From 692b77b4da7f96e230b3e009dd5c123e8a2c77fd Mon Sep 17 00:00:00 2001
From: Isaac Connor <isaac@zoneminder.com>
Date: Tue, 31 Mar 2026 12:27:56 -0400
Subject: [PATCH] fix: guard against empty auth_relay producing double && in
 zms URLs

When auth is disabled or auth_relay is empty, appending '&'+auth_relay
produces a trailing '&' which results in double '&&' when the next
parameter is appended (e.g. ?monitor=2&&scale=41&mode=single).

Guard all 4 places in MonitorStream.js where auth_relay is concatenated
into URLs, consistent with EventStream.js which already guards this.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 web/js/MonitorStream.js | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/web/js/MonitorStream.js b/web/js/MonitorStream.js
index c386ad3ba..d75a6e936 100644
--- a/web/js/MonitorStream.js
+++ b/web/js/MonitorStream.js
@@ -188,7 +188,7 @@ function MonitorStream(monitorData) {
   this.show = function() {
     const stream = this.getElement();
     if (!stream.src) {
-      stream.src = this.url_to_zms+"&mode=single&scale="+this.scale+"&connkey="+this.connKey+'&'+auth_relay;
+      stream.src = this.url_to_zms+"&mode=single&scale="+this.scale+"&connkey="+this.connKey+(auth_relay?'&'+auth_relay:'');
     }
   };
 
@@ -605,9 +605,9 @@ function MonitorStream(monitorData) {
       this.streamCommand(CMD_PLAY);
     } else {
       let src = this.url_to_zms.replace(/mode=single/i, 'mode=jpeg');
-      if (-1 == src.search('auth')) {
+      if (-1 == src.search('auth') && auth_relay) {
         src += '&'+auth_relay;
-      } else {
+      } else if (-1 != src.search('auth')) {
         src = src.replace(/auth=\w+/i, 'auth='+auth_hash);
       }
       if (-1 == src.search('connkey')) {
@@ -647,9 +647,9 @@ function MonitorStream(monitorData) {
     if (!imgInfoBlock) return null;
 
     let src = this.url_to_zms.replace(/mode=jpeg/i, 'mode=single');
-    if (-1 == src.search('auth')) {
+    if (-1 == src.search('auth') && auth_relay) {
       src += '&'+auth_relay;
-    } else {
+    } else if (-1 != src.search('auth')) {
       src = src.replace(/auth=\w+/i, 'auth='+auth_hash);
     }
     if (-1 == src.search('scale=')) {
@@ -1601,7 +1601,7 @@ function MonitorStream(monitorData) {
   }; // this.getStatusCmdResponse
 
   this.statusCmdQuery = function() {
-    $j.getJSON(this.url + '?view=request&request=status&entity=monitor&element[]=Status&element[]=CaptureFPS&element[]=AnalysisFPS&element[]=Analysing&element[]=Recording&id='+this.id+'&'+auth_relay)
+    $j.getJSON(this.url + '?view=request&request=status&entity=monitor&element[]=Status&element[]=CaptureFPS&element[]=AnalysisFPS&element[]=Analysing&element[]=Recording&id='+this.id+(auth_relay?'&'+auth_relay:''))
         .done(this.getStatusCmdResponse.bind(this))
         .fail(logAjaxFail);