Block a user
Control server: no socket timeout and unlimited connections allow thread exhaustion
Control server: no socket timeout and unlimited connections allow thread exhaustion
Fixed in dd612fc, shipped in v0.9.0.
startServer()now usesstart(NanoHTTPD.SOCKET_READ_TIMEOUT, true), so accepted sockets get a read deadline instead of blocking forever.- The ping timer…
Leaving playback should return to where the viewer was in the channel list
Reconnect strategy: back off instead of retrying instantly after a stream drops
App crashes on startup when the control port is taken or a MediaSession still exists
M3U parser: names with commas get truncated, BOM breaks the first entry, no format validation
Phone remote: "Verbinden" does nothing after a wrong pairing code
Phone remote: status pushes rebuild the list every 2 s, swallowing taps and overwriting typed input
Playback errors drop the viewer back to the list without ever showing the error
Pausing during buffering does nothing — playback can resume in the background after leaving the app
seekBy always jumps to position 0 when the duration is unknown
set_playlist: unrestricted URL fetch (SSRF) with unbounded response buffering
Pairing token travels in cleartext, lands in cloud backups and never rotates