Nic Boet 46ccb7529f fix: without a token secret, zmu still gets an API request's own password ...

When ZM_AUTH_HASH_SECRET is unusable zmu refuses tokens, so
zmuCredentials() falls back to what zmu got before. With
ZM_AUTH_RELAY=plain the API's alarm action used to pass the password
from the request (pass= or password=); the fallback read only the
session, which an API call without a stateful login doesn't have, so
zmu refused the call (rc 255). zmuCredentials() takes the caller's
password first again. With a usable secret it is never used.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 5ca19c2703ea9211fe040991305ce9b0a873faff)

2026-10-30 19:30:28 -04:00

..

event_sort_test.php

…

test_allowed_commands.php

…

test_api_request_field.php

…

test_api_user_self_edit.php

…

test_assignment_precedence.php

…

test_auth_hash_candidate_addrs.php

…

test_auth_hash_compare.php

…

test_auth_no_include_side_effects.php

…

test_auth_relay_encoding.php

…

test_auth_request_string.php

…

test_bandwidth_clamp.php

…

test_config_file_booleans.php

…

test_config_value_filter.php

…

test_control_command.php

…

test_cron_modal.php

…

test_crontab.php

…

test_database_emulated_prepares.php

…

test_database_error_paths.php

…

test_database_lazy_connect.php

…

test_default_password.php

…

test_download_content_disposition.php

…

test_event_writes_require_events_edit.php

fix: change or delete only events on monitors the user can view

2026-10-30 18:10:30 -04:00

test_export_dir_permissions.php

…

test_filter_canedit_autoexecute.php

…

test_filter_canview.php

…

test_filter_limit_sqli.php

…

test_filter_term_date_range.php

…

test_first_run.php

…

test_http_range.php

…

test_local_redirect_url.php

…

test_logger_calls_qualified.php

…

test_login_message.php

…

test_monitor_actions_columns.php

…

test_monitor_alarm_cause.php

…

test_monitor_status_filter.php

…

test_object_save_error.php

…

test_recaptcha_allows_login.php

…

test_remote_addr.php

…

test_remote_control_url.php

…

test_request_ids_scalar.php

…

test_settings_action_requires_control_edit.php

fix(web): require Control edit for camera settings, store only what zmu set

2026-10-30 18:10:07 -04:00

test_snapshot_create_requires_snapshots_edit.php

fix: require Snapshots edit to create a snapshot

2026-10-30 18:11:04 -04:00

test_stream_error_reason.php

…

test_tmpfiles_conf.php

…

test_user_permissions.php

…

test_validate_user_compare.php

…

test_web_option_wiring.php

…

test_zmu_credentials.php

fix: without a token secret, zmu still gets an API request's own password

2026-10-30 19:30:28 -04:00