0 Fork 0

mirror of https://github.com/ZoneMinder/zoneminder.git synced 2026-11-06 04:33:05 -05:00

Files

T

Nic BoetandClaude Opus 5.5 7fffa186f6 fix(api): check monitor filter fields, qualify them with the model

MonitorsController::index() passed its named parameters to
FilterComponent::buildFilter() without a field list, so any name made
of letters, digits and dots reached MySQL as a column:

  GET /api/monitors/index/Nope:1.json   -> 500, PDOException 42S22

and the bare names Id and Name, which the joined Manufacturers and
Models tables have too, failed as ambiguous columns (also 500).

FilterComponent::qualifyFields() checks each field against the columns
of the queried model and of the models find() joins, and writes it
Model.Field: a bare field is a Monitors column. GroupId stays bare for
the Groups_Monitors join. Anything else is a 400 "Unknown filter field",
as events/index answers since 028ccecb5. Column names match without
regard to case and are written as the schema spells them.

The web UI's map (Deleted:0) keeps working;
Name:x, Id >:0, Name LIKE:x and Id IN:1,2 now return monitors instead
of a 500.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-01 11:31:26 -05:00