Isaac ConnorandClaude Opus 5.5 1677470af1 fix: require System edit to change a monitor's event commands refs GHSA-vcrj-35c6-g97c ...

zmc runs a monitor's EventStartCommand and EventEndCommand at the start
and end of each event. Both the classic save and bulk edit actions and
the API monitor add and edit authorized only on the monitor, so a user
with edit on one monitor and no System permission could set a command
for zmc to run as the ZoneMinder service user.

Changing either field now needs System=Edit, as Filter::canEdit()
already requires for AutoExecuteCmd. Monitor::commandFieldChangesNotAllowed()
reports the command fields a change would alter; submitting the current
value is not a change, so other users can still save the rest of the
monitor. The monitor form shows the fields read-only to them. Also
close the EventEndCommand list item.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-07 08:09:33 -04:00

..

Config

…

Console

…

Controller

…

Model

…

Plugin

…

vendor

…

View

…

webroot

…

index.php

…