mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-08-03 00:37:21 -04:00
6b94903e63
validateToken() returns array(false, $errorMessage) when a token is invalid or its signature fails. The token branch in auth.php assigned $user = $ret[0] unconditionally, leaving $user as boolean false on failure. Because isset($false) is true in PHP, the ZM_OPT_USE_AUTH gate in index.php (!isset($user)) was skipped, allowing unauthenticated access via any malformed ?token= value. It also permitted an unauthenticated DoS: downstream $user->Username() on a bool fatals. Check !$ret[0] and unset($user) on failure, mirroring the existing validateUser branch, so $user stays undefined and the auth gate blocks the request. The API call sites already throw UnauthorizedException on !$user and are unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>