mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-02 18:54:28 -05:00
Isaac ConnorandClaude Opus 5.5
c3d2e542bc
ZM_Object's constructor treats an array as the object's row, and validInt() and validCardinal() returned an array as they got it (preg_replace() does). So wherever a request id reached `new ZM\X(...)`, raw or through those validators, a crafted array built an object whose Id, UserId or MonitorId the sender chose. The permission check then looked at those, and the delete or update that followed used the Id. A user with Events=View deleted another user's filter by posting Id[Id]=<filter>&Id[UserId]=<self> to the filter delete action; the same shape reached events (MonitorId), users, reports, snapshots and storage. validInt() and validCardinal() now give '' for anything that isn't a single value. The places that built an object from a raw $_REQUEST value (the control and event ajax handlers, the event, filter, report, snapshot and storage actions, view_hls, and the download and event detail modals) take the id through validCardinal(). tests/php/test_request_ids_scalar.php covers the validators with arrays and fails if web code builds an object straight from $_REQUEST, $_GET or $_POST. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
57 lines
2.2 KiB
PHP
57 lines
2.2 KiB
PHP
<?php
|
|
//
|
|
// ZoneMinder web action
|
|
// Copyright (C) 2019 ZoneMinder LLC
|
|
//
|
|
// This program is free software; you can redistribute it and/or
|
|
// modify it under the terms of the GNU General Public License
|
|
// as published by the Free Software Foundation; either version 2
|
|
// of the License, or (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with this program; if not, write to the Free Software
|
|
// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
//
|
|
|
|
// If there is an action on an event, then we must have an id.
|
|
if ( empty($_REQUEST['eid']) ) {
|
|
ZM\Warning('No eid in action on event view');
|
|
return;
|
|
}
|
|
|
|
// Event scope actions. Require edit on this event, which includes access to its monitor.
|
|
$event = new ZM\Event(validCardinal($_REQUEST['eid']));
|
|
if ( $event->Id() and $event->canEdit() ) {
|
|
$_REQUEST['eid'] = $event->Id();
|
|
|
|
if ( ($action == 'rename') && isset($_REQUEST['eventName']) ) {
|
|
dbQuery('UPDATE Events SET Name=? WHERE Id=?', array($_REQUEST['eventName'], $_REQUEST['eid']));
|
|
ZM\AuditAction('rename', 'event', $_REQUEST['eid'], 'Name: '.$_REQUEST['eventName']);
|
|
} else if ( $action == 'eventdetail' ) {
|
|
dbQuery('UPDATE Events SET Cause=?, Notes=? WHERE Id=?',
|
|
array(
|
|
$_REQUEST['newEvent']['Cause'],
|
|
$_REQUEST['newEvent']['Notes'],
|
|
$_REQUEST['eid']
|
|
)
|
|
);
|
|
ZM\AuditAction('update', 'event', $_REQUEST['eid'], 'Detail update');
|
|
$refreshParent = true;
|
|
$closePopup = true;
|
|
} else if ( $action == 'archive' ) {
|
|
dbQuery('UPDATE Events SET Archived=? WHERE Id=?', array(1, $_REQUEST['eid']));
|
|
} else if ( $action == 'unarchive' ) {
|
|
dbQuery('UPDATE Events SET Archived=? WHERE Id=?', array(0, $_REQUEST['eid']));
|
|
} else if ( $action == 'delete' ) {
|
|
deleteEvent($_REQUEST['eid']);
|
|
ZM\AuditAction('delete', 'event', $_REQUEST['eid'], '');
|
|
$refreshParent = true;
|
|
}
|
|
} // end if event canEdit
|
|
?>
|