mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-10-28 17:28:33 -04:00
Nic Boet
9ee0e91819
ZM_OPT_USE_AUTH shipped as 0, so a new install accepted every request as the default user with System=Edit. That includes requests a browser sends on behalf of any web page a user on the same network opens, so a server that is never exposed to the internet could still be driven from it. Default it to 1. zm_create.sql (generated from ConfigData) gives new installs authentication on. Existing installs keep their value: zmupdate.pl -f loads Value from the database and writes it back, and only DefaultValue changes. zm_update-1.39.41.sql also sets DefaultValue to 1 for the row, so that an upgrade run without -f doesn't leave Value = DefaultValue = 0, which the C++ config loader would skip in favour of its compiled-in default (on) while the web UI read off. Update the option help and the user guide (getting started, FAQ, system options) to say authentication is on for new installs and kept on upgrade. tests/perl/test_auth_default.pl checks the default, the stored value and that no update script sets the row's Value; tests/zm_config.cpp now expects the compiled-in default (opt_use_auth) to be on.