diff --git a/web/ajax/log.php b/web/ajax/log.php
index e8caff6bd..2fd220578 100644
--- a/web/ajax/log.php
+++ b/web/ajax/log.php
@@ -19,7 +19,7 @@ switch ( $_REQUEST['task'] ) {
else
$line = NULL;
- $levels = array_flip(Logger::$codes);
+ $levels = array_flip(ZM\Logger::$codes);
if ( !isset($levels[$_POST['level']]) )
ZM\Panic("Unexpected logger level '".$_POST['level']."'");
$level = $levels[$_POST['level']];
@@ -322,7 +322,7 @@ switch ( $_REQUEST['task'] ) {
$classLevel = ZM\Logger::FATAL;
elseif ( $classLevel > ZM\Logger::DEBUG )
$classLevel = ZM\Logger::DEBUG;
- $logClass = 'log-'.strtolower(Logger::$codes[$classLevel]);
+ $logClass = 'log-'.strtolower(ZM\Logger::$codes[$classLevel]);
fprintf( $exportFP, "
| %s | %s | %s | %d | %s | %s | %s | %s |
\n", $logClass, $log['DateTime'], $log['Component'], $log['Server'], $log['Pid'], $log['Code'], $log['Message'], $log['File'], $log['Line'] );
}
fwrite( $exportFP,
diff --git a/web/includes/Monitor.php b/web/includes/Monitor.php
index dd1f81149..2030c9ec7 100644
--- a/web/includes/Monitor.php
+++ b/web/includes/Monitor.php
@@ -652,7 +652,8 @@ private $control_fields = array(
} // end function Source
public function UrlToIndex() {
- return $this->Server()->UrlToIndex(ZM_MIN_STREAMING_PORT ? (ZM_MIN_STREAMING_PORT+$this->Id()) : null);
+ return $this->Server()->UrlToIndex();
+ //ZM_MIN_STREAMING_PORT ? (ZM_MIN_STREAMING_PORT+$this->Id()) : null);
}
} // end class Monitor
diff --git a/web/index.php b/web/index.php
index c556a2171..f48ef03fb 100644
--- a/web/index.php
+++ b/web/index.php
@@ -38,7 +38,7 @@ if ( version_compare(phpversion(), '4.1.0', '<') ) {
if ( false ) {
ob_start();
phpinfo(INFO_VARIABLES);
- $fp = fopen('/tmp/env.html', 'w');
+ $fp = fopen('/tmp/env.html', 'w+');
fwrite($fp, ob_get_contents());
fclose($fp);
ob_end_clean();
@@ -70,8 +70,15 @@ define('ZM_BASE_PROTOCOL', $protocol);
// Use relative URL's instead
define('ZM_BASE_URL', '');
-// Verify the system, php, and mysql timezones all match
require_once('includes/functions.php');
+if ( $_SERVER['REQUEST_METHOD'] == 'OPTIONS' ) {
+ Logger::Debug("OPTIONS Method, only doing CORS");
+ # Add Cross domain access headers
+ CORSHeaders();
+ return;
+}
+
+// Verify the system, php, and mysql timezones all match
check_timezone();
if ( isset($_GET['skin']) ) {
@@ -187,7 +194,7 @@ isset($view) || $view = NULL;
isset($request) || $request = NULL;
isset($action) || $action = NULL;
-Logger::Debug("View: $view Request: $request Action: $action");
+Logger::Debug("View: $view Request: $request Action: $action User: " . ( isset($user) ? $user['Username'] : 'none' ));
if (
ZM_ENABLE_CSRF_MAGIC &&
( $action != 'login' ) &&
@@ -214,6 +221,12 @@ if ( $action ) {
# If I put this here, it protects all views and popups, but it has to go after actions.php because actions.php does the actual logging in.
if ( ZM_OPT_USE_AUTH and !isset($user) and ($view != 'login') ) {
+ /* AJAX check */
+ if ( !empty($_SERVER['HTTP_X_REQUESTED_WITH'])
+ && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest' ) {
+ header('HTTP/1.1 401 Unauthorized');
+ exit;
+ }
Logger::Debug('Redirecting to login');
$view = 'none';
$redirect = ZM_BASE_URL.$_SERVER['PHP_SELF'].'?view=login';
diff --git a/web/skins/classic/includes/functions.php b/web/skins/classic/includes/functions.php
index 37209b7d0..662856eb7 100644
--- a/web/skins/classic/includes/functions.php
+++ b/web/skins/classic/includes/functions.php
@@ -275,7 +275,6 @@ function getNavBarHTML($reload = null) {
dbQuery('DELETE low_priority FROM Logs ORDER BY TimeKey ASC LIMIT ?', array($rows - ZM_LOG_DATABASE_LIMIT));
}
} else if ( preg_match('/^\d\s*(hour|minute|day|week|month|year)$/', ZM_LOG_DATABASE_LIMIT, $matches) ) {
- ZM\Logger::Debug("have interval ".$matches[1]);
dbQuery('DELETE FROM Logs WHERE TimeKey < unix_timestamp( NOW() - interval '.ZM_LOG_DATABASE_LIMIT.') LIMIT 100');
} else {
ZM\Error('Potentially invalid value for ZM_LOG_DATABASE_LIMIT: ' . ZM_LOG_DATABASE_LIMIT);