mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-03 03:04:29 -05:00
Isaac ConnorandClaude Opus 5.5
c3d2e542bc
ZM_Object's constructor treats an array as the object's row, and validInt() and validCardinal() returned an array as they got it (preg_replace() does). So wherever a request id reached `new ZM\X(...)`, raw or through those validators, a crafted array built an object whose Id, UserId or MonitorId the sender chose. The permission check then looked at those, and the delete or update that followed used the Id. A user with Events=View deleted another user's filter by posting Id[Id]=<filter>&Id[UserId]=<self> to the filter delete action; the same shape reached events (MonitorId), users, reports, snapshots and storage. validInt() and validCardinal() now give '' for anything that isn't a single value. The places that built an object from a raw $_REQUEST value (the control and event ajax handlers, the event, filter, report, snapshot and storage actions, view_hls, and the download and event detail modals) take the id through validCardinal(). tests/php/test_request_ids_scalar.php covers the validators with arrays and fails if web code builds an object straight from $_REQUEST, $_GET or $_POST. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
56 lines
1.7 KiB
PHP
56 lines
1.7 KiB
PHP
<?php
|
|
//
|
|
// ZoneMinder web action file
|
|
// Copyright (C) 2019 ZoneMinder LLC
|
|
//
|
|
// This program is free software; you can redistribute it and/or
|
|
// modify it under the terms of the GNU General Public License
|
|
// as published by the Free Software Foundation; either version 2
|
|
// of the License, or (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with this program; if not, write to the Free Software
|
|
// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
//
|
|
|
|
require_once('includes/Report.php');
|
|
if (!empty($_REQUEST['id'])) {
|
|
$report = new ZM\Report(validCardinal($_REQUEST['id']));
|
|
} else {
|
|
$report = new ZM\Report();
|
|
}
|
|
global $redirect;
|
|
global $error_message;
|
|
|
|
if ($report->Id() and !$report->canEdit()) {
|
|
ZM\Warning('You do not have permission to edit report '.$report->Id());
|
|
$redirect = '?view=reports';
|
|
return;
|
|
}
|
|
|
|
if ($action == 'save') {
|
|
$changes = $report->changes($_REQUEST['Report']);
|
|
if (!$report->Id()) {
|
|
$changes['CreatedBy'] = $user->Id();
|
|
}
|
|
|
|
if (count($changes)) {
|
|
if (!$report->save($changes)) {
|
|
$error_message .= "Error saving report: " . $report->get_last_error().'</br>';
|
|
} else {
|
|
$redirect = '?view=report&id='.$report->Id();
|
|
}
|
|
}
|
|
} else if ($action == 'delete') {
|
|
$report->delete();
|
|
$redirect = '?view=reports';
|
|
} else {
|
|
ZM\Error("Unknown action $action in saving Report");
|
|
}
|
|
?>
|