c7026a1b65
requests should be csrf'd. view_video does not need to be
2017-06-20 10:56:59 -04:00
1932fa7f81
don't do CSRF for requests, and when not auth, clear the request so that we don't do it.
2017-06-20 10:52:16 -04:00
0e643f0f93
Merge branch 'master' into storageareas
2017-05-30 11:58:38 -04:00
3062fe43f3
revert csrf on login page. csrf needs to be off in order for zmNinja to work
2017-05-30 11:25:25 -04:00
f851daca68
merge code to load video.js etc on Event view
2017-05-18 15:10:13 -04:00
3ccf7e102e
fix Debug to Logger::Debug
2017-05-18 14:50:17 -04:00
f4224bb88e
Merge branch 'master' into storageareas
2017-05-17 17:47:39 -04:00
33092e4022
Allow API authentication using the `auth` query parameter containing an auth. hash. ( #1845 )
...
* Allow API authentication using the `auth` query parameter containing an auth. hash.
Fixes #1827
The same auth. hash for zms is used here. This allows consumers to use the API without sending the password in the query string and not require forging logins via the login form.
* Move logger.php's global Debug function to Logger::Debug to avoid polluting globals
This avoids a conflict with CakePHP when logger.php gets included indrectly from API code.
* Protect action=login when ZM_ENABLE_CSRF_MAGIC is enabled
2017-05-15 21:51:48 -04:00
92854f5cba
more debug
2017-05-05 16:37:30 -04:00
dce39bb2a9
Merge branch 'master' into storageareas
2017-04-26 15:58:17 -04:00
1a565a47f2
fix skin path in export_functions
2017-04-26 12:17:01 -05:00
b87839f785
turn off csrf on view=view_video
2017-04-19 10:12:51 -04:00
d1d4fa7b8f
fix the redirect location
2017-04-19 10:02:07 -04:00
7815f1c539
introduce a redirect flag global variable to allow us to redirect. Which allows to redirect on successful login so we don't get repost popups
2017-04-05 10:05:21 -04:00
b2db0888ae
add a warning if csrf_check returns false
2017-03-30 10:46:13 -04:00
35067211e0
more the csrf to before actions.php
2017-03-29 10:19:00 -04:00
3cd9e46df9
Merge branch 'knnniggett-csrf' into storageareas
2017-03-28 20:44:38 -04:00
eb55a6bb9b
set action,view, and/or request to NULL if there are not defined
2017-03-28 17:52:31 -05:00
4e16ae6d19
add ZM_ENABLE_CSRF_MAGIC toggle
2017-03-28 17:29:36 -05:00
d38bae72ae
integrate csrf-magic library
2017-03-18 20:12:06 -05:00
746a096483
Merge branch 'master' of github.com:ZoneMinder/ZoneMinder
2017-01-27 15:16:33 -07:00
30674919c4
always include Storage object, because in the end we will be using it everywhere
2017-01-02 10:34:45 -05:00
5ae34a7561
Merge branch 'master' into storageareas
2017-01-02 09:39:10 -05:00
2dda2d9e1e
remove unneeded, empty files
2016-12-26 09:49:14 -06:00
254fcbcef7
update gpl 2 mailing address in source files
2016-12-26 09:23:16 -06:00
69c39f8a23
set http_only flag in cookie settings
2016-12-14 14:39:44 -05:00
acbc5bc9e3
Merge branch 'cookie_http_only' into storageareas
2016-12-08 15:20:54 -05:00
772792a1b9
remove extra ,
2016-12-08 15:20:43 -05:00
7f2bf04c2f
Merge branch 'cookie_http_only' into storageareas
2016-12-08 14:26:13 -05:00
20793ee822
set httpOnly to true on cookie creation. This will override whatever is in php.ini
2016-12-08 14:25:29 -05:00
c2d6b3d809
fix auth
2016-11-29 15:25:10 -05:00
f9af1e7129
put authorized check back after including actions.php where it needs to go
2016-11-28 11:34:46 -05:00
f153e9b8fb
MontageReview should only be visisble to people who can view events. Fix running state
2016-10-20 13:38:12 -04:00
67e14bd12f
move States loading code into state view where it belongs. Move runnign check into specific places where it is needed. These changes reduce events list load time by about 4 seconds for me.
2016-10-20 13:16:50 -04:00
fc540786a5
Move login by auth hash out of actions.php and into index.php. Double quotes to single quotes and google code style changes in indx.php
2016-10-20 11:51:42 -04:00
01397b6695
Merge branch 'iconnor-updated-console' into storageareas
2016-05-06 14:31:27 -04:00
83795805f2
Move state getting into index.php
2016-05-06 14:30:50 -04:00
44e5b566b8
Merge branch 'iconnor-updated-console' into storageareas
2016-05-06 11:56:24 -04:00
8405db4750
Move running=daemonCheck from header to index.php so that it is defined early and can be used everywhere
2016-05-06 11:56:03 -04:00
851a81eff7
Merge pull request #1406 from ZoneMinder/svg_zones
...
replace the static zone image with a stream, and use SVG to draw the zones
2016-04-11 11:14:11 -04:00
56c2679afd
Merge branch 'icon_video' into storageareas
2016-04-11 10:30:01 -04:00
5542788a45
make cannot write to content dir an error, rather than fatal
2016-04-10 18:45:38 -05:00
bbd33cc159
add monitor class so we don't have to everywhere else
2016-04-08 13:56:49 -04:00
1b69299c2d
Include Monitor object so it can be used elsewhere
2016-03-29 14:36:42 -04:00
c309cdaad4
include Event object so it can be used elsewhere
2016-03-29 12:06:51 -04:00
41d92bbf94
need to include Server class
2015-12-02 10:26:11 -05:00
644080fd41
call CORSHeaders
2015-12-02 10:05:27 -05:00
cb7acb36ab
Use relative URL's instead of absolute
2015-10-24 13:04:54 -05:00
13aab8a1be
Merge pull request #1113 from baffo32/1112-detect-missing-content
...
Fatal if content dirs are unwritable
2015-10-14 06:49:33 -05:00
da8e9dd81b
Remove reference to php.ini from timezone error
2015-10-13 16:55:38 -04:00
Isaac Connor
Matt N
Isaac Connor
Andrew Bauer
Andy Bauer
Kyle Johnson
Isaac Connor
Isaac Connor
Isaac Connor
baffo32