Nic BoetandClaude Opus 5.5 99cf213f62 fix: forward control requests to the server that records the monitor ...

In a multi-server setup a PTZ move, preset or light command sent to one
server for a monitor that another server records never reached the
camera. Monitor::sendControlCommand() passed the zmcontrol option string
to the other server's monitors/daemonControl API, which only starts and
stops zmcontrol.pl, so the request built a URL like
daemonControl/4/ --panspeed=51 ... --command=moveConLeft/zmcontrol.pl.json
and answered "Failed". The web UI's own PTZ buttons send to the
monitor's server and were not affected; clients that send every request
to the server they log in to (zm-py, pyzmNg, zmNinjaNg, aiozoneminder)
and monitor actions whose target is on another server were.

ajax/control.php now hands such a request, as received, to the index.php
of the server that records the monitor (or the action's target), with
the auth relay in place of the caller's credentials, and answers with
that server's reply. That server checks the permissions and builds the
command itself. A request is forwarded at most once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 10:24:29 -05:00

..

event_sort_test.php

feat: add Filter::buildSortSql for directional event sort specs with integration test

2026-06-09 17:35:39 -04:00

test_api_request_field.php

fix: read API request fields the way Model::set() saves them refs GHSA-fp33-8fx5-4j6c

2026-10-10 13:36:01 -04:00

test_api_user_self_edit.php

fix: honour ZM_USER_SELF_EDIT in the users API

2026-10-12 11:28:40 -05:00

test_auth_hash_candidate_addrs.php

fix: keep an auth hash valid when the client address changes refs #4921

2026-08-17 20:52:10 -04:00

test_auth_hash_compare.php

fix: compare the auth hash with hash_equals() in getAuthUser()

2026-10-15 18:57:14 -05:00

test_auth_no_include_side_effects.php

test: detect calls nested in file-scope conditions

2026-08-17 20:52:10 -04:00

test_auth_relay_encoding.php

fix: URL-encode the username in the auth relay

2026-10-15 18:57:14 -05:00

test_auth_request_string.php

fix: treat a request parameter that is not a string as absent in auth

2026-09-24 19:44:16 -04:00

test_bandwidth_clamp.php

refactor: derive the ZM_WEB_ bandwidth aliases from the profile prefix

2026-08-29 14:01:25 -04:00

test_config_file_booleans.php

fix: read yes/no, true/false and on/off in config files as booleans in PHP and Perl

2026-10-15 22:37:07 -04:00

test_control_command.php

fix: bind the FOSCAMR2C preset and require Control permission for PTZ refs GHSA-qcm7-vq92-f86f

2026-10-08 18:21:32 -04:00

test_database_emulated_prepares.php

perf: emulate prepares for ZoneMinder's own queries on PHP 8.1+

2026-10-14 22:41:42 -05:00

test_database_error_paths.php

fix: log the database error when dbQuery's prepare or query returns false

2026-10-15 07:58:26 -04:00

test_database_lazy_connect.php

refactor: connect to the database on first use, not on include

2026-08-17 20:52:10 -04:00

test_default_password.php

feat: add a minimum length for new passwords refs #5287

2026-10-16 10:13:53 -05:00

test_download_content_disposition.php

fix: quote the download filename so Chrome doesn't save the export as index.php

2026-09-03 20:17:16 -04:00

test_export_dir_permissions.php

fix: keep the per-event export dir to the owner and off the flat path refs #5074

2026-09-01 07:50:15 +05:30

test_filter_canedit_autoexecute.php

fix: require System permission for filter AutoExecute and gate auto-actions in canEdit

2026-07-21 21:29:50 -04:00

test_filter_canview.php

fix: gate filterdebug modal on Filter::canView

2026-07-28 21:45:08 -04:00

test_filter_limit_sqli.php

fix: coerce Filter limit to int to prevent SQL injection

2026-07-28 21:27:47 -04:00

test_filter_term_date_range.php

fix: scope the frames list search to its event and match on FrameId refs #5164

2026-10-01 11:48:26 -04:00

test_first_run.php

feat: add a minimum length for new passwords refs #5287

2026-10-16 10:13:53 -05:00

test_http_range.php

fix: validate Range requests in view_video instead of trusting them refs #5174

2026-10-04 08:26:42 -05:00

test_local_redirect_url.php

fix: only redirect back to a zone's Referer when it is on this server

2026-10-11 11:16:14 -04:00

test_login_message.php

feat: add ZM_WEB_LOGIN_MESSAGE to show a notice on the login page

2026-08-05 22:08:23 -04:00

test_monitor_status_filter.php

feat: list deleted monitors from the console Status filter

2026-08-08 15:41:20 -04:00

test_object_save_error.php

fix: report a failed monitor delete instead of silently ignoring it fixes #4215

2026-08-30 01:37:45 +05:30

test_recaptcha_allows_login.php

fix: let a reCAPTCHA login through only on an explicit success

2026-10-15 18:57:14 -05:00

test_remote_addr.php

fix: only trust X-Forwarded-For from configured proxies for auth hash IPs

2026-09-24 19:51:27 -04:00

test_remote_control_url.php

fix: forward control requests to the server that records the monitor

2026-10-24 10:24:29 -05:00

test_request_ids_scalar.php

fix: never build an object from an id the request sent as an array

2026-10-11 23:07:08 -04:00

test_stream_error_reason.php

fix: address the review comments on the stream error classification refs #5038

2026-08-07 21:06:58 -04:00

test_user_permissions.php

fix: give ZM\User real canView/canEdit/canCreate area checks refs GHSA-ff93-w6fm-vqxr

2026-10-08 18:14:17 -04:00

test_validate_user_compare.php

test: lift isDefaultPassword() into the validateUser() comparison test

2026-10-16 21:51:23 -05:00

test_web_option_wiring.php

test: read the bandwidth options the way the skin now derives them

2026-09-08 02:56:06 +05:30