administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-07-15 00:11:15 +03:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

enforce camera access in chat start_camera_watch tool

Browse Source 
The start_camera_watch tool called via POST /chat/completion did not
validate camera access, allowing a restricted viewer to start VLM
monitoring on cameras outside their allowed set through the chat
interface.
This commit is contained in:
Josh Hawkins 2026-03-31 12:54:19 -05:00
parent 082f025509
commit 9a0ac6ee70
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
frigate/api/chat.py
View File

@ -673,6 +673,8 @@ async def _execute_start_camera_watch(
if camera not in config.cameras:
return {"error": f"Camera '{camera}' not found."}
await require_camera_access(camera, request=request)
genai_manager = request.app.genai_manager
vision_client = genai_manager.vision_client or genai_manager.tool_client
if vision_client is None: