ZoneMinder / zoneminder

ZoneMinder is a free, open source Closed-circuit television software application developed for Linux which supports IP, USB and Analog cameras.
http://www.zoneminder.com/
GNU General Public License v2.0
5.12k stars 1.22k forks source link

Enable CSRF protection by default #2507

Closed mnoorenberghe closed 5 years ago

mnoorenberghe commented 5 years ago

I've been running with it on for years and never have problems, even using the API from HASS and zmNinja. We really should have it enabled by default to go with our other security fixes. I would suggest enabling it for everyone by default new installs and upgrades, but I would also be fine with just enabling it for new installs as a starting point to not potentially break compatibility. I think it's possible that the other security fixes will already break some compatibility so personally I'd rather do it at the same time and call this stuff out in release notes.

@SteveGilvarry, you were looking for things to help with. Maybe you're familiar with DB migrations / changing defaults?

SteveGilvarry commented 5 years ago

Yep can do a PR and we can discuss.

On Sun, 10 Feb 2019 at 5:49 pm, Matt N. notifications@github.com wrote:

I've been running with it on for years and never have problems, even using the API from HASS and zmNinja. We really should have it enabled by default to go with our other security fixes. I would suggest enabling it for everyone by default new installs and upgrades, but I would also be fine with just enabling it for new installs as a starting point to not potentially break compatibility. I think it's possible that the other security fixes will already break some compatibility so personally I'd rather do it at the same time and call this stuff out in release notes.

@SteveGilvarry https://github.com/SteveGilvarry, you were looking for things to help with. Maybe you're familiar with DB migrations / changing defaults?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ZoneMinder/zoneminder/issues/2507, or mute the thread https://github.com/notifications/unsubscribe-auth/AHQrXGDw8NC9Jp3fQXi8uE68H2kDosvTks5vL8EVgaJpZM4ay661 .