mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-09-23 02:55:44 -04:00
Isaac ConnorandClaude Opus 5
465c3e2dfc
web/skins/classic/includes/config.php defines all 18 ZM_WEB_* constants inside a switch on $_COOKIE['zmBandwidth'] with cases for high, medium and low and no default. On any other value none of them are defined, and skin.js.php - emitted in the footer of every page - reads ZM_WEB_VIEWING_TIMEOUT, ZM_WEB_AJAX_TIMEOUT and ZM_WEB_REFRESH_NAVBAR. On PHP 8 an undefined constant is a fatal Error, so every page including login stops rendering until the cookie is cleared, which cannot be done from inside the interface. skin.php only tested the value for empty, and nothing else validated it: - the cookie is set client side by skin.js, so any value survives - action=bandwidth put $_REQUEST['newBandwidth'] through validStr, which is only strip_tags, and persisted it - ZM_BANDWIDTH_DEFAULT is a free-form string in ConfigData. The Options UI renders it as a select, but loadConfig lets a conf.d file override the database, so a typo there locks out everyone with no cookie yet skin.php now validates both the cookie and ZM_BANDWIDTH_DEFAULT before falling back to low, and the action rejects a value it does not recognise rather than storing it. tests/php/test_bandwidth_clamp.php checks the whitelist against the switch it guards - the two must name the same profiles, since a value in one and not the other reopens this - and that no arm of the switch defines a constant the others do not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Y6FieTwEXuLhhR4e2yiax
38 lines
1.4 KiB
PHP
38 lines
1.4 KiB
PHP
<?php
|
|
//
|
|
// ZoneMinder web action file
|
|
// Copyright (C) 2019 ZoneMinder LLC
|
|
//
|
|
// This program is free software; you can redistribute it and/or
|
|
// modify it under the terms of the GNU General Public License
|
|
// as published by the Free Software Foundation; either version 2
|
|
// of the License, or (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with this program; if not, write to the Free Software
|
|
// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
//
|
|
|
|
|
|
if ( $action == 'bandwidth' && isset($_REQUEST['newBandwidth']) ) {
|
|
$newBandwidth = validStr($_REQUEST['newBandwidth']);
|
|
// Storing an unrecognised profile would leave the skin unable to define its
|
|
// ZM_WEB_* constants on every subsequent request, so reject it here instead
|
|
// of persisting it to the cookie.
|
|
if ( !isValidBandwidth($newBandwidth) ) {
|
|
ZM\Error('Ignoring invalid bandwidth value: '.$newBandwidth);
|
|
} else {
|
|
$_COOKIE['zmBandwidth'] = $newBandwidth;
|
|
zm_setcookie('zmBandwidth', $newBandwidth);
|
|
$refreshParent = true;
|
|
$view = 'none';
|
|
$closePopup = true;
|
|
}
|
|
}
|
|
?>
|