Isaac Connor 60fbea3880 fix: security and code quality improvements in auth.php ...

- Fix SQL injection vulnerability in migrateHash() by using prepared statements
- Add null/empty check in password_type() to prevent array access error
- Remove dead code branch in generateAuthHash() (unreachable $_SESSION check)
- Fix PHP version in error message (5.3 -> 5.5 for password_hash)
- Prevent username enumeration by using consistent error messages
- Fix spacing inconsistency in substr() call
- Add TODO comment about MD5 hash weakness

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-02-05 15:10:55 -05:00

..

actions

refactor: rename Janus_Use_RTSP_Restream to Restream

2026-01-31 18:47:37 -05:00

csrf

Until we use "use strict", additional code analysis is required (csrf-magic.js)

2025-08-09 18:54:45 +03:00

auth.php

fix: security and code quality improvements in auth.php

2026-02-05 15:10:55 -05:00

config.php.in

Remove zm_configvals. Just use zm_config. Move code into loadConfig.

2026-01-05 09:32:25 -05:00

control_functions.php

Remove extra { breaking ptz

2022-04-23 19:29:04 -04:00

Control.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

database.php

Merge dbUpdate and dbInsert from another branch

2024-11-18 10:47:07 -05:00

download_functions.php

Now you can download without archiving, and archiving is performed in stages as new MP4 files are generated (download_functions.php)

2026-01-09 16:26:33 +03:00

Event_Data.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Event_Tag.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Event.php

Apply intval to scale calculations

2025-10-10 13:26:30 -04:00

Filter.php

Remove Preview Rate Control. Disable BuiltIn Video controls.

2026-01-29 11:18:30 -05:00

FilterTerm.php

Add "Any Tag" filter option for events

2026-01-10 14:13:37 +00:00

Frame.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

functions.php

Merge pull request #4510 from SteveGilvarry/videojs_update

2026-01-10 10:21:50 -05:00

Group_Monitor.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Group_Permission.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Group.php

Remove session usage for monitor filters, use cookies only

2026-01-07 18:23:47 +00:00

lang.php

Convert user from an array to a User object

2023-04-23 12:57:29 -04:00

logger.php

Enforce max length of 64k for log entries. Use HTTP_X_FORWARDED_FOR in logging so we log actual remote addr

2023-11-16 10:34:44 -05:00

Manufacturer.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Model.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Monitor_Permission.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

monitor_probe.php

fix: Use numeric constant for CURLE_PEER_FAILED_VERIFICATION in PHP

2026-02-02 14:36:00 +00:00

Monitor.php

refactor: rename RTSP2WebStream to StreamChannel

2026-01-31 19:37:08 -05:00

MontageLayout.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Object.php

Add support for the string NULL is object lookup values

2026-01-30 08:33:49 -05:00

Report.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Role_Group_Permission.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

Role_Monitor_Permission.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

Server.php

Update Server.php

2026-01-31 21:01:00 -05:00

session.php

When setting cookies via PHP, add handling of the "path" value in the options (session.php)

2024-05-22 10:32:10 +03:00

Snapshot.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Storage.php

Use the same filter on Storage Name as we use in Monitor Name.

2024-09-30 06:33:09 -04:00

Tag.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

User_Preference.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

User_Role.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

User.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

Zone.php

Include Monitor.php

2024-01-28 16:52:16 -05:00