mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-03 03:04:29 -05:00
Isaac ConnorandClaude Opus 5.5
7eb7dc4bff
actions/control.php and actions/eventdetail.php redirected to $_SERVER['HTTP_REFERER'] as is. That is the Referer of the POST itself, which normally comes from a ZoneMinder page, and the CSRF token keeps other sites from making the POST, so it isn't the open redirect the zone save had. But it is the same pattern, and a missing Referer warned about an undefined index and rendered the action's view instead of redirecting. Use localRedirectUrl() as the zone save does, falling back to the monitor's control view and to the events list. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
43 lines
1.6 KiB
PHP
43 lines
1.6 KiB
PHP
<?php
|
|
//
|
|
// ZoneMinder web action file
|
|
// Copyright (C) 2019 ZoneMinder LLC
|
|
//
|
|
// This program is free software; you can redistribute it and/or
|
|
// modify it under the terms of the GNU General Public License
|
|
// as published by the Free Software Foundation; either version 2
|
|
// of the License, or (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with this program; if not, write to the Free Software
|
|
// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
//
|
|
|
|
// Monitor control actions, require a monitor id and control view permissions for that monitor
|
|
if ( empty($_REQUEST['mid']) ) {
|
|
ZM\Warning('Settings requires a monitor id');
|
|
return;
|
|
}
|
|
if ( ! canView('Control', $_REQUEST['mid']) ) {
|
|
ZM\Warning('Settings requires the Control permission');
|
|
return;
|
|
}
|
|
|
|
require_once('includes/control_functions.php');
|
|
require_once('includes/Monitor.php');
|
|
$mid = validInt($_REQUEST['mid']);
|
|
if ( $action == 'control' ) {
|
|
$monitor = new ZM\Monitor($mid);
|
|
|
|
$ctrlCommand = buildControlCommand($monitor);
|
|
$monitor->sendControlCommand($ctrlCommand);
|
|
// Back to the page the command came from, if that is on this server.
|
|
$redirect = localRedirectUrl(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '', '?view=control&mid='.$mid);
|
|
}
|
|
?>
|