Fix csrf (#16230)

* Fix csrf check

* Simplify

docs/docs/configuration/genai.md

@@ -116,6 +116,12 @@ genai:
   model: gpt-4o
 ```
 
+::: note
+
+To use a different OpenAI-compatible API endpoint, set the `OPENAI_BASE_URL` environment variable to your provider's API URL.
+
+:::
+
 ## Azure OpenAI
 
 Microsoft offers several vision models through Azure OpenAI. A subscription is required.

docs/docs/integrations/plus.md

@@ -29,7 +29,9 @@ You cannot use the `environment_vars` section of your Frigate configuration file
 
 ## Submit examples
 
-Once your API key is configured, you can submit examples directly from the Explore page in Frigate using the `Frigate+` button.
+Once your API key is configured, you can submit examples directly from the Explore page in Frigate. From the More Filters menu, select "Has a Snapshot - Yes" and "Submitted to Frigate+ - No", and press Apply at the bottom of the pane. Then, click on a thumbnail and select the Snapshot tab.
+
+You can use your keyboard's left and right arrow keys to quickly navigate between the tracked object snapshots.
 
 :::note
 
@@ -37,8 +39,6 @@ Snapshots must be enabled to be able to submit examples to Frigate+
 
 :::
 
-![Send To Plus](/img/plus/send-to-plus.jpg)
-
 ![Submit To Plus](/img/plus/submit-to-plus.jpg)
 
 ### Annotate and verify

frigate/api/app.py

@@ -153,6 +153,7 @@ def config(request: Request):
 
     config["plus"] = {"enabled": request.app.frigate_config.plus_api.is_active()}
     config["model"]["colormap"] = config_obj.model.colormap
+    config["model"]["all_attributes"] = config_obj.model.all_attributes
 
     # use merged labelamp
     for detector_config in config["detectors"].values():

frigate/api/fastapi_app.py

@@ -26,14 +26,13 @@ from frigate.storage import StorageMaintainer
 logger = logging.getLogger(__name__)
 
 
-def check_csrf(request: Request):
+def check_csrf(request: Request) -> bool:
     if request.method in ["GET", "HEAD", "OPTIONS", "TRACE"]:
-        pass
+        return True
     if "origin" in request.headers and "x-csrf-token" not in request.headers:
-        return JSONResponse(
-            content={"success": False, "message": "Missing CSRF header"},
-            status_code=401,
-        )
+        return False
+
+    return True
 
 
 # Used to retrieve the remote-user header: https://starlette-context.readthedocs.io/en/latest/plugins.html#easy-mode
@@ -71,7 +70,12 @@ def create_fastapi_app(
     @app.middleware("http")
     async def frigate_middleware(request: Request, call_next):
         # Before request
-        check_csrf(request)
+        if not check_csrf(request):
+            return JSONResponse(
+                content={"success": False, "message": "Missing CSRF header"},
+                status_code=401,
+            )
+
         if database.is_closed():
             database.connect()
 

frigate/ffmpeg_presets.py

@@ -111,12 +111,12 @@ PRESETS_HW_ACCEL_ENCODE_BIRDSEYE = {
     "preset-rpi-64-h265": "{0} -hide_banner {1} -c:v hevc_v4l2m2m {2}",
     FFMPEG_HWACCEL_VAAPI: "{0} -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_device {3} {1} -c:v h264_vaapi -g 50 -bf 0 -profile:v high -level:v 4.1 -sei:v 0 -an -vf format=vaapi|nv12,hwupload {2}",
     "preset-intel-qsv-h264": "{0} -hide_banner {1} -c:v h264_qsv -g 50 -bf 0 -profile:v high -level:v 4.1 -async_depth:v 1 {2}",
-    "preset-intel-qsv-h265": "{0} -hide_banner {1} -c:v h264_qsv -g 50 -bf 0 -profile:v high -level:v 4.1 -async_depth:v 1 {2}",
+    "preset-intel-qsv-h265": "{0} -hide_banner {1} -c:v h264_qsv -g 50 -bf 0 -profile:v main -level:v 4.1 -async_depth:v 1 {2}",
     FFMPEG_HWACCEL_NVIDIA: "{0} -hide_banner {1} -c:v h264_nvenc -g 50 -profile:v high -level:v auto -preset:v p2 -tune:v ll {2}",
     "preset-jetson-h264": "{0} -hide_banner {1} -c:v h264_nvmpi -profile high {2}",
-    "preset-jetson-h265": "{0} -hide_banner {1} -c:v h264_nvmpi -profile high {2}",
+    "preset-jetson-h265": "{0} -hide_banner {1} -c:v h264_nvmpi -profile main {2}",
     "preset-rk-h264": "{0} -hide_banner {1} -c:v h264_rkmpp -profile:v high {2}",
-    "preset-rk-h265": "{0} -hide_banner {1} -c:v hevc_rkmpp -profile:v high {2}",
+    "preset-rk-h265": "{0} -hide_banner {1} -c:v hevc_rkmpp -profile:v main {2}",
     "default": "{0} -hide_banner {1} -c:v libx264 -g 50 -profile:v high -level:v 4.1 -preset:v superfast -tune:v zerolatency {2}",
 }
 PRESETS_HW_ACCEL_ENCODE_BIRDSEYE["preset-nvidia-h264"] = (
@@ -131,13 +131,13 @@ PRESETS_HW_ACCEL_ENCODE_TIMELAPSE = {
     "preset-rpi-64-h265": "{0} -hide_banner {1} -c:v hevc_v4l2m2m -pix_fmt yuv420p {2}",
     FFMPEG_HWACCEL_VAAPI: "{0} -hide_banner -hwaccel vaapi -hwaccel_output_format vaapi -hwaccel_device {3} {1} -c:v h264_vaapi {2}",
     "preset-intel-qsv-h264": "{0} -hide_banner {1} -c:v h264_qsv -profile:v high -level:v 4.1 -async_depth:v 1 {2}",
-    "preset-intel-qsv-h265": "{0} -hide_banner {1} -c:v hevc_qsv -profile:v high -level:v 4.1 -async_depth:v 1 {2}",
+    "preset-intel-qsv-h265": "{0} -hide_banner {1} -c:v hevc_qsv -profile:v main -level:v 4.1 -async_depth:v 1 {2}",
     FFMPEG_HWACCEL_NVIDIA: "{0} -hide_banner -hwaccel cuda -hwaccel_output_format cuda -extra_hw_frames 8 {1} -c:v h264_nvenc {2}",
     "preset-nvidia-h265": "{0} -hide_banner -hwaccel cuda -hwaccel_output_format cuda -extra_hw_frames 8 {1} -c:v hevc_nvenc {2}",
     "preset-jetson-h264": "{0} -hide_banner {1} -c:v h264_nvmpi -profile high {2}",
-    "preset-jetson-h265": "{0} -hide_banner {1} -c:v hevc_nvmpi -profile high {2}",
+    "preset-jetson-h265": "{0} -hide_banner {1} -c:v hevc_nvmpi -profile main {2}",
     "preset-rk-h264": "{0} -hide_banner {1} -c:v h264_rkmpp -profile:v high {2}",
-    "preset-rk-h265": "{0} -hide_banner {1} -c:v hevc_rkmpp -profile:v high {2}",
+    "preset-rk-h265": "{0} -hide_banner {1} -c:v hevc_rkmpp -profile:v main {2}",
     "default": "{0} -hide_banner {1} -c:v libx264 -preset:v ultrafast -tune:v zerolatency {2}",
 }
 PRESETS_HW_ACCEL_ENCODE_TIMELAPSE["preset-nvidia-h264"] = (

frigate/ptz/onvif.py

@@ -411,19 +411,19 @@ class OnvifController:
         # The onvif spec says this can report as +INF and -INF, so this may need to be modified
         pan = numpy.interp(
             pan,
+            [-1, 1],
             [
                 self.cams[camera_name]["relative_fov_range"]["XRange"]["Min"],
                 self.cams[camera_name]["relative_fov_range"]["XRange"]["Max"],
             ],
-            [-1, 1],
         )
         tilt = numpy.interp(
             tilt,
+            [-1, 1],
             [
                 self.cams[camera_name]["relative_fov_range"]["YRange"]["Min"],
                 self.cams[camera_name]["relative_fov_range"]["YRange"]["Max"],
             ],
-            [-1, 1],
         )
 
         move_request.Speed = {
@@ -536,11 +536,11 @@ class OnvifController:
         # function takes in 0 to 1 for zoom, interpolate to the values of the camera.
         zoom = numpy.interp(
             zoom,
+            [0, 1],
             [
                 self.cams[camera_name]["absolute_zoom_range"]["XRange"]["Min"],
                 self.cams[camera_name]["absolute_zoom_range"]["XRange"]["Max"],
             ],
-            [0, 1],
         )
 
         move_request.Speed = {"Zoom": speed}

web/src/components/card/SearchThumbnail.tsx

@@ -1,4 +1,4 @@
-import { useMemo } from "react";
+import { useCallback, useMemo } from "react";
 import { useApiHost } from "@/api";
 import { getIconForLabel } from "@/utils/iconUtil";
 import useSWR from "swr";
@@ -33,6 +33,16 @@ export default function SearchThumbnail({
     onClick(searchResult, true, false);
   });
 
+  const handleOnClick = useCallback(
+    (e: React.MouseEvent<HTMLDivElement>) => {
+      if (e.metaKey) {
+        e.stopPropagation();
+        onClick(searchResult, true, false);
+      }
+    },
+    [searchResult, onClick],
+  );
+
   const objectLabel = useMemo(() => {
     if (
       !config ||
@@ -57,6 +67,7 @@ export default function SearchThumbnail({
       <div className={`size-full ${imgLoaded ? "visible" : "invisible"}`}>
         <img
           ref={imgRef}
+          onClick={handleOnClick}
           className={cn(
             "size-full select-none object-cover object-center opacity-100 transition-opacity",
           )}

web/src/components/filter/SearchFilterGroup.tsx

@@ -61,7 +61,9 @@ export default function SearchFilterGroup({
       }
       const cameraConfig = config.cameras[camera];
       cameraConfig.objects.track.forEach((label) => {
-        labels.add(label);
+        if (!config.model.all_attributes.includes(label)) {
+          labels.add(label);
+        }
       });
 
       if (cameraConfig.audio.enabled_in_config) {

web/src/types/frigateConfig.ts

@@ -343,6 +343,7 @@ export interface FrigateConfig {
     width: number;
     colormap: { [key: string]: [number, number, number] };
     attributes_map: { [key: string]: [string] };
+    all_attributes: [string];
   };
 
   motion: Record<string, unknown> | null;