Isaac Connor 21f88bfcee fix: stop image proxy following redirects past the SSRF guard refs GHSA-v2qc-p8cq-g4pc ...

The proxy= handler in web/views/image.php validates the resolved address
of the URL host against FILTER_FLAG_NO_RES_RANGE, then fetches with
fopen() using PHP's default follow_location=1. A host that passes the
check could answer 302 to 127.0.0.1 (or ::1, 169.254.169.254) and the
stream wrapper would request it, returning the loopback content.

Set follow_location to 0 in the http stream context so a 3xx is not
followed. The same $opts is reused for the digest auth retry, so both
fetches are covered. Camera discovery has no need for redirects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit ec71edad630ff614eaae499146d33fd780449715)

2026-09-24 19:46:37 -04:00

..

archive.php

Allow snapshot downloading

2021-08-18 10:53:59 -04:00

download.php

fix: quote the download filename so Chrome doesn't save the export as index.php

2026-09-03 20:17:16 -04:00

image.php

fix: stop image proxy following redirects past the SSRF guard refs GHSA-v2qc-p8cq-g4pc

2026-09-24 19:46:37 -04:00

no_database_connection.php

remove debug hello

2021-10-14 17:56:16 -04:00

view_hls.php

Write "is not" instead of "has not" (view_hls.php)

2026-06-05 12:13:03 +03:00

view_video.php

fix: enforce per-event ACL on direct media endpoints (GHSA-vj5r-pc2v-gfwv)

2026-06-03 08:45:20 -04:00