mirror/zoneminder

0 Fork 0

mirror of https://github.com/ZoneMinder/zoneminder.git synced 2026-10-03 07:55:22 -04:00

Files

T

History

Isaac Connor 21f88bfcee fix: stop image proxy following redirects past the SSRF guard refs GHSA-v2qc-p8cq-g4pc

The proxy= handler in web/views/image.php validates the resolved address
of the URL host against FILTER_FLAG_NO_RES_RANGE, then fetches with
fopen() using PHP's default follow_location=1. A host that passes the
check could answer 302 to 127.0.0.1 (or ::1, 169.254.169.254) and the
stream wrapper would request it, returning the loopback content.

Set follow_location to 0 in the http stream context so a 3xx is not
followed. The same $opts is reused for the digest auth retry, so both
fetches are covered. Camera discovery has no need for redirects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit ec71edad630ff614eaae499146d33fd780449715)

2026-09-24 19:46:37 -04:00

..

feat: measure the audio level on demand, with a meter in the editor

2026-09-20 18:17:44 -05:00

fix: issue the API token to the account that authenticated

2026-09-24 19:44:16 -04:00

old overlay code is no longer used

2021-01-11 13:46:50 -05:00

Update material icons to v1.11.10

2022-08-19 13:33:22 -04:00

…

fix: escape filter[query] in sortHeader() column links refs GHSA-626g-6988-pv4p

2026-09-24 19:45:15 -04:00

feat: measure the audio level on demand, with a meter in the editor

2026-09-20 18:17:44 -05:00

feat: measure the audio level on demand, with a meter in the editor

2026-09-20 18:17:44 -05:00

feat: measure the audio level on demand, with a meter in the editor

2026-09-20 18:17:44 -05:00

feat(): Custom snapp.ogg sound for ZoneMinder

2024-03-02 10:15:44 -05:00

Replace MySQL Password() with bcrypt, allow for alternate JWT tokens (#2598 )

2019-05-24 13:48:40 -04:00

fix: stop image proxy following redirects past the SSRF guard refs GHSA-v2qc-p8cq-g4pc

2026-09-24 19:46:37 -04:00

.editorconfig

…

.gitignore

Replace MySQL Password() with bcrypt, allow for alternate JWT tokens (#2598 )

2019-05-24 13:48:40 -04:00

.travis.yml

…

CMakeLists.txt

Install the web/sounds directory

2025-03-03 13:49:14 -05:00

composer.json

build(deps): bump firebase/php-jwt from 6.0.0 to 7.0.0 in /web

2026-02-23 18:16:55 -05:00

composer.lock

build(deps): bump firebase/php-jwt from 6.0.0 to 7.0.0 in /web

2026-02-23 18:16:55 -05:00

index.php

Make actions can ono longer be performed with POST a debug

2026-08-28 22:31:29 -04:00

README.md

…

robots.txt

…

README.md

Modern ZoneMinder Skin

This web frontend to ZoneMinder is a complete rewrite of the classic frontend, based on CakePHP.