Isaac Connor cd6e262dc5 Merge pull request #5402 from connortechnology/fix/ghsa-3m5x-events-view-acl ...

fix: API events/view refuses events on monitors the user may not view (GHSA-3m5x-32ch-gg29)

2026-10-31 19:53:10 -04:00

..

actions

fix: require Snapshots edit to create a snapshot

2026-10-30 18:11:04 -04:00

csrf

Until we use "use strict", additional code analysis is required (csrf-magic.js)

2025-08-09 18:54:45 +03:00

auth.php

Merge commit from fork

2026-10-31 19:06:37 -04:00

Command.php

feat: add ZM_ALLOWED_COMMANDS to restrict what filters and tasks may run refs #4957

2026-10-28 18:01:25 -05:00

config.php.in

feat: make options set in zm.conf or conf.d read-only on the Options page refs #5289

2026-10-16 09:24:48 -05:00

control_functions.php

fix: harden remote control request forwarding refs #5343

2026-10-25 09:59:36 -04:00

Control.php

refactor: drop the unused Type column from Controls

2026-10-10 09:32:17 -04:00

CronJob.php

feat: add ZM_ALLOWED_COMMANDS to restrict what filters and tasks may run refs #4957

2026-10-28 18:01:25 -05:00

CronTab.php

fix: qualify the logger calls in CronTab.php refs #4957

2026-10-28 18:01:26 -05:00

database.php

fix: log the database error when dbQuery's prepare or query returns false

2026-10-15 07:58:26 -04:00

download_functions.php

fix: quote the download filename so Chrome doesn't save the export as index.php

2026-09-03 20:17:16 -04:00

EncoderTemplates.php

feat: encoder parameter templates with editor + REST API closes #4778 closes #4802

2026-05-06 17:24:17 -04:00

Event_Data.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Event_Tag.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Event.php

fix: refuse canView and canEdit for an Event with no Id

2026-10-31 19:08:08 -04:00

Filter.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

FilterTerm.php

fix: scope the frames list search to its event and match on FrameId refs #5164

2026-10-01 11:48:26 -04:00

Frame.php

feat: key Frames by (EventId, FrameId) and drop the surrogate Id refs #5164

2026-10-01 11:48:26 -04:00

functions.php

Merge pull request #5391 from connortechnology/fix/ghsa-7hhq-stream-owner

2026-10-31 17:04:34 -04:00

Group_Monitor.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Group_Permission.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

Group.php

fix: require edit on each monitor a group change moves

2026-09-29 17:54:25 -04:00

HttpRange.php

fix: validate Range requests in view_video instead of trusting them refs #5174

2026-10-04 08:26:42 -05:00

lang.php

Potential fix for pull request finding

2026-05-10 15:25:50 -04:00

logger.php

refactor: connect to the database on first use, not on include

2026-08-17 20:52:10 -04:00

Manufacturer.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

MenuItem.php

feat: customizable menu entries with links, icons and delete on options menu tab

2026-06-27 12:13:49 -04:00

Model.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Monitor_Permission.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

monitor_probe.php

fix: stop the web offering an rtsp protocol that no longer captures

2026-10-10 09:32:17 -04:00

Monitor.php

fix: don't send camera commands to another server's daemonControl API

2026-10-24 10:38:45 -05:00

MonitorAction.php

feat: run monitor actions at a time of day refs #4957

2026-10-28 18:01:25 -05:00

MontageLayout.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Network.php

fix: only trust X-Forwarded-For from configured proxies for auth hash IPs

2026-09-24 19:51:27 -04:00

Object.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

Report.php

Merge branch 'master' into patch-380634

2026-05-06 10:47:45 +03:00

Role_Group_Permission.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

Role_Monitor_Permission.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

Server.php

fix: match single-server ServerId=0 in Server::ReadStats

2026-07-27 08:12:51 -04:00

session.php

Merge pull request #5382 from connortechnology/fix/ghsa-2pgc-session-fixation

2026-10-31 09:34:50 -04:00

Snapshot.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

Storage.php

fix: store the computed event disk space when Storage.DiskSpace is NULL refs #5191

2026-10-07 08:50:55 -04:00

Tag.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

TagOrder.php

fix(db): make User_Preferences unique per (UserId, Name) refs #5021

2026-08-08 11:33:29 -04:00

User_Preference.php

fix: php 8.3 deprecated get_class method call without argument

2023-11-22 10:48:04 +03:30

User_Role.php

fix: only dispatch set()/changes() keys to field accessors refs GHSA-vvx7-ghpv-jq98

2026-09-28 19:32:25 -04:00

User.php

fix: give ZM\User real canView/canEdit/canCreate area checks refs GHSA-ff93-w6fm-vqxr

2026-10-08 18:14:17 -04:00

Zone.php

fix: escape Zone, Event and Server names on output

2026-07-19 12:39:35 -04:00