From b6e929d2ad71dad8e812055bbbf620fcac14891c Mon Sep 17 00:00:00 2001
From: Mitchell R <root@mitchellr.info>
Date: Tue, 26 May 2026 06:44:25 +0200
Subject: [PATCH] fix: decode XML entities in ONVIF RTSP URIs

ONVIF returns XML with &amp; in URIs. GStreamer rtspsrc cant parse
these. Now decoded before storing in camera_streams. Fixes RTSP
Unauthorized for ONVIF-discovered cameras with query params.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 server/src/plugins/service-admin-http/routes-admin.ts | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/server/src/plugins/service-admin-http/routes-admin.ts b/server/src/plugins/service-admin-http/routes-admin.ts
index 498afbe..5d237d0 100644
--- a/server/src/plugins/service-admin-http/routes-admin.ts
+++ b/server/src/plugins/service-admin-http/routes-admin.ts
@@ -112,15 +112,17 @@ async function uniqueCameraName(deps: AdminDeps, rawName: string): Promise<strin
 }
 
 function rtspWithCredentials(raw: string, username: string, password: string): string {
-  if (!username) return raw;
+  // ONVIF returns XML — URIs may contain &amp; instead of &
+  let clean = raw.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">");
+  if (!username) return clean;
   try {
-    const url = new URL(raw);
-    if (url.protocol !== "rtsp:" || url.username) return raw;
+    const url = new URL(clean);
+    if (url.protocol !== "rtsp:" || url.username) return clean;
     url.username = username;
     url.password = password;
     return url.toString();
   } catch {
-    return raw;
+    return clean;
   }
 }