zoneminder

mirror/zoneminder

0 Fork 0

mirror of https://github.com/ZoneMinder/zoneminder.git synced 2026-10-03 07:55:22 -04:00

Commit Graph

Author	SHA1	Message	Date
Isaac ConnorandClaude Opus 5.5	a57634871c	fix: check permissions in Logs delete and the ZonePresets API LogsController::delete() never declared global $user, so its System=Edit check always passed and anyone with System view could delete log entries. Logs add, which ZM_LOG_INJECT opens to non-admins, could overwrite an existing entry by Id; pin it. ZonePresetsController had no permission checks. Reading presets stays open to signed-in users; changing them now needs System=Edit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-29 17:54:25 -04:00
Isaac Connor	dc57a3c91c	fix spacing/quotes/google code style	2018-07-24 16:41:09 -04:00
Ubuntu	dd9603f70f	Merged Angular UI branch API to master	2015-06-11 02:58:58 +00:00

Author

SHA1

Message

Date

Isaac ConnorandClaude Opus 5.5

a57634871c

fix: check permissions in Logs delete and the ZonePresets API

LogsController::delete() never declared global $user, so its System=Edit
check always passed and anyone with System view could delete log entries.
Logs add, which ZM_LOG_INJECT opens to non-admins, could overwrite an
existing entry by Id; pin it.

ZonePresetsController had no permission checks. Reading presets stays
open to signed-in users; changing them now needs System=Edit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-29 17:54:25 -04:00

Isaac Connor

dc57a3c91c

fix spacing/quotes/google code style

2018-07-24 16:41:09 -04:00

Ubuntu

dd9603f70f

Merged Angular UI branch API to master

2015-06-11 02:58:58 +00:00