ZoneMinder
/
zoneminder
mirror of https://github.com/ZoneMinder/zoneminder.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

When saving a layout, check for System[edit] or ownership of the layout.

pull/3524/head
Isaac Connor 2022-07-12 17:31:30 -04:00
parent 64ed7370b6
commit 2988d49454
1 changed files with 17 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
web/includes/actions/montage.php
View File

@ -17,30 +17,33 @@
// along with this program; if not, write to the Free Software
// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
//
require_once('includes/MontageLayout.php');
if ( isset($_REQUEST['object']) ) {
if ( $_REQUEST['object'] == 'MontageLayout' ) {
// System edit actions
if ( ! canEdit('System') ) {
ZM\Warning('Need System permissions to edit layouts');
return;
}
require_once('includes/MontageLayout.php');
if ( $action == 'Save' ) {
if ($action == 'Save') {
$Layout = null;
# Name is only populated when creating a new layout
if ( $_REQUEST['Name'] != '' ) {
$Layout = new ZM\MontageLayout();
$Layout->Name($_REQUEST['Name']);
} else {
$Layout = new ZM\MontageLayout($_REQUEST['zmMontageLayout']);
}
$Layout->Positions($_REQUEST['Positions']);
$Layout->save();
zm_session_start();
$_SESSION['zmMontageLayout'] = $Layout->Id();
session_write_close();
zm_setcookie('zmMontageLayout', $Layout->Id());
$redirect = '?view=montage';
if (canEdit('System') or !$Layout->Id() or ($user['Id'] == $Layout->UserId())) {
$Layout->UserId($user['Id']);
$Layout->Positions($_REQUEST['Positions']);
$Layout->save();
zm_session_start();
$_SESSION['zmMontageLayout'] = $Layout->Id();
session_write_close();
zm_setcookie('zmMontageLayout', $Layout->Id());
$redirect = '?view=montage';
} else {
ZM\Warning('Need System permissions to edit layouts');
return;
}
} // end if save
} # end if isset($_REQUEST['object'] )
} # end if isset($_REQUEST['object'] )