From 2e40e78413194050b7f0ae0f0e96b9e526c9c02a Mon Sep 17 00:00:00 2001
From: Mitchell R <root@mitchellr.info>
Date: Thu, 21 May 2026 16:29:24 +0200
Subject: [PATCH] fix(admin): mask passwords in stream RTSP URIs on camera
 detail page

---
 server/src/web-templates/admin-pages.tsx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/server/src/web-templates/admin-pages.tsx b/server/src/web-templates/admin-pages.tsx
index 188832c..be67c9e 100644
--- a/server/src/web-templates/admin-pages.tsx
+++ b/server/src/web-templates/admin-pages.tsx
@@ -1318,7 +1318,7 @@ export function CameraEditPage(props: CameraEditProps) {
                     <tr>
                       <td><span class="badge badge-gray">{s.role}</span></td>
                       <td>{s.name}</td>
-                      <td style="font-size:0.8rem; word-break:break-all">{s.rtsp_uri}</td>
+                      <td style="font-size:0.8rem; word-break:break-all">{maskRtspPassword(s.rtsp_uri)}</td>
                     </tr>
                   ))}
                 </tbody>
@@ -2846,6 +2846,10 @@ function parseRtspUrl(url: string): { host: string; port: string; path: string;
   };
 }
 
+function maskRtspPassword(uri: string): string {
+  return uri.replace(/(rtsp:\/\/[^:]+:)([^@]+)(@)/, "$1**********$3");
+}
+
 function formatTime(iso: string): string {
   try {
     const d = new Date(iso);