Isaac Connor 911362d873 fix: escape filter[query] in sortHeader() column links refs GHSA-626g-6988-pv4p ...

sortHeader() concatenated $_REQUEST['filter']['query'] into the href of
every export view column header without escaping, allowing reflected
HTML injection (iframe, meta refresh, style) via a crafted link. Pass it
through validHtmlStr() like the other request values in the same string
are passed through validInt()/validCardinal().

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 7517018879f2be9ba1f9439e3364686ccee226ed)

2026-09-24 19:45:15 -04:00

..

actions

feat: add per-monitor actions that drive a light or a speaker on alarm

2026-09-11 20:13:02 -05:00

csrf

Until we use "use strict", additional code analysis is required (csrf-magic.js)

2025-08-09 18:54:45 +03:00

auth.php

fix: treat a request parameter that is not a string as absent in auth

2026-09-24 19:44:16 -04:00

config.php.in

refactor: connect to the database on first use, not on include

2026-08-17 20:52:10 -04:00

control_functions.php

feat: add audio playback control capability and an ONVIF IP speaker module

2026-09-11 20:13:02 -05:00

Control.php

feat: add audio playback control capability and an ONVIF IP speaker module

2026-09-11 20:13:02 -05:00

database.php

refactor: connect to the database on first use, not on include

2026-08-17 20:52:10 -04:00

download_functions.php

fix: quote the download filename so Chrome doesn't save the export as index.php

2026-09-03 20:17:16 -04:00

EncoderTemplates.php

feat: encoder parameter templates with editor + REST API closes #4778 closes #4802

2026-05-06 17:24:17 -04:00

Event_Data.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Event_Tag.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Event.php

refactor: connect to the database on first use, not on include

2026-08-17 20:52:10 -04:00

Filter.php

fix: close the filter terms table markup refs #5147

2026-09-18 19:04:04 -04:00

FilterTerm.php

fix: rotate logs on SIGWINCH instead of SIGHUP fixes #5063

2026-08-22 15:30:46 -04:00

Frame.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

functions.php

fix: escape filter[query] in sortHeader() column links refs GHSA-626g-6988-pv4p

2026-09-24 19:45:15 -04:00

Group_Monitor.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Group_Permission.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Group.php

Remove session usage for monitor filters, use cookies only

2026-01-07 18:23:47 +00:00

lang.php

Potential fix for pull request finding

2026-05-10 15:25:50 -04:00

logger.php

refactor: connect to the database on first use, not on include

2026-08-17 20:52:10 -04:00

Manufacturer.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

MenuItem.php

feat: customizable menu entries with links, icons and delete on options menu tab

2026-06-27 12:13:49 -04:00

Model.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Monitor_Permission.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

monitor_probe.php

Now we don't need to return "$monitor->Id()" because we can get Monitor.Id after Id has become public. (monitor_probe.php)

2026-05-29 16:27:15 +03:00

Monitor.php

Merge pull request #5143 from SteveGilvarry/feature/stream-socket-events

2026-09-23 18:17:50 -04:00

MonitorAction.php

feat: add per-monitor actions that drive a light or a speaker on alarm

2026-09-11 20:13:02 -05:00

MontageLayout.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Network.php

fix: keep an auth hash valid when the client address changes refs #4921

2026-08-17 20:52:10 -04:00

Object.php

feat: customizable menu entries with links, icons and delete on options menu tab

2026-06-27 12:13:49 -04:00

Report.php

Merge branch 'master' into patch-380634

2026-05-06 10:47:45 +03:00

Role_Group_Permission.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

Role_Monitor_Permission.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

Server.php

fix: match single-server ServerId=0 in Server::ReadStats

2026-07-27 08:12:51 -04:00

session.php

fix: only store sessions for clients that carry them

2026-08-25 17:36:31 -04:00

Snapshot.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Storage.php

Use the same filter on Storage Name as we use in Monitor Name.

2024-09-30 06:33:09 -04:00

Tag.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

TagOrder.php

fix(db): make User_Preferences unique per (UserId, Name) refs #5021

2026-08-08 11:33:29 -04:00

User_Preference.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

User_Role.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

User.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

Zone.php

fix: escape Zone, Event and Server names on output

2026-07-19 12:39:35 -04:00