mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-06 20:53:00 -05:00
Isaac ConnorandClaude Opus 5.5
13138a0afc
actions/eventdetail.php checked only the global Events=Edit permission and then updated the Name, Cause and Notes of every id in markEids, so a user denied some monitors could rewrite those monitors' events. The event detail modal likewise showed the name, cause and notes of any event id it was given. Load each event and require $event->canEdit(), which adds the per-monitor view check, as archiving and unarchiving in actions/events.php already do. The action skips events that fail it; the modal leaves them out, and shows nothing for a single event that fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
56 lines
1.9 KiB
PHP
56 lines
1.9 KiB
PHP
<?php
|
|
//
|
|
// ZoneMinder web action file
|
|
// Copyright (C) 2019 ZoneMinder LLC
|
|
//
|
|
// This program is free software; you can redistribute it and/or
|
|
// modify it under the terms of the GNU General Public License
|
|
// as published by the Free Software Foundation; either version 2
|
|
// of the License, or (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with this program; if not, write to the Free Software
|
|
// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
//
|
|
|
|
if ( !isset($_REQUEST['markEids']) ) {
|
|
ZM\Warning('Events actions require eids');
|
|
return;
|
|
}
|
|
|
|
// Event scope actions, view permissions only required
|
|
if ( !canEdit('Events') ) {
|
|
ZM\Warning('Events actions require Edit permissions');
|
|
return;
|
|
} // end if ! canEdit(Events)
|
|
|
|
if ( $action == 'eventdetail' ) {
|
|
$dbConn->beginTransaction();
|
|
foreach ( $_REQUEST['markEids'] as $markEid ) {
|
|
// Events=Edit alone isn't enough: the event's monitor has to be one the user
|
|
// may see, as for archiving in actions/events.php.
|
|
$event = new ZM\Event(validInt($markEid));
|
|
if (!$event->Id() or !$event->canEdit()) {
|
|
ZM\Warning('No permission to edit event '.validInt($markEid));
|
|
continue;
|
|
}
|
|
dbQuery('UPDATE Events SET Name=?, Cause=?, Notes=? WHERE Id=?',
|
|
array(
|
|
$_REQUEST['newEvent']['Name'],
|
|
$_REQUEST['newEvent']['Cause'],
|
|
$_REQUEST['newEvent']['Notes'],
|
|
$event->Id()
|
|
)
|
|
);
|
|
}
|
|
$dbConn->commit();
|
|
// Back to the page the edit came from, if that is on this server.
|
|
$redirect = localRedirectUrl(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '', '?view=events');
|
|
}
|
|
?>
|