Claude
639bb6821e
Fix ONVIF password URL encoding in camera configuration
...
When adding cameras via ONVIF probe, passwords containing special
characters (like parentheses, slashes, etc.) were being stored in the
database in URL-encoded form instead of plain text. This caused
authentication failures when the encoded password was used.
The issue was in extract_auth_values_from_url() which extracted
credentials from the stream URI but didn't decode them. Since the ONVIF
probe process double-encodes passwords (to survive POST encoding), and
monitor.php decodes once, the extracted password still remained
URL-encoded.
The fix adds urldecode() to both username and password after extraction,
ensuring they're stored in their original form in the database.
Example: Password "pass)word" was being stored as "pass%29word"
2026-01-09 11:00:59 +11:00
Isaac Connor
6c2ad8d906
Use the same code for ImageStill and for ImageStream. Use ImageStream when mode == paused. Fixes #4491
2025-12-19 11:10:32 -05:00
Isaac Connor
cd2bd508ff
Test for is_object(user)
2025-10-23 15:09:11 -04:00
Isaac Connor
cc76c723d2
Handle objects as well as arrays in array_to_hash
2025-10-23 15:07:57 -04:00
Isaac Connor
fdfe87be38
Fixup deletePath. Handle links, and report failures. Fix escaping the filename and put it in quotes in case it has spaces. Fixes #4446
2025-10-03 16:11:55 -04:00
Isaac Connor
80e46948c1
Add blob for hls.js
2025-06-26 14:57:50 -04:00
Isaac Connor
9125b8e6f9
Add support for sorting by Notes. Warn when the sort_field is unsupported
2024-11-27 13:56:35 -05:00
Isaac Connor
3b379e99c0
Introduce detaintPathAllowAbsolute. Use it to protect against Path Traversal in files view. Fixes GHSA-8fw2-wh82-vv4h
2024-09-30 06:42:10 -04:00
Isaac Connor
c45a2af08b
Revert lack of src tag on event image
2024-09-05 09:18:41 -04:00
Isaac Connor
08d2f44613
Allow further query parameters after view in HomeView
2024-09-04 16:52:59 -04:00
Isaac Connor
b64461d518
Merge branch 'master' into only_stream_visible
2024-09-03 14:51:36 -04:00
Isaac Connor
f81d6fb823
Sanitise filter[Id]
2024-05-30 12:12:02 -04:00
Isaac Connor
b3c90c3216
Merge branch 'master' into only_stream_visible
2024-05-23 14:18:47 -04:00
Isaac Connor
c8d9cd02d7
Fix use of int as a function instead of a cast
2024-03-28 09:02:53 -04:00
Isaac Connor
b7bc7cef7e
Only load non deleted Monitors
2024-01-28 16:52:36 -05:00
Isaac Connor
c138984fc9
XSS prevent on sort_asc and eid. Still need to protect filter
2024-01-25 18:48:39 -05:00
Isaac Connor
63def6b82e
Add a function to_string that handles nulls, arrays, etc
2024-01-11 10:30:36 -05:00
Isaac Connor
2cc47557df
Remove bogus adding RTSP2WEB to CSP and CORS
2024-01-02 16:44:05 -05:00
Isaac Connor
f064887451
Add ZM_RTSP2WEB_PATH to CSP_Headers
2024-01-02 16:25:28 -05:00
Isaac Connor
f9b82ca037
Always append username to zmu command line so that auth is more efficient
2023-12-12 11:14:29 -05:00
Isaac Connor
afb594aa19
Don't load Servers, they are loaded globally in config. Enforce int instead of string for range because fseek can't handle strings
2023-11-16 10:34:44 -05:00
Isaac Connor
2d46fc350a
Spacing, test for setting of ZM_PATH_IP
2023-09-29 12:07:50 -04:00
Isaac Connor
7060945e97
Use new ZM_PATH_IP and ZM_PATH_IFCONFIG instead of hard coded paths. Fixes #3670
2023-09-28 13:32:42 -04:00
Isaac Connor
45bcb13045
Add backtrace to errors in json
2023-09-25 16:32:20 -04:00
Charlie Root
c4302c27ac
Add code to test for existence of ip and support ifconfig
2023-09-13 10:14:21 -07:00
Isaac Connor
b7ed7a4bd8
in detaintPath also strip :// because php:// is a way to inject code
2023-09-11 12:34:31 -04:00
Isaac Connor
bc4d625ca4
Add systemd_isactive
2023-05-30 20:47:05 -04:00
Isaac Connor
969baa3891
Convert user from an array to a User object
2023-04-23 12:57:29 -04:00
Isaac Connor
593c7ac902
Handle HomeView not being set, and default it so that it is set
2023-03-24 12:53:49 -04:00
Isaac Connor
01ba5f59f9
Use dirname(__FILE__) instead of DOCUMENT_ROOT. Apparently many people have something wrong in DOCUMENT_ROOT. I don't understand it, but it seems like dirname(__FILE__) is a better solution anyways.
2023-03-21 18:22:53 -04:00
Isaac Connor
3e86454fc6
implement getHomeView function
2023-03-05 10:21:18 -05:00
Isaac Connor
6867b0c841
Correct the syntax of the CSP
2023-02-23 09:47:49 -05:00
Isaac Connor
d6dc1d3e30
Add object-src CSP directive
2023-02-20 18:15:16 -05:00
Isaac Connor
4f66ab3503
Introduce check_datetime function to validate dates
2023-02-20 11:53:53 -05:00
Isaac Connor
3268f95282
Fix detaintPath not stripping sequences like ..././
2023-02-20 09:18:51 -05:00
Isaac Connor
8ec5946791
Add backtrace to value not in values warning
2023-02-15 15:02:11 -05:00
Isaac Connor
d04b9891f1
Just do the symlink, there is a race between file_exists and symlink
2023-01-27 15:50:50 -05:00
Isaac Connor
cda2191f3e
Spacing, quotes, remove dead code
2023-01-03 13:57:14 -05:00
Isaac Connor
d7e95175b8
Fix html_input
2022-12-12 13:00:28 -05:00
Isaac Connor
ff756591c9
Rough in html_input
2022-12-07 12:34:59 -05:00
Isaac Connor
5bd50fe575
Add Access-Control-Allow-Credentials: true so that we can pass cookies along with xhr requests.
2022-11-01 08:21:59 -04:00
Isaac Connor
d11bb88f94
rough in array_to_hash_by_key function to generate hashes of Id => Object
2022-10-25 12:56:38 -04:00
Isaac Connor
2e03d91ef7
Fix selecting 0 values in htmlSelect. Fixes not showing ZM_LOG_DATABASE_LEVEL==Info
2022-10-21 16:29:26 -04:00
Isaac Connor
f1843528d0
Put back width and height setting on img tag. Needed for event viewing
2022-10-20 16:45:37 -04:00
Isaac Connor
d64868a44b
Fix downloads due to chunkSize not being defined
2022-10-11 16:45:03 -04:00
Isaac Connor
f8eef392d3
Add output_file to includes/functions.php
2022-10-11 16:45:03 -04:00
Isaac Connor
072e94385b
Make the ajaxError logging be debug level. If the error was actually critical, we will have to log that separately. Most of the errors reported by ajaxError are transient.
2022-10-05 09:31:39 -04:00
Isaac Connor
340ed19c71
Handle filter[query] not being defined
2022-09-29 14:29:36 -04:00
Isaac Connor
0b37df3782
Fix scroll to top on option help modals by not having an href=#. Fix css so that the ? still is blue.
2022-09-23 09:34:29 -04:00
Isaac Connor
7059e5a1ea
For mp4, use video tag, with videojs instead of embed
2022-09-06 15:41:42 -04:00
