mirror of
https://github.com/bilawalsidhu/gods-eye-view.git
synced 2026-11-04 10:24:02 +00:00
/api/cctv/media relayed still-image cameras with an ordinary fetch: it followed redirects to any host, passed through any content type and had no body cap. Stills are served by /api/cctv/frame, which keeps redirects on the registered origin, accepts only image/* and caps the body, and no client requests a still through /media. /media now answers 404 for anything but HLS, MP4/WebM and MJPEG, before any upstream request.