mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-08-03 00:37:21 -04:00
c5f24a1d1f
detaintPath() and detaintPathAllowAbsolute() removed '://' with a single str_replace() while the '../' removal below them already looped. One pass is not enough, because removing a match can join its neighbours into a fresh match: '::////' collapses to '://'. So 'php::////filter/read=string.rot13/resource=/etc/passwd' came back out of the filter as 'php://filter/read=string.rot13/resource=/etc/passwd', reinstating exactly the wrapper the strip exists to remove. Loop the '://' removal the same way the '../' removal is looped. These functions guard $view, $request, $action, the modal name and skin file paths. Refs GHSA-wgqf-6fjf-7gxw. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Modern ZoneMinder Skin
This web frontend to ZoneMinder is a complete rewrite of the classic frontend, based on CakePHP.