Commit Graph

12468 Commits

Author SHA1 Message Date
IgorA100
ae148db5ac Chore: Optimized saving of "navbar_type" in session and cookies (index.php) 2026-03-01 22:36:28 +03:00
Isaac Connor
a61b8ffefd Merge branch 'master' of github.com:ZoneMinder/zoneminder 2026-02-28 17:10:14 -05:00
Isaac Connor
f6e86d5f9e Merge pull request #4663 from IgorA100/patch-721583
Fix: If an RTSP2Web type RTC error occurs, restart the stream instead of killing it (MonitorStream.js)
2026-02-28 16:57:12 -05:00
Isaac Connor
a6c242c247 Merge pull request #4662 from IgorA100/patch-361902
Fix: Saving "navbar_type" in cookies
2026-02-28 16:54:52 -05:00
Isaac Connor
bc4049d84d Merge pull request #4632 from IgorA100/patch-885409
Fix: Event handling for VID (event.js)
2026-02-28 16:54:36 -05:00
IgorA100
3d02585634 Fix: If an RTSP2Web type RTC error occurs, restart the stream instead of killing it (MonitorStream.js) 2026-03-01 00:31:08 +03:00
IgorA100
dd35971142 Fix: Saving "navbar_type" in cookies (index.php)
Also, _REQUEST is more important than _COOKIE
Therefore, we check _REQUEST after checking _COOKIE
2026-02-28 21:53:39 +03:00
Isaac Connor
07345d095a Merge pull request #4638 from IgorA100/patch-129096
Optimizing "VolumeSlider" (MonitorStream.js)
2026-02-28 10:39:03 -05:00
Isaac Connor
1aedd44c14 Merge pull request #4659 from IgorA100/patch-286993
Fix: Apply z-index=3 for display zone and for Event page
2026-02-28 09:53:00 -05:00
IgorA100
f6806ec3f4 Fix: Apply z-index=3 to the Event page as well (skin.css) 2026-02-28 14:29:32 +03:00
IgorA100
478289537a Fix: Don't assign "resize" listener when using Observer (zone.js)
Although the committees 10f1608f1d
a3ef673279
and improved the situation, but more needs to be done.

Instead of #4655
2026-02-28 11:52:22 +03:00
Isaac Connor
812251f40f fix: improve JS error logging for undefined messages and cross-origin errors
window.onerror now captures column number and error stack trace when
available. Undefined or browser-sanitized "Script error." messages get a
descriptive placeholder instead of logging "undefined". Caller name
introspection is guarded against strict mode and empty names.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-27 22:16:23 -05:00
Isaac Connor
a90a3bccea fix: auto-detect and convert pixel zone coordinates to percentages in web layer
When zone coordinates are stored as pixel values (e.g. from a missed DB
migration), the web layer now detects values > 100 and converts them to
percentages using the monitor's dimensions, mirroring the existing C++
detection logic in zm_zone.cpp. This prevents limitPoints() from clamping
pixel values to 0-100 and zones rendering incorrectly in SVG overlays.

- Add convertPixelPointsToPercent() helper in functions.php
- Call conversion before limitPoints() in zone.php and zones.php
- Update Zone::svg_polygon() to accept monitor dimensions and convert
- Pass ViewWidth/ViewHeight to svg_polygon() from Monitor::getStreamHTML()

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-27 17:49:14 -05:00
Isaac Connor
18e515be46 Satisfy eslint, but also log the error 2026-02-27 17:40:53 -05:00
Isaac Connor
a3ef673279 Only .imageFeed will have the alarm/idle border. Not the img within it or video or anything else. Fixes extra borders and streams jumping around as borders appear/disappear 2026-02-27 17:15:36 -05:00
Isaac Connor
10f1608f1d fix: use ResizeObserver for zone point positioning on initial load
Replace img load event listener with ResizeObserver on imageFeed
container. The old approach listened for load events on #imageFrame img
elements, which never fires for video-based streams (Go2RTC MSE) since
they use <video> not <img>. ResizeObserver fires whenever the container
dimensions change regardless of content type, fixing incorrect zone
point positions on initial load.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-27 17:04:21 -05:00
Isaac Connor
b5511e3f02 Merge pull request #4656 from IgorA100/patch-544353
Fix: For ".imageFeed svg.zones" apply z-index: 3 (skin.css)
2026-02-27 14:44:21 -05:00
IgorA100
d162e5efe2 In "src," use '_CameraDirectPrimary' instead of '_0' in "createGo2rtcStream" (skin.js).
Otherwise, we'll be able to get the stream.
2026-02-27 22:11:13 +03:00
IgorA100
39079b2a24 The z-index for "svg.zones" cannot exceed the index value for ".zonePoint" (skin.css) 2026-02-27 17:07:44 +03:00
IgorA100
e53d97bc9f For ".imageFeed svg.zones" apply z-index: 100 (skin.css)
On the Zones page, with the default player = go2rtc, a zone may not display due to the added <video-stream> tag
due to "position: relative"
And zones should always be above all other elements.
Possible fix #4648
2026-02-27 16:54:46 +03:00
Isaac Connor
99986eeed2 Merge branch 'master' of github.com:ZoneMinder/zoneminder 2026-02-26 19:16:54 -05:00
Isaac Connor
bf82278b6e feat: integrate EventStream into montagereview with zms recovery and fixes
- Integrate EventStream.js into montagereview.js for persistent MJPEG
  streaming in replay mode (speeds >= 1x), falling back to per-frame
  mode=single for speeds < 1x where zms lacks slow-motion support
- Add EventStream recovery logic: detect zms death via AJAX failures,
  img.onerror, and error responses; auto-restart with new connkey and
  exponential backoff (max 5 retries)
- Fix zms crash on bulk/interpolated frames: add stat() check in
  sendFrame() for SaveJPEGs & 1 path, fall through to ffmpeg_input
  when JPEG file doesn't exist on disk; send "No frame available"
  text frame instead of terminating when no source available
- Center monitor canvases: text-align in CSS for scale mode,
  horizontal offset calculation in maxfit2() for fit mode
- Reduce console noise: comment out high-frequency debug logs,
  convert error-path logs to console.warn/error
- Fix ESLint sourceType to "script" for traditional non-module JS
  files, resolving false-positive no-unused-vars on global functions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 19:14:06 -05:00
IgorA100
f23098fa6a Fix: Check the "players" variable (MonitorStream.js).
After adding the "players" variable, the "players is not defined" issue appears on various pages.

There's currently an error on the Zones page.
Yes, ideally, the variable should be added in *.js.php files on various pages.
The absence of the variable has no significant impact, other than incomplete display of information.
The current error disrupts all JavaScript.
This PR prevents the disruption of all JavaScript code on the page.
2026-02-26 22:49:20 +03:00
Isaac Connor
a12d9749eb fix: use DOM img element and rAF loop for MJPEG stream reception
A detached Image() object does not reliably decode multipart MJPEG
streams — browsers only update a DOM-attached <img> with each frame
from a multipart/x-mixed-replace response. Switch to creating a
hidden DOM <img> element and use requestAnimationFrame to copy
decoded frames to the canvas.

Also properly clean up the img element from the DOM in stop() and
switchEvent(), and guard drawFrame() against drawing before the
first frame has been decoded.

Tested: start, pause, play, seek, setRate, stop all verified
working against a live zms event stream.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 14:47:39 -05:00
Isaac Connor
c26b94d195 Merge pull request #4649 from IgorA100/patch-287120
Fix: Assign toggleZones listener only after Event page loads
2026-02-26 14:12:14 -05:00
Isaac Connor
516ff419a5 feat: add EventStream.js for persistent MJPEG event playback
Introduce EventStream constructor that manages a persistent zms MJPEG
connection for event playback, replacing the per-frame mode=single HTTP
request pattern. Frames arrive via a hidden Image element and are drawn
to a caller-supplied canvas on each onload.

Supports seek, pause, play, rate control, scale changes, and event
switching via the existing zms command-socket protocol. Follows the
same constructor-function pattern as MonitorStream.js.

Include the script in montagereview.php for upcoming integration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 14:09:59 -05:00
Isaac Connor
b036408a5b Fix RCE vulnerability via API config edit privilege escalation
Add RBAC checks to ConfigsController edit() and delete() requiring
System=Edit permission, matching the pattern used by other controllers.
Harden System/Readonly column checks with !empty() to handle missing
columns gracefully. Fix command injection in Event.php by using
ZM_PATH_FFMPEG constant with escapeshellarg() instead of hardcoded
unsanitized ffmpeg call. Add is_executable() validation at all exec()
sites using ZM_PATH_FFMPEG as defense-in-depth against poisoned config
values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 13:51:30 -05:00
Isaac Connor
dfc7b54127 fix: store speed value instead of index in montagereview cookie
setCookie('speed', ...) was storing the speedIndex (array position)
but the PHP side reads the cookie and compares it against speed values
to find the matching index. Storing the index meant the value never
matched, so the slider always reset to the default 1x on reload.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 13:32:59 -05:00
Isaac Connor
ffe4858106 Merge branch 'master' of github.com:ZoneMinder/zoneminder 2026-02-26 13:16:56 -05:00
Isaac Connor
2b14e9044e fix: improve montage review playback smoothness and fix video seek overshoot
Fix FFmpeg initial seek overshooting to a future keyframe when the
requested timestamp falls between keyframes. After the initial
AVSEEK_FLAG_FRAME seek, detect if the returned frame is past the
target and re-seek backward to get the correct keyframe before it.

On the JS side, preserve fractional seconds throughout the playback
pipeline: remove Math.floor() truncation in mmove() and setSpeed(),
and use parseFloat instead of parseInt for currentTimeSecs
initialization. Reduce initial display interval from 1000ms to 100ms
for ~10fps refresh rate during review playback.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 13:16:07 -05:00
Isaac Connor
61b025b85f fix: calculate optimal thumbnail overlay scale from monitor dimensions
Add data-monitor-width and data-monitor-height attributes to thumbnail
img elements in console.php, events.php, watch.php, and monitor.php.
Use these to calculate the scale parameter as a ratio of overlay size to
monitor native resolution, clamped to 5-100%, instead of hardcoding
scale=75 (overlay) and scale=32 (fallback).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 12:16:56 -05:00
Isaac Connor
9ebf48da35 Add Create to canEdit 2026-02-26 07:22:31 -05:00
Isaac Connor
84728cec6d Add Create to canEdit 2026-02-26 07:21:13 -05:00
IgorA100
e5dc1c31bf Fix: Assign toggleZones listener only after Event page loads (event.js) 2026-02-24 23:31:35 +03:00
Isaac Connor
bc532627f7 fix: mobile layout for monitor and watch views
Fix monitor config view labels being pushed off-screen to the left on
mobile. The CSS specificity of the mobile override selector
(ul.form > li > label) was lower than the base rule
(ul.form > li > label:first-child), so margin-left: -300px was never
overridden on small screens. Match the :first-child pseudo-class in
the media query to fix.

Also add mobile responsive overrides for the watch view (which had
none), and change flex-nowrap to flex-md-nowrap so sidebar/PTZ stack
vertically on phones.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-24 09:57:44 -05:00
IgorA100
e19ca5de09 Merge branch 'ZoneMinder:master' into patch-885409 2026-02-24 13:41:29 +03:00
IgorA100
3aaa4758fe Merge branch 'ZoneMinder:master' into patch-129096 2026-02-24 13:40:36 +03:00
Isaac Connor
02684f85c8 Merge branch 'master' of github.com:ZoneMinder/zoneminder 2026-02-23 22:36:53 -05:00
Isaac Connor
c2ab47ae0d Don't audit log logins 2026-02-23 22:36:03 -05:00
IgorA100
2a66c47158 Use streamCmdPlay instead of monitorStream.start (watch.js)
This will correctly display the state of the #dvrControls buttons.
2026-02-23 18:19:20 -05:00
Isaac Connor
ec1b06f194 Add intel_gpu_top view 2026-02-23 18:19:20 -05:00
Isaac Connor
e6ace6fcf4 feat: add AUDIT logging level for tracking administrative changes
Add a new AUDIT logging level (-5) between PANIC (-4) and NOLOG (shifted
to -6) across C++, PHP, and Perl loggers. AUDIT entries use code 'AUD'
and syslog priority LOG_NOTICE. They record who changed what, from where,
for monitors, filters, users, config, roles, groups, zones, states,
servers, storage, events, snapshots, control caps, and login/logout.

AUDIT entries have their own retention period (ZM_LOG_AUDIT_DATABASE_LIMIT,
default 1 year) separate from regular log pruning. The log pruning in
zmstats.pl and zmaudit.pl now excludes AUDIT rows from regular pruning
and prunes them independently.

Critical safety: the C++ termination logic is changed from
'if (level <= FATAL)' to 'if (level == FATAL || level == PANIC)' to
prevent AUDIT-level log calls from killing the process.

Includes db migration zm_update-1.39.1.sql to shift any stored NOLOG
config values from -5 to -6.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-23 18:19:20 -05:00
Isaac Connor
c0016fa00b feat: store zone coordinates as percentages for resolution independence
Convert zone coordinates from absolute pixel values to percentages
(0.00-100.00) so zones automatically adapt when monitor resolution
changes. This eliminates the need to manually reconfigure zones after
resolution adjustments.

Changes:
- Add DB migration (zm_update-1.37.81.sql) to convert existing pixel
  coords to percentages, recalculate area, and update Units default
- Add Zone::ParsePercentagePolygon() in C++ to parse percentage coords
  and convert to pixels at runtime using monitor dimensions
- Backwards compat: C++ Zone::Load() checks Units column and uses old
  pixel parser for legacy 'Pixels' zones
- Update PHP coordsToPoints/mapCoords/getPolyArea for float coords,
  replace scanline area algorithm with shoelace formula
- Update JS zone editor to work in percentage coordinate space with
  SVG viewBox "0 0 100 100" and non-scaling-stroke for consistent
  line thickness
- Position zone SVG overlay inside imageFeed container via JS to align
  with image only (not status bar)
- Support array of zone IDs in Monitor::getStreamHTML zones option
- Update monitor resize handler: percentage coords don't need rescaling,
  only threshold pixel counts are adjusted
- Add 8 Catch2 unit tests for ParsePercentagePolygon

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-23 18:19:20 -05:00
Ben Dailey
1d56c5a8d9 feat: add pushState URL state management for events page filters
Update URL when filter changes so the filter state can be shared via URL
and browser back/forward navigation restores previous filter states.

- Add buildFilterQuery() helper to construct filter query string
- Add history.replaceState() on page load for initial state
- Add history.pushState() in filterEvents() when filters change
- Add popstate event listener to restore filter state on back/forward
- Refactor filterEvents() to accept options parameter for skipPushState

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-23 18:16:56 -05:00
IgorA100
520145991b Exit the getTracksFromStream function if it could not determine the Monitor.ID from the passed stream (skin.js) 2026-02-23 18:16:56 -05:00
IgorA100
af0733505a Moved getTracksFromStream from MonitorStream.js (skin.js) 2026-02-23 18:16:56 -05:00
IgorA100
6c9e5e644b Added getTracksFromStream function for Go2RTC (video-stream.js) 2026-02-23 18:16:56 -05:00
IgorA100
72f0bee2d7 Moved the getTracksFromStream functions to sfin.js, as this will allow you to retrieve tracks from recorded events. (MonitorStream.js)
Also: If any error occurs during execution of "appendMseBuffer" (not just 'QuotaExceededError'), restart the thread
2026-02-23 18:16:56 -05:00
dependabot[bot]
f8fb93d784 build(deps): bump firebase/php-jwt from 6.0.0 to 7.0.0 in /web
Bumps [firebase/php-jwt](https://github.com/firebase/php-jwt) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/firebase/php-jwt/releases)
- [Changelog](https://github.com/firebase/php-jwt/blob/main/CHANGELOG.md)
- [Commits](https://github.com/firebase/php-jwt/compare/v6.0.0...v7.0.0)

---
updated-dependencies:
- dependency-name: firebase/php-jwt
  dependency-version: 7.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-02-23 18:16:55 -05:00
Isaac Connor
3e5acbea02 fix: guard against null evtStream element in restartZmsStream
document.getElementById('evtStream') can return null if the element
was removed from the DOM during event navigation or deletion, causing
a TypeError when accessing .src on the result.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-23 18:16:55 -05:00