d93924bd89
increase width of controls popup.
2019-02-20 15:39:26 -05:00
8837015239
remove bogus test for Filter Id
2019-02-19 13:54:25 -05:00
6d1541a4d2
Merge branch 'fix_privacy_view' into storageareas
2019-02-19 12:57:01 -05:00
97a888c0db
get rid of js that just does the form submit. Upgrade the button from an input to a button. Use 0 and 1 instead of accept and decline, which allows us to pre-select the current value of ZM_TELEMETRY_DATA. So that if you had previously declined, you won't accidentally accept. This fixes the reported error that choosing decline would cause the setting to not be saved and the privacy popup to happen again.
2019-02-19 12:54:12 -05:00
fbdb5bcb62
Merge branch 'master' into storageareas
2019-02-19 12:06:32 -05:00
eaa7341935
Add missing / in path to auth.php
2019-02-19 10:07:36 -05:00
87988185e5
remove data-on-click-this from markEids[] because we have an onclick bind in initPage
2019-02-19 09:58:03 -05:00
5029d7214a
Merge branch 'master' into storageareas
2019-02-18 17:00:45 -05:00
4cd3a93e96
add missing /
2019-02-18 16:30:03 -05:00
b646284da3
don't quote dbEscape values it will quote it already ( #2529 )
2019-02-17 11:31:28 -05:00
04c17283ec
need to prefix with _dir_ otherwise relative to initial script ( #2531 )
2019-02-17 11:31:10 -05:00
b7a6aed1cd
Merge branch 'master' into storageareas
2019-02-16 11:51:23 -05:00
34873d5636
We must leave ZM_HOME_CONTENT unescaped so that we can insert actual html like image tags
2019-02-16 11:50:09 -05:00
6156aa2af9
Merge branch 'storageareas' of github.com:/ConnorTechnology/ZoneMinder into storageareas
2019-02-15 10:49:06 -05:00
b25770a2f0
Merge branch 'master' into storageareas
2019-02-13 11:52:31 -05:00
d0745da11c
fix path to Control.php
2019-02-13 11:52:16 -05:00
a41e8a8834
Merge branch 'master' into storageareas
2019-02-13 11:38:38 -05:00
400d4dc27e
encode the label on the preset so that weird characters and quotes don't break the button
2019-02-13 11:24:09 -05:00
dd641793a2
Merge branch 'improve_session' into storageareas
2019-02-13 11:17:30 -05:00
91a280e56e
need to include session.php in auth.php
2019-02-13 11:17:15 -05:00
3d6efe2253
Merge branch 'storageareas' of github.com:/ConnorTechnology/ZoneMinder into storageareas
2019-02-13 11:10:07 -05:00
d1b3b23c09
Merge branch 'master' into storageareas
2019-02-13 09:42:03 -05:00
b6a0e704d2
whitespace, remove xhtml cruft
2019-02-12 16:41:08 -05:00
7a8668ea99
whitespace
2019-02-12 16:40:48 -05:00
9a0f3801de
fix + instead of .
2019-02-12 16:25:31 -05:00
2f301cf5fe
Merge branch 'master' of github.com:ZoneMinder/ZoneMinder
2019-02-12 13:18:08 -05:00
5b9bb93703
fix navbar auth
2019-02-12 13:17:55 -05:00
28f5ac4220
Merge pull request #2518 from connortechnology/reload_zmfilter_on_filter_save
...
rough in a control function in Filter object. Use it to start/stop z…
2019-02-12 09:26:17 -06:00
f95e9c0363
Fix comment about hiding navbar ( #2521 )
...
Fixes #2520
2019-02-11 17:14:33 -05:00
5ce681b463
instantiate a false Frame object with id = objectect
2019-02-11 16:37:22 -05:00
5a924ab176
cleanup redundant code and spacing
2019-02-11 16:29:19 -05:00
3871c28089
Merge branch 'master' of github.com:ZoneMinder/ZoneMinder
2019-02-11 14:15:35 -05:00
40e0019267
fix all the nav missing when a users Monitors Permission is None
2019-02-11 14:15:24 -05:00
a3374aa26c
Merge branch 'reload_zmfilter_on_filter_save' into storageareas
2019-02-11 13:26:53 -05:00
5695be9f32
rough in a control function in Filter object. Use it to start/stop zmfilter processes when filters are deleted or Saved.
2019-02-11 13:21:00 -05:00
5a333e153c
show object detected file, if object detection in place ( #2514 )
2019-02-11 10:58:34 -05:00
9675367e03
event.js: Wait for delete request to succeed before navigating. Fixes #2384 ( #2515 )
2019-02-11 09:34:51 -05:00
cdbd59f054
bandwidth.php: Submit to the 'bandwidth' view but render the 'none' view. Fixes #2493
2019-02-10 13:22:08 -08:00
cda4a28fec
Fix accidental use of 'let' in 255806bd54
2019-02-10 11:14:55 -08:00
555cb4780d
Merge branch 'master' into storageareas
2019-02-10 12:37:45 -05:00
c9032d3cb4
add autocomplete tags to username and password inputs
2019-02-10 00:27:33 -08:00
c8e41bfee7
log.php: Ensure 'line' is an integer. Helps with #2466
2019-02-10 00:10:39 -08:00
a6ee79f428
Fix typo in dbc1c7b72f comment
2019-02-09 22:40:39 -08:00
dbc1c7b72f
Only output the CSRF Try Again button (and add a warning) when ZM_LOG_DEBUG is on. Fixes #2469
2019-02-09 22:39:54 -08:00
a97711de89
Replace or sanitize remaining uses of PHP_SELF. Fixes #2446
2019-02-09 22:12:36 -08:00
99f1e23c5b
Replace usage of PHP_SELF in views/. Fixes #2450
2019-02-09 21:39:19 -08:00
effd609ff7
Escape output of state names. Fixes #2475
2019-02-09 20:40:08 -08:00
d7ede4643d
_monitor_filters.php: Escape MonitorName and Source. Fixes #2457
2019-02-09 19:14:31 -08:00
c9d597dced
logger.php: Don't output Panic messages unless debugging is on. Fixes #2460
2019-02-09 18:51:30 -08:00
255806bd54
log.js: Escape HTML to be shown in the log HtmlTable. Fixes #2453
2019-02-09 18:43:55 -08:00
6af2c4ad0e
Escape output of WEB_TITLE, HOME_URL, HOME_CONTENT, & WEB_CONSOLE_BANNER. Fixes #2468
2019-02-09 18:06:21 -08:00
9ce05a9a09
user.php: Escape the Username upon display. Fixes #2467
2019-02-09 17:45:52 -08:00
6d2f3c265f
events.php: Remove inline event handlers and enforce CSP
2019-02-09 17:34:59 -08:00
fcbc22b6a2
functions.php: Ensure 'limit' request parameter is an integer. Fixes #2456
2019-02-09 17:27:47 -08:00
502f53fad0
functions.php: Fix SQLi in getFormChanges
2019-02-09 17:15:02 -08:00
ef0e5f453a
monitor.php: Fix XSS from LinkedMonitors. Fixes #2463
2019-02-09 17:11:53 -08:00
9705edfe24
monitor.php: Escape monitor method. Fixes #2464
2019-02-09 17:01:45 -08:00
cef54feaf9
monitor.php: Escape a bug of output variables. Fixes #2465
2019-02-09 16:54:06 -08:00
254b7286b4
monitor.php: Escape SignalCheckColour to prevent XSS. Fixes #2451
2019-02-09 16:41:54 -08:00
bb75dad091
filter.php: Escape filter query term value to avoid XSS. Fixes #2462
2019-02-09 15:35:55 -08:00
dd37808ef7
filter.php: Escape AutoExecuteCmd before output to prevent XSS. Fixes #2461
2019-02-09 15:24:13 -08:00
70e59ed546
filter.php: Escape the filter name on output. Fixes #2455
2019-02-09 15:19:15 -08:00
b2a97ee190
frame.php: Fix multiple XSS from 'show' and 'scale' parameters and enforce CSP.
...
Fixes #2448 , fixes #2449 , and fixes #2447 .
2019-02-09 15:10:45 -08:00
c8066919ff
functions.php: Esacepe textContent in htmlOptions()
2019-02-09 14:14:46 -08:00
7b0ee8a6a2
group: Escape group name in heading. Fixes #2454
2019-02-09 14:05:50 -08:00
fa6716a64b
console: Escape source column output to prevent XSS. Fixes #2452
2019-02-09 02:28:40 -08:00
98e0a0d2c5
Don't output Fatal(...) error messages unless debugging is on to avoid leaking info. Fixes #2459
2019-02-09 02:18:57 -08:00
02f09aad7f
view=export: Remove inline event handlers and fix arbitrary URL/XSS usage. Fixes #2443
2019-02-09 02:01:26 -08:00
61f6a92cc0
view=download: Validate the eid parameter to avoid XSS. Fixes #2442
2019-02-09 01:37:32 -08:00
0b38e72f88
view=download: Remove inline event handlers and fix arbitrary URL/XSS usage. Fixes #2441
2019-02-09 01:16:32 -08:00
e36ac1b872
Add a polyfill for NodeList.prototype.forEach
2019-02-08 21:54:23 -08:00
2dc935b488
added object detection frame rendering ( #2505 )
2019-02-08 13:49:00 -05:00
0eb1efff8b
fix eslint errors
2019-02-08 13:48:38 -05:00
ee3a0c1fd1
fix validateForm running on monitor cancel due to lack of type=button on cancel button
2019-02-08 09:55:32 -05:00
ca781523a8
Merge branch 'master' into storageareas
2019-02-07 08:57:50 -05:00
1039149866
fix buttons on events page. data-onclick-this to data-on-click-this
2019-02-07 08:56:48 -05:00
d33e094526
Merge branch 'master' into storageareas
2019-02-06 17:03:41 -05:00
7e84a5914c
fix CSP policy violations on filters view
2019-02-06 13:55:19 -05:00
0783802d0c
fix CSP violations on events
2019-02-06 13:31:34 -05:00
b04b67c39d
Fix CSP violation in the onclick of the monitor view in montagereview
2019-02-06 12:17:10 -05:00
6744a9a116
Make montagereview more robust when the storage area of an event has been deleted. Add the onmouse events using javascript instead of in the html canvas element so that our CSP policy works.
2019-02-06 11:46:55 -05:00
edaf582eb4
Make montagereview more robust when the storage area of an event has been deleted. Add the onmouse events using javascript instead of in the html canvas element so that our CSP policy works.
2019-02-06 11:46:48 -05:00
8e62c93f5f
add to_json function to Storage.
2019-02-06 11:44:36 -05:00
a9f0463223
Merge branch 'master' into storageareas
2019-02-05 16:46:47 -05:00
dca9a81cfd
implement data-on-click-true
2019-02-05 16:45:05 -05:00
d121ecab75
Merge branch 'improve_session' into storageareas
2019-02-05 15:48:42 -05:00
141f2afc8c
Merge branch 'master' into storageareas
2019-02-05 15:46:58 -05:00
21702dcc68
Merge branch 'master' into improve_session
2019-02-05 12:35:29 -05:00
a40cd144fa
Merge branch 'master' of github.com:ZoneMinder/ZoneMinder
2019-02-05 12:35:15 -05:00
c54fe7e89a
fix state actions
2019-02-05 12:35:06 -05:00
d08a6fcc7c
Don't redirect to login if we are already viewing login. Put auth before including skin includes
2019-02-05 12:32:24 -05:00
78bc2c1dc2
add autocomplete tags to username and password inputs
2019-02-05 11:53:57 -05:00
b6b4a21dbe
Move auth code to includes/auth.php
2019-02-05 11:45:58 -05:00
cb0d9325e6
Use session_regenerate_id instead of our broken code to do the same
2019-02-05 11:45:09 -05:00
2466d765bf
If there is a username in the session, then we are logged in, but we need to load the user object from the db. We can't just trust it from the session. The user may have been deleted and having that data in the session can be a security risk. So load the user object on every request.
2019-02-05 11:44:45 -05:00
5a9083fe86
Remove redirect on line. We do it in javascript on postlogin view so that we can say logging in before switching to console
2019-02-05 11:40:58 -05:00
a2e04c307d
update buttons. reduce duplicated code. Make it so that users with System=View can at least see if there is an update.
2019-01-31 09:40:19 -05:00
86b7fe5d29
fix spacing
2019-01-30 16:08:41 -05:00
4bacd26c98
log redirections
2019-01-30 16:08:24 -05:00
97e3a8178a
use session_regenerate_id instead of other strange code
2019-01-30 16:08:09 -05:00
b09a71d0e2
code style
2019-01-30 16:06:16 -05:00
71f961d012
remove redirect to console on login, as it is done in javascript after Logging in message is displayed
2019-01-30 16:05:51 -05:00
4e10e6f0ae
Merge branch 'improve_session' into storageareas
2019-01-30 15:26:37 -05:00
9a3aa49bae
Merge branch 'fix_bandwidth' into storageareas
2019-01-30 15:18:16 -05:00
533d021dea
Merge branch 'master' into storageareas
2019-01-30 15:17:27 -05:00
604dbf8776
fix state changing/etc
2019-01-30 14:36:46 -05:00
2e2404643f
Fix bandwidth due to new actions code. Update buttons on bandwidth popup
2019-01-30 13:20:24 -05:00
cc0b5e0f1f
Move is_session_open to session.php. Move code to clear a session into session.php
2019-01-30 12:52:01 -05:00
0eba430932
remove duplicate line
2019-01-30 11:05:43 -05:00
4e9ce3c5b7
Move session code to includes/session.php
2019-01-30 11:05:36 -05:00
85bb70df68
Use zm specific session functions, which are now located in includes/session.php. Be more agressive about clearing session on logout.
2019-01-30 11:05:19 -05:00
7ea8be3fa8
spacing, remove non html5 elements
2019-01-25 09:22:08 -05:00
8c5687ca30
Fix name/protocol XSS in controlcaps.php. Fixes #2445 ( #2479 )
2019-01-25 08:35:07 -05:00
fd6179d7c8
Enforce CSP on many more views ( #2480 )
2019-01-25 08:34:29 -05:00
a3e8fd4fd5
Fix zones.php self-xss. Fixes #2444
2019-01-24 23:40:41 -08:00
47d8c9b066
plugin.php: Remove undefined onclick function reference and enforce CSP
...
Also fix tag closing.
2019-01-23 19:47:58 -08:00
59cc65411f
plugin.php: Fix XSS and directory traversal bugs. Fixes #2436
...
This view seems like dead code so maybe it should be removed instead.
2019-01-23 19:41:38 -08:00
e53678f869
Can't use a normal subsitution on the Order by field. So parse the sort param instead
2019-01-23 12:22:00 -05:00
6eb4d7ae27
Filter improvements ( #2438 )
...
* Put back code to close the popup when view is none
* clean up and reduce depth of some logic
* Increase width of user popup
* fix code style
* Make execute_filter work on a filter Id instead of name
* rework logic to reduce code depth. Change view to events to display the results of execute.
* Change the redirect to stay on the new view. When redirecting from executing a filter, it was redirecting to filter.
* Set a form action for correctness. Change execute button to a button instead of a submit. Stay on the filter view when executing
2019-01-23 11:30:51 -05:00
4da95369f9
Fix zone area calculation ( #2437 )
...
Previous method resulted in bogus zone areas (in the range of
1000s of % of frame area) when entering points with the keyboard, even
after applying commit 4937a68650http://mathworld.wolfram.com/PolygonArea.html
It has been tested on ZoneMinder 1.32.3 and works correctly when
either entering coordinates with the keyboard or dragging points with
the mouse.
2019-01-23 10:35:18 -05:00
7026ebafac
Make ajax/stream wait longer for zms. On pi can take up to 3 seconds. Also for php < 5.6, we need to fake 64bit unpack support
2019-01-22 16:45:38 -05:00
cc8de69eba
Merge branch 'master' into storageareas
2019-01-22 11:44:42 -05:00
2914fb1d58
Update to html5, remove code to close popup (as it is taken care of in skin.js now. Use cache_bust on skin.js
2019-01-22 09:15:25 -05:00
e712cedbde
spacing and quotes
2019-01-22 09:14:44 -05:00
ae703c45ee
Set closePopup=true so that we don't need code in the none view to close the popup. The common code in skin.js will take care of it.
2019-01-22 09:14:33 -05:00
0619a4a161
Validate cnj, obr, and cbr arguments in parseFilter ( #2434 )
2019-01-22 08:03:25 -05:00
e7e45b2d95
Remove jQuery use from top-level event listeners in skin.js since view=none doesn't have $j ( #2433 )
2019-01-22 08:00:39 -05:00
7260f823cb
Merge branch 'master' into storageareas
2019-01-21 13:52:38 -05:00
785c208ecf
Fixes #2426 . Ca should have been endTime
2019-01-21 12:01:46 -05:00
326ac60ae4
add missing braces to fix logic
2019-01-21 11:20:56 -05:00
a2d4dc974b
Merge branch 'master' of github.com:ZoneMinder/ZoneMinder
2019-01-21 11:19:07 -05:00
e663397816
spacing
2019-01-21 11:17:21 -05:00
c6311b7079
When logging in, stay on the login view
2019-01-21 11:17:09 -05:00
fbc236128e
add a function to format a time into a duration. Can't use date() because 0 doesn't give us 00:00:00 it gives 19:00:00
2019-01-21 11:16:14 -05:00
b24b930f65
After login go to postlogin, not console. the login view is in a popup so we want to close
2019-01-21 11:15:36 -05:00
19c272061a
Replace MooTools usage for adding window event listeners ( #2429 )
2019-01-21 11:14:32 -05:00
27bcf3f994
Upgrade jQuery version ( #2430 )
...
* Upgrade jQuery to 1.12.4
* Upgrade jQuery to 2.2.4; Stop support for IE8
* 2.2.4 is compatible with 1.12.4
* This fixes a CSP violation on every page load due to jQuery testing of focusin support with a hidden element.
2019-01-21 11:13:40 -05:00
f0b33145f5
Log CSP violations in ZM logs in supported browsers ( #2431 )
2019-01-21 11:12:17 -05:00
d7ebc85d81
Replace remaining `console` inline event handlers ( #2432 )
...
* Use a hidden submit button in _monitor_filters rather than onkeydown
* events/console: Convert checkbox header toggle inline event listeners
2019-01-21 11:11:40 -05:00
f69b77e38f
fix eslint complaints
2019-01-19 12:40:17 -05:00
a1a42345e3
More eslint fixes; eslint in php; add eslint to travis ( #2419 )
...
* Add eslint to travis.yml
* Update eslint package versions and apply new indent rules
* Enable the brace-style and block-style eslint rules
* Enable the 'curly' eslint rule
* Enable the 'keyword-spacing' eslint rule
* Enable the 'key-spacing' eslint rule
* Enable the 'object-curly-spacing' eslint rule
* Enable the 'no-new-object' eslint rule
* Only disable the no-caller eslint rule in the one affected file
* Enable the 'no-unused-vars' eslint rule for local variables
* Add linting of JS in .php files
2019-01-19 10:32:40 -05:00
35fb4366b6
Fix recaptcha support with the CSP ( #2420 )
2019-01-19 09:47:04 -05:00
c0a6e54d60
skins/classic/views/control.php second order sqli ( #2422 )
2019-01-19 09:46:21 -05:00
02fd1e79b3
Fix ajax/status.php orderby sql injection ( #2421 )
...
https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#ajaxstatusphp-line-276-orderby-sql-injection
2019-01-19 09:46:08 -05:00
34e2e47993
controlcap.php: Reflected xss fix with validHtmlStr ( #2423 )
2019-01-19 09:43:28 -05:00
d3f8037e58
Replace onclick='submitTab(...' with a click listener ( #2424 )
2019-01-19 09:42:12 -05:00
4e48939660
Add a validateForm event listener and enforce CSP on some views ( #2425 )
...
* Add a validateForm event listener and enforce CSP on the controlcap view
* filter.php: Use .validateFormOnSubmit
* server.php: Use .validateFormOnSubmit and fix makePopupButton condition check
* Use .validateFormOnSubmit and enforce CSP on the storage view
2019-01-19 09:41:53 -05:00
552e14a971
Merge branch 'master' into storageareas
2019-01-18 10:36:59 -05:00
43a1725060
Fix duplicate 'class' attribute in options ( #2418 )
2019-01-18 10:05:44 -05:00
eef113b6a7
Convert some characters to HTML entities ( #2417 )
2019-01-18 10:02:48 -05:00
Isaac Connor
Mitch Capper
Andrew Bauer
timwsuqld
Pliable Pixels
Matt N
Isaac Connor
montagdude