Isaac Connor 65bb4ad6dc fix: sanitize monitor Device path to prevent command injection (GHSA-g66m-77fq-79v9) ...

The Device field from the Monitors table was interpolated directly into
shell commands (qx(), backticks, exec()) without sanitization, allowing
authenticated users with monitor-edit permissions to execute arbitrary
commands as www-data via the Device Path field.

Defense in depth:
- Input validation: reject Device values not matching /^\/dev\/[\w\/.\-]+$/
  at save time in both web UI and REST API
- Output sanitization: use escapeshellarg() in PHP and quote validated
  values in Perl at every shell execution point

Affected locations:
- scripts/ZoneMinder/lib/ZoneMinder/Monitor.pm (control, zmcControl)
- scripts/zmpkg.pl.in (system startup)
- web/includes/Monitor.php (zmcControl)
- web/includes/functions.php (zmcStatus, zmcCheck, validDevicePath)
- web/includes/actions/monitor.php (save action)
- web/api/app/Model/Monitor.php (daemonControl, validation rules)
- web/api/app/Controller/MonitorsController.php (daemonStatus)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-05-23 19:34:05 -04:00

..

bandwidth.php

Use net zm_setcookie

2022-01-20 09:47:53 -05:00

console.php

Remove deprecated MonitorsIds. Replace it's use with looking for edit permission per monitor

2023-07-19 12:39:32 -04:00

control.php

fix save button in controlpreset modal

2020-10-02 16:10:32 -05:00

controlcap.php

Add error reporting when saving a control

2025-07-14 17:35:14 -07:00

controlcaps.php

Php namespace (#2537)

2019-02-22 09:19:07 -05:00

device.php

remove warnings used for testing

2020-10-03 07:08:04 -05:00

devices.php

Php namespace (#2537)

2019-02-22 09:19:07 -05:00

donate.php

Use new getHomeView function instead of view=console

2023-03-05 10:21:59 -05:00

event.php

Php namespace (#2537)

2019-02-22 09:19:07 -05:00

eventdetail.php

Add event Name to the event detail modal

2023-05-12 15:15:55 -04:00

events.php

Return Debug to a regular function to match other logging functions. Since we switched to using namespaces we no longer clash with cake_php.

2020-10-14 10:39:25 -04:00

files.php

Require path to be a defined storage area. Use detaintPath to prevent Path Traversal. Fixes GHSA-g355-3rf6-f38v

2024-10-21 17:40:01 -04:00

filter.php

fix: restore filter Name and UserId after save/reload

2026-02-13 12:33:46 -05:00

function.php

Fix saving from the function modal. Put action in the post variables and change the action to save instead of function.

2022-10-14 14:10:46 -04:00

group.php

Quiet warning about MonitorIds not exisitng in newGroup array when no MonitorIds are selected for that group

2024-01-23 16:14:21 -05:00

groups.php

Use net zm_setcookie

2022-01-20 09:48:02 -05:00

login.php

Use REQUEST instead of SESSION to store the post login redirect because we clear the session on login. Fixes #3517

2022-10-17 17:25:56 -04:00

logout.php

Convert user from an array to a User object

2023-04-23 12:57:29 -04:00

monitor.php

fix: sanitize monitor Device path to prevent command injection (GHSA-g66m-77fq-79v9)

2026-05-23 19:34:05 -04:00

monitors.php

If success when saving monitors, do a redirect so that a reload doesn't repeat the request and ask to resubmit data

2024-01-09 17:12:45 -05:00

montage.php

Santisize zmMontageLayout when passing to constructor

2024-05-21 09:22:55 -04:00

options.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

privacy.php

Use new getHomeView function instead of view=console

2023-03-05 10:21:59 -05:00

report.php

rough in major actions for reports

2022-08-04 09:11:24 -04:00

role.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

server.php

Code style clceanup in server action

2023-11-13 11:38:03 -05:00

settings.php

WHen saving v4l settings redirect back to watch instead of console.

2021-10-19 12:39:37 -04:00

snapshot.php

Convert user from an array to a User object

2023-04-23 12:57:29 -04:00

state.php

Fix typo in getHomeView

2023-10-23 16:49:34 -04:00

storage.php

Try to do something useful with error messages from SQL, but since storage isn't a real view, it won't be shown.

2024-09-30 06:34:15 -04:00

user.php

Only save permissions if passed in POST. We might not be able to see all monitors, so might not exist in POST.

2024-03-05 16:33:41 -05:00

version.php

add 1 month as an option to the version popup dropdown

2020-04-04 11:46:31 -04:00

zone.php

Use reload instead of restart on zone save

2023-02-16 14:10:30 -05:00

zones.php

FIx arrap_map to array_map. Don't assume _REQUEST[mids] exists. Fixes #3859

2024-03-10 10:59:56 -04:00