Isaac ConnorandClaude Opus 4.8 49610fb685 fix: make StatesController::packageControl protected so it can't be called directly ...

packageControl() runs zmpkg.pl (which starts, stops and switches the run state
of ZoneMinder) with the state name from the request. It was public, so CakePHP
routed GET /api/states/packageControl/<command> straight to it, skipping the
System=Edit check in change() -- the method's only intended caller. With
beforeFilter() admitting any user whose System permission is not None, a
System=View user could stop, restart or change the run state.

Make it protected. change() still calls it after its System=Edit check; the
direct route now raises PrivateActionException (404).

Addresses GHSA-9gc6-9xg2-5636.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-10-23 22:29:38 -04:00

..

Component

fix(api): answer 400 naming the field instead of 500 on an unknown filter

2026-08-28 19:54:07 -04:00

AppController.php

fix: read API request fields the way Model::set() saves them refs GHSA-fp33-8fx5-4j6c

2026-10-10 13:36:01 -04:00

CameraModelsController.php

[API] Fix User variable from array to object

2023-04-23 22:07:24 +02:00

ConfigsController.php

fix: require System permission to read the Config API and withhold secrets

2026-08-15 22:18:47 -04:00

ControlsController.php

fix: let users who can control a monitor read the Controls API

2026-10-16 21:07:45 -04:00

EncoderTemplatesController.php

feat: encoder parameter templates with editor + REST API closes #4778 closes #4802

2026-05-06 17:24:17 -04:00

EventDataController.php

fix: apply the per-monitor ACL throughout the Events API

2026-09-29 17:54:25 -04:00

EventsController.php

fix: apply the per-monitor ACL throughout the Events API

2026-09-29 17:54:25 -04:00

FramesController.php

feat: key Frames by (EventId, FrameId) and drop the surrogate Id refs #5164

2026-10-01 11:48:26 -04:00

GroupsController.php

fix: require edit on each monitor a group change moves

2026-09-29 17:54:25 -04:00

HostController.php

fix: replace and refuse the shipped ZM_AUTH_HASH_SECRET refs GHSA-wmcc-x64g-jr84 GHSA-p2c6-jw8f-ffjc

2026-09-28 19:47:22 -04:00

LogsController.php

fix: check permissions in Logs delete and the ZonePresets API

2026-09-29 17:54:25 -04:00

ManufacturersController.php

[API] Fix User variable from array to object

2023-04-23 22:07:24 +02:00

MonitorsController.php

fix: restart zmcontrol.pl when a monitor is edited through the API (#5205)

2026-10-11 11:23:46 -04:00

NotificationsController.php

fix: address Copilot review feedback on Notifications API refs #4684

2026-03-05 20:39:54 -05:00

PagesController.php

further merges from cakephp 2.10.8

2018-03-21 13:09:55 -04:00

RolesController.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

ServersController.php

[API] Fix User variable from array to object

2023-04-23 22:07:24 +02:00

ServerStatsController.php

Add named parameters support to ServerStatsController.

2023-10-26 18:26:51 -04:00

SnapshotsController.php

fix: keep denied monitors' events out of Snapshots and Tags

2026-09-29 17:54:25 -04:00

StatesController.php

fix: make StatesController::packageControl protected so it can't be called directly

2026-10-23 22:29:38 -04:00

StorageController.php

Add named parameter filtering to Storage controller

2023-05-12 14:10:53 -04:00

TagsController.php

fix: keep denied monitors' events out of Snapshots and Tags

2026-09-29 17:54:25 -04:00

UserPreferenceController.php

fix: make user preferences answer to their owner rather than to System

2026-08-15 22:18:47 -04:00

UsersController.php

fix: honour ZM_USER_SELF_EDIT in the users API

2026-10-12 11:28:40 -05:00

ZonePresetsController.php

fix: check permissions in Logs delete and the ZonePresets API

2026-09-29 17:54:25 -04:00

ZonesController.php

fix: stop the API falling back to generic Crud actions, restrict zone reads

2026-09-29 17:54:25 -04:00