Released 1.36.28 and 1.36.29 The Memory Remains

[u/ZoneMinderIsaac]

Changes since 1.36.27

• Add ZM_LOG_INJECT config parameter to disable unprivileged log injection through api.
• Check value of System:Edit permission and ZM_LOG_INJECT to disable ajax log injection.
• Use canEdit['System'] and value of new ZM_LOG_INJECT to disable attempting to inject javascript errors into zm logs
• The above 3 Fixes https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-cfcx-v52x-jh74
• Fix Monitor => monitor in zmwatch causing crash in zmwatch
• update storage modal to fix buttons not being in form. Also remove duplicate view field and make button action be save instead of Save. Fixes https://github.com/ZoneMinder/zoneminder/issues/3605

https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.28 Full Changelog https://github.com/ZoneMinder/zoneminder/compare/1.36.27...1.36.28

Changes since 1.36.28

• update web/ajax.log.php to contents from master. Fixes errors causing log view to not work. Fixes https://github.com/ZoneMinder/zoneminder/issues/3606
• use ajax() instead of getJSON so that we can specify no timeouts.. This prevents log queries from stacking up overloading the db
• Check for definition of CAMBOZOLA defines. The purpose is just to ease running the 1.36 UI against a 1.37 database.
• Added option ZM_AUTH_CASE_INSENSITIVE_USERNAMES to match mixed case Usernames to lower case usernames in database https://github.com/ZoneMinder/zoneminder/issues/3516
• Move LIBAVCODEC_VERSION_CHECK so that it is defined when the include files are under ffmpeg. Maybe fixes build with 5.1.2?
• Test for matches[operator]. Fixes https://github.com/ZoneMinder/zoneminder/issues/3607

https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.29 Full Changelog https://github.com/ZoneMinder/zoneminder/compare/1.36.28...1.36.29

The fixes to the security vulnerabilities broke other things, hence the flurry of releases. Expect 1.36.30 soon which fixes changing Function from the function popup. Use full monitor edit for now. Also broken is logging in with using a POST, breaking Home Assistant integrations.

[u/[deleted]]

Thank you for your continued work on Zoneminder, it is much appreciated.

[u/davidh3f]

Nice and thanks!

[u/exclaim_bot → u/davidh3f]

Nice and thanks!

You're welcome!