The snapshot action's create step had no permission check: any
logged-in user could POST view=snapshot&action=create and have the
server force an alarm (zmu -a) on any monitor id, record an event and
archive it, and add a Snapshots row. zmu itself only asks for Stream
view on a monitor it can access, so a stock viewer forced alarms; a
user without Stream still added Snapshots rows.
Create now needs Snapshots edit, uses only monitors the user can view,
and creates nothing when none is left. An unknown or non-numeric
monitor id used to call Error(), which is PHP's Error class, not a
function, and ended the request with a fatal error; it is now logged
with ZM\Error and skipped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 910961d744b26da577f393ec17ef084ddcb474a5)
Nic Boet
052efeb90d