Isaac Connor daf4fcbfda Merge pull request #5379 from connortechnology/3qq8-zmu-token ...

fix: give zmu a short-lived token instead of reusable credentials (GHSA-3qq8-fq8j-rx7j)

2026-10-30 23:59:22 -04:00

..

event_sort_test.php

…

test_allowed_commands.php

…

test_api_error_log_redaction.php

fix(api): redact credentials sent as arrays, keep empty values visible

2026-10-30 18:53:27 -04:00

test_api_request_field.php

…

test_api_user_self_edit.php

…

test_assignment_precedence.php

…

test_auth_hash_candidate_addrs.php

…

test_auth_hash_compare.php

…

test_auth_no_include_side_effects.php

…

test_auth_relay_encoding.php

fix: URL-encode the username in the auth relay

2026-10-15 18:57:14 -05:00

test_auth_request_string.php

…

test_bandwidth_clamp.php

…

test_config_file_booleans.php

…

test_config_value_filter.php

…

test_control_command.php

…

test_cron_modal.php

…

test_crontab.php

…

test_database_emulated_prepares.php

…

test_database_error_paths.php

…

test_database_lazy_connect.php

…

test_default_password.php

…

test_download_content_disposition.php

…

test_event_writes_require_events_edit.php

fix: change or delete only events on monitors the user can view

2026-10-30 18:10:30 -04:00

test_export_dir_permissions.php

…

test_filter_canedit_autoexecute.php

…

test_filter_canview.php

…

test_filter_limit_sqli.php

…

test_filter_term_date_range.php

…

test_first_run.php

…

test_http_range.php

…

test_local_redirect_url.php

…

test_logger_calls_qualified.php

…

test_login_message.php

…

test_monitor_actions_columns.php

…

test_monitor_alarm_cause.php

…

test_monitor_status_filter.php

…

test_object_save_error.php

…

test_recaptcha_allows_login.php

…

test_remote_addr.php

…

test_remote_control_url.php

…

test_request_ids_scalar.php

…

test_settings_action_requires_control_edit.php

fix(web): require Control edit for camera settings, store only what zmu set

2026-10-30 18:10:07 -04:00

test_snapshot_create_requires_snapshots_edit.php

fix: require Snapshots edit to create a snapshot

2026-10-30 18:11:04 -04:00

test_stream_error_reason.php

…

test_tmpfiles_conf.php

…

test_user_permissions.php

…

test_validate_user_compare.php

…

test_web_option_wiring.php

…

test_zmu_credentials.php

fix: without a token secret, zmu still gets an API request's own password

2026-10-30 19:30:28 -04:00