From 506584ceee4571298c77522f689078d6b94860a0 Mon Sep 17 00:00:00 2001
From: Pierre Rudloff <contact@rudloff.pro>
Date: Sun, 24 Mar 2019 15:13:01 +0100
Subject: [PATCH] fix: Specify allowed protocols explicitely

"^=http" also catches http_dash_segments
---
 controllers/FrontController.php | 13 ++++---------
 templates/video.tpl             |  4 ++--
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/controllers/FrontController.php b/controllers/FrontController.php
index 7c27d75..1e22d87 100644
--- a/controllers/FrontController.php
+++ b/controllers/FrontController.php
@@ -67,7 +67,7 @@ class FrontController
      *
      * @var string
      */
-    private $defaultFormat = 'best[protocol^=http]';
+    private $defaultFormat = 'best[protocol=https]/best[protocol=http]';
 
     /**
      * LocaleManager instance.
@@ -265,14 +265,14 @@ class FrontController
     private function getAudioResponse(Request $request, Response $response, array $params, $password = null)
     {
         try {
-            if (isset($params['from']) || isset($params['to'])) {
+            if (isset($params['from']) && !empty($params['from']) || isset($params['to']) && !empty($params['to'])) {
                 throw new Exception('Force convert when we need to seek.');
             }
 
             if ($this->config->stream) {
                 return $this->getStream($params['url'], 'mp3', $response, $request, $password);
             } else {
-                $urls = $this->download->getURL($params['url'], 'mp3[protocol^=http]', $password);
+                $urls = $this->download->getURL($params['url'], 'mp3[protocol=https]/mp3[protocol=http]', $password);
 
                 return $response->withRedirect($urls[0]);
             }
@@ -300,11 +300,7 @@ class FrontController
         } catch (PasswordException $e) {
             return $this->password($request, $response);
         }
-        if ($this->config->stream) {
-            $protocol = '';
-        } else {
-            $protocol = '[protocol^=http]';
-        }
+
         if (isset($video->entries)) {
             $template = 'playlist.tpl';
         } else {
@@ -324,7 +320,6 @@ class FrontController
                 'class'       => 'video',
                 'title'       => $title,
                 'description' => $description,
-                'protocol'    => $protocol,
                 'config'      => $this->config,
                 'canonical'   => $this->getCanonicalUrl($request),
                 'locale'      => $this->localeManager->getLocale(),
diff --git a/templates/video.tpl b/templates/video.tpl
index cdf4242..4dfef1a 100644
--- a/templates/video.tpl
+++ b/templates/video.tpl
@@ -27,7 +27,7 @@
         {/if}
         <select name="format" id="format" class="formats monospace">
             <optgroup label="{t}Generic formats{/t}">
-                <option value="best{$protocol}">
+                <option value="{if $config->stream}best{else}best[protocol=https]/best[protocol=http]{/if}">
                     {strip}
                         {t}Best{/t} ({$video->ext})
                     {/strip}
@@ -37,7 +37,7 @@
                         {t}Remux best video with best audio{/t}
                     </option>
                 {/if}
-                <option value="worst{$protocol}">
+                <option value="{if $config->stream}worst{else}worst[protocol=https]/worst[protocol=http]{/if}">
                     {t}Worst{/t}
                 </option>
             </optgroup>