Isaac Connor 00c20c7958 fix: align auth hash validation with generation and warn on user mismatch ...

- AppController.php: stop overwriting $_SESSION['remoteAddr'] with bare
  REMOTE_ADDR right after zm_session_start() already populated it from
  HTTP_X_FORWARDED_FOR. The clobber bound generated hashes to the proxy
  IP, but getAuthUser() validates against XFF, so any hash produced
  inside the legacy stateful API path was DOA behind a reverse proxy.
- getAuthUser(): prefer the URL user= parameter over
  \$_SESSION['username'] for filtering, matching what zms's
  zmLoadAuthUser does, and honor ZM_CASE_INSENSITIVE_USERNAMES on the
  primary filter. Warn when the URL user= disagrees with the session
  username (stale hash, cross-tab contamination, or tampered request).
- Add a Debug input dump on entry and an Info-level failure line that
  reports filterUser, XFF, REMOTE_ADDR, rowsTried and the TTL window so
  the next 401 surfaces which input is wrong.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-24 07:58:04 -04:00

..

actions

fix: sanitize monitor Device path to prevent command injection (GHSA-g66m-77fq-79v9)

2026-05-23 19:34:05 -04:00

csrf

Until we use "use strict", additional code analysis is required (csrf-magic.js)

2025-08-09 18:54:45 +03:00

auth.php

fix: align auth hash validation with generation and warn on user mismatch

2026-05-24 07:58:04 -04:00

config.php.in

Remove zm_configvals. Just use zm_config. Move code into loadConfig.

2026-01-05 09:32:25 -05:00

control_functions.php

Remove extra { breaking ptz

2022-04-23 19:29:04 -04:00

Control.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

database.php

Merge dbUpdate and dbInsert from another branch

2024-11-18 10:47:07 -05:00

download_functions.php

fix: close SQL injection, command injection, and shell escaping gaps

2026-05-23 19:34:05 -04:00

Event_Data.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Event_Tag.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Event.php

fix: include username in auth relay and fix stale auth in stream restart

2026-05-24 07:51:06 -04:00

Filter.php

Remove Preview Rate Control. Disable BuiltIn Video controls.

2026-01-29 11:18:30 -05:00

FilterTerm.php

fix: close SQL injection, command injection, and shell escaping gaps

2026-05-23 19:34:05 -04:00

Frame.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

functions.php

fix: close SQL injection, command injection, and shell escaping gaps

2026-05-23 19:34:05 -04:00

Group_Monitor.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Group_Permission.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Group.php

Remove session usage for monitor filters, use cookies only

2026-01-07 18:23:47 +00:00

lang.php

Convert user from an array to a User object

2023-04-23 12:57:29 -04:00

logger.php

Enforce max length of 64k for log entries. Use HTTP_X_FORWARDED_FOR in logging so we log actual remote addr

2023-11-16 10:34:44 -05:00

Manufacturer.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Model.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Monitor_Permission.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

monitor_probe.php

fix: escape URL in wget() to prevent command injection in camera probe (GHSA-745h-vg7c-73cg)

2026-05-23 19:34:05 -04:00

Monitor.php

fix: include username in auth relay and fix stale auth in stream restart

2026-05-24 07:51:06 -04:00

MontageLayout.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Object.php

Add support for the string NULL is object lookup values

2026-01-30 08:33:49 -05:00

Report.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Role_Group_Permission.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

Role_Monitor_Permission.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

Server.php

Update Server.php

2026-01-31 21:01:00 -05:00

session.php

fix: use HTTP_X_FORWARDED_FOR in auth hash validation to fix AUTH_HASH_IPS with reverse proxy

2026-05-24 07:58:04 -04:00

Snapshot.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Storage.php

Use the same filter on Storage Name as we use in Monitor Name.

2024-09-30 06:33:09 -04:00

Tag.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

User_Preference.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

User_Role.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

User.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

Zone.php

Include Monitor.php

2024-01-28 16:52:16 -05:00