From 4b2b4af606237def78273a42e881ae9f971cb505 Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Wed, 4 Nov 2026 01:29:57 +0100
Subject: net: block private and link-local URLs

---
 src/commands/music.rs | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'src/commands/music.rs')

diff --git a/src/commands/music.rs b/src/commands/music.rs
index 245eb88..baa91b1 100644
--- a/src/commands/music.rs
+++ b/src/commands/music.rs
@@ -121,6 +121,10 @@ async fn resolve_source(
         let url = name.clone();
         let display_name = clean_name(url.rsplit('/').next().unwrap_or(&url));
 
+        if !ctx.data().copyparty.is_own_url(&url) {
+            crate::net::ensure_public_http_url(&url).await?;
+        }
+
         // yt-dlp platforms → download; everything else (radio, HLS,
         // playlists, Copyparty, direct media) → ffmpeg stream.
         let kind = classify_url(&url);
-- 
cgit v1.2.3