From 4488a8939166fe00196e88fd4074bf472e980f29 Mon Sep 17 00:00:00 2001
From: Estrella Pan <estrellaxd05@gmail.com>
Date: Mon, 26 Jan 2026 20:11:40 +0100
Subject: [PATCH] fix(player): normalize URLs without protocol to prevent
 relative path redirects

URLs entered without http:// or https:// were being treated as relative
paths by the browser. Added normalizeUrl() function that prepends http://
when no protocol is present.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .../src/components/setting/config-player.vue  |  6 ++---
 webui/src/store/player.ts                     | 22 ++++++++++++++++++-
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/webui/src/components/setting/config-player.vue b/webui/src/components/setting/config-player.vue
index 0a07e5ec..a3cdd552 100644
--- a/webui/src/components/setting/config-player.vue
+++ b/webui/src/components/setting/config-player.vue
@@ -1,5 +1,5 @@
 <script lang="ts" setup>
-const { types, type, url } = storeToRefs(usePlayerStore());
+const { types, type, rawUrl } = storeToRefs(usePlayerStore());
 </script>
 
 <template>
@@ -13,10 +13,10 @@ const { types, type, url } = storeToRefs(usePlayerStore());
       ></ab-setting>
 
       <ab-setting
-        v-model:data="url"
+        v-model:data="rawUrl"
         type="input"
         :label="$t('config.media_player_set.url')"
-        :prop="{ placeholder: 'media player url' }"
+        :prop="{ placeholder: 'http://192.168.1.100:8096' }"
       ></ab-setting>
     </div>
   </ab-fold-panel>
diff --git a/webui/src/store/player.ts b/webui/src/store/player.ts
index 5f9ecb8e..66d57a9d 100644
--- a/webui/src/store/player.ts
+++ b/webui/src/store/player.ts
@@ -2,14 +2,34 @@ import { useLocalStorage } from '@vueuse/core';
 
 type MediaPlayerType = 'jump' | 'iframe';
 
+function normalizeUrl(url: string): string {
+  if (!url) return '';
+  const trimmed = url.trim();
+  if (!trimmed) return '';
+  // If URL already has a protocol, return as-is
+  if (/^https?:\/\//i.test(trimmed)) {
+    return trimmed;
+  }
+  // Otherwise, prepend http://
+  return `http://${trimmed}`;
+}
+
 export const usePlayerStore = defineStore('player', () => {
   const types = ref<MediaPlayerType[]>(['jump', 'iframe']);
   const type = useLocalStorage<MediaPlayerType>('media-player-type', 'jump');
-  const url = useLocalStorage('media-player-url', '');
+  const rawUrl = useLocalStorage('media-player-url', '');
+
+  const url = computed(() => normalizeUrl(rawUrl.value));
+
+  function setUrl(value: string) {
+    rawUrl.value = value;
+  }
 
   return {
     types,
     type,
     url,
+    rawUrl,
+    setUrl,
   };
 });