ControlsController only reads control definitions (index/view) — editing
them happens under Options, which requires System — but its beforeFilter
required System for the reads too. A client building a PTZ command fetches
the monitor's control definition from this API, and the web ui lets anyone
who can control a monitor (canView('Control')) do that, so a user with
Control permission but System=None could drive PTZ in the web ui yet got
401 from the API.
Allow the read for canView('System') or canView('Control'), matching
web/ajax/control.php. A user with neither is still refused.
Tested with the API on a scratch database: a Control=Edit, System=None user
got 401 on /api/controls and /api/controls/view/1 before and 200 after; a
Stream-only user with neither permission still gets 401.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Neither checked anything, so any enabled, API-enabled account could read them.
Control definitions describe how to drive a camera and are edited under Options,
which requires System. Manufacturers, CameraModels and EncoderTemplates already
gate their reference data that way; Controls was left open.
getLoad returns the system load average, which getSysLoadHTML() in the web ui
declines to render without canView('System'), so the API no longer hands the
same figure to an account without it.
getDiskPercent reported usage per monitor, keyed by monitor name, telling an
account which monitors exist and how much disk each uses even when it was not
permitted to view any of them. It now reports only on monitors the caller can
view, and asking about one specific monitor requires view on that monitor.
daemonCheck is deliberately left alone: it reports only whether ZoneMinder is
running, which the web ui's navbar shows to every logged-in user, and gating it
here would make the API stricter than the interface it serves.
