ZoneMinder 1.38.4 Release Notes

This is a maintenance release for the 1.38 series: API/web authorization
fixes, memory-safety and injection hardening, recording correctness fixes,
and UI fixes.

Key Highlights

🔒 Security & Hardening

Access control

• Per-monitor ACL enforced on the EventData and Tags API controllers
• Per-monitor ACL enforced on direct event, frame and zone API endpoints
• Per-monitor ACL applied to FramesController::index() (refs #5000)
• Per-event ACL enforced on the direct media endpoints (GHSA-vj5r-pc2v-gfwv)
• Authorization enforced on the API events/archive action
• System permission now required for filter AutoExecute; auto-execution gated
• filterdebug modal gated on Filter::canView
• ConfigsController now uses a method call for the System permission check

Authentication

• Fixed auth bypass when token validation fails
• Fixed token authentication bypass by using an instanceof check

Injection & overflow

• SQL injection: Filter limit coerced to int; Filter sort_field validated before use
• XSS: Zone, Event and Server names escaped on output
• SDP stack overflow: sprop-parameter-sets copy is now bounded
• HTTP camera buffer overflow: response header copies are now bounded
• Camera frame buffer sizes computed in size_t to avoid int overflow
• Storage containment enforced before deleting files
• detaintPath now loops the :// strip so it cannot be re-formed
• Image proxy restricted to non-reserved addresses and monitor-edit permission
• CodeQL analysis now excludes vendored third-party JavaScript

🐛 Correctness & Recording

• Insert id returned as uint64_t so event ids past 2^31 survive
• Closed the DB/rename race that exposed incomplete.* to event consumers
• VideoStore path kept in sync when the incomplete file is renamed
• recover_timestamps derives event start from the mp4 end time
• hwaccel is retried on reconnect instead of latching to software decode
• analysis_image only allocated when there is a motion score
• Deprecated YUVJ pixel formats mapped before swscale in Image::Assign
• zms command processor starts after buffer state is initialised
• zms buffer_level guarded against a zero buffer count (refs #4936)
• Corrected PHP SHM SharedData/TriggerData field offsets
• zmwatch skips restart/reboot actions during systemic DB/host failures
• TimeoutSec set on the RedHat systemd unit to prevent SIGABRT on shutdown

🖥️ Web UI

• Montage stream scale rounded up so images are not upscaled
• Empty events reported as zero-span in the events ajax and montage query
• Empty crash-orphaned events kept out of montage review selection
• Montage review clock advances by real elapsed time
• montagereview timeline indicator displayed in server timezone
• Width/Height inputs update the dimensions dropdown
• Console Columns dropdown kept inside the viewport in short windows
• Watch auto-scale no longer shrinks video when the status bar wraps
• New ZM_LOG_BROWSER_EXTENSIONS config; browser-extension errors and CSP
  violations are no longer logged by default

⚡ Performance

• ServerId index added to Server_Stats to speed up per-server stat queries
• Server::ReadStats matches single-server ServerId=0 rows

📦 Packaging & CI

• Fedora 44 added to the RPM package build workflows
• RPM builddep step allows erasing conflicting packages
• Package build artifacts use retention-days: 1

Full Changelog: 1.38.3...1.38.4