mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-08-03 00:37:21 -04:00
3d5de347a4
The REST API archive action toggled an event's Archived (retention-protection) flag with no authorization beyond the controller's coarse "Events permission is not None" gate. Any authenticated read-only user, including one restricted to a subset of monitors, could flip the retention state of any event by enumerating event ids, and the action was reachable over GET (CSRF-able). Gate the write by direction: archiving (protects from purge) requires view access via Event::canView(); un-archiving (re-exposes to purge) requires edit access via Event::canEdit(). Both enforce the per-monitor object-level ACL. Restrict the action to POST/PUT to block CSRF. Addresses GHSA-5v9h-ww7p-hxgv. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ZoneMinder API
This is the ZoneMinder API. It should be, for now, installed under the webroot e.g. /api.
app/Config/database.php.default must be configured and copied to app/Config/database.php
In addition, Security.salt and Security.cipherSeed in app/Config/core.php should be changed.
The API can run on a dedicated / separate instance, so long as it can access the database as configured in app/Config/database.php