Nic BoetandClaude Opus 5.5 93c0114e7a fix: don't send camera commands to another server's daemonControl API ...

For a monitor recorded by another server, sendControlCommand() put any
zmcontrol command into a monitors/daemonControl URL, which only takes
start, stop and quit. Those still go there; other commands now log why
they were not sent and return false instead of requesting a malformed
URL.

fixes #5342

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 10:38:45 -05:00

..

actions

Merge pull request #5288 from nabbi/hard/auth-default

2026-10-16 19:03:06 -04:00

csrf

Until we use "use strict", additional code analysis is required (csrf-magic.js)

2025-08-09 18:54:45 +03:00

auth.php

Merge pull request #5288 from nabbi/hard/auth-default

2026-10-16 19:03:06 -04:00

config.php.in

feat: make options set in zm.conf or conf.d read-only on the Options page refs #5289

2026-10-16 09:24:48 -05:00

control_functions.php

fix: forward control requests to the server that records the monitor

2026-10-24 10:24:29 -05:00

Control.php

refactor: drop the unused Type column from Controls

2026-10-10 09:32:17 -04:00

database.php

fix: log the database error when dbQuery's prepare or query returns false

2026-10-15 07:58:26 -04:00

download_functions.php

fix: quote the download filename so Chrome doesn't save the export as index.php

2026-09-03 20:17:16 -04:00

EncoderTemplates.php

feat: encoder parameter templates with editor + REST API closes #4778 closes #4802

2026-05-06 17:24:17 -04:00

Event_Data.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Event_Tag.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Event.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

Filter.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

FilterTerm.php

fix: scope the frames list search to its event and match on FrameId refs #5164

2026-10-01 11:48:26 -04:00

Frame.php

feat: key Frames by (EventId, FrameId) and drop the surrogate Id refs #5164

2026-10-01 11:48:26 -04:00

functions.php

fix: coerce request event ids to a plain id before constructing ZM\Event

2026-10-23 23:55:50 -04:00

Group_Monitor.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Group_Permission.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

Group.php

fix: require edit on each monitor a group change moves

2026-09-29 17:54:25 -04:00

HttpRange.php

fix: validate Range requests in view_video instead of trusting them refs #5174

2026-10-04 08:26:42 -05:00

lang.php

Potential fix for pull request finding

2026-05-10 15:25:50 -04:00

logger.php

refactor: connect to the database on first use, not on include

2026-08-17 20:52:10 -04:00

Manufacturer.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

MenuItem.php

feat: customizable menu entries with links, icons and delete on options menu tab

2026-06-27 12:13:49 -04:00

Model.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Monitor_Permission.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

monitor_probe.php

fix: stop the web offering an rtsp protocol that no longer captures

2026-10-10 09:32:17 -04:00

Monitor.php

fix: don't send camera commands to another server's daemonControl API

2026-10-24 10:38:45 -05:00

MonitorAction.php

feat: add per-monitor actions that drive a light or a speaker on alarm

2026-09-11 20:13:02 -05:00

MontageLayout.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Network.php

fix: only trust X-Forwarded-For from configured proxies for auth hash IPs

2026-09-24 19:51:27 -04:00

Object.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

Report.php

Merge branch 'master' into patch-380634

2026-05-06 10:47:45 +03:00

Role_Group_Permission.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

Role_Monitor_Permission.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

Server.php

fix: match single-server ServerId=0 in Server::ReadStats

2026-07-27 08:12:51 -04:00

session.php

fix: only store sessions for clients that carry them

2026-08-25 17:36:31 -04:00

Snapshot.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Storage.php

fix: store the computed event disk space when Storage.DiskSpace is NULL refs #5191

2026-10-07 08:50:55 -04:00

Tag.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

TagOrder.php

fix(db): make User_Preferences unique per (UserId, Name) refs #5021

2026-08-08 11:33:29 -04:00

User_Preference.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

User_Role.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

User.php

fix: give ZM\User real canView/canEdit/canCreate area checks refs GHSA-ff93-w6fm-vqxr

2026-10-08 18:14:17 -04:00

Zone.php

fix: escape Zone, Event and Server names on output

2026-07-19 12:39:35 -04:00