Files
zoneminder/scripts/zmtelemetry.pl.in
T
Steve GilvarryandClaude Opus 5 ba49bbb33c fix: make the Perl scripts' taint-safe PATH configurable
The scripts run under -T, so they cannot trust the caller's PATH and set
their own. Sixteen of them hardcoded /bin:/usr/bin:/usr/local/bin, which
assumes everything they shell out to lives under /usr or /usr/local.

ZoneMinder::General::findDbCommand looks for a database client on that
PATH, and zmupdate.pl and zmcamtool.pl run what it finds. So an install
whose client sits anywhere else cannot apply schema changes:

  sh: mysql: command not found
  Command 'mysql -u'zmuser' ... ' exited with status: 127

even with the client on the caller's PATH. Homebrew on Apple Silicon is
the case that surfaced it - the client is in /opt/homebrew/bin - but a
--prefix=/opt install on Linux has the same shape, as does anything that
keeps its database client outside the FHS locations.

Replaced the literal with @ZM_SCRIPT_PATH@, defaulting to the same three
directories plus wherever cmake actually found a client, and overridable
for packagers who want to pin it. Warn at configure time when no client
is found at all, since that failure otherwise appears much later and
says something unrelated.

Nothing changes for an install whose client is already under /usr/bin:
the directory is only appended when it is not in the list, so the
default stays exactly as it was.

Memory.pm is deliberately left alone. It has a narrower PATH of
/bin:/usr/bin, and the only command it runs is uname through an absolute
path from ZM_PATH_UNAME, so it does not need widening.

Verified on macOS across the three cases: with the client in
/opt/homebrew/bin the directory is appended; -DZM_SCRIPT_PATH= is
respected verbatim; and pointing detection at /usr/bin/mariadb leaves
the default untouched. Build clean, suite 146 cases.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B5KL9Xbi7K5aGsauLtd8tG
2026-09-13 13:04:59 +10:00

452 lines
14 KiB
Plaintext

#!@PERL_EXECUTABLE@ -wT
#
# ==========================================================================
#
# ZoneMinder Telemetry Upload Script, $Date$, $Revision$
# Copyright (C) 2001-2008 Philip Coombes
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# ==========================================================================
use strict;
use warnings;
use bytes;
use utf8;
@EXTRA_PERL_LIB@
use ZoneMinder;
use DBI;
use Getopt::Long;
use autouse 'Pod::Usage'=>qw(pod2usage);
use LWP::UserAgent;
use Sys::MemInfo qw(totalmem);
use Sys::CPU qw(cpu_count);
use POSIX qw(strftime uname);
use JSON::MaybeXS;
use Encode;
use URI;
$ENV{PATH} = '@ZM_SCRIPT_PATH@';
$ENV{SHELL} = '/bin/sh' if exists $ENV{SHELL};
delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};
# Setting these as constants for now.
my $help = 0;
my $force = 0;
my $show = 0;
# Interval between version checks
my $interval;
my $version;
my $dry_run = 0;
my $verbose;
GetOptions(
force => \$force,
help => \$help,
show => \$show,
interval=> \$interval,
version => \$version,
verbose => \$verbose,
dry_run => \$dry_run,
);
if ($version) {
print(ZoneMinder::Base::ZM_VERSION . "\n");
exit(0);
}
if ($help) {
pod2usage(-exitstatus => -1);
}
logInit();
my $dbh = zmDbConnect();
if ($show) {
my %telemetry;
collectData($dbh, \%telemetry);
my $result = jsonEncode(\%telemetry);
print($result);
exit(0) if $dry_run;
}
if (!defined $interval) {
$interval = eval($Config{ZM_TELEMETRY_INTERVAL});
}
if (!($Config{ZM_TELEMETRY_DATA} or $force)) {
print("ZoneMinder Telemetry Agent not enabled. Exiting.\n");
exit(0);
}
print('ZoneMinder Telemetry Agent starting at '.strftime('%y/%m/%d %H:%M:%S', localtime())."\n");
my $lastCheck = $Config{ZM_TELEMETRY_LAST_UPLOAD};
while (1) {
while ( ! ( $dbh and $dbh->ping() ) ) {
Info('Reconnecting to db');
if ( !($dbh = zmDbConnect()) ) {
#What we do here is not that important, so just skip this interval
sleep($interval);
}
}
my $now = time();
my $since_last_check = $now - $lastCheck;
Debug("Last Check time (now($now) - lastCheck($lastCheck)) = $since_last_check > interval($interval) or force($force)");
if ($since_last_check < 0) {
Warning('Seconds since last check is negative! Which means that lastCheck is in the future!');
sleep($interval);
next;
}
if ((($since_last_check) > $interval) or $force) {
print "Collecting data to send to ZoneMinder Telemetry server.\n";
# Build the telemetry hash
# We should keep *BSD systems in mind when calling system commands
my %telemetry;
collectData($dbh, \%telemetry);
my $result = jsonEncode(\%telemetry);
if (sendData($result)) {
ZoneMinder::Database::zmDbDo('UPDATE Config SET Value=? WHERE Name=?',
$now, 'ZM_TELEMETRY_LAST_UPLOAD');
$Config{ZM_TELEMETRY_LAST_UPLOAD} = $now;
}
} elsif (-t STDIN) {
print "ZoneMinder Telemetry Agent sleeping for $interval seconds because ($now-$lastCheck=$since_last_check > $interval\n";
}
$lastCheck = $now;
sleep($interval);
} # end while
print 'ZoneMinder Telemetry Agent exiting at '.strftime('%y/%m/%d %H:%M:%S', localtime())."\n";
exit(0);
###############
# SUBROUTINES #
###############
# collect data to send
sub collectData {
my $dbh = shift;
my $telemetry = shift;
$telemetry->{uuid} = getUUID($dbh);
$telemetry->{timezone} = $Config{ZM_TIMEZONE};
@$telemetry{qw(city region country latitude longitude)} = getGeo();
$telemetry->{timestamp} = strftime('%Y-%m-%dT%H:%M:%S%z', localtime());
$telemetry->{monitor_count} = countQuery($dbh, 'Monitors');
$telemetry->{event_count} = countQuery($dbh, 'Events');
$telemetry->{architecture} = runSysCmd($Config{ZM_PATH_UNAME}.' -p');
@$telemetry{qw(kernel distro version)} = getDistro();
$telemetry->{zm_version} = ZoneMinder::Base::ZM_VERSION;
$telemetry->{system_memory} = totalmem();
$telemetry->{processor_count} = cpu_count();
$telemetry->{use_event_server} = $Config{ZM_OPT_USE_EVENTNOTIFICATION};
$telemetry->{monitors} = getMonitorRef($dbh);
}
# Find, verify, then run the supplied system command
sub runSysCmd {
my $msg = shift;
my @arguments = split(/ /, $msg);
chomp($arguments[0]);
my $path = qx( which $arguments[0] );
my $status = $? >> 8;
my $result = '';
if (!$path || $status) {
Warning("Cannot find the $arguments[0] executable.");
return $result;
}
chomp($path);
$arguments[0] = $path;
my $cmd = join(' ', @arguments);
($cmd) = $cmd =~ /(.*)/; # detaint
$result = qx( $cmd );
chomp($result);
return $result;
}
# Upload message data to ZoneMinder telemetry server
sub sendData {
my $msg = shift;
my $ua = LWP::UserAgent->new;
my $server_endpoint = $Config{ZM_TELEMETRY_SERVER_ENDPOINT};
if ($Config{ZM_UPDATE_CHECK_PROXY}) {
$ua->proxy('https', $Config{ZM_UPDATE_CHECK_PROXY});
}
Debug("Posting telemetry data $msg to: $server_endpoint");
# set custom HTTP request header fields
my $req = HTTP::Request->new(POST => $server_endpoint);
$req->header('content-type' => 'application/x-www-form-urlencoded');
$req->header('content-length' => length($msg));
$req->header('connection' => 'Close');
$req->content(encode('UTF-8', $msg));
my $resp = $ua->request($req);
my $resp_msg = $resp->decoded_content;
my $resp_code = $resp->code;
if ($resp->is_success) {
Info('Telemetry data uploaded successfully.');
Debug("Telemetry server upload success response message: $resp_msg");
} else {
Warning("Telemetry server returned HTTP POST error code: $resp_code");
Debug("Telemetry server upload failure response message: $resp_msg");
}
return $resp->is_success;
}
# Retrieves the UUID from the database. Creates a new UUID if one does not exist.
sub getUUID {
my $dbh = shift;
my $uuid = '';
# Verify the current UUID is valid and not nil
if (
($Config{ZM_TELEMETRY_UUID} =~ /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i)
&&
($Config{ZM_TELEMETRY_UUID} ne '00000000-0000-0000-0000-000000000000' )
) {
$uuid = $Config{ZM_TELEMETRY_UUID};
} else {
my $sql = 'SELECT uuid()';
my $sth = $dbh->prepare_cached( $sql ) or die( "Can't prepare '$sql': ".$dbh->errstr() );
my $res = $sth->execute() or die( "Can't execute: ".$sth->errstr() );
$uuid = $Config{ZM_TELEMETRY_UUID} = $sth->fetchrow_array();
$sth->finish();
zmDbDo('UPDATE Config SET Value=? WHERE Name=?', $uuid, 'ZM_TELEMETRY_UUID');
}
return $uuid;
}
# Retrieve this server's general location information from a GeoIP database
sub getGeo {
my $unknown = 'Unknown';
my $endpoint = 'https://ipinfo.io/geo';
my $ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(GET => $endpoint);
my $resp = $ua->request($req);
my $resp_msg = $resp->decoded_content;
my $resp_code = $resp->code;
if ($resp->is_success) {
my $content = decode_json($resp_msg);
(my $latitude, my $longitude) = split /,/, $content->{loc};
return ($content->{city}, $content->{region}, $content->{country}, $latitude, $longitude);
} else {
my $endpoint2 = 'https://api.ip2location.io';
my $ua2 = LWP::UserAgent->new;
my $req2 = HTTP::Request->new(GET => $endpoint2);
my $resp2 = $ua2->request($req2);
my $resp_msg2 = $resp2->decoded_content;
my $resp_code2 = $resp2->code;
if ($resp2->is_success) {
my $content = decode_json($resp_msg2);
return ($content->{city_name}, $content->{region_name}, $content->{country_code}, $content->{latitude}, $content->{longitude});
} else {
Warning("Geoip data retrieval returned HTTP POST error code: $resp_code2");
Debug("Geoip data retrieval failure response message: $resp_msg2");
return ($unknown, $unknown, $unknown, $unknown, $unknown);
}
}
}
# As the name implies, just your average mysql count query
sub countQuery {
my $dbh = shift;
my $table = shift;
my $sql = "SELECT count(*) FROM `$table`";
$sql .= ' WHERE `Deleted`=false' if $table eq 'Monitors';
my $sth = $dbh->prepare_cached($sql) or die "Can't prepare '$sql': ".$dbh->errstr();
my $res = $sth->execute() or die 'Can\'t execute: '.$sth->errstr();
my $count = $sth->fetchrow_array();
$sth->finish();
return $count
}
# Returns a reference to an array of hashes containing data from all monitors
sub getMonitorRef {
my $dbh = shift;
my $sql = 'SELECT `Id`,`Name`,`Type`,`Capturing`,`Analysing`,`Recording`,`Width`,`Height`,`Colours`,`MaxFPS`,`AlarmMaxFPS`, `Path`,
(SELECT Name FROM Manufacturers WHERE Manufacturers.Id = ManufacturerId) AS Manufacturer,
(SELECT Name FROM Models WHERE Models.Id = ModelId) AS Model
FROM `Monitors` WHERE Deleted=false';
my $sth = $dbh->prepare_cached( $sql ) or die( "Can't prepare '$sql': ".$dbh->errstr() );
my $res = $sth->execute() or die( "Can't execute: ".$sth->errstr() );
my $arrayref = $sth->fetchall_arrayref({});
# Sanitize Path
foreach my $monitor (@{$arrayref}) {
next if $$monitor{Type} eq 'Local';
my $uri = URI->new($$monitor{Path});
$uri->authority('username:password@host');
$$monitor{Path} = $uri->as_string();
}
return $arrayref;
}
sub getDistro {
my $kernel = '';
my $distro = '';
my $version = '';
my @uname = uname();
if ($uname[0] =~ /Linux/) {
Debug('Linux distro detected.');
($kernel, $distro, $version) = linuxDistro();
} elsif ($uname[0] =~ /.*BSD/) {
Debug('BSD distro detected.');
$kernel = $uname[3];
$distro = $uname[0];
$version = $uname[2];
} elsif ($uname[0] =~ /Darwin/) {
Debug('Mac OS distro detected.');
$kernel = $uname[3];
$distro = runSysCmd('sw_vers -productName');
$version = runSysCmd('sw_vers -productVersion');
} elsif ( $uname[0] =~ /SunOS|Solaris/ ) {
Debug('Sun Solaris detected.');
$kernel = $uname[3];
$distro = $uname[1];
$version = $uname[2];
} else {
Warning('ZoneMinder was unable to determine the host system. Please report.');
$kernel = 'Unknown';
$distro = 'Unknown';
$version = 'Unknown';
}
return ($kernel, $distro, $version);
}
sub linuxDistro {
my @uname = uname();
my $kernel = $uname[2];
my $distro = 'Unknown Linux Distro';
my $version = 'Unknown Linux Version';
my $found = 0;
# os-release is the standard for many new distros based on systemd
if (-f '/etc/os-release') {
open(my $RELFILE,'<','/etc/os-release') or die( "Can't Open file: $!\n" );
while (<$RELFILE>) {
if (/^NAME=(")?(.*)(?(1)\1|).*$/) {
$distro = $2;
$found = 1;
}
if (/^VERSION_ID=(")?(.*)(?(1)\1|).*$/) {
$version = $2;
$found = 1;
}
}
close $RELFILE;
# exists on many distros but does not always contain useful information, such as redhat
} elsif (-f '/etc/lsb-release') {
if (open(my $RELFILE,'<','/etc/lsb-release')) {
while (<$RELFILE>) {
if (/^DISTRIB_DESCRIPTION=(")?(.*)(?(1)\1|).*$/) {
$distro = $2;
$found = 1;
}
if (/^DISTRIB_RELEASE=(")?(.*)(?(1)\1|).*$/) {
$version = $2;
$found = 1;
}
}
close($RELFILE);
} else {
Error("Can't Open file /etc/lsb-release: $!\n");
}
}
# If all else fails, search through a list of known release files until we find one
if (!$found) {
my @releasefile = ('/etc/SuSE-release', '/etc/redhat-release', '/etc/redhat_version',
'/etc/fedora-release', '/etc/slackware-release', '/etc/slackware-version',
'/etc/debian_release', '/etc/debian_version', '/etc/mandrake-release',
'/etc/yellowdog-release', '/etc/gentoo-release');
foreach (@releasefile) {
if ( -f $_ ) {
open(my $RELFILE,'<',$_) or die( "Can't Open file: $!\n" );
while (<$RELFILE>) {
if ( /(.*).* (\d+\.?\d*) .*/ ) {
$distro = $1;
$version = $2;
$found = 1;
}
}
close $RELFILE;
last;
}
}
}
if (!$found) {
Warning('ZoneMinder was unable to determine Linux distro. Please report.');
}
return ($kernel, $distro, $version);
}
1;
__END__
=head1 NAME
zmtelemetry.pl - Send usage information to the ZoneMinder development team
=head1 SYNOPSIS
zmtelemetry.pl [--force] [--help] [--show] [--interval=seconds] [--version]
=head1 DESCRIPTION
This script collects usage information of the local system and sends it to the
ZoneMinder development team. This data will be used to determine things like
who and where our customers are, how big their systems are, the underlying
hardware and operating system, etc. This is being done for the sole purpoase of
creating a better product for our target audience. This script is intended to
be completely transparent to the end user, and can be disabled from the web
console under Options.
=head1 OPTIONS
--force Force the script to upload it's data instead of waiting
for the defined interval since last upload.
--help Display usage information
--show Displays telemetry data that is sent to zoneminder
--interval Override the default configured interval since last upload.
The value should be given in seconds, but can be an expression
such as 24*60*60.
--version Output the version of ZoneMinder.
=cut