mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-10-12 23:03:52 -04:00
Isaac ConnorandClaude Opus 5.5
1677470af1
zmc runs a monitor's EventStartCommand and EventEndCommand at the start and end of each event. Both the classic save and bulk edit actions and the API monitor add and edit authorized only on the monitor, so a user with edit on one monitor and no System permission could set a command for zmc to run as the ZoneMinder service user. Changing either field now needs System=Edit, as Filter::canEdit() already requires for AutoExecuteCmd. Monitor::commandFieldChangesNotAllowed() reports the command fields a change would alter; submitting the current value is not a change, so other users can still save the rest of the monitor. The monitor form shows the fields read-only to them. Also close the EventEndCommand list item. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
64 lines
2.2 KiB
PHP
64 lines
2.2 KiB
PHP
<?php
|
|
//
|
|
// ZoneMinder web action file
|
|
// Copyright (C) 2019 ZoneMinder LLC
|
|
//
|
|
// This program is free software; you can redistribute it and/or
|
|
// modify it under the terms of the GNU General Public License
|
|
// as published by the Free Software Foundation; either version 2
|
|
// of the License, or (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with this program; if not, write to the Free Software
|
|
// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
//
|
|
|
|
// Monitor edit actions, monitor id derived, require edit permissions for that monitor
|
|
if (!canEdit('Monitors')) {
|
|
ZM\Warning("Monitor actions require Monitors Permissions");
|
|
return;
|
|
}
|
|
|
|
if ($action == 'save') {
|
|
global $error_message;
|
|
foreach ($_REQUEST['mids'] as $mid) {
|
|
$mid = ValidInt($mid);
|
|
if (!canEdit('Monitors', $mid)) {
|
|
ZM\Warning('Cannot edit monitor '.$mid);
|
|
continue;
|
|
}
|
|
$Monitor = new ZM\Monitor($mid);
|
|
// Before stopping it, so a refused save leaves the monitor running.
|
|
$refused = $Monitor->commandFieldChangesNotAllowed($_REQUEST['newMonitor']);
|
|
if (count($refused)) {
|
|
$error_message .= 'Changing '.implode(', ', $refused).' requires System edit permission.<br/>';
|
|
continue;
|
|
}
|
|
if ($Monitor->Type() != 'WebSite') {
|
|
$Monitor->zmcControl('stop');
|
|
}
|
|
if (!$Monitor->save($_REQUEST['newMonitor'])) {
|
|
$error_message .= 'Error saving monitor: ' . $Monitor->get_last_error().'<br/>';
|
|
} else {
|
|
ZM\AuditAction('update', 'monitor', $mid, 'Bulk update: '.implode(', ', array_keys($_REQUEST['newMonitor'])));
|
|
}
|
|
if ($Monitor->Capturing() != 'None' && $Monitor->Type() != 'WebSite') {
|
|
$Monitor->zmcControl('start');
|
|
}
|
|
} // end foreach mid
|
|
|
|
if ($error_message) {
|
|
$view = 'console';
|
|
} else {
|
|
$redirect = '?view=console';
|
|
}
|
|
} else {
|
|
ZM\Warning("Unknown action $action in Monitor");
|
|
} // end if action == Delete
|
|
?>
|