zoneminder

event_sort_test.php

feat: add Filter::buildSortSql for directional event sort specs with integration test

2026-06-09 17:35:39 -04:00

test_allowed_commands.php

feat: add ZM_ALLOWED_COMMANDS to restrict what filters and tasks may run refs #4957

2026-10-28 18:01:25 -05:00

test_api_associated_ids.php

fix: snapshot and tag edits keep the event links the editor can't view

2026-10-31 18:45:52 -04:00

test_api_error_log_redaction.php

fix(api): redact credentials sent as arrays, keep empty values visible

2026-10-30 18:53:27 -04:00

test_api_event_view_acl.php

fix(api): refuse events/view for an event on a monitor the user may not view

2026-10-31 19:08:08 -04:00

test_api_login_token.php

fix: refuse host/login with both a password and a token

2026-10-31 10:46:05 -04:00

test_api_request_field.php

fix: read API request fields the way Model::set() saves them refs GHSA-fp33-8fx5-4j6c

2026-10-10 13:36:01 -04:00

test_api_user_self_edit.php

fix: honour ZM_USER_SELF_EDIT in the users API

2026-10-12 11:28:40 -05:00

test_assignment_precedence.php

fix: key the precedence test's known list on the variable, not the line

2026-10-28 18:01:26 -05:00

test_auth_hash_candidate_addrs.php

fix: keep an auth hash valid when the client address changes refs #4921

2026-08-17 20:52:10 -04:00

test_auth_hash_compare.php

fix: compare the auth hash with hash_equals() in getAuthUser()

2026-10-15 18:57:14 -05:00

test_auth_no_include_side_effects.php

test: detect calls nested in file-scope conditions

2026-08-17 20:52:10 -04:00

test_auth_relay_encoding.php

fix: URL-encode the username in the auth relay

2026-10-15 18:57:14 -05:00

test_auth_request_string.php

fix: treat a request parameter that is not a string as absent in auth

2026-09-24 19:44:16 -04:00

test_bandwidth_clamp.php

refactor: derive the ZM_WEB_ bandwidth aliases from the profile prefix

2026-08-29 14:01:25 -04:00

test_config_file_booleans.php

fix: read yes/no, true/false and on/off in config files as booleans in PHP and Perl

2026-10-15 22:37:07 -04:00

test_config_value_filter.php

fix: stop the Config API leaking secret values refs GHSA-8g63-hqg8-82cv

2026-10-28 19:20:54 -04:00

test_control_command.php

fix: bind the FOSCAMR2C preset and require Control permission for PTZ refs GHSA-qcm7-vq92-f86f

2026-10-08 18:21:32 -04:00

test_cron_modal.php

feat: add and edit scheduled tasks in a modal refs #4957

2026-10-28 18:01:25 -05:00

test_crontab.php

feat: add a UI for scheduled tasks, backed by the crontab refs #4957

2026-10-28 18:01:25 -05:00

test_database_emulated_prepares.php

perf: emulate prepares for ZoneMinder's own queries on PHP 8.1+

2026-10-14 22:41:42 -05:00

test_database_error_paths.php

fix: log the database error when dbQuery's prepare or query returns false

2026-10-15 07:58:26 -04:00

test_database_lazy_connect.php

refactor: connect to the database on first use, not on include

2026-08-17 20:52:10 -04:00

test_default_password.php

feat: add a minimum length for new passwords refs #5287

2026-10-16 10:13:53 -05:00

test_download_content_disposition.php

fix: quote the download filename so Chrome doesn't save the export as index.php

2026-09-03 20:17:16 -04:00

test_editable_monitor_group_deny.php

test: a group None deny stops monitor edits

2026-10-22 21:05:33 -05:00

test_event_can_view_no_id.php

test: give the Event::canView() test user canView() and canEdit()

2026-10-31 19:08:28 -04:00

test_event_role_permissions.php

fix: let a Snapshots grant view the events held in a snapshot

2026-10-21 19:06:25 -05:00

test_event_video_requires_view.php

fix: make event videos only for events the user can view

2026-10-31 18:19:41 -04:00

test_event_writes_require_events_edit.php

fix: change or delete only events on monitors the user can view

2026-10-30 18:10:30 -04:00

test_export_dir_permissions.php

fix: keep the per-event export dir to the owner and off the flat path refs #5074

2026-09-01 07:50:15 +05:30

test_filter_canedit_autoexecute.php

fix: require System permission for filter AutoExecute and gate auto-actions in canEdit

2026-07-21 21:29:50 -04:00

test_filter_canview.php

fix: gate filterdebug modal on Filter::canView

2026-07-28 21:45:08 -04:00

test_filter_limit_sqli.php

fix: coerce Filter limit to int to prevent SQL injection

2026-07-28 21:27:47 -04:00

test_filter_term_date_range.php

fix: scope the frames list search to its event and match on FrameId refs #5164

2026-10-01 11:48:26 -04:00

test_first_run.php

feat: add a minimum length for new passwords refs #5287

2026-10-16 10:13:53 -05:00

test_http_range.php

fix: validate Range requests in view_video instead of trusting them refs #5174

2026-10-04 08:26:42 -05:00

test_local_redirect_url.php

fix: only redirect back to a zone's Referer when it is on this server

2026-10-11 11:16:14 -04:00

test_logger_calls_qualified.php

fix: qualify the remaining logger calls in the web ui, and test for them

2026-10-28 18:01:26 -05:00

test_login_message.php

feat: add ZM_WEB_LOGIN_MESSAGE to show a notice on the login page

2026-08-05 22:08:23 -04:00

test_monitor_actions_columns.php

fix: size the actions table's When and Schedule columns from their contents refs #4957

2026-10-28 18:01:26 -05:00

test_monitor_alarm_cause.php

feat: record the cause given to the monitors alarm API

2026-10-25 20:58:53 -05:00

test_monitor_status_filter.php

feat: list deleted monitors from the console Status filter

2026-08-08 15:41:20 -04:00

test_object_save_error.php

fix: report a failed monitor delete instead of silently ignoring it fixes #4215

2026-08-30 01:37:45 +05:30

test_recaptcha_allows_login.php

fix: let a reCAPTCHA login through only on an explicit success

2026-10-15 18:57:14 -05:00

test_remote_addr.php

fix: only trust X-Forwarded-For from configured proxies for auth hash IPs

2026-09-24 19:51:27 -04:00

test_remote_control_url.php

fix: harden remote control request forwarding refs #5343

2026-10-25 09:59:36 -04:00

test_request_ids_scalar.php

fix: never build an object from an id the request sent as an array

2026-10-11 23:07:08 -04:00

test_session_strict_id.php

fix: reject session ids the server never issued

2026-10-31 09:04:37 -04:00

test_settings_action_requires_control_edit.php

fix(web): require Control edit for camera settings, store only what zmu set

2026-10-30 18:10:07 -04:00

test_snapshot_create_requires_snapshots_edit.php

fix: require Snapshots edit to create a snapshot

2026-10-30 18:11:04 -04:00

test_stream_error_reason.php

fix: address the review comments on the stream error classification refs #5038

2026-08-07 21:06:58 -04:00

test_tmpfiles_conf.php

feat: have tmpfiles.d age out the cache busting directory

2026-10-28 18:01:26 -05:00

test_user_permissions.php

fix: give ZM\User real canView/canEdit/canCreate area checks refs GHSA-ff93-w6fm-vqxr

2026-10-08 18:14:17 -04:00

test_validate_user_compare.php

test: lift isDefaultPassword() into the validateUser() comparison test

2026-10-16 21:51:23 -05:00

test_web_option_wiring.php

test: read the bandwidth options the way the skin now derives them

2026-09-08 02:56:06 +05:30

test_zms_socket_path.php

fix: name zms command sockets after the user the stream serves refs GHSA-7hhq-xw65-4crf

2026-10-31 11:11:01 -04:00

test_zmu_credentials.php

fix: without a token secret, zmu still gets an API request's own password

2026-10-30 19:30:28 -04:00