Isaac Connor 015931945b Merge pull request #5294 from nabbi/fix/auth-compare-hardening ...

fix-low: auth.php: compare hashes with hash_equals, encode the relay username, stricter reCAPTCHA check

2026-10-16 11:05:48 -04:00

..

event_sort_test.php

feat: add Filter::buildSortSql for directional event sort specs with integration test

2026-06-09 17:35:39 -04:00

test_api_request_field.php

fix: read API request fields the way Model::set() saves them refs GHSA-fp33-8fx5-4j6c

2026-10-10 13:36:01 -04:00

test_api_user_self_edit.php

fix: honour ZM_USER_SELF_EDIT in the users API

2026-10-12 11:28:40 -05:00

test_auth_hash_candidate_addrs.php

fix: keep an auth hash valid when the client address changes refs #4921

2026-08-17 20:52:10 -04:00

test_auth_hash_compare.php

fix: compare the auth hash with hash_equals() in getAuthUser()

2026-10-15 18:57:14 -05:00

test_auth_no_include_side_effects.php

test: detect calls nested in file-scope conditions

2026-08-17 20:52:10 -04:00

test_auth_relay_encoding.php

fix: URL-encode the username in the auth relay

2026-10-15 18:57:14 -05:00

test_auth_request_string.php

fix: treat a request parameter that is not a string as absent in auth

2026-09-24 19:44:16 -04:00

test_bandwidth_clamp.php

refactor: derive the ZM_WEB_ bandwidth aliases from the profile prefix

2026-08-29 14:01:25 -04:00

test_config_file_booleans.php

fix: read yes/no, true/false and on/off in config files as booleans in PHP and Perl

2026-10-15 22:37:07 -04:00

test_control_command.php

fix: bind the FOSCAMR2C preset and require Control permission for PTZ refs GHSA-qcm7-vq92-f86f

2026-10-08 18:21:32 -04:00

test_database_emulated_prepares.php

perf: emulate prepares for ZoneMinder's own queries on PHP 8.1+

2026-10-14 22:41:42 -05:00

test_database_error_paths.php

fix: log the database error when dbQuery's prepare or query returns false

2026-10-15 07:58:26 -04:00

test_database_lazy_connect.php

refactor: connect to the database on first use, not on include

2026-08-17 20:52:10 -04:00

test_download_content_disposition.php

fix: quote the download filename so Chrome doesn't save the export as index.php

2026-09-03 20:17:16 -04:00

test_export_dir_permissions.php

fix: keep the per-event export dir to the owner and off the flat path refs #5074

2026-09-01 07:50:15 +05:30

test_filter_canedit_autoexecute.php

fix: require System permission for filter AutoExecute and gate auto-actions in canEdit

2026-07-21 21:29:50 -04:00

test_filter_canview.php

fix: gate filterdebug modal on Filter::canView

2026-07-28 21:45:08 -04:00

test_filter_limit_sqli.php

fix: coerce Filter limit to int to prevent SQL injection

2026-07-28 21:27:47 -04:00

test_filter_term_date_range.php

fix: scope the frames list search to its event and match on FrameId refs #5164

2026-10-01 11:48:26 -04:00

test_http_range.php

fix: validate Range requests in view_video instead of trusting them refs #5174

2026-10-04 08:26:42 -05:00

test_local_redirect_url.php

fix: only redirect back to a zone's Referer when it is on this server

2026-10-11 11:16:14 -04:00

test_login_message.php

feat: add ZM_WEB_LOGIN_MESSAGE to show a notice on the login page

2026-08-05 22:08:23 -04:00

test_monitor_status_filter.php

feat: list deleted monitors from the console Status filter

2026-08-08 15:41:20 -04:00

test_object_save_error.php

fix: report a failed monitor delete instead of silently ignoring it fixes #4215

2026-08-30 01:37:45 +05:30

test_recaptcha_allows_login.php

fix: let a reCAPTCHA login through only on an explicit success

2026-10-15 18:57:14 -05:00

test_remote_addr.php

fix: only trust X-Forwarded-For from configured proxies for auth hash IPs

2026-09-24 19:51:27 -04:00

test_request_ids_scalar.php

fix: never build an object from an id the request sent as an array

2026-10-11 23:07:08 -04:00

test_stream_error_reason.php

fix: address the review comments on the stream error classification refs #5038

2026-08-07 21:06:58 -04:00

test_user_permissions.php

fix: give ZM\User real canView/canEdit/canCreate area checks refs GHSA-ff93-w6fm-vqxr

2026-10-08 18:14:17 -04:00

test_validate_user_compare.php

fix: compare stored plain and MySQL password hashes with hash_equals()

2026-10-15 18:57:14 -05:00

test_web_option_wiring.php

test: read the bandwidth options the way the skin now derives them

2026-09-08 02:56:06 +05:30