mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-10-02 15:35:09 -04:00
Isaac Connor
84967e9b52
GenerateVideo used DefaultVideo as the ffmpeg input relative to the event directory and built the output file from Name with only whitespace replaced, so an Events=Edit user could make zmvideo read or write any path the account can reach. zmfilter's generateImage passed event_path/DefaultVideo to ffmpeg -i, and the %EV% email tag attached event_path/DefaultVideo, which could mail out any readable file. Strip everything up to the last path separator from DefaultVideo in all three places, and reduce Name to [-A-Za-z0-9_.] with no leading dot before using it as the video filename. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 5904023f13448e557dc205edb9440972e4a6482d)