zoneminder

0 Fork 0

mirror of https://github.com/ZoneMinder/zoneminder.git synced 2026-11-07 05:03:00 -05:00

Files

T

Isaac ConnorandClaude Opus 4.8 49610fb685 fix: make StatesController::packageControl protected so it can't be called directly

packageControl() runs zmpkg.pl (which starts, stops and switches the run state
of ZoneMinder) with the state name from the request. It was public, so CakePHP
routed GET /api/states/packageControl/<command> straight to it, skipping the
System=Edit check in change() -- the method's only intended caller. With
beforeFilter() admitting any user whose System permission is not None, a
System=View user could stop, restart or change the run state.

Make it protected. change() still calls it after its System=Edit check; the
direct route now raises PrivateActionException (404).

Addresses GHSA-9gc6-9xg2-5636.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-10-23 22:29:38 -04:00

Config

fix: include ZoneMinder version in CakePHP cache prefix

2026-09-11 20:36:03 -04:00

Console

further merges from cakephp 2.10.8

2018-03-21 13:09:55 -04:00

Controller

fix: make StatesController::packageControl protected so it can't be called directly

2026-10-23 22:29:38 -04:00

Model

fix: refuse the password admin wherever a password is set refs #5287