Merge branch 'master' of github.com:ZoneMinder/zoneminder

src/zm_eventstream.cpp

@@ -112,7 +112,7 @@ bool EventStream::loadInitialEventData(
 bool EventStream::loadEventData(uint64_t event_id) {
   std::string sql = stringtf(
                       "SELECT `MonitorId`, `StorageId`, `Frames`, unix_timestamp( `StartDateTime` ) AS StartTimestamp, "
-                      "unix_timestamp( `EndDateTime` ) AS EndTimestamp, "
+                      "unix_timestamp( `EndDateTime` ) AS EndTimestamp, Length, "
                       "(SELECT max(`Delta`)-min(`Delta`) FROM `Frames` WHERE `EventId`=`Events`.`Id`) AS FramesDuration, "
                       "`DefaultVideo`, `Scheme`, `SaveJPEGs`, `Orientation`+0 FROM `Events` WHERE `Id` = %" PRIu64, event_id);
 
@@ -140,20 +140,20 @@ bool EventStream::loadEventData(uint64_t event_id) {
   event_data->frame_count = dbrow[2] == nullptr ? 0 : atoi(dbrow[2]);
   event_data->start_time = SystemTimePoint(Seconds(atoi(dbrow[3])));
   event_data->end_time = dbrow[4] ? SystemTimePoint(Seconds(atoi(dbrow[4]))) : std::chrono::system_clock::now();
-  event_data->duration = std::chrono::duration_cast<Microseconds>(event_data->end_time - event_data->start_time);
+  event_data->duration = std::chrono::duration_cast<Microseconds>(dbrow[5] ? FPSeconds(atof(dbrow[5])) : event_data->end_time - event_data->start_time);
   event_data->frames_duration =
-    std::chrono::duration_cast<Microseconds>(dbrow[5] ? FPSeconds(atof(dbrow[5])) : FPSeconds(0.0));
-  event_data->video_file = std::string(dbrow[6]);
-  std::string scheme_str = std::string(dbrow[7]);
+    std::chrono::duration_cast<Microseconds>(dbrow[6] ? FPSeconds(atof(dbrow[6])) : FPSeconds(0.0));
+  event_data->video_file = std::string(dbrow[7]);
+  std::string scheme_str = std::string(dbrow[8]);
   if ( scheme_str == "Deep" ) {
     event_data->scheme = Storage::DEEP;
   } else if ( scheme_str == "Medium" ) {
     event_data->scheme = Storage::MEDIUM;
   } else {
     event_data->scheme = Storage::SHALLOW;
   }
-  event_data->SaveJPEGs = dbrow[8] == nullptr ? 0 : atoi(dbrow[8]);
-  event_data->Orientation = (Monitor::Orientation)(dbrow[9] == nullptr ? 0 : atoi(dbrow[9]));
+  event_data->SaveJPEGs = dbrow[9] == nullptr ? 0 : atoi(dbrow[9]);
+  event_data->Orientation = (Monitor::Orientation)(dbrow[10] == nullptr ? 0 : atoi(dbrow[10]));
   mysql_free_result(result);
 
   if (!monitor) {
@@ -289,7 +289,7 @@ bool EventStream::loadEventData(uint64_t event_id) {
           frame.in_db);
   } // end foreach db row
 
-  if (event_data->end_time.time_since_epoch() != Seconds(0) and event_data->duration != Seconds(0)) {
+  if (event_data->end_time.time_since_epoch() != Seconds(0) and event_data->duration != Seconds(0) and event_data->frame_count > last_id) {
     Microseconds delta;
     if (!last_frame) {
       // There were no frames in db
@@ -306,6 +306,7 @@ bool EventStream::loadEventData(uint64_t event_id) {
       last_timestamp = event_data->start_time;
       event_data->frame_count ++;
     } else {
+      Debug(1, "EIther no endtime or no duration, frame_count %d, last_id %d", event_data->frame_count, last_id);
       delta = std::chrono::duration_cast<Microseconds>((event_data->end_time - last_timestamp)/(event_data->frame_count-last_id));
       Debug(1, "Setting delta from endtime %f - %f / %d - %d", 
               FPSeconds(event_data->end_time.time_since_epoch()).count(),
@@ -659,7 +660,7 @@ void EventStream::processCommand(const CmdMsg *msg) {
 
     status_data.event_id = event_data->event_id;
     //status_data.duration = event_data->duration;
-    status_data.duration = std::chrono::duration<double>(event_data->duration).count();
+    status_data.duration = FPSeconds(event_data->duration).count();
     //status_data.progress = event_data->frames[curr_frame_id-1].offset;
     status_data.progress = std::chrono::duration<double>(event_data->frames[curr_frame_id-1].offset).count();
     status_data.rate = replay_rate;

web/ajax/log.php

@@ -192,7 +192,7 @@ function queryRequest() {
 
     $row['Server'] = $Server ? $Server->Name() : '';
     // Strip out all characters that are not ASCII 32-126 (yes, 126)
-    $row['Message'] = preg_replace('/[^\x20-\x7E]/', '', $row['Message']);
+    $row['Message'] = preg_replace('/[^\x20-\x7E]/', '', htmlspecialchars($row['Message']));
     $row['File'] = preg_replace('/[^\x20-\x7E]/', '', strip_tags($row['File']));
     $rows[] = $row;
   }

web/includes/Storage.php

@@ -21,7 +21,7 @@ class Storage extends ZM_Object {
   protected $defaults = array(
     'Id'        => null,
     'Path'      => array('type'=>'text','filter_regexp'=>array('/[^\w\-\.\(\)\:\/ ]/','/\/$/'), 'default'=>''),
-    'Name'      => '',
+    'Name' => array('type'=>'text','filter_regexp'=>'/[^\w\-\.\(\)\:\/ ]/', 'default'=>'Storage'),
     'Type'      => 'local',
     'Url'       => '',
     'DiskSpace' => null,

web/includes/actions/storage.php

@@ -24,16 +24,22 @@
   return;
 }
 
+global $error_message;
+
 if ($action == 'save') {
   $storage = new ZM\Storage($_REQUEST['id']);
 
   $changes = $storage->changes($_REQUEST['newStorage']);
 
   if (count($changes)) {
-    $storage->save($changes);
-    $refreshParent = true;
+    if ($storage->save($changes)) {
+    } else {
+      $error_message .= $storage->get_last_error();
+    } // end if successful save
   }
+  // there is no view=storage, so need to redirect somewhere useful
   $redirect = '?view=options&tab=storage';
+  $refreshParent = true;
 } else {
   ZM\Error("Unknown action $action in saving Storage");
 }

web/includes/functions.php

@@ -1884,6 +1884,16 @@ function generateConnKey() {
   return rand(1, 999999);
 }
 
+function detaintPathAllowAbsolute($path) {
+  // Strip out :// because php:// is a way to inject code apparently
+  $path = str_replace('://', '', $path);
+  // Remove any absolute paths, or relative ones that want to go up
+  do {
+    $path = str_replace('../', '', $path, $count);
+  } while($count);
+  return $path;
+}
+
 function detaintPath($path) {
 
   // Strip out :// because php:// is a way to inject code apparently

web/skins/classic/js/skin.js

@@ -1216,6 +1216,11 @@ function thisClickOnStreamObject(clickObj) {
   } else return false;
 }
 
+/* For mobile device Not implemented yet. */
+function thisClickOnTimeline(clickObj) {
+  return false;
+}
+
 var doubleTouchExecute = function(event, touchEvent) {
 //  if (touchEvent.target.id &&
 //    (touchEvent.target.id.indexOf('evtStream') != -1 || touchEvent.target.id.indexOf('liveStream') != -1 || touchEvent.target.id.indexOf('monitorStatus') != -1)) {

web/skins/classic/views/event.php

@@ -150,7 +150,8 @@
   $replayMode = 'none';
 }
 
-$video_tag = ($codec == 'MP4') | ((false !== strpos($Event->DefaultVideo(), 'h264')) & ($codec === 'auto'));
+$video_tag = ($codec == 'MP4') || 
+  ((false !== strpos($Event->DefaultVideo(), 'h264')) || (false !== strpos($Event->DefaultVideo(), 'av1')) && ($codec === 'auto'));
 
 // videojs zoomrotate only when direct recording
 $Zoom = 1;

web/skins/classic/views/files.php

@@ -23,7 +23,7 @@
   return;
 }
 
-$path = (!empty($_REQUEST['path'])) ? $_REQUEST['path'] : ZM_DIR_EVENTS;
+$path = (!empty($_REQUEST['path'])) ? detaintPathAllowAbsolute($_REQUEST['path']) : ZM_DIR_EVENTS;
 $is_ok_path = false;
 foreach (ZM\Storage::find() as $storage) {
   $rc = strstr($path, $storage->Path(), true);

web/skins/classic/views/js/event.js

@@ -204,6 +204,7 @@ function renderAlarmCues(containerEl) {
   var spanTimeEnd = 0;
   var alarmed = 0;
   var alarmHtml = '';
+  var pix = 0;
   var pixSkew = 0;
   var skip = 0;
   var num_cueFrames = cueFrames.length;
@@ -218,7 +219,7 @@ function renderAlarmCues(containerEl) {
       if (frame.Delta == 0) continue; //If event starts with an alarm or too few for a nonespan
       spanTimeEnd = frame.Delta * 100;
       spanTime = spanTimeEnd - spanTimeStart;
-      let pix = cueRatio * spanTime;
+      pix = cueRatio * spanTime;
       pixSkew += pix - Math.round(pix);//average out the rounding errors.
       pix = Math.round(pix);
       if ((pixSkew > 1 || pixSkew < -1) && pix + Math.round(pixSkew) > 0) { //add skew if it's a pixel and won't zero out span.