Isaac Connor 0ad172d989 Merge pull request #5387 from connortechnology/fix/ghsa-qrhf-login-token ...

fix: refuse host/login with both a password and a token (GHSA-qrhf)

2026-10-31 10:59:17 -04:00

..

Component

…

AppController.php

fix: a stateful API request gets a new session id whenever the session takes on a user

2026-10-31 09:04:37 -04:00

CameraModelsController.php

…

ConfigsController.php

fix: stop the Config API leaking secret values refs GHSA-8g63-hqg8-82cv

2026-10-28 19:20:54 -04:00

ControlsController.php

fix: let users who can control a monitor read the Controls API

2026-10-16 21:07:45 -04:00

EncoderTemplatesController.php

…

EventDataController.php

…

EventsController.php

…

FramesController.php

…

GroupsController.php

…

HostController.php

fix: refuse host/login with both a password and a token

2026-10-31 10:46:05 -04:00

LogsController.php

…

ManufacturersController.php

…

MonitorsController.php

fix: without a token secret, zmu still gets an API request's own password

2026-10-30 19:30:28 -04:00

NotificationsController.php

…

PagesController.php

…

RolesController.php

…

ServersController.php

…

ServerStatsController.php

…

SnapshotsController.php

…

StatesController.php

fix: make StatesController::packageControl protected so it can't be called directly

2026-10-23 22:29:38 -04:00

StorageController.php

…

TagsController.php

…

UserPreferenceController.php

…

UsersController.php

fix: honour ZM_USER_SELF_EDIT in the users API

2026-10-12 11:28:40 -05:00

ZonePresetsController.php

…

ZonesController.php

…