mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-10-03 16:05:24 -04:00
Isaac ConnorandClaude Opus 5
465c3e2dfc
web/skins/classic/includes/config.php defines all 18 ZM_WEB_* constants inside a switch on $_COOKIE['zmBandwidth'] with cases for high, medium and low and no default. On any other value none of them are defined, and skin.js.php - emitted in the footer of every page - reads ZM_WEB_VIEWING_TIMEOUT, ZM_WEB_AJAX_TIMEOUT and ZM_WEB_REFRESH_NAVBAR. On PHP 8 an undefined constant is a fatal Error, so every page including login stops rendering until the cookie is cleared, which cannot be done from inside the interface. skin.php only tested the value for empty, and nothing else validated it: - the cookie is set client side by skin.js, so any value survives - action=bandwidth put $_REQUEST['newBandwidth'] through validStr, which is only strip_tags, and persisted it - ZM_BANDWIDTH_DEFAULT is a free-form string in ConfigData. The Options UI renders it as a select, but loadConfig lets a conf.d file override the database, so a typo there locks out everyone with no cookie yet skin.php now validates both the cookie and ZM_BANDWIDTH_DEFAULT before falling back to low, and the action rejects a value it does not recognise rather than storing it. tests/php/test_bandwidth_clamp.php checks the whitelist against the switch it guards - the two must name the same profiles, since a value in one and not the other reopens this - and that no arm of the switch defines a constant the others do not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Y6FieTwEXuLhhR4e2yiax