Released 1.36.27, 1.36.28 The Memory Remains

[iconnor]

#Changes since 1.36.26

- Use zm_setcookie, which will automatically set samesite on the session cookie. Maybe fixes #3517
- commit to free up locks when there is an error doing MoveTo (like does not exist on disk). Also remove commit from CopyTo which does no transactions/locking.
- Use y instead of Y for path generation when using Deep scheme. Fixes #3583
- Add spans and title attributes on the title h2 parts of frame view so that on mouseover it tells you what the numbers are
- Update frame view js to use const etc instead of var. Put back EventId and FrameId in stats being links and fix FrameId not being populated. If no stats available disable the stats button and use the title to explain why.
- In failure state populate imageData array to reduce output php errors in frame view
- Add connkey and semaphore key to logging about failure to get semaphore. Add sem_release before every ajaxError call because ajaxError exits and so we never release the semaphore.
- fix not saving v4l settings.
- Only warn about event exceeding section_length if we are not using close_mode=TIME. Fixes #3599
- make OutputCodec work in API Maybe fixes #3341
- Handle filter[query] not being defined
- Fix export not working for filter due to limit set to 0.
- Only look for action if there is a view. Prevents lookup of a non-existent file.
- Include monitor Id in zmwatch logs, for consistency as well as utility
- Escape File parameters when inserting log to prevent XSS. Related to fixing #2466. Fixes https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-h6xp-cvwv-q433
- Only perform actions on post. Doing them on GET allows doing actions without CSRF from things like img tags which is not good. Fixes https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-xgv6-qv6c-399q
- Upgrade jquery to 3.6.1
- Update jquery-ui to 1.13.2 to remove reported dependency advisory
- Fix missing STATE_UNKNOWN in perl libs causing missed events in zmes.
- Add permissions checking to API/Logs. Fixes unprivileged user being to add/edit/delete/view logs. Fixes https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mpcx-3gvh-9488

1.36.27
Full Changelog

# Changes since 1.36.27

- Add ZM_LOG_INJECT config parameter to disable unprivileged log injection through api.
- Check value of System:Edit permission and ZM_LOG_INJECT to disable ajax log injection.
- Use canEdit['System'] and value of new ZM_LOG_INJECT to disable attempting to inject javascript errors into zm logs
- The above 3 Fixes https://github.com/ZoneMinder/zoneminde ... -v52x-jh74
- Fix Monitor => monitor in zmwatch causing crash in zmwatch
- update storage modal to fix buttons not being in form. Also remove duplicate view field and make button action be save instead of Save. Fixes #3605

1.36.28
Full Changelog

[Magic919]

I seem to have zmwatch.pl trouble -

zmdc[2577884]: ERR ['zmwatch.pl' exited abnormally, exit status 9]

When I manually run it
Global symbol "$Monitor" requires explicit package name (did you forget to declare "my $Monitor"?) at /usr/bin/zmwatch.pl line 115.
Execution of /usr/bin/zmwatch.pl aborted due to compilation errors.

[pat2]

Thanks, Isaac, for the version upgrade.

Upgraded. I'm on ARMHF platform (Odroid XU4, Ubuntu 16.04)
1. Saw in log the same ERR message Magic is declaring.
zmdc[2577884]: ERR ['zmwatch.pl' exited abnormally, exit status 9]
Error too if I launch zmwatch.pl from teminal. Same msg as Magic.

2. I'm receving too a WAR message present also in previous version (I don't know if this message is only for my ZM istance: I'm using a dedicated layout-created by me through EDIT LAYOUT function- and after logon I'm jumping directly to montage view through Options->Users->Home View=?view=montage):
Specified value 352 not in contents: Array( [auto] => auto [160px] => 160px [320px] => 320px [352px] => 352px [640px] => 640px [1280px] => 1280px)

[iconnor]

1.36.28 quickly released to fix issues with .27

[pat2]

Thanks a lot, Isaac, for your very quick fix!

Upgraded.
Tried to launch /usr/bin/zmwatch.pl from terminal and it is ok!
But in my case I cannot access to web log page...
Let's see for Magic.
Anyway thanks a lot.

[dougmccrary]

If you mean zm says Loading, please wait , , , yeah that's what I get, too.

[pat2]

exactly

[iconnor]

Delete lines 32 and 33 of /usr/share/zoneminder/www/ajax/log.php

[rip]

Code: Select all

//  $task = $_REQUEST['task'];
// }

I needed a sudo service zoneminder restart

[pat2]

Code: Select all

} else {
  // Only the query and create tasks are supported at the moment
  $message = 'Unrecognised task '.$_REQUEST['task'];
} else {
//  $task = $_REQUEST['task'];
// }

I needed a sudo service zoneminder restart

Ithink there is a syntax error.
Better (no syntax error):

Code: Select all

} else {
  // Only the query and create tasks are supported at the moment
  $message = 'Unrecognised task '.$_REQUEST['task'];
}
// else {
//  $task = $_REQUEST['task'];
//}

Anyway in both cases zm continues to say Loading, please wait , , ,

[dougmccrary]

Similar.
In a fit of frustration I installed the one from 1.37, and it still works, apparently. It's a bit longer so it may break something, I dunno.

[iconnor]

I'll have a proper fix tonight. It is getting to be too difficult to manage the two codebases. Can't just cherry pick any more.

My initial fix is just to import the ajax/log.php from master. So if you want to grab the one from master and stick it in place your logs will be fixed.

[pat2]

If I understood correctly: to be substituted /usr/share/zoneminder/www/ajax/log.php of 1.36.28 with https://raw.githubusercontent.com/ZoneM ... ax/log.php
I did. It's working.

There is no zmdc[2577884]: ERR ['zmwatch.pl' exited abnormally, exit status 9] error and the log web page is working too.

Thanks, Isaac.

Pls, Isaac, if it is common to other users, open an issue to be fixed in a next release: on 1.36.xx I'm receiving an annoying warning in the log web page (each time I pass from the Montage View to another ZM page):

Code: Select all

2022-10-08 18:05:42   web_php         22786   WARSpecified value 352 not in contents: Array( [auto] => auto [160px] => 160px [320px] => 320px [352px] => 352px [640px] => 640px [1280px] => 1280px)/usr/share/zoneminder/www/includes/functions.php 482

All is working fine. I cannot understand why the annoying warning.

[lightguy48]

Upgraded two machines to .28 and in both cases the Log screen is no longer working.

Just sits there indefinitely saying "Loading, please wait..."

Never errors out and no events ever show up.

[Magic919]

Either follow the instructions above, or wait for a new version with the fix.