DLNA/Cast stream server listens on every interface and serves any client #102

In DLNA and Cast modes the desktop stream is served to anyone who asks. While a session is running, any machine on the network can open vlc http://<your-ip>:8080/ and watch. There is nothing to guess, the port defaults to 8080 and the paths are fixed.

Three small things add up to it. main.py:355 binds the server to 0.0.0.0, so it listens on every interface including VPN and the transient P2P one, even though the address the TV is actually told to use is already computed at main.py:287. The URL we hand the device carries a session prefix (main.py:288), but session_id never appears in server.py, so /live.ts and a bare / are served without it and the prefix does nothing. And client_address is only written to the log (server.py:350), never compared against the target device.

The same applies locally: HLS_DIR is a fixed /tmp/fluxcast created with default permissions, so other users on the machine can read the segments off disk.

Fixing it means binding to the address from main.py:287, actually enforcing the session prefix and generating it with secrets.token_urlsafe instead of int(time.time()), refusing requests that don't come from the target device, and creating the segment directory per session with mode 0700. None of that changes anything for the user, the TV already receives that exact address and path from us.

WFD is unaffected, it never reaches this server.

To check: with a session running, curl -sI http://<your-ip>:8080/ from another machine should be refused while the TV keeps playing.