mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-06 04:33:05 -05:00
Nic BoetandClaude Opus 4.8
1d6dcff83b
ajax/stream.php sends stream commands (query, pause, seek, zoom, quit) to the zms whose unix socket matches a connkey, with no permission check. Connkeys are six random digits chosen when the stream starts, so any logged-in user who guessed or saw one could read the status of another user's stream, of a monitor they may not view included, and pause or end it. A second zms started with the same connkey also waited on the first one's lock and then took over its socket. zms already authenticates the user and checks their access to the monitor or event before it streams. Keep that user's id and put it in the lock, command socket and reply socket names (zms-<connkey>-<user id>s.sock); stream.php builds the names from the caller's own id through zmsSocketPath(), so a request reaches only the caller's streams. Without authentication the id is 0 on both sides. Adds a StreamBase test in tests/zm_stream.cpp and tests/php/test_zms_socket_path.php, which pin the same names. The existing command-socket-teardown test is updated for the owner-suffixed names (it postdates the reporter's base commit). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>