Allow further query parameters after view in HomeView

ZoneMinder · Sep 4, 2024 · 08d2f44 · 08d2f44
1 parent ade2f2e
commit 08d2f44
Showing 1 changed file with 16 additions and 8 deletions.
diff --git a/web/includes/functions.php b/web/includes/functions.php
@@ -2478,20 +2478,28 @@ function getHomeView() {
  global $skin;
  if ($user and $user->HomeView()) {
  $view = detaintPath($user->HomeView());
- $path = dirname(__FILE__, 2).'/skins/'.$skin.'/views/'.$view.'.php';
- if (file_exists($path)) {
- return $view;
+ if (preg_match('/^(\w+)([\w&=]*)$/', $view, $matches)) {
+ $path = dirname(__FILE__, 2).'/skins/'.$skin.'/views/'.$matches[1].'.php';
+ if (file_exists($path)) {
+ return $view;
+ } else {
+ ZM\Warning('Invalid view '.$user->HomeView().' in HomeView for user '.$user->Username().' does not exist at '.$path);
+ }
  } else {
- ZM\Warning('Invalid view '.$user->HomeView().' in HomeView for user '.$user->Username().' does not exist at '.$path);
+ ZM\Warning('Invalid view '.$user->HomeView().' in HomeView for user '.$user->Username().' does not match regexp');
  }
  }
  if (defined('ZM_WEB_HOMEVIEW') and ZM_WEB_HOMEVIEW) {
  $view = detaintPath(ZM_WEB_HOMEVIEW);
- $path = dirname(__FILE__, 2).'/skins/'.$skin.'/views/'.$view.'.php';
- if (file_exists($path)) {
- return $view;
+ if (preg_match('/^(\w+)([\w&=]*)$/', $view, $matches)) {
+ $path = dirname(__FILE__, 2).'/skins/'.$skin.'/views/'.$matches[1].'.php';
+ if (file_exists($path)) {
+ return $view;
+ } else {
+ ZM\Warning('Invalid view '.ZM_WEB_HOMEVIEW.' in ZM_WEB_HOMEVIEW does not exist at '.$path);
+ }
  } else {
- ZM\Warning('Invalid view '.ZM_WEB_HOMEVIEW.' in ZM_WEB_HOMEVIEW does not exist at '.$path);
+ ZM\Warning('Invalid view '.ZM_WEB_HOMEVIEW.' in ZM_WEB_HOMEVIEW does not match regexp');
  }
  }
  return 'console';