mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-06 20:53:00 -05:00
Isaac ConnorandClaude Opus 4.8
6b5e6fb321
ControlsController only reads control definitions (index/view) — editing
them happens under Options, which requires System — but its beforeFilter
required System for the reads too. A client building a PTZ command fetches
the monitor's control definition from this API, and the web ui lets anyone
who can control a monitor (canView('Control')) do that, so a user with
Control permission but System=None could drive PTZ in the web ui yet got
401 from the API.
Allow the read for canView('System') or canView('Control'), matching
web/ajax/control.php. A user with neither is still refused.
Tested with the API on a scratch database: a Control=Edit, System=None user
got 401 on /api/controls and /api/controls/view/1 before and 200 after; a
Stream-only user with neither permission still gets 401.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>