Benjamin benjamin
  • Joined on 2026-03-15
benjamin commented on issue be-nj/castarr#12 2026-08-26 02:19:01 +02:00
Reconnect strategy: back off instead of retrying instantly after a stream drops

Fixed in dd612fc, shipped in v0.9.0 — on both sides.

Server: channel_shutdown_delay was 0, so Dispatcharr tore down the upstream connection the instant the last viewer left and opened a…

benjamin commented on issue be-nj/castarr#11 2026-08-26 02:18:54 +02:00
App crashes on startup when the control port is taken or a MediaSession still exists

Fixed in dd612fc, shipped in v0.9.0.

  • The MediaSession gets an explicit id: MediaSession.Builder(context, player).setId("castarr").build(), so it no longer collides on the default empty id. -…
benjamin closed issue be-nj/castarr#10 2026-08-26 02:18:43 +02:00
M3U parser: names with commas get truncated, BOM breaks the first entry, no format validation
benjamin closed issue be-nj/castarr#9 2026-08-26 02:18:42 +02:00
Phone remote: "Verbinden" does nothing after a wrong pairing code
benjamin commented on issue be-nj/castarr#10 2026-08-26 02:18:35 +02:00
M3U parser: names with commas get truncated, BOM breaks the first entry, no format validation

Fixed in dd612fc, shipped in v0.9.0 — with unit tests, since the comma logic is easy to get subtly wrong.

  • Names with commas survive: the display name is taken after the first unquoted
benjamin commented on issue be-nj/castarr#9 2026-08-26 02:18:28 +02:00
Phone remote: "Verbinden" does nothing after a wrong pairing code

Fixed in dd612fc, shipped in v0.9.0.

  • state.ws is cleared in onclose, and the pair button now checks readyState <= 1 before choosing between close() and connect() — so a closed socket…
benjamin closed issue be-nj/castarr#8 2026-08-26 02:17:17 +02:00
Phone remote: status pushes rebuild the list every 2 s, swallowing taps and overwriting typed input
benjamin commented on issue be-nj/castarr#8 2026-08-26 02:17:16 +02:00
Phone remote: status pushes rebuild the list every 2 s, swallowing taps and overwriting typed input

Fixed in dd612fc, shipped in v0.9.0. All three parts:

  1. No more blind rebuilds. Status pushes go through renderChannelsIfChanged(), which compares a signature (channel count, search term,…
benjamin closed issue be-nj/castarr#7 2026-08-26 02:17:05 +02:00
Playback errors drop the viewer back to the list without ever showing the error
benjamin commented on issue be-nj/castarr#7 2026-08-26 02:17:03 +02:00
Playback errors drop the viewer back to the list without ever showing the error

Fixed in dd612fc, shipped in v0.9.0.

  • AppState.syncFromPlayer() only hides the player when there is neither an error nor a pending reconnect, so a failure no longer drops the viewer back to…
benjamin closed issue be-nj/castarr#6 2026-08-26 02:16:52 +02:00
Pausing during buffering does nothing — playback can resume in the background after leaving the app
benjamin commented on issue be-nj/castarr#6 2026-08-26 02:16:50 +02:00
Pausing during buffering does nothing — playback can resume in the background after leaving the app

Fixed in dd612fc, shipped in v0.9.0.

Both methods now act on the intent flag instead of the derived isPlaying:

fun pause() { player.playWhenReady = false }
fun toggle() { if
benjamin closed issue be-nj/castarr#5 2026-08-26 02:16:41 +02:00
seekBy always jumps to position 0 when the duration is unknown
benjamin commented on issue be-nj/castarr#5 2026-08-26 02:16:39 +02:00
seekBy always jumps to position 0 when the duration is unknown

Fixed in dd612fc, shipped in v0.9.0.

seekBy() no longer clamps against an unknown duration:

val duration = player.duration
var target = (player.currentPosition + deltaSeconds *
benjamin closed issue be-nj/castarr#4 2026-08-26 02:16:31 +02:00
set_playlist: unrestricted URL fetch (SSRF) with unbounded response buffering
benjamin commented on issue be-nj/castarr#4 2026-08-26 02:16:29 +02:00
set_playlist: unrestricted URL fetch (SSRF) with unbounded response buffering

Fixed in dd612fc, shipped in v0.9.0.

  • open() now validates the scheme and rejects anything that is not http/https before opening the connection.
  • download() streams into a builder with…
benjamin closed issue be-nj/castarr#3 2026-08-26 02:16:17 +02:00
Pairing token travels in cleartext, lands in cloud backups and never rotates
benjamin commented on issue be-nj/castarr#3 2026-08-26 02:16:14 +02:00
Pairing token travels in cleartext, lands in cloud backups and never rotates

Fixed in dd612fc, shipped in v0.9.0 — with one deliberate exception noted below.

  • Backup: res/xml/backup_rules.xml and res/xml/data_extraction_rules.xml exclude pairing.xml and…
benjamin closed issue be-nj/castarr#2 2026-08-26 02:15:58 +02:00
Pairing: global rate limit lets anyone lock out the code, and the code path hands out the permanent token
benjamin commented on issue be-nj/castarr#2 2026-08-26 02:15:57 +02:00
Pairing: global rate limit lets anyone lock out the code, and the code path hands out the permanent token

Fixed in dd612fc, shipped in v0.9.0. All three weaknesses are addressed:

  1. Rate limiting is per remote address and counts every failed hello, whether it carried a token or a code…