mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-07-27 05:16:46 -04:00
00c20c7958
- AppController.php: stop overwriting $_SESSION['remoteAddr'] with bare REMOTE_ADDR right after zm_session_start() already populated it from HTTP_X_FORWARDED_FOR. The clobber bound generated hashes to the proxy IP, but getAuthUser() validates against XFF, so any hash produced inside the legacy stateful API path was DOA behind a reverse proxy. - getAuthUser(): prefer the URL user= parameter over \$_SESSION['username'] for filtering, matching what zms's zmLoadAuthUser does, and honor ZM_CASE_INSENSITIVE_USERNAMES on the primary filter. Warn when the URL user= disagrees with the session username (stale hash, cross-tab contamination, or tampered request). - Add a Debug input dump on entry and an Info-level failure line that reports filterUser, XFF, REMOTE_ADDR, rowsTried and the TTL window so the next 401 surfaces which input is wrong. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ZoneMinder API
This is the ZoneMinder API. It should be, for now, installed under the webroot e.g. /api.
app/Config/database.php.default must be configured and copied to app/Config/database.php
In addition, Security.salt and Security.cipherSeed in app/Config/core.php should be changed.
The API can run on a dedicated / separate instance, so long as it can access the database as configured in app/Config/database.php