From 18d2c3bda9d1b22797842a99d3ee697dddf26db6 Mon Sep 17 00:00:00 2001
From: "Jahleel A." <jahleelabraham@hotmail.com>
Date: Thu, 21 Mar 2024 21:20:27 +0000
Subject: [PATCH] Added arguments and shell escaping

---
 www/lib/lib.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/www/lib/lib.php b/www/lib/lib.php
index fc323e2e..ec398bcd 100644
--- a/www/lib/lib.php
+++ b/www/lib/lib.php
@@ -772,10 +772,12 @@ public function checkConnection() {
 		ini_set('default_socket_timeout', 1);
 
 		$path = "";
+		$args = "";
 
 		switch($this->info['protocol'])  {
 			case 'IP-RTSP':
-				$path = '-rtsp_transport tcp "rtsp://'.((empty($this->info['rtsp_username'])) ? '' : $this->info['rtsp_username'].':'.$this->info['rtsp_password'].'@').$this->info['ipAddr'].':'.$this->info['port'].$this->info['rtsp'].'"';
+				$path = 'rtsp://'.((empty($this->info['rtsp_username'])) ? '' : $this->info['rtsp_username'].':'.$this->info['rtsp_password'].'@').$this->info['ipAddr'].':'.$this->info['port'].$this->info['rtsp'];
+				$args = array("-rtsp_flags +prefer_tcp", "-rtsp_transport tcp", "-rtsp_transport tcp")[$this->info['rtsp_rtp_prefer_tcp']];
 				break;
 			case 'IP-MJPEG': 
 				//FIXME: This is the old logic for testing MJPEG. Testing for MJPEG is currently not supported by the bundled ffprobe method used for RTSP
@@ -789,7 +791,7 @@ public function checkConnection() {
 
 		//-> '-stimeout' is measured in microseconds
 		$ffprobe_output = shell_exec(
-			"/usr/lib/bluecherry/ffprobe -stimeout 5000000 -hide_banner -show_format -show_streams -print_format json ".$path);
+			"/usr/lib/bluecherry/ffprobe -stimeout 5000000 -hide_banner -show_format -show_streams -print_format json ".$args. " " . escapeshellarg($path));
 
 		$rtsp_data = json_decode($ffprobe_output, true);