mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-07 05:03:00 -05:00
Isaac ConnorandClaude Opus 4.8
49610fb685
packageControl() runs zmpkg.pl (which starts, stops and switches the run state of ZoneMinder) with the state name from the request. It was public, so CakePHP routed GET /api/states/packageControl/<command> straight to it, skipping the System=Edit check in change() -- the method's only intended caller. With beforeFilter() admitting any user whose System permission is not None, a System=View user could stop, restart or change the run state. Make it protected. change() still calls it after its System=Edit check; the direct route now raises PrivateActionException (404). Addresses GHSA-9gc6-9xg2-5636. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ZoneMinder API
This is the ZoneMinder API. It should be, for now, installed under the webroot e.g. /api.
app/Config/database.php.default must be configured and copied to app/Config/database.php
In addition, Security.salt and Security.cipherSeed in app/Config/core.php should be changed.
The API can run on a dedicated / separate instance, so long as it can access the database as configured in app/Config/database.php