From 924d5235d0ba93f88eafcd99f546ec06c36ecac3 Mon Sep 17 00:00:00 2001
From: Steve Gilvarry <SteveGilvarry@users.noreply.github.com>
Date: Thu, 14 Feb 2019 02:40:43 +1100
Subject: [PATCH 1/2] Validate zmu Username and Password lengths (#2484)

* Validate zmu Username and Password lengths
Ensure user provided values are not larger than allowed and error if
they are, therefore further preventing overflow.

* Check username and password functions for zmu and zms

* Check username and password functions for zmu and zms
---
 src/zm_user.cpp | 15 +++++++++++++++
 src/zm_user.h   |  2 ++
 src/zms.cpp     |  5 ++++-
 src/zmu.cpp     | 13 ++++++++++++-
 4 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/src/zm_user.cpp b/src/zm_user.cpp
index 6dbfb56fa..da0c66416 100644
--- a/src/zm_user.cpp
+++ b/src/zm_user.cpp
@@ -245,3 +245,18 @@ User *zmLoadAuthUser( const char *auth, bool use_remote_addr ) {
   Debug(1, "No user found for auth_key %s", auth );
   return 0;
 }
+
+//Function to check Username length
+bool checkUser ( const char *username) {
+  if ( strlen(username) > 32) {
+    return false;
+  }
+  return true;
+}
+//Function to check password length
+bool checkPass (const char *password) {
+  if ( strlen(password) > 64) {
+    return false;
+  }
+  return true;
+}
diff --git a/src/zm_user.h b/src/zm_user.h
index 37bf45736..00c61185b 100644
--- a/src/zm_user.h
+++ b/src/zm_user.h
@@ -77,5 +77,7 @@ public:
 
 User *zmLoadUser( const char *username, const char *password=0 );
 User *zmLoadAuthUser( const char *auth, bool use_remote_addr );
+bool checkUser ( const char *username);
+bool checkPass (const char *password);
 
 #endif // ZM_USER_H
diff --git a/src/zms.cpp b/src/zms.cpp
index a5fef0134..634e07030 100644
--- a/src/zms.cpp
+++ b/src/zms.cpp
@@ -191,9 +191,12 @@ int main( int argc, const char *argv[] ) {
     User *user = 0;
 
     if ( strcmp(config.auth_relay, "none") == 0 ) {
-      if ( username.length() ) {
+      if ( checkUser(username.c_str()) ) {
         user = zmLoadUser(username.c_str());
+      } else {
+        Error("")
       }
+
     } else {
       //if ( strcmp( config.auth_relay, "hashed" ) == 0 )
       {
diff --git a/src/zmu.cpp b/src/zmu.cpp
index af6cb603d..a8ee61273 100644
--- a/src/zmu.cpp
+++ b/src/zmu.cpp
@@ -425,6 +425,10 @@ int main(int argc, char *argv[]) {
 
   if ( config.opt_use_auth ) {
     if ( strcmp(config.auth_relay, "none") == 0 ) {
+      if ( !checkUser(username)) {
+        fprintf(stderr, "Error, username greater than allowed 32 characters\n");
+        exit_zmu(-1);
+      }
       if ( !username ) {
         fprintf(stderr, "Error, username must be supplied\n");
         exit_zmu(-1);
@@ -438,7 +442,14 @@ int main(int argc, char *argv[]) {
         fprintf(stderr, "Error, username and password or auth string must be supplied\n");
         exit_zmu(-1);
       }
-
+      if ( !checkUser(username)) {
+        fprintf(stderr, "Error, username greater than allowed 32 characters\n");
+        exit_zmu(-1);
+      }
+      if ( !checkPass(password)) {
+        fprintf(stderr, "Error, password greater than allowed 64 characters\n");
+        exit_zmu(-1);
+      }
       //if ( strcmp( config.auth_relay, "hashed" ) == 0 )
       {
         if ( auth ) {

From 400d4dc27e2aec72371cc8b4897c2498b8252c3f Mon Sep 17 00:00:00 2001
From: Isaac Connor <isaac@zoneminder.com>
Date: Wed, 13 Feb 2019 11:24:09 -0500
Subject: [PATCH 2/2] encode the label on the preset so that weird characters
 and quotes don't break the button

---
 web/skins/classic/includes/control_functions.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/skins/classic/includes/control_functions.php b/web/skins/classic/includes/control_functions.php
index 6274afae5..ec51458ee 100644
--- a/web/skins/classic/includes/control_functions.php
+++ b/web/skins/classic/includes/control_functions.php
@@ -270,7 +270,7 @@ function controlPresets( $monitor, $cmds ) {
 <?php
   for ( $i = 1; $i <= $monitor->NumPresets(); $i++ ) {
     ?>
-      <input type="button" class="ptzNumBtn" title="<?php echo isset($labels[$i])?$labels[$i]:"" ?>" value="<?php echo $i ?>" onclick="controlCmd('<?php echo $cmds['PresetGoto'] ?><?php echo $i ?>');"/>
+      <input type="button" class="ptzNumBtn" title="<?php echo isset($labels[$i])?htmlentities($labels[$i]):'' ?>" value="<?php echo $i ?>" onclick="controlCmd('<?php echo $cmds['PresetGoto'] ?><?php echo $i ?>');"/>
 <?php
     if ( $i && (($i%$presetBreak) == 0) ) {
 ?><br/><?php