Isaac Connor 516bab0247 fix: enforce per-monitor ACL on direct event, frame and zone API endpoints ...

Several API endpoints checked only the coarse Events/Monitors permission
and not the per-monitor object ACL, so a user explicitly denied a monitor
could still reach that monitor's objects by addressing them directly:

- EventsController::edit() and ::delete() checked Events=Edit but never
  called canEdit() on the event, so any event could be mutated or deleted
  by Id.
- FramesController only guaranteed Events != None in beforeFilter().
  view() returned any frame by Id, and edit()/delete() mutated frames
  without requiring Events=Edit or checking the parent event at all.
- ZonesController::forMonitor() listed zones for any monitor Id.

Resolve the owning object and apply the same canView()/canEdit() checks
the normal read paths already use. Frames are addressed by their own Id,
so their parent event is looked up to reach the monitor ACL.

Refs GHSA-hw39-qpjw-p7cg.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-19 11:51:54 -04:00

20 KiB

Raw Blame History

View Raw