zoneminder

0 Fork 0

mirror of https://github.com/ZoneMinder/zoneminder.git synced 2026-10-03 07:55:22 -04:00

Files

T

Isaac ConnorandClaude Opus 5.5 ffed77e4d3 fix: pin the record id in Zones, Frames and EventData API writes refs GHSA-f8h6-62c9-x6qr GHSA-993c-fc6p-hpxg

CakePHP's Model::set() takes the record id from a primary key in the
data passed to save(). edit() authorized the id in the URL and then saved
the request body, so Zone[Id]=<other> in the body wrote to that other
zone, past the per-monitor check just added. add() could likewise update
an existing row instead of creating one.

Add AppController::pinRequestId(), which drops the primary key from the
request data and sets the model id, and use it in these edits (pinned to
the URL id) and adds (cleared). Frames and EventData edit() never set the
model id at all, so a body without an Id inserted a new row rather than
updating; pinning fixes that too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-28 19:38:59 -04:00

Config

fix: include ZoneMinder version in CakePHP cache prefix

2026-09-11 20:36:03 -04:00

Console

further merges from cakephp 2.10.8

2018-03-21 13:09:55 -04:00

Controller

fix: pin the record id in Zones, Frames and EventData API writes refs GHSA-f8h6-62c9-x6qr GHSA-993c-fc6p-hpxg

2026-09-28 19:38:59 -04:00

Model

fix: use only the filename part of DefaultVideo in the API event fileSize()