mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-02 10:44:30 -05:00
Nic BoetandClaude Opus 5.5
5c69921e18
The network probe logged the camera password it was about to try and camera URLs with user:password@ (monitor_probe.php), saving a monitor dumped the changed fields with Pass, ONVIF_Password and the Path and ControlAddress credentials (actions/monitor.php), the ONVIF probe logged the failing zmonvif-probe command line, password included, at Error level, which reaches the Logs table by default (onvifprobe.php), the CSV camera import logged each URL at Info level (add_monitors.php), and the image proxy logged its Digest Authorization header and the camera URL (views/image.php). Log user names without passwords, URLs through urlForLog() and dumps through redactForLog(). removeUserinfo(), used by both, now also strips a ControlAddress's scheme-less user:password@host, and ends the userinfo at the last @ before the path: a camera password with a raw @ in it works with cameras and ffmpeg, and its tail was left in the log. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>