administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-07-17 17:31:15 +03:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

enforce camera access in thumbnail tracked-object fallback

Browse Source 
The /events/{id}/thumbnail endpoint called require_camera_access when
loading persisted events but skipped the check in the tracked-object
fallback path for in-progress events. A restricted viewer could
retrieve thumbnails from cameras they should not have access to.
This commit is contained in:
Josh Hawkins 2026-03-31 12:51:35 -05:00
parent 85df969e82
commit c2220c89a9
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
frigate/api/media.py
View File

@ -896,6 +896,9 @@ async def event_thumbnail(
if event_id in camera_state.tracked_objects: if event_id in camera_state.tracked_objects:
tracked_obj = camera_state.tracked_objects.get(event_id) tracked_obj = camera_state.tracked_objects.get(event_id)
if tracked_obj is not None: if tracked_obj is not None:
await require_camera_access(
camera_state.name, request=request
)
thumbnail_bytes = tracked_obj.get_thumbnail(extension.value) thumbnail_bytes = tracked_obj.get_thumbnail(extension.value)
except Exception: except Exception:
return JSONResponse( return JSONResponse(