Isaac Connor d7bf19d4da fix: enforce Storage containment before deleting files ...

The delete action computed $is_ok_path to confirm the requested path sits
below a configured Storage area, but never consulted it, so the check was
dead code and unlink() ran on whatever path was supplied. The path comes
from detaintPathAllowAbsolute($_REQUEST['path']), which deliberately
permits absolute paths, so nothing else constrained the target.

Return with an error when the path is not below a Storage area. Deleting
already requires System Edit, so this is not reachable by a low privilege
user, but the containment check should do what it was written to do.

The adjacent $path_parts assignment is also unused; left in place as it
predates this change.

Refs GHSA-g355-3rf6-f38v.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 38a817353b)

2026-07-19 16:23:22 -04:00

..

bandwidth.php

Use net zm_setcookie

2022-01-20 09:47:53 -05:00

console.php

Remove deprecated MonitorsIds. Replace it's use with looking for edit permission per monitor

2023-07-19 12:39:32 -04:00

control.php

fix save button in controlpreset modal

2020-10-02 16:10:32 -05:00

controlcap.php

Add error reporting when saving a control

2025-07-14 17:35:14 -07:00

controlcaps.php

Php namespace (#2537)

2019-02-22 09:19:07 -05:00

device.php

remove warnings used for testing

2020-10-03 07:08:04 -05:00

devices.php

Php namespace (#2537)

2019-02-22 09:19:07 -05:00

donate.php

Use new getHomeView function instead of view=console

2023-03-05 10:21:59 -05:00

event.php

Php namespace (#2537)

2019-02-22 09:19:07 -05:00

eventdetail.php

Add event Name to the event detail modal

2023-05-12 15:15:55 -04:00

events.php

Return Debug to a regular function to match other logging functions. Since we switched to using namespaces we no longer clash with cake_php.

2020-10-14 10:39:25 -04:00

files.php

fix: enforce Storage containment before deleting files

2026-07-19 16:23:22 -04:00

filter.php

fix: restore filter Name and UserId after save/reload

2026-02-13 12:33:46 -05:00

function.php

Fix saving from the function modal. Put action in the post variables and change the action to save instead of function.

2022-10-14 14:10:46 -04:00

group.php

Quiet warning about MonitorIds not exisitng in newGroup array when no MonitorIds are selected for that group

2024-01-23 16:14:21 -05:00

groups.php

Use net zm_setcookie

2022-01-20 09:48:02 -05:00

login.php

Use REQUEST instead of SESSION to store the post login redirect because we clear the session on login. Fixes #3517

2022-10-17 17:25:56 -04:00

logout.php

Convert user from an array to a User object

2023-04-23 12:57:29 -04:00

monitor.php

fix: sanitize monitor Device path to prevent command injection (GHSA-g66m-77fq-79v9)

2026-05-23 19:34:05 -04:00

monitors.php

If success when saving monitors, do a redirect so that a reload doesn't repeat the request and ask to resubmit data

2024-01-09 17:12:45 -05:00

montage.php

Santisize zmMontageLayout when passing to constructor

2024-05-21 09:22:55 -04:00

options.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

privacy.php

Use new getHomeView function instead of view=console

2023-03-05 10:21:59 -05:00

report.php

rough in major actions for reports

2022-08-04 09:11:24 -04:00

role.php

feat: add User Roles feature for reusable permission templates

2026-01-29 13:34:27 -05:00

server.php

Code style clceanup in server action

2023-11-13 11:38:03 -05:00

settings.php

WHen saving v4l settings redirect back to watch instead of console.

2021-10-19 12:39:37 -04:00

snapshot.php

Convert user from an array to a User object

2023-04-23 12:57:29 -04:00

state.php

Fix typo in getHomeView

2023-10-23 16:49:34 -04:00

storage.php

Try to do something useful with error messages from SQL, but since storage isn't a real view, it won't be shown.

2024-09-30 06:34:15 -04:00

user.php

Only save permissions if passed in POST. We might not be able to see all monitors, so might not exist in POST.

2024-03-05 16:33:41 -05:00

version.php

add 1 month as an option to the version popup dropdown

2020-04-04 11:46:31 -04:00

zone.php

Use reload instead of restart on zone save

2023-02-16 14:10:30 -05:00

zones.php

FIx arrap_map to array_map. Don't assume _REQUEST[mids] exists. Fixes #3859

2024-03-10 10:59:56 -04:00