'])) { + $attrs['data-cookie'] = $term['cookie']; + if (!$selected and isset($_COOKIE[$term['cookie']])) + $selected = self::decode_multi($_COOKIE[$term['cookie']]); + } $html .= ''; - $html .= htmlSelect("filter[Query][terms][$i][val]", Group::get_dropdown_options(), $term['val'], - ['class'=>'term-value chosen chosen-auto-width', - 'multiple'=>'multiple', - 'data-placeholder'=>translate('All Groups')]).PHP_EOL; + $html .= htmlSelect("filter[Query][terms][$i][val]", Group::get_dropdown_options(), $selected, $attrs).PHP_EOL; $html .= $this->addButtonForFilterSelect("filter[Query][terms][$i][val]"); $html .= ''; } else if ( $term['attr'] == 'StateId' ) { @@ -1293,17 +1315,14 @@ class Filter extends ZM_Object { $monitors[$m->Id()] = $m->Id().' '.validHtmlStr($m->Name()); } } - $selected = explode(',', $term['val']); + $selected = self::decode_multi($term['val']); // echo '
Monitor selected: '; print_r($selected); echo '
'; - if (count($selected) == 1 and !$selected[0]) { - $selected = null; - } $options = ['class'=>'term-value chosen chosen-auto-width', 'multiple'=>'multiple', 'data-placeholder'=>translate('All Monitors')]; if (isset($term['cookie'])) { $options['data-cookie'] = $term['cookie']; - if (!$selected and isset($_COOKIE[$term['cookie']]) and $_COOKIE[$term['cookie']]) - $selected = explode(',', $_COOKIE[$term['cookie']]); + if (!$selected and isset($_COOKIE[$term['cookie']])) + $selected = self::decode_multi($_COOKIE[$term['cookie']]); } $html .= ''; $html .= htmlSelect("filter[Query][terms][$i][val]", $monitors, $selected, $options).PHP_EOL; @@ -1344,15 +1363,12 @@ class Filter extends ZM_Object { $html .= $this->addButtonForFilterSelect("filter[Query][terms][$i][val]"); } else if ( $term['attr'] == 'Notes' ) { $attrs = ['id'=>'filterNotes', 'class'=>'term-value chosen chosen-auto-width', 'multiple'=>'multiple', 'data-placeholder'=>translate('Event Type')]; - $selected = explode(',', $term['val']); - if (count($selected) == 1 and !$selected[0]) { - $selected = null; - } + $selected = self::decode_multi($term['val']); if (isset($term['cookie'])) { $attrs['data-cookie'] = $term['cookie']; - if (!$selected and isset($_COOKIE[$term['cookie']]) and $_COOKIE[$term['cookie']]) - $selected = explode(',', $_COOKIE[$term['cookie']]); + if (!$selected and isset($_COOKIE[$term['cookie']])) + $selected = self::decode_multi($_COOKIE[$term['cookie']]); } $options = [ 'Motion' => 'Motion', @@ -1440,19 +1456,34 @@ class Filter extends ZM_Object { if (!$u) $u=$user; if ($u->canEdit('System')) return true; - if ($this->UserId() == $u->Id()) { - if ($u->canEdit('Events')) return true; - if ($u->canView('Events')) { - // If we can only view events, then we can't perform filters that involve changing the event. - if (!( - $this->AutoExecute() and - $this->AutoDelete() and - $this->AutoUnarchive() and - $this->AutoMove() and - $this->AutoCopy() - )) { - return true; - } + // Below here the user is not a System editor, so may only act on filters + // that they own. + if ($this->UserId() != $u->Id()) return false; + + // AutoExecuteCmd is run verbatim as an OS command by zmfilter.pl, which is + // equivalent to shell access on the server. Restrict it to System editors, + // who were already granted access above. + if ($this->AutoExecute()) return false; + + // Users who can edit Events may run filters that change events + // (move/copy/delete/archive/etc). + if ($u->canEdit('Events')) return true; + + // View-only users may only run filters that neither change events nor + // trigger side effects. Deny if ANY auto action is enabled. + if ($u->canView('Events')) { + if (!( + $this->AutoDelete() or + $this->AutoUnarchive() or + $this->AutoArchive() or + $this->AutoMove() or + $this->AutoCopy() or + $this->AutoVideo() or + $this->AutoUpload() or + $this->AutoEmail() or + $this->AutoMessage() + )) { + return true; } } return false; diff --git a/web/includes/FilterTerm.php b/web/includes/FilterTerm.php index c8a60c2f7..89c4ae4bc 100644 --- a/web/includes/FilterTerm.php +++ b/web/includes/FilterTerm.php @@ -304,6 +304,13 @@ class FilterTerm { case 'CurrentWeekday': return 'weekday(NOW()'; case 'DateTime': + // DateTime is an "event overlaps this instant/window" idiom, not a plain + // StartDateTime comparison. A lower bound (>=/>) is satisfied by an event + // still running at that time, so compare against EndDateTime (NULL end = + // ongoing = never ends). An upper bound (<=/op == '>=' or $this->op == '>') + return "COALESCE(E.EndDateTime, '9999-12-31 23:59:59')"; return 'E.StartDateTime'; case 'Date': return 'to_days(E.StartDateTime)'; diff --git a/web/includes/Zone.php b/web/includes/Zone.php index eba3af4d9..3069d396d 100644 --- a/web/includes/Zone.php +++ b/web/includes/Zone.php @@ -79,7 +79,7 @@ class Zone extends ZM_Object { $areaCoords = preg_replace('/\s+/', ',', pointsToCoords($points)); } } - return ''.$this->Name().''; + return ''.validHtmlStr($this->Name()).''; } } # end class Zone ?> diff --git a/web/includes/actions/files.php b/web/includes/actions/files.php index 46446a978..8f4f98389 100644 --- a/web/includes/actions/files.php +++ b/web/includes/actions/files.php @@ -45,6 +45,15 @@ if ($action == 'delete') { } $path_parts = pathinfo($path); + # $is_ok_path was computed above but never consulted, so a path outside every + # Storage area still reached unlink(). detaintPathAllowAbsolute() permits + # absolute paths, so this is what keeps the delete inside a Storage area. + if (!$is_ok_path) { + $error_message .= 'Path is not valid. Path must be below a designated Storage area.
'; + ZM\Warning("Refusing to delete files under '$path': not below a Storage area"); + return; + } + foreach ($_REQUEST['files'] as $file) { $full_path = $path.'/'.detaintPath($file); if (is_file($full_path)) { diff --git a/web/includes/functions.php b/web/includes/functions.php index 19b3cf11c..99307c79c 100644 --- a/web/includes/functions.php +++ b/web/includes/functions.php @@ -1823,8 +1823,12 @@ function generateConnKey() { } function detaintPathAllowAbsolute($path) { - // Strip out :// because php:// is a way to inject code apparently - $path = str_replace('://', '', $path); + // Strip out :// because php:// is a way to inject code apparently. + // This must loop: a single pass lets the removal re-form the sequence it + // just removed, so '::////' collapses back into '://'. + do { + $path = str_replace('://', '', $path, $count); + } while($count); // Remove any absolute paths, or relative ones that want to go up do { $path = str_replace('../', '', $path, $count); @@ -1834,8 +1838,12 @@ function detaintPathAllowAbsolute($path) { function detaintPath($path) { - // Strip out :// because php:// is a way to inject code apparently - $path = str_replace('://', '', $path); + // Strip out :// because php:// is a way to inject code apparently. + // This must loop: a single pass lets the removal re-form the sequence it + // just removed, so '::////' collapses back into '://'. + do { + $path = str_replace('://', '', $path, $count); + } while($count); // Remove any absolute paths, or relative ones that want to go up do { $path = str_replace('../', '', $path, $count); diff --git a/web/js/EventStream.js b/web/js/EventStream.js index c9072ea24..0afc90dd9 100644 --- a/web/js/EventStream.js +++ b/web/js/EventStream.js @@ -88,6 +88,17 @@ function EventStream(config) { */ this.start = function(eventId, options) { options = options || {}; + + // An explicit start supersedes any pending recovery. + if (this.recoveryTimer) { + clearTimeout(this.recoveryTimer); + this.recoveryTimer = null; + } + + // Tear down any existing connection first. Re-using a live would + // abort its MJPEG stream behind zms's back and orphan the zms process. + if (this.started || this.img) this.teardown(this.started); + this.currentEventId = eventId; this.rate = (options.rate !== undefined) ? options.rate : 100; this.paused = false; @@ -172,6 +183,37 @@ function EventStream(config) { this.started = true; }; + // ------------------------------------------------------------------------- + // teardown(quit) — Drop the connection, timers and draw loop. + // Pass quit=false when zms is already gone, so we don't ask a dead process + // to exit. Detaching the img handlers before clearing src keeps our own + // teardown from firing onerror and looking like a stream failure. + // ------------------------------------------------------------------------- + + this.teardown = function(quit) { + if (quit && this.started) this.streamCommand(CMD_QUIT); + this.streamCmdTimer = clearInterval(this.streamCmdTimer); + + if (this.rafId) { + cancelAnimationFrame(this.rafId); + this.rafId = null; + } + + if (this.img) { + this.img.onload = null; + this.img.onerror = null; + this.img.src = ''; + if (this.img.parentNode) { + this.img.parentNode.removeChild(this.img); + } + this.img = null; + } + + this.started = false; + this.connKey = null; + this.streamCmdParms.connkey = null; + }; + // ------------------------------------------------------------------------- // stop() — Stop the current stream // ------------------------------------------------------------------------- @@ -184,29 +226,9 @@ function EventStream(config) { if (!this.started) return; - this.streamCommand(CMD_QUIT); - this.streamCmdTimer = clearInterval(this.streamCmdTimer); - - if (this.rafId) { - cancelAnimationFrame(this.rafId); - this.rafId = null; - } - - if (this.img) { - this.img.onload = null; - this.img.onerror = null; - this.img.src = ''; - if (this.img.parentNode) { - this.img.parentNode.removeChild(this.img); - } - this.img = null; - } - - this.started = false; + this.teardown(true); this.paused = false; this.stopped = false; - this.connKey = null; - this.streamCmdParms.connkey = null; this.consecutiveErrors = 0; this.recoveryDelay = 1000; }; @@ -216,8 +238,24 @@ function EventStream(config) { // ------------------------------------------------------------------------- this.recover = function() { + // A recovery is already scheduled. Without this, every error arriving + // while we wait to retry (the status poll keeps firing, and each reply + // is another Error) would queue another restart and inflate the attempt + // count until we give up on a stream that was never retried once. + if (this.recoveryTimer) return; + this.consecutiveErrors++; + var self = this; + var eventId = this.currentEventId; + var opts = Object.assign({}, this.lastOptions || {}); + opts.rate = this.rate; + + // Drop the dead connection before deciding whether to retry, so that + // giving up leaves nothing running. zms is already gone, so no CMD_QUIT. + this.teardown(false); + this.stopped = false; + if (this.consecutiveErrors > this.maxRecoveryAttempts) { console.error('EventStream: max recovery attempts reached for monitor ' + this.monitorId + ', giving up'); @@ -228,34 +266,14 @@ function EventStream(config) { console.warn('EventStream: recovery attempt ' + this.consecutiveErrors + '/' + this.maxRecoveryAttempts + ' for monitor ' + this.monitorId); - var self = this; - var eventId = this.currentEventId; - var opts = Object.assign({}, this.lastOptions || {}); - opts.rate = this.rate; - - // Clean up old state without sending CMD_QUIT (zms is already dead) - this.streamCmdTimer = clearInterval(this.streamCmdTimer); - if (this.rafId) { - cancelAnimationFrame(this.rafId); - this.rafId = null; - } - if (this.img) { - this.img.onload = null; - this.img.onerror = null; - this.img.src = ''; - if (this.img.parentNode) { - this.img.parentNode.removeChild(this.img); - } - this.img = null; - } - this.started = false; - this.connKey = null; - this.stopped = false; - this.streamCmdParms.connkey = null; - // Delay before restarting — exponential backoff this.recoveryTimer = setTimeout(function() { self.recoveryTimer = null; + // teardown() cleared started, so a consumer polling for a live stream + // may have restarted us while we waited. Restarting again here would + // abort that healthy stream and orphan its zms, which fails the img + // and lands us straight back in recover(). + if (self.started) return; self.start(eventId, opts); }, this.recoveryDelay); @@ -340,37 +358,15 @@ function EventStream(config) { this.recoveryTimer = null; } - if (this.started) { - // Tell current zms to exit - this.streamCommand(CMD_QUIT); - this.streamCmdTimer = clearInterval(this.streamCmdTimer); - if (this.rafId) { - cancelAnimationFrame(this.rafId); - this.rafId = null; - } - if (this.img) { - this.img.onload = null; - this.img.onerror = null; - this.img.src = ''; - if (this.img.parentNode) { - this.img.parentNode.removeChild(this.img); - } - this.img = null; - } - this.started = false; - this.connKey = null; - this.streamCmdParms.connkey = null; - } - // Reset recovery state for fresh event this.consecutiveErrors = 0; this.recoveryDelay = 1000; - // Brief delay to let the old zms process clean up, then start fresh - var self = this; - setTimeout(function() { - self.start(eventId, options); - }, 200); + // start() tears the old stream down (sending CMD_QUIT) and brings the new + // event up in one step. Doing the teardown here instead and starting from + // a timer would leave started=false in between, and a consumer polling for + // a live stream would start its own before the timer fired. + this.start(eventId, options); }; // ------------------------------------------------------------------------- diff --git a/web/js/MonitorStream.js b/web/js/MonitorStream.js index 92729029a..8fcee6608 100644 --- a/web/js/MonitorStream.js +++ b/web/js/MonitorStream.js @@ -745,9 +745,8 @@ function MonitorStream(monitorData) { stream.srcObject = null; this.webrtc = null; } - if (this.hls) { - hlsDestroy(this.hls); - } + if (this.hls) hlsDestroy(this); + if (-1 !== this.activePlayer.indexOf('mse')) { this.stopMse(); } @@ -1839,7 +1838,7 @@ function MonitorStream(monitorData) { // PCM, G.711A, G.711Mu, G.726, G.723 - no audio track this.updateStreamInfo('', `Error. AAC codec "${data.audio.codec}" is not supported.`); //HLS this.streamErrorRegistration(); - hlsDestroy(this.hls); + hlsDestroy(this); this.restart(this.currentChannelStream); } }, this); @@ -1851,7 +1850,7 @@ function MonitorStream(monitorData) { if (!data || !data.fatal) return; this.updateStreamInfo('', 'Error'); //HLS this.streamErrorRegistration(); - hlsDestroy(this.hls); + hlsDestroy(this); this.restart(this.currentChannelStream); }, this); this.hls.loadSource(hlsUrl.href); diff --git a/web/skins/classic/assets/bootstrap-table b/web/skins/classic/assets/bootstrap-table index a7e5f1d08..e7718abf7 120000 --- a/web/skins/classic/assets/bootstrap-table +++ b/web/skins/classic/assets/bootstrap-table @@ -1 +1 @@ -bootstrap-table-1.27.1/ \ No newline at end of file +bootstrap-table-1.27.3/ \ No newline at end of file diff --git a/web/skins/classic/assets/bootstrap-table-1.27.1/bootstrap-table-vue.js b/web/skins/classic/assets/bootstrap-table-1.27.1/bootstrap-table-vue.js deleted file mode 100644 index 4e42c4baf..000000000 --- a/web/skins/classic/assets/bootstrap-table-1.27.1/bootstrap-table-vue.js +++ /dev/null @@ -1,1664 +0,0 @@ -//#region node_modules/@vue/shared/dist/shared.esm-bundler.js -/* @__NO_SIDE_EFFECTS__ */ -function e(e) { - let t = /* @__PURE__ */ Object.create(null); - for (let n of e.split(",")) t[n] = 1; - return (e) => e in t; -} -var t = process.env.NODE_ENV === "production" ? {} : Object.freeze({}), n = process.env.NODE_ENV === "production" ? [] : Object.freeze([]), r = () => {}, i = (e) => e.charCodeAt(0) === 111 && e.charCodeAt(1) === 110 && (e.charCodeAt(2) > 122 || e.charCodeAt(2) < 97), a = Object.assign, o = (e, t) => { - let n = e.indexOf(t); - n > -1 && e.splice(n, 1); -}, s = Object.prototype.hasOwnProperty, c = (e, t) => s.call(e, t), l = Array.isArray, u = (e) => v(e) === "[object Map]", d = (e) => v(e) === "[object Set]", f = (e) => typeof e == "function", p = (e) => typeof e == "string", m = (e) => typeof e == "symbol", h = (e) => typeof e == "object" && !!e, g = (e) => (h(e) || f(e)) && f(e.then) && f(e.catch), _ = Object.prototype.toString, v = (e) => _.call(e), y = (e) => v(e).slice(8, -1), ee = (e) => v(e) === "[object Object]", b = (e) => p(e) && e !== "NaN" && e[0] !== "-" && "" + parseInt(e, 10) === e, te = ((e) => { - let t = /* @__PURE__ */ Object.create(null); - return ((n) => t[n] || (t[n] = e(n))); -})((e) => e.charAt(0).toUpperCase() + e.slice(1)), x = (e, t) => !Object.is(e, t), S = (e, t, n, r = !1) => { - Object.defineProperty(e, t, { - configurable: !0, - enumerable: !1, - writable: r, - value: n - }); -}, C, w = () => C ||= typeof globalThis < "u" ? globalThis : typeof self < "u" ? self : typeof window < "u" ? window : typeof global < "u" ? global : {}; -function ne(e) { - if (l(e)) { - let t = {}; - for (let n = 0; n < e.length; n++) { - let r = e[n], i = p(r) ? oe(r) : ne(r); - if (i) for (let e in i) t[e] = i[e]; - } - return t; - } else if (p(e) || h(e)) return e; -} -var re = /;(?![^(]*\))/g, ie = /:([^]+)/, ae = /\/\*[^]*?\*\//g; -function oe(e) { - let t = {}; - return e.replace(ae, "").split(re).forEach((e) => { - if (e) { - let n = e.split(ie); - n.length > 1 && (t[n[0].trim()] = n[1].trim()); - } - }), t; -} -function se(e) { - let t = ""; - if (p(e)) t = e; - else if (l(e)) for (let n = 0; n < e.length; n++) { - let r = se(e[n]); - r && (t += r + " "); - } - else if (h(e)) for (let n in e) e[n] && (t += n + " "); - return t.trim(); -} -//#endregion -//#region node_modules/@vue/reactivity/dist/reactivity.esm-bundler.js -function T(e, ...t) { - console.warn(`[Vue warn] ${e}`, ...t); -} -var ce; -function le() { - return ce; -} -var E, ue = /* @__PURE__ */ new WeakSet(), de = class { - constructor(e) { - this.fn = e, this.deps = void 0, this.depsTail = void 0, this.flags = 5, this.next = void 0, this.cleanup = void 0, this.scheduler = void 0, ce && ce.active && ce.effects.push(this); - } - pause() { - this.flags |= 64; - } - resume() { - this.flags & 64 && (this.flags &= -65, ue.has(this) && (ue.delete(this), this.trigger())); - } - notify() { - this.flags & 2 && !(this.flags & 32) || this.flags & 8 || he(this); - } - run() { - if (!(this.flags & 1)) return this.fn(); - this.flags |= 2, Ee(this), ve(this); - let e = E, t = D; - E = this, D = !0; - try { - return this.fn(); - } finally { - process.env.NODE_ENV !== "production" && E !== this && T("Active effect was not restored correctly - this is likely a Vue internal bug."), ye(this), E = e, D = t, this.flags &= -3; - } - } - stop() { - if (this.flags & 1) { - for (let e = this.deps; e; e = e.nextDep) Se(e); - this.deps = this.depsTail = void 0, Ee(this), this.onStop && this.onStop(), this.flags &= -2; - } - } - trigger() { - this.flags & 64 ? ue.add(this) : this.scheduler ? this.scheduler() : this.runIfDirty(); - } - runIfDirty() { - be(this) && this.run(); - } - get dirty() { - return be(this); - } -}, fe = 0, pe, me; -function he(e, t = !1) { - if (e.flags |= 8, t) { - e.next = me, me = e; - return; - } - e.next = pe, pe = e; -} -function ge() { - fe++; -} -function _e() { - if (--fe > 0) return; - if (me) { - let e = me; - for (me = void 0; e;) { - let t = e.next; - e.next = void 0, e.flags &= -9, e = t; - } - } - let e; - for (; pe;) { - let t = pe; - for (pe = void 0; t;) { - let n = t.next; - if (t.next = void 0, t.flags &= -9, t.flags & 1) try { - t.trigger(); - } catch (t) { - e ||= t; - } - t = n; - } - } - if (e) throw e; -} -function ve(e) { - for (let t = e.deps; t; t = t.nextDep) t.version = -1, t.prevActiveLink = t.dep.activeLink, t.dep.activeLink = t; -} -function ye(e) { - let t, n = e.depsTail, r = n; - for (; r;) { - let e = r.prevDep; - r.version === -1 ? (r === n && (n = e), Se(r), Ce(r)) : t = r, r.dep.activeLink = r.prevActiveLink, r.prevActiveLink = void 0, r = e; - } - e.deps = t, e.depsTail = n; -} -function be(e) { - for (let t = e.deps; t; t = t.nextDep) if (t.dep.version !== t.version || t.dep.computed && (xe(t.dep.computed) || t.dep.version !== t.version)) return !0; - return !!e._dirty; -} -function xe(e) { - if (e.flags & 4 && !(e.flags & 16) || (e.flags &= -17, e.globalVersion === De) || (e.globalVersion = De, !e.isSSR && e.flags & 128 && (!e.deps && !e._dirty || !be(e)))) return; - e.flags |= 2; - let t = e.dep, n = E, r = D; - E = e, D = !0; - try { - ve(e); - let n = e.fn(e._value); - (t.version === 0 || x(n, e._value)) && (e.flags |= 128, e._value = n, t.version++); - } catch (e) { - throw t.version++, e; - } finally { - E = n, D = r, ye(e), e.flags &= -3; - } -} -function Se(e, t = !1) { - let { dep: n, prevSub: r, nextSub: i } = e; - if (r && (r.nextSub = i, e.prevSub = void 0), i && (i.prevSub = r, e.nextSub = void 0), process.env.NODE_ENV !== "production" && n.subsHead === e && (n.subsHead = i), n.subs === e && (n.subs = r, !r && n.computed)) { - n.computed.flags &= -5; - for (let e = n.computed.deps; e; e = e.nextDep) Se(e, !0); - } - !t && !--n.sc && n.map && n.map.delete(n.key); -} -function Ce(e) { - let { prevDep: t, nextDep: n } = e; - t && (t.nextDep = n, e.prevDep = void 0), n && (n.prevDep = t, e.nextDep = void 0); -} -var D = !0, we = []; -function Te() { - we.push(D), D = !1; -} -function O() { - let e = we.pop(); - D = e === void 0 ? !0 : e; -} -function Ee(e) { - let { cleanup: t } = e; - if (e.cleanup = void 0, t) { - let e = E; - E = void 0; - try { - t(); - } finally { - E = e; - } - } -} -var De = 0, Oe = class { - constructor(e, t) { - this.sub = e, this.dep = t, this.version = t.version, this.nextDep = this.prevDep = this.nextSub = this.prevSub = this.prevActiveLink = void 0; - } -}, ke = class { - constructor(e) { - this.computed = e, this.version = 0, this.activeLink = void 0, this.subs = void 0, this.map = void 0, this.key = void 0, this.sc = 0, this.__v_skip = !0, process.env.NODE_ENV !== "production" && (this.subsHead = void 0); - } - track(e) { - if (!E || !D || E === this.computed) return; - let t = this.activeLink; - if (t === void 0 || t.sub !== E) t = this.activeLink = new Oe(E, this), E.deps ? (t.prevDep = E.depsTail, E.depsTail.nextDep = t, E.depsTail = t) : E.deps = E.depsTail = t, Ae(t); - else if (t.version === -1 && (t.version = this.version, t.nextDep)) { - let e = t.nextDep; - e.prevDep = t.prevDep, t.prevDep && (t.prevDep.nextDep = e), t.prevDep = E.depsTail, t.nextDep = void 0, E.depsTail.nextDep = t, E.depsTail = t, E.deps === t && (E.deps = e); - } - return process.env.NODE_ENV !== "production" && E.onTrack && E.onTrack(a({ effect: E }, e)), t; - } - trigger(e) { - this.version++, De++, this.notify(e); - } - notify(e) { - ge(); - try { - if (process.env.NODE_ENV !== "production") for (let t = this.subsHead; t; t = t.nextSub) t.sub.onTrigger && !(t.sub.flags & 8) && t.sub.onTrigger(a({ effect: t.sub }, e)); - for (let e = this.subs; e; e = e.prevSub) e.sub.notify() && e.sub.dep.notify(); - } finally { - _e(); - } - } -}; -function Ae(e) { - if (e.dep.sc++, e.sub.flags & 4) { - let t = e.dep.computed; - if (t && !e.dep.subs) { - t.flags |= 20; - for (let e = t.deps; e; e = e.nextDep) Ae(e); - } - let n = e.dep.subs; - n !== e && (e.prevSub = n, n && (n.nextSub = e)), process.env.NODE_ENV !== "production" && e.dep.subsHead === void 0 && (e.dep.subsHead = e), e.dep.subs = e; - } -} -var je = /* @__PURE__ */ new WeakMap(), k = /* @__PURE__ */ Symbol(process.env.NODE_ENV === "production" ? "" : "Object iterate"), Me = /* @__PURE__ */ Symbol(process.env.NODE_ENV === "production" ? "" : "Map keys iterate"), A = /* @__PURE__ */ Symbol(process.env.NODE_ENV === "production" ? "" : "Array iterate"); -function j(e, t, n) { - if (D && E) { - let r = je.get(e); - r || je.set(e, r = /* @__PURE__ */ new Map()); - let i = r.get(n); - i || (r.set(n, i = new ke()), i.map = r, i.key = n), process.env.NODE_ENV === "production" ? i.track() : i.track({ - target: e, - type: t, - key: n - }); - } -} -function M(e, t, n, r, i, a) { - let o = je.get(e); - if (!o) { - De++; - return; - } - let s = (o) => { - o && (process.env.NODE_ENV === "production" ? o.trigger() : o.trigger({ - target: e, - type: t, - key: n, - newValue: r, - oldValue: i, - oldTarget: a - })); - }; - if (ge(), t === "clear") o.forEach(s); - else { - let i = l(e), a = i && b(n); - if (i && n === "length") { - let e = Number(r); - o.forEach((t, n) => { - (n === "length" || n === A || !m(n) && n >= e) && s(t); - }); - } else switch ((n !== void 0 || o.has(void 0)) && s(o.get(n)), a && s(o.get(A)), t) { - case "add": - i ? a && s(o.get("length")) : (s(o.get(k)), u(e) && s(o.get(Me))); - break; - case "delete": - i || (s(o.get(k)), u(e) && s(o.get(Me))); - break; - case "set": - u(e) && s(o.get(k)); - break; - } - } - _e(); -} -function N(e) { - let t = /* @__PURE__ */ z(e); - return t === e ? t : (j(t, "iterate", A), /* @__PURE__ */ R(e) ? t : t.map(B)); -} -function Ne(e) { - return j(e = /* @__PURE__ */ z(e), "iterate", A), e; -} -function P(e, t) { - return /* @__PURE__ */ L(e) ? _t(/* @__PURE__ */ I(e) ? B(t) : t) : B(t); -} -var Pe = { - __proto__: null, - [Symbol.iterator]() { - return Fe(this, Symbol.iterator, (e) => P(this, e)); - }, - concat(...e) { - return N(this).concat(...e.map((e) => l(e) ? N(e) : e)); - }, - entries() { - return Fe(this, "entries", (e) => (e[1] = P(this, e[1]), e)); - }, - every(e, t) { - return F(this, "every", e, t, void 0, arguments); - }, - filter(e, t) { - return F(this, "filter", e, t, (e) => e.map((e) => P(this, e)), arguments); - }, - find(e, t) { - return F(this, "find", e, t, (e) => P(this, e), arguments); - }, - findIndex(e, t) { - return F(this, "findIndex", e, t, void 0, arguments); - }, - findLast(e, t) { - return F(this, "findLast", e, t, (e) => P(this, e), arguments); - }, - findLastIndex(e, t) { - return F(this, "findLastIndex", e, t, void 0, arguments); - }, - forEach(e, t) { - return F(this, "forEach", e, t, void 0, arguments); - }, - includes(...e) { - return Re(this, "includes", e); - }, - indexOf(...e) { - return Re(this, "indexOf", e); - }, - join(e) { - return N(this).join(e); - }, - lastIndexOf(...e) { - return Re(this, "lastIndexOf", e); - }, - map(e, t) { - return F(this, "map", e, t, void 0, arguments); - }, - pop() { - return ze(this, "pop"); - }, - push(...e) { - return ze(this, "push", e); - }, - reduce(e, ...t) { - return Le(this, "reduce", e, t); - }, - reduceRight(e, ...t) { - return Le(this, "reduceRight", e, t); - }, - shift() { - return ze(this, "shift"); - }, - some(e, t) { - return F(this, "some", e, t, void 0, arguments); - }, - splice(...e) { - return ze(this, "splice", e); - }, - toReversed() { - return N(this).toReversed(); - }, - toSorted(e) { - return N(this).toSorted(e); - }, - toSpliced(...e) { - return N(this).toSpliced(...e); - }, - unshift(...e) { - return ze(this, "unshift", e); - }, - values() { - return Fe(this, "values", (e) => P(this, e)); - } -}; -function Fe(e, t, n) { - let r = Ne(e), i = r[t](); - return r !== e && !/* @__PURE__ */ R(e) && (i._next = i.next, i.next = () => { - let e = i._next(); - return e.done || (e.value = n(e.value)), e; - }), i; -} -var Ie = Array.prototype; -function F(e, t, n, r, i, a) { - let o = Ne(e), s = o !== e && !/* @__PURE__ */ R(e), c = o[t]; - if (c !== Ie[t]) { - let t = c.apply(e, a); - return s ? B(t) : t; - } - let l = n; - o !== e && (s ? l = function(t, r) { - return n.call(this, P(e, t), r, e); - } : n.length > 2 && (l = function(t, r) { - return n.call(this, t, r, e); - })); - let u = c.call(o, l, r); - return s && i ? i(u) : u; -} -function Le(e, t, n, r) { - let i = Ne(e), a = i !== e && !/* @__PURE__ */ R(e), o = n, s = !1; - i !== e && (a ? (s = r.length === 0, o = function(t, r, i) { - return s && (s = !1, t = P(e, t)), n.call(this, t, P(e, r), i, e); - }) : n.length > 3 && (o = function(t, r, i) { - return n.call(this, t, r, i, e); - })); - let c = i[t](o, ...r); - return s ? P(e, c) : c; -} -function Re(e, t, n) { - let r = /* @__PURE__ */ z(e); - j(r, "iterate", A); - let i = r[t](...n); - return (i === -1 || i === !1) && /* @__PURE__ */ ht(n[0]) ? (n[0] = /* @__PURE__ */ z(n[0]), r[t](...n)) : i; -} -function ze(e, t, n = []) { - Te(), ge(); - let r = (/* @__PURE__ */ z(e))[t].apply(e, n); - return _e(), O(), r; -} -var Be = /* @__PURE__ */ e("__proto__,__v_isRef,__isVue"), Ve = new Set(/* @__PURE__ */ Object.getOwnPropertyNames(Symbol).filter((e) => e !== "arguments" && e !== "caller").map((e) => Symbol[e]).filter(m)); -function He(e) { - m(e) || (e = String(e)); - let t = /* @__PURE__ */ z(this); - return j(t, "has", e), t.hasOwnProperty(e); -} -var Ue = class { - constructor(e = !1, t = !1) { - this._isReadonly = e, this._isShallow = t; - } - get(e, t, n) { - if (t === "__v_skip") return e.__v_skip; - let r = this._isReadonly, i = this._isShallow; - if (t === "__v_isReactive") return !r; - if (t === "__v_isReadonly") return r; - if (t === "__v_isShallow") return i; - if (t === "__v_raw") return n === (r ? i ? ct : st : i ? ot : at).get(e) || Object.getPrototypeOf(e) === Object.getPrototypeOf(n) ? e : void 0; - let a = l(e); - if (!r) { - let e; - if (a && (e = Pe[t])) return e; - if (t === "hasOwnProperty") return He; - } - let o = Reflect.get(e, t, /* @__PURE__ */ V(e) ? e : n); - if ((m(t) ? Ve.has(t) : Be(t)) || (r || j(e, "get", t), i)) return o; - if (/* @__PURE__ */ V(o)) { - let e = a && b(t) ? o : o.value; - return r && h(e) ? /* @__PURE__ */ ft(e) : e; - } - return h(o) ? r ? /* @__PURE__ */ ft(o) : /* @__PURE__ */ dt(o) : o; - } -}, We = class extends Ue { - constructor(e = !1) { - super(!1, e); - } - set(e, t, n, r) { - let i = e[t], a = l(e) && b(t); - if (!this._isShallow) { - let r = /* @__PURE__ */ L(i); - if (!/* @__PURE__ */ R(n) && !/* @__PURE__ */ L(n) && (i = /* @__PURE__ */ z(i), n = /* @__PURE__ */ z(n)), !a && /* @__PURE__ */ V(i) && !/* @__PURE__ */ V(n)) return r ? (process.env.NODE_ENV !== "production" && T(`Set operation on key "${String(t)}" failed: target is readonly.`, e[t]), !0) : (i.value = n, !0); - } - let o = a ? Number(t) < e.length : c(e, t), s = Reflect.set(e, t, n, /* @__PURE__ */ V(e) ? e : r); - return e === /* @__PURE__ */ z(r) && (o ? x(n, i) && M(e, "set", t, n, i) : M(e, "add", t, n)), s; - } - deleteProperty(e, t) { - let n = c(e, t), r = e[t], i = Reflect.deleteProperty(e, t); - return i && n && M(e, "delete", t, void 0, r), i; - } - has(e, t) { - let n = Reflect.has(e, t); - return (!m(t) || !Ve.has(t)) && j(e, "has", t), n; - } - ownKeys(e) { - return j(e, "iterate", l(e) ? "length" : k), Reflect.ownKeys(e); - } -}, Ge = class extends Ue { - constructor(e = !1) { - super(!0, e); - } - set(e, t) { - return process.env.NODE_ENV !== "production" && T(`Set operation on key "${String(t)}" failed: target is readonly.`, e), !0; - } - deleteProperty(e, t) { - return process.env.NODE_ENV !== "production" && T(`Delete operation on key "${String(t)}" failed: target is readonly.`, e), !0; - } -}, Ke = /* @__PURE__ */ new We(), qe = /* @__PURE__ */ new Ge(), Je = /* @__PURE__ */ new Ge(!0), Ye = (e) => e, Xe = (e) => Reflect.getPrototypeOf(e); -function Ze(e, t, n) { - return function(...r) { - let i = this.__v_raw, o = /* @__PURE__ */ z(i), s = u(o), c = e === "entries" || e === Symbol.iterator && s, l = e === "keys" && s, d = i[e](...r), f = n ? Ye : t ? _t : B; - return !t && j(o, "iterate", l ? Me : k), a(Object.create(d), { next() { - let { value: e, done: t } = d.next(); - return t ? { - value: e, - done: t - } : { - value: c ? [f(e[0]), f(e[1])] : f(e), - done: t - }; - } }); - }; -} -function Qe(e) { - return function(...t) { - if (process.env.NODE_ENV !== "production") { - let n = t[0] ? `on key "${t[0]}" ` : ""; - T(`${te(e)} operation ${n}failed: target is readonly.`, /* @__PURE__ */ z(this)); - } - return e === "delete" ? !1 : e === "clear" ? void 0 : this; - }; -} -function $e(e, t) { - let n = { - get(n) { - let r = this.__v_raw, i = /* @__PURE__ */ z(r), a = /* @__PURE__ */ z(n); - e || (x(n, a) && j(i, "get", n), j(i, "get", a)); - let { has: o } = Xe(i), s = t ? Ye : e ? _t : B; - if (o.call(i, n)) return s(r.get(n)); - if (o.call(i, a)) return s(r.get(a)); - r !== i && r.get(n); - }, - get size() { - let t = this.__v_raw; - return !e && j(/* @__PURE__ */ z(t), "iterate", k), t.size; - }, - has(t) { - let n = this.__v_raw, r = /* @__PURE__ */ z(n), i = /* @__PURE__ */ z(t); - return e || (x(t, i) && j(r, "has", t), j(r, "has", i)), t === i ? n.has(t) : n.has(t) || n.has(i); - }, - forEach(n, r) { - let i = this, a = i.__v_raw, o = /* @__PURE__ */ z(a), s = t ? Ye : e ? _t : B; - return !e && j(o, "iterate", k), a.forEach((e, t) => n.call(r, s(e), s(t), i)); - } - }; - return a(n, e ? { - add: Qe("add"), - set: Qe("set"), - delete: Qe("delete"), - clear: Qe("clear") - } : { - add(e) { - let n = /* @__PURE__ */ z(this), r = Xe(n), i = /* @__PURE__ */ z(e), a = !t && !/* @__PURE__ */ R(e) && !/* @__PURE__ */ L(e) ? i : e; - return r.has.call(n, a) || x(e, a) && r.has.call(n, e) || x(i, a) && r.has.call(n, i) || (n.add(a), M(n, "add", a, a)), this; - }, - set(e, n) { - !t && !/* @__PURE__ */ R(n) && !/* @__PURE__ */ L(n) && (n = /* @__PURE__ */ z(n)); - let r = /* @__PURE__ */ z(this), { has: i, get: a } = Xe(r), o = i.call(r, e); - o ? process.env.NODE_ENV !== "production" && it(r, i, e) : (e = /* @__PURE__ */ z(e), o = i.call(r, e)); - let s = a.call(r, e); - return r.set(e, n), o ? x(n, s) && M(r, "set", e, n, s) : M(r, "add", e, n), this; - }, - delete(e) { - let t = /* @__PURE__ */ z(this), { has: n, get: r } = Xe(t), i = n.call(t, e); - i ? process.env.NODE_ENV !== "production" && it(t, n, e) : (e = /* @__PURE__ */ z(e), i = n.call(t, e)); - let a = r ? r.call(t, e) : void 0, o = t.delete(e); - return i && M(t, "delete", e, void 0, a), o; - }, - clear() { - let e = /* @__PURE__ */ z(this), t = e.size !== 0, n = process.env.NODE_ENV === "production" ? void 0 : u(e) ? new Map(e) : new Set(e), r = e.clear(); - return t && M(e, "clear", void 0, void 0, n), r; - } - }), [ - "keys", - "values", - "entries", - Symbol.iterator - ].forEach((r) => { - n[r] = Ze(r, e, t); - }), n; -} -function et(e, t) { - let n = $e(e, t); - return (t, r, i) => r === "__v_isReactive" ? !e : r === "__v_isReadonly" ? e : r === "__v_raw" ? t : Reflect.get(c(n, r) && r in t ? n : t, r, i); -} -var tt = { get: /* @__PURE__ */ et(!1, !1) }, nt = { get: /* @__PURE__ */ et(!0, !1) }, rt = { get: /* @__PURE__ */ et(!0, !0) }; -function it(e, t, n) { - let r = /* @__PURE__ */ z(n); - if (r !== n && t.call(e, r)) { - let t = y(e); - T(`Reactive ${t} contains both the raw and reactive versions of the same object${t === "Map" ? " as keys" : ""}, which can lead to inconsistencies. Avoid differentiating between the raw and reactive versions of an object and only use the reactive version if possible.`); - } -} -var at = /* @__PURE__ */ new WeakMap(), ot = /* @__PURE__ */ new WeakMap(), st = /* @__PURE__ */ new WeakMap(), ct = /* @__PURE__ */ new WeakMap(); -function lt(e) { - switch (e) { - case "Object": - case "Array": return 1; - case "Map": - case "Set": - case "WeakMap": - case "WeakSet": return 2; - default: return 0; - } -} -function ut(e) { - return e.__v_skip || !Object.isExtensible(e) ? 0 : lt(y(e)); -} -/* @__NO_SIDE_EFFECTS__ */ -function dt(e) { - return /* @__PURE__ */ L(e) ? e : mt(e, !1, Ke, tt, at); -} -/* @__NO_SIDE_EFFECTS__ */ -function ft(e) { - return mt(e, !0, qe, nt, st); -} -/* @__NO_SIDE_EFFECTS__ */ -function pt(e) { - return mt(e, !0, Je, rt, ct); -} -function mt(e, t, n, r, i) { - if (!h(e)) return process.env.NODE_ENV !== "production" && T(`value cannot be made ${t ? "readonly" : "reactive"}: ${String(e)}`), e; - if (e.__v_raw && !(t && e.__v_isReactive)) return e; - let a = ut(e); - if (a === 0) return e; - let o = i.get(e); - if (o) return o; - let s = new Proxy(e, a === 2 ? r : n); - return i.set(e, s), s; -} -/* @__NO_SIDE_EFFECTS__ */ -function I(e) { - return /* @__PURE__ */ L(e) ? /* @__PURE__ */ I(e.__v_raw) : !!(e && e.__v_isReactive); -} -/* @__NO_SIDE_EFFECTS__ */ -function L(e) { - return !!(e && e.__v_isReadonly); -} -/* @__NO_SIDE_EFFECTS__ */ -function R(e) { - return !!(e && e.__v_isShallow); -} -/* @__NO_SIDE_EFFECTS__ */ -function ht(e) { - return e ? !!e.__v_raw : !1; -} -/* @__NO_SIDE_EFFECTS__ */ -function z(e) { - let t = e && e.__v_raw; - return t ? /* @__PURE__ */ z(t) : e; -} -function gt(e) { - return !c(e, "__v_skip") && Object.isExtensible(e) && S(e, "__v_skip", !0), e; -} -var B = (e) => h(e) ? /* @__PURE__ */ dt(e) : e, _t = (e) => h(e) ? /* @__PURE__ */ ft(e) : e; -/* @__NO_SIDE_EFFECTS__ */ -function V(e) { - return e ? e.__v_isRef === !0 : !1; -} -function vt(e) { - return /* @__PURE__ */ V(e) ? e.value : e; -} -var yt = { - get: (e, t, n) => t === "__v_raw" ? e : vt(Reflect.get(e, t, n)), - set: (e, t, n, r) => { - let i = e[t]; - return /* @__PURE__ */ V(i) && !/* @__PURE__ */ V(n) ? (i.value = n, !0) : Reflect.set(e, t, n, r); - } -}; -function bt(e) { - return /* @__PURE__ */ I(e) ? e : new Proxy(e, yt); -} -var xt = {}, St = /* @__PURE__ */ new WeakMap(), H = void 0; -function Ct(e, t = !1, n = H) { - if (n) { - let t = St.get(n); - t || St.set(n, t = []), t.push(e); - } else process.env.NODE_ENV !== "production" && !t && T("onWatcherCleanup() was called when there was no active watcher to associate with."); -} -function wt(e, n, i = t) { - let { immediate: a, deep: s, once: c, scheduler: u, augmentJob: d, call: p } = i, m = (e) => { - (i.onWarn || T)("Invalid watch source: ", e, "A watch source can only be a getter/effect function, a ref, a reactive object, or an array of these types."); - }, h = (e) => s ? e : /* @__PURE__ */ R(e) || s === !1 || s === 0 ? U(e, 1) : U(e), g, _, v, y, ee = !1, b = !1; - if (/* @__PURE__ */ V(e) ? (_ = () => e.value, ee = /* @__PURE__ */ R(e)) : /* @__PURE__ */ I(e) ? (_ = () => h(e), ee = !0) : l(e) ? (b = !0, ee = e.some((e) => /* @__PURE__ */ I(e) || /* @__PURE__ */ R(e)), _ = () => e.map((e) => { - if (/* @__PURE__ */ V(e)) return e.value; - if (/* @__PURE__ */ I(e)) return h(e); - if (f(e)) return p ? p(e, 2) : e(); - process.env.NODE_ENV !== "production" && m(e); - })) : f(e) ? _ = n ? p ? () => p(e, 2) : e : () => { - if (v) { - Te(); - try { - v(); - } finally { - O(); - } - } - let t = H; - H = g; - try { - return p ? p(e, 3, [y]) : e(y); - } finally { - H = t; - } - } : (_ = r, process.env.NODE_ENV !== "production" && m(e)), n && s) { - let e = _, t = s === !0 ? Infinity : s; - _ = () => U(e(), t); - } - let te = le(), S = () => { - g.stop(), te && te.active && o(te.effects, g); - }; - if (c && n) { - let e = n; - n = (...t) => { - e(...t), S(); - }; - } - let C = b ? Array(e.length).fill(xt) : xt, w = (e) => { - if (!(!(g.flags & 1) || !g.dirty && !e)) if (n) { - let e = g.run(); - if (s || ee || (b ? e.some((e, t) => x(e, C[t])) : x(e, C))) { - v && v(); - let t = H; - H = g; - try { - let t = [ - e, - C === xt ? void 0 : b && C[0] === xt ? [] : C, - y - ]; - C = e, p ? p(n, 3, t) : n(...t); - } finally { - H = t; - } - } - } else g.run(); - }; - return d && d(w), g = new de(_), g.scheduler = u ? () => u(w, !1) : w, y = (e) => Ct(e, !1, g), v = g.onStop = () => { - let e = St.get(g); - if (e) { - if (p) p(e, 4); - else for (let t of e) t(); - St.delete(g); - } - }, process.env.NODE_ENV !== "production" && (g.onTrack = i.onTrack, g.onTrigger = i.onTrigger), n ? a ? w(!0) : C = g.run() : u ? u(w.bind(null, !0), !0) : g.run(), S.pause = g.pause.bind(g), S.resume = g.resume.bind(g), S.stop = S, S; -} -function U(e, t = Infinity, n) { - if (t <= 0 || !h(e) || e.__v_skip || (n ||= /* @__PURE__ */ new Map(), (n.get(e) || 0) >= t)) return e; - if (n.set(e, t), t--, /* @__PURE__ */ V(e)) U(e.value, t, n); - else if (l(e)) for (let r = 0; r < e.length; r++) U(e[r], t, n); - else if (d(e) || u(e)) e.forEach((e) => { - U(e, t, n); - }); - else if (ee(e)) { - for (let r in e) U(e[r], t, n); - for (let r of Object.getOwnPropertySymbols(e)) Object.prototype.propertyIsEnumerable.call(e, r) && U(e[r], t, n); - } - return e; -} -//#endregion -//#region node_modules/@vue/runtime-core/dist/runtime-core.esm-bundler.js -var W = []; -function Tt(e) { - W.push(e); -} -function Et() { - W.pop(); -} -var Dt = !1; -function G(e, ...t) { - if (Dt) return; - Dt = !0, Te(); - let n = W.length ? W[W.length - 1].component : null, r = n && n.appContext.config.warnHandler, i = Ot(); - if (r) Pt(r, n, 11, [ - e + t.map((e) => e.toString?.call(e) ?? JSON.stringify(e)).join(""), - n && n.proxy, - i.map(({ vnode: e }) => `at <${yr(n, e.type)}>`).join("\n"), - i - ]); - else { - let n = [`[Vue warn]: ${e}`, ...t]; - i.length && n.push("\n", ...kt(i)), console.warn(...n); - } - O(), Dt = !1; -} -function Ot() { - let e = W[W.length - 1]; - if (!e) return []; - let t = []; - for (; e;) { - let n = t[0]; - n && n.vnode === e ? n.recurseCount++ : t.push({ - vnode: e, - recurseCount: 0 - }); - let r = e.component && e.component.parent; - e = r && r.vnode; - } - return t; -} -function kt(e) { - let t = []; - return e.forEach((e, n) => { - t.push(...n === 0 ? [] : ["\n"], ...At(e)); - }), t; -} -function At({ vnode: e, recurseCount: t }) { - let n = t > 0 ? `... (${t} recursive calls)` : "", r = e.component ? e.component.parent == null : !1, i = ` at <${yr(e.component, e.type, r)}`, a = ">" + n; - return e.props ? [ - i, - ...jt(e.props), - a - ] : [i + a]; -} -function jt(e) { - let t = [], n = Object.keys(e); - return n.slice(0, 3).forEach((n) => { - t.push(...Mt(n, e[n])); - }), n.length > 3 && t.push(" ..."), t; -} -function Mt(e, t, n) { - return p(t) ? (t = JSON.stringify(t), n ? t : [`${e}=${t}`]) : typeof t == "number" || typeof t == "boolean" || t == null ? n ? t : [`${e}=${t}`] : /* @__PURE__ */ V(t) ? (t = Mt(e, /* @__PURE__ */ z(t.value), !0), n ? t : [ - `${e}=Ref<`, - t, - ">" - ]) : f(t) ? [`${e}=fn${t.name ? `<${t.name}>` : ""}`] : (t = /* @__PURE__ */ z(t), n ? t : [`${e}=`, t]); -} -var Nt = { - sp: "serverPrefetch hook", - bc: "beforeCreate hook", - c: "created hook", - bm: "beforeMount hook", - m: "mounted hook", - bu: "beforeUpdate hook", - u: "updated", - bum: "beforeUnmount hook", - um: "unmounted hook", - a: "activated hook", - da: "deactivated hook", - ec: "errorCaptured hook", - rtc: "renderTracked hook", - rtg: "renderTriggered hook", - 0: "setup function", - 1: "render function", - 2: "watcher getter", - 3: "watcher callback", - 4: "watcher cleanup function", - 5: "native event handler", - 6: "component event handler", - 7: "vnode hook", - 8: "directive hook", - 9: "transition hook", - 10: "app errorHandler", - 11: "app warnHandler", - 12: "ref function", - 13: "async component loader", - 14: "scheduler flush", - 15: "component update", - 16: "app unmount cleanup function" -}; -function Pt(e, t, n, r) { - try { - return r ? e(...r) : e(); - } catch (e) { - It(e, t, n); - } -} -function Ft(e, t, n, r) { - if (f(e)) { - let i = Pt(e, t, n, r); - return i && g(i) && i.catch((e) => { - It(e, t, n); - }), i; - } - if (l(e)) { - let i = []; - for (let a = 0; a < e.length; a++) i.push(Ft(e[a], t, n, r)); - return i; - } else process.env.NODE_ENV !== "production" && G(`Invalid value type passed to callWithAsyncErrorHandling(): ${typeof e}`); -} -function It(e, n, r, i = !0) { - let a = n ? n.vnode : null, { errorHandler: o, throwUnhandledErrorInProduction: s } = n && n.appContext.config || t; - if (n) { - let t = n.parent, i = n.proxy, a = process.env.NODE_ENV === "production" ? `https://vuejs.org/error-reference/#runtime-${r}` : Nt[r]; - for (; t;) { - let n = t.ec; - if (n) { - for (let t = 0; t < n.length; t++) if (n[t](e, i, a) === !1) return; - } - t = t.parent; - } - if (o) { - Te(), Pt(o, null, 10, [ - e, - i, - a - ]), O(); - return; - } - } - Lt(e, r, a, i, s); -} -function Lt(e, t, n, r = !0, i = !1) { - if (process.env.NODE_ENV !== "production") { - let i = Nt[t]; - if (n && Tt(n), G(`Unhandled error${i ? ` during execution of ${i}` : ""}`), n && Et(), r) throw e; - console.error(e); - } else if (i) throw e; - else console.error(e); -} -var K = [], q = -1, J = [], Y = null, X = 0, Rt = /* @__PURE__ */ Promise.resolve(), zt = null, Bt = 100; -function Vt(e) { - let t = zt || Rt; - return e ? t.then(this ? e.bind(this) : e) : t; -} -function Ht(e) { - let t = q + 1, n = K.length; - for (; t < n;) { - let r = t + n >>> 1, i = K[r], a = qt(i); - a < e || a === e && i.flags & 2 ? t = r + 1 : n = r; - } - return t; -} -function Ut(e) { - if (!(e.flags & 1)) { - let t = qt(e), n = K[K.length - 1]; - !n || !(e.flags & 2) && t >= qt(n) ? K.push(e) : K.splice(Ht(t), 0, e), e.flags |= 1, Wt(); - } -} -function Wt() { - zt ||= Rt.then(Jt); -} -function Gt(e) { - l(e) ? J.push(...e) : Y && e.id === -1 ? Y.splice(X + 1, 0, e) : e.flags & 1 || (J.push(e), e.flags |= 1), Wt(); -} -function Kt(e) { - if (J.length) { - let t = [...new Set(J)].sort((e, t) => qt(e) - qt(t)); - if (J.length = 0, Y) { - Y.push(...t); - return; - } - for (Y = t, process.env.NODE_ENV !== "production" && (e ||= /* @__PURE__ */ new Map()), X = 0; X < Y.length; X++) { - let t = Y[X]; - process.env.NODE_ENV !== "production" && Yt(e, t) || (t.flags & 4 && (t.flags &= -2), t.flags & 8 || t(), t.flags &= -2); - } - Y = null, X = 0; - } -} -var qt = (e) => e.id == null ? e.flags & 2 ? -1 : Infinity : e.id; -function Jt(e) { - process.env.NODE_ENV !== "production" && (e ||= /* @__PURE__ */ new Map()); - let t = process.env.NODE_ENV === "production" ? r : (t) => Yt(e, t); - try { - for (q = 0; q < K.length; q++) { - let e = K[q]; - if (e && !(e.flags & 8)) { - if (process.env.NODE_ENV !== "production" && t(e)) continue; - e.flags & 4 && (e.flags &= -2), Pt(e, e.i, e.i ? 15 : 14), e.flags & 4 || (e.flags &= -2); - } - } - } finally { - for (; q < K.length; q++) { - let e = K[q]; - e && (e.flags &= -2); - } - q = -1, K.length = 0, Kt(e), zt = null, (K.length || J.length) && Jt(e); - } -} -function Yt(e, t) { - let n = e.get(t) || 0; - if (n > Bt) { - let e = t.i, n = e && vr(e.type); - return It(`Maximum recursive updates exceeded${n ? ` in component <${n}>` : ""}. This means you have a reactive effect that is mutating its own dependencies and thus recursively triggering itself. Possible sources include component template, render function, updated hook or watcher source function.`, null, 10), !0; - } - return e.set(t, n + 1), !1; -} -var Xt = /* @__PURE__ */ new Map(); -process.env.NODE_ENV !== "production" && (w().__VUE_HMR_RUNTIME__ = { - createRecord: rn(Qt), - rerender: rn(en), - reload: rn(tn) -}); -var Zt = /* @__PURE__ */ new Map(); -function Qt(e, t) { - return Zt.has(e) ? !1 : (Zt.set(e, { - initialDef: $t(t), - instances: /* @__PURE__ */ new Set() - }), !0); -} -function $t(e) { - return br(e) ? e.__vccOpts : e; -} -function en(e, t) { - let n = Zt.get(e); - n && (n.initialDef.render = t, [...n.instances].forEach((e) => { - t && (e.render = t, $t(e.type).render = t), e.renderCache = [], e.job.flags & 8 || e.update(); - })); -} -function tn(e, t) { - let n = Zt.get(e); - if (!n) return; - t = $t(t), nn(n.initialDef, t); - let r = [...n.instances]; - for (let e = 0; e < r.length; e++) { - let i = r[e], a = $t(i.type), o = Xt.get(a); - o || (a !== n.initialDef && nn(a, t), Xt.set(a, o = /* @__PURE__ */ new Set())), o.add(i), i.appContext.propsCache.delete(i.type), i.appContext.emitsCache.delete(i.type), i.appContext.optionsCache.delete(i.type), i.ceReload ? (o.add(i), i.ceReload(t.styles), o.delete(i)) : i.parent ? Ut(() => { - i.job.flags & 8 || (i.parent.update(), o.delete(i)); - }) : i.appContext.reload ? i.appContext.reload() : typeof window < "u" ? window.location.reload() : console.warn("[HMR] Root or manually mounted instance modified. Full reload required."), i.root.ce && i !== i.root && i.root.ce._removeChildStyle(a); - } - Gt(() => { - Xt.clear(); - }); -} -function nn(e, t) { - a(e, t); - for (let n in e) n !== "__file" && !(n in t) && delete e[n]; -} -function rn(e) { - return (t, n) => { - try { - return e(t, n); - } catch (e) { - console.error(e), console.warn("[HMR] Something went wrong during Vue component hot-reload. Full reload required."); - } - }; -} -var an, on = []; -function sn(e, t) { - an = e, an ? (an.enabled = !0, on.forEach(({ event: e, args: t }) => an.emit(e, ...t)), on = []) : typeof window < "u" && window.HTMLElement && !(window.navigator?.userAgent)?.includes("jsdom") ? ((t.__VUE_DEVTOOLS_HOOK_REPLAY__ = t.__VUE_DEVTOOLS_HOOK_REPLAY__ || []).push((e) => { - sn(e, t); - }), setTimeout(() => { - an || (t.__VUE_DEVTOOLS_HOOK_REPLAY__ = null, on = []); - }, 3e3)) : on = []; -} -var Z = null, cn = null; -function ln(e, t, n = !1) { - let r = ur(); - if (r || Pn) { - let i = Pn ? Pn._context.provides : r ? r.parent == null || r.ce ? r.vnode.appContext && r.vnode.appContext.provides : r.parent.provides : void 0; - if (i && e in i) return i[e]; - if (arguments.length > 1) return n && f(t) ? t.call(r && r.proxy) : t; - process.env.NODE_ENV !== "production" && G(`injection "${String(e)}" not found.`); - } else process.env.NODE_ENV !== "production" && G("inject() can only be used inside setup() or functional components."); -} -var un = /* @__PURE__ */ Symbol.for("v-scx"), dn = () => { - { - let e = ln(un); - return e || process.env.NODE_ENV !== "production" && G("Server rendering context not provided. Make sure to only call useSSRContext() conditionally in the server build."), e; - } -}; -function fn(e, n, i = t) { - let { immediate: o, deep: s, flush: c, once: l } = i; - process.env.NODE_ENV !== "production" && !n && (o !== void 0 && G("watch() \"immediate\" option is only respected when using the watch(source, callback, options?) signature."), s !== void 0 && G("watch() \"deep\" option is only respected when using the watch(source, callback, options?) signature."), l !== void 0 && G("watch() \"once\" option is only respected when using the watch(source, callback, options?) signature.")); - let u = a({}, i); - process.env.NODE_ENV !== "production" && (u.onWarn = G); - let d = n && o || !n && c !== "post", f; - if (mr) { - if (c === "sync") { - let e = dn(); - f = e.__watcherHandles ||= []; - } else if (!d) { - let e = () => {}; - return e.stop = r, e.resume = r, e.pause = r, e; - } - } - let p = lr; - u.call = (e, t, n) => Ft(e, p, t, n); - let m = !1; - c === "post" ? u.scheduler = (e) => { - Ln(e, p && p.suspense); - } : c !== "sync" && (m = !0, u.scheduler = (e, t) => { - t ? e() : Ut(e); - }), u.augmentJob = (e) => { - n && (e.flags |= 4), m && (e.flags |= 2, p && (e.id = p.uid, e.i = p)); - }; - let h = wt(e, n, u); - return mr && (f ? f.push(h) : d && h()), h; -} -function pn(e, t, n) { - let r = this.proxy, i = p(e) ? e.includes(".") ? mn(r, e) : () => r[e] : e.bind(r, r), a; - f(t) ? a = t : (a = t.handler, n = t); - let o = fr(this), s = fn(i, a.bind(r), n); - return o(), s; -} -function mn(e, t) { - let n = t.split("."); - return () => { - let t = e; - for (let e = 0; e < n.length && t; e++) t = t[n[e]]; - return t; - }; -} -var hn = (e) => e.__isTeleport; -function gn(e, t) { - e.shapeFlag & 6 && e.component ? (e.transition = t, gn(e.component.subTree, t)) : e.shapeFlag & 128 ? (e.ssContent.transition = t.clone(e.ssContent), e.ssFallback.transition = t.clone(e.ssFallback)) : e.transition = t; -} -w().requestIdleCallback, w().cancelIdleCallback; -var _n = /* @__PURE__ */ Symbol.for("v-ndc"), vn = (e) => e ? pr(e) ? hr(e) : vn(e.parent) : null, yn = /* @__PURE__ */ a(/* @__PURE__ */ Object.create(null), { - $: (e) => e, - $el: (e) => e.vnode.el, - $data: (e) => e.data, - $props: (e) => process.env.NODE_ENV === "production" ? e.props : /* @__PURE__ */ pt(e.props), - $attrs: (e) => process.env.NODE_ENV === "production" ? e.attrs : /* @__PURE__ */ pt(e.attrs), - $slots: (e) => process.env.NODE_ENV === "production" ? e.slots : /* @__PURE__ */ pt(e.slots), - $refs: (e) => process.env.NODE_ENV === "production" ? e.refs : /* @__PURE__ */ pt(e.refs), - $parent: (e) => vn(e.parent), - $root: (e) => vn(e.root), - $host: (e) => e.ce, - $emit: (e) => e.emit, - $options: (e) => Tn(e), - $forceUpdate: (e) => e.f ||= () => { - Ut(e.update); - }, - $nextTick: (e) => e.n ||= Vt.bind(e.proxy), - $watch: (e) => pn.bind(e) -}), bn = (e) => e === "_" || e === "$", xn = (e, n) => e !== t && !e.__isScriptSetup && c(e, n), Sn = { - get({ _: e }, n) { - if (n === "__v_skip") return !0; - let { ctx: r, setupState: i, data: a, props: o, accessCache: s, type: l, appContext: u } = e; - if (process.env.NODE_ENV !== "production" && n === "__isVue") return !0; - if (n[0] !== "$") { - let e = s[n]; - if (e !== void 0) switch (e) { - case 1: return i[n]; - case 2: return a[n]; - case 4: return r[n]; - case 3: return o[n]; - } - else if (xn(i, n)) return s[n] = 1, i[n]; - else if (a !== t && c(a, n)) return s[n] = 2, a[n]; - else if (c(o, n)) return s[n] = 3, o[n]; - else if (r !== t && c(r, n)) return s[n] = 4, r[n]; - else wn && (s[n] = 0); - } - let d = yn[n], f, m; - if (d) return n === "$attrs" ? (j(e.attrs, "get", ""), process.env.NODE_ENV) : process.env.NODE_ENV !== "production" && n === "$slots" && j(e, "get", n), d(e); - if ((f = l.__cssModules) && (f = f[n])) return f; - if (r !== t && c(r, n)) return s[n] = 4, r[n]; - if (m = u.config.globalProperties, c(m, n)) return m[n]; - process.env.NODE_ENV !== "production" && Z && (!p(n) || n.indexOf("__v") !== 0) && (a !== t && bn(n[0]) && c(a, n) ? G(`Property ${JSON.stringify(n)} must be accessed via $data because it starts with a reserved character ("$" or "_") and is not proxied on the render context.`) : e === Z && G(`Property ${JSON.stringify(n)} was accessed during render but is not defined on instance.`)); - }, - set({ _: e }, n, r) { - let { data: i, setupState: a, ctx: o } = e; - return xn(a, n) ? (a[n] = r, !0) : process.env.NODE_ENV !== "production" && a.__isScriptSetup && c(a, n) ? (G(`Cannot mutate