mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-10-15 10:41:38 -04:00
Isaac ConnorandClaude Opus 5.5
768abdd5e3
The API alarm action and ajax/alarm.php checked no per-monitor permission and relied on zmu, which only requires that the user can see the monitor. A user with view on a monitor could force, cancel or disable its alarms. Changing alarm state now needs Monitor::canEdit(), and the API status query needs canView(). Monitors API edit and add also pin the record id, so an Id in the body cannot redirect the save to another monitor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
33 lines
948 B
PHP
33 lines
948 B
PHP
<?php
|
|
define('MSG_TIMEOUT', 2.0);
|
|
define('MSG_DATA_SIZE', 4+256);
|
|
|
|
require_once('includes/Monitor.php');
|
|
$monitor = new ZM\Monitor(validCardinal($_REQUEST['id']));
|
|
|
|
// Needs edit on this monitor, not only the global Monitors permission.
|
|
if ( $monitor->Id() and $monitor->canEdit() ) {
|
|
$zmuCommand = getZmuCommand(' -m '.$monitor->Id());
|
|
|
|
switch ( validJsStr($_REQUEST['command']) ) {
|
|
case 'disableAlarms' :
|
|
$zmuCommand .= ' -n';
|
|
break;
|
|
case 'enableAlarms' :
|
|
$zmuCommand .= ' -c';
|
|
break;
|
|
case 'forceAlarm' :
|
|
$zmuCommand .= ' -a';
|
|
break;
|
|
case 'cancelForcedAlarm' :
|
|
$zmuCommand .= ' -c';
|
|
break;
|
|
default :
|
|
ajaxError("Unexpected command '".validJsStr($_REQUEST['command'])."'");
|
|
}
|
|
ajaxResponse(exec(escapeshellcmd($zmuCommand)));
|
|
} else {
|
|
ajaxError('Insufficient permissions');
|
|
}
|
|
?>
|