mirror of
https://github.com/rommapp/romm.git
synced 2026-06-29 23:35:47 +00:00
SS media URLs are stripped of ssid/sspassword before DB storage (correct), but downloads were issued against the credential-less stored URLs, causing them to count against the anonymous IP quota instead of the user's account. Adds restore_sensitive_query_params() as the principled complement to strip_sensitive_query_params(), and add_ss_auth_to_url() in ss_handler which re-attaches credentials at download time without storing them. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>