Conversation
The /events/{id}/thumbnail endpoint called require_camera_access when
loading persisted events but skipped the check in the tracked-object
fallback path for in-progress events. A restricted viewer could
retrieve thumbnails from cameras they should not have access to.
The ffmpeg argument blocklist missed -filter_complex, -lavfi, -vf, -af, -filter, and -attach. These flags can read arbitrary files via source filters like movie= and amovie=, bypassing the existing -i block. A user with camera access could exploit this through the custom export endpoint.
POST /vlm/monitor allowed any authenticated user to start VLM monitoring on any camera without checking camera access. A viewer restricted to specific cameras could monitor cameras they should not have access to.
The start_camera_watch tool called via POST /chat/completion did not validate camera access, allowing a restricted viewer to start VLM monitoring on cameras outside their allowed set through the chat interface.
|
By the way, did the Reindex button for semantic search disappear? |
Looks like it did. Let me push a change. |
mergeSectionConfig was replacing the entire base uiSchema when a level override (global/camera) also defined one, causing base-level ui:after/ui:before directives to be silently dropped. This broke the SemanticSearchReindex button which was defined in base uiSchema.
|
Also, I saw fields in Weblate for using different model configurations for specific detectors, but I didn’t see them being used on the page either. Is this feature not yet implemented, or is it a display issue? |
|
The Weblate strings exist because they were auto-generated from the full JSON schema, but Actually, these are already implemented when a detector is added that has special fields. The fields are nested under |
3 participants
Please read the contributing guidelines before submitting a PR.
Proposed change
This PR makes improvements to features in
dev:/api/configresponsestart_camera_watchrequire_rolestring vs list bug on region grid endpointType of change
Additional information
For new features
AI disclosure
AI tool(s) used (e.g., Claude, Copilot, ChatGPT, Cursor):
How AI was used (e.g., code generation, code review, debugging, documentation):
Extent of AI involvement (e.g., generated entire implementation, assisted with specific functions, suggested fixes):
Human oversight: Describe what manual review, testing, and validation you performed on the AI-generated portions.
Checklist
enlocale.ruff format frigate)