mirror/zoneminder

0 Fork 0

mirror of https://github.com/ZoneMinder/zoneminder.git synced 2026-10-02 07:25:02 -04:00

Files

T

History

Isaac ConnorandClaude Opus 5.5 dbd2cb231d fix: refuse cross-site image proxy requests by Sec-Fetch-Site

The CSRF token check on the image proxy only runs when ZM_ENABLE_CSRF_MAGIC
is on. Browsers that send Sec-Fetch-Site report when another site started a
request, so refuse proxy requests whose value is anything but same-origin or
none, whatever the CSRF setting. Browsers that do not send the header are
unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-25 07:56:03 -04:00

..

fix: require auth for every ajax request regardless of view refs GHSA-vvw3-j4p4-4rgx

2026-09-24 19:46:37 -04:00

fix: use only the filename part of DefaultVideo in the API event fileSize()

2026-09-24 23:16:53 -04:00

…

…

…

fix: quote each ffmpeg argument in the PHP event video generator

2026-09-25 07:56:03 -04:00

feat: measure the audio level on demand, with a meter in the editor

2026-09-20 18:17:44 -05:00

feat: measure the audio level on demand, with a meter in the editor

2026-09-20 18:17:44 -05:00

fix: require a CSRF token for image proxy requests

2026-09-24 23:16:11 -04:00

…

…

fix: refuse cross-site image proxy requests by Sec-Fetch-Site

2026-09-25 07:56:03 -04:00

.editorconfig

…

.gitignore

…

.travis.yml

…

CMakeLists.txt

…

composer.json

…

composer.lock

…

index.php

fix: require auth for every ajax request regardless of view refs GHSA-vvw3-j4p4-4rgx

2026-09-24 19:46:37 -04:00

README.md

…

robots.txt

…

README.md

Modern ZoneMinder Skin

This web frontend to ZoneMinder is a complete rewrite of the classic frontend, based on CakePHP.