Isaac ConnorandClaude Opus 5.5 dbd2cb231d fix: refuse cross-site image proxy requests by Sec-Fetch-Site ...

The CSRF token check on the image proxy only runs when ZM_ENABLE_CSRF_MAGIC
is on. Browsers that send Sec-Fetch-Site report when another site started a
request, so refuse proxy requests whose value is anything but same-origin or
none, whatever the CSRF setting. Browsers that do not send the header are
unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-25 07:56:03 -04:00

..

archive.php

Allow snapshot downloading

2021-08-18 10:53:59 -04:00

download.php

fix: quote the download filename so Chrome doesn't save the export as index.php

2026-09-03 20:17:16 -04:00

image.php

fix: refuse cross-site image proxy requests by Sec-Fetch-Site

2026-09-25 07:56:03 -04:00

no_database_connection.php

remove debug hello

2021-10-14 17:56:16 -04:00

view_hls.php

Write "is not" instead of "has not" (view_hls.php)

2026-06-05 12:13:03 +03:00

view_video.php

fix: enforce per-event ACL on direct media endpoints (GHSA-vj5r-pc2v-gfwv)

2026-06-03 08:45:20 -04:00