mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-08-03 08:46:44 -04:00
9a49c9b09f
Filter::canEdit() checked view-only users with an `and` chain, so it only denied a filter when every auto-action was enabled at once; a filter with only AutoExecute set passed the check. Because AutoExecuteCmd is run as a shell command by zmfilter.pl (qx($command)), a user with Events=View could run arbitrary OS commands via a temporary filter. Rework canEdit(): - enforce ownership before any per-flag checks - require System edit permission for AutoExecute; running an arbitrary OS command is a System-level capability, not event editing - deny view-only users when ANY auto side-effect is enabled (and -> or), covering AutoArchive/Video/Upload/Email/Message as well Hide the AutoExecute/AutoExecuteCmd inputs in the classic filter view from non-System users, preserving existing values in hidden fields so unrelated edits do not alter them. Add tests/php/test_filter_canedit_autoexecute.php exercising the real canEdit() across the permission matrix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019pVdHJvR87bvPMu1EFDN7M