Camera event stream, video player, some security tweaks

controllers/CameraController.php

@@ -5,6 +5,9 @@ namespace app\controllers;
 use Yii;
 use yii\web\Controller;
 
+use yii\web\NotFoundHttpException;
+use yii\web\ForbiddenHttpException;
+
 class CameraController extends Controller
 {
     public function actionStream($id, $scale = 50)
@@ -72,12 +75,54 @@ class CameraController extends Controller
 		return $result;
 	}
 
-	public function actionViewArchive($event_id)
+	private function getZMEvent($event_id)
 	{
+		$client = new \app\components\ApiClient(Yii::$app->params['zmUrl'].'zm/api');
+		$json = $client->getEvent($event_id);
+		$r = json_decode($json, true);
+		$e = new \app\models\zm\Event($r['event']['Event']);
+		return $e;
+	}
+
+	private function checkCameraAccess($camera_id, $event_id)
+	{
+		$cms = Yii::$app->params['cameras'];
+		if (!isset($cms[$camera_id]))
+		{
+			throw new NotFoundHttpException();
+		}
+		$e = $this->getZMEvent($event_id);
+		if ($e->monitor_id !== $camera_id)
+		{
+			throw new ForbiddenHttpException();
+		}
+
+	}
+
+	public function actionViewArchive($camera_id, $event_id)
+	{
+		$this->checkCameraAccess($camera_id, $event_id);
 		return $this->render('view_archive',
 			[
+				'camera_id' => $camera_id,
 				'id' => $event_id,
+				'event' => $this->getZMEvent($event_id),
 			]);
 	}
+
+	public function actionStreamEvent($camera_id, $event_id)
+	{
+		$this->checkCameraAccess($camera_id, $event_id);
+		$source_url = Yii::$app->params['zmUrl'].'/zm/index.php?mode=mpeg&format=h264&eid='.$event_id.'&view=view_video';
+		$fp = fopen($source_url, 'r', false);
+		if ($fp)
+		{
+			Yii::$app->response->format = \yii\web\Response::FORMAT_RAW;
+			// pass data
+			fpassthru($fp);
+			fclose($fp);
+		}
+		else throw new NotFoundHttpException();
+	}
 }