Repository navigation
fix: go to the zones list after saving a zone opened without a Referer - #5207
Merged
connortechnology merged 1 commit intoOct 11, 2026
Merged
Conversation
The zone form posts its Referer back as REFERER, and posts it empty when the form was opened from a typed URL or a bookmark. The action used it whenever it was set, so $redirect was empty, index.php rendered the zone view with the action's $zone (a database row, or array() for a new zone, neither with Points) and ksort() at views/zone.php:105 failed with 'Argument #1 must be of type array, null given'. The zone was saved but the browser got a 500. Use REFERER only when it is not empty and fall back to the monitor's zones list. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
connortechnology
pushed a commit
that referenced
this pull request
Oct 11, 2026
#5207) The zone form posts its Referer back as REFERER, and posts it empty when the form was opened from a typed URL or a bookmark. The action used it whenever it was set, so $redirect was empty, index.php rendered the zone view with the action's $zone (a database row, or array() for a new zone, neither with Points) and ksort() at views/zone.php:105 failed with 'Argument #1 must be of type array, null given'. The zone was saved but the browser got a 500. Use REFERER only when it is not empty and fall back to the monitor's zones list. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 6a35e89)
connortechnology
added a commit
that referenced
this pull request
Oct 11, 2026
After saving a zone, actions/zone.php redirected to the REFERER the zone form posted, which the form fills from the Referer its page was loaded with. A zone editor who reached the zone page through a link on another site was sent to that site after saving: an open redirect, usable to lead someone from a trusted ZoneMinder page to a look-alike login. Forging the POST itself is blocked by the CSRF token, so it needs an editor who followed such a link. localRedirectUrl() returns the target only if it is a query-only URL or an absolute http(s) URL on the host and port of the current request, and the fallback otherwise: another host, //host, backslashes, user@host, other schemes and control characters all give the fallback. The zone save falls back to the zones list, as it already does with no Referer (#5207). tests/php/test_local_redirect_url.php covers 21 cases. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 16817e4)
connortechnology
added a commit
that referenced
this pull request
Oct 11, 2026
After saving a zone, actions/zone.php redirected to the REFERER the zone form posted, which the form fills from the Referer its page was loaded with. A zone editor who reached the zone page through a link on another site was sent to that site after saving: an open redirect, usable to lead someone from a trusted ZoneMinder page to a look-alike login. Forging the POST itself is blocked by the CSRF token, so it needs an editor who followed such a link. localRedirectUrl() returns the target only if it is a query-only URL or an absolute http(s) URL on the host and port of the current request, and the fallback otherwise: another host, //host, backslashes, user@host, other schemes and control characters all give the fallback. The zone save falls back to the zones list, as it already does with no Referer (#5207). tests/php/test_local_redirect_url.php covers 21 cases. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
?view=zones&mid=N), so the save redirects as it does from the list. 1 file, +5/-2.Details: change, checks
Before
Upstream master
6c0f976c2, typed-URL save:HTTP 500, Location None ... row saved: 7 4.Change
web/includes/actions/zone.php: use REFERER only when it is!empty(), otherwise'?view=zones&mid='.$mid.test_zone_save_typed_urlin holodeck (browser-driven; ZoneMinder has no web UI test harness).Behaviour changes
After
Branch at
42b6e6b27(base6c0f976c2):HTTP 302, Location '?view=zones&mid=1'.Not run: release-1.38 (same code; the patch applies with
git am -3).refs #5206
🤖 Generated with Claude Code