Merge remote-tracking branch 'origin/master' into dev

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4iDiYSpWJD13YQUdNKC5o

docker/main/rootfs/usr/local/go2rtc/create_config.py

@@ -8,15 +8,17 @@ from typing import Any
 from ruamel.yaml import YAML
 
 sys.path.insert(0, "/opt/frigate")
-from frigate.const import (
-    BIRDSEYE_PIPE,
-    LIBAVFORMAT_VERSION_MAJOR,
-)
+from frigate.const import BIRDSEYE_PIPE
 from frigate.ffmpeg_presets import parse_preset_hardware_acceleration_encode
-from frigate.util.config import find_config_file, resolve_ffmpeg_path
+from frigate.util.config import (
+    find_config_file,
+    is_valid_ffmpeg_path,
+    resolve_ffmpeg_path,
+)
 from frigate.util.env import apply_config_env_vars, substitute_frigate_vars
 from frigate.util.live_streams import raw_transcode_streams
 from frigate.util.services import (
+    apply_go2rtc_ffmpeg_config,
     is_go2rtc_arbitrary_exec_allowed,
     is_restricted_go2rtc_source,
 )
@@ -97,20 +99,17 @@ if go2rtc_config.get("rtsp", {}).get("password") is not None:
 
 # ensure ffmpeg path is set correctly
 path = config.get("ffmpeg", {}).get("path", "default")
+if not is_valid_ffmpeg_path(path):
+    print(
+        "[ERROR] ffmpeg path contains spaces, quotes or shell characters, using the default ffmpeg instead."
+    )
 ffmpeg_path = resolve_ffmpeg_path(path, "ffmpeg")
 
-if go2rtc_config.get("ffmpeg") is None:
-    go2rtc_config["ffmpeg"] = {"bin": ffmpeg_path}
-elif go2rtc_config["ffmpeg"].get("bin") is None:
-    go2rtc_config["ffmpeg"]["bin"] = ffmpeg_path
-
-# need to replace ffmpeg command when using ffmpeg4
-if LIBAVFORMAT_VERSION_MAJOR < 59:
-    rtsp_args = "-fflags nobuffer -flags low_delay -stimeout 10000000 -user_agent go2rtc/ffmpeg -rtsp_transport tcp -i {input}"
-    if go2rtc_config.get("ffmpeg") is None:
-        go2rtc_config["ffmpeg"] = {"rtsp": rtsp_args}
-    elif go2rtc_config["ffmpeg"].get("rtsp") is None:
-        go2rtc_config["ffmpeg"]["rtsp"] = rtsp_args
+for key in apply_go2rtc_ffmpeg_config(go2rtc_config, ffmpeg_path):
+    print(
+        f"[ERROR] go2rtc option '{key}' was ignored because it is disabled by default for security. "
+        f"Set GO2RTC_ALLOW_ARBITRARY_EXEC=true to enable arbitrary exec."
+    )
 
 
 for name in list(go2rtc_config.get("streams", {})):
@@ -121,7 +120,7 @@ for name in list(go2rtc_config.get("streams", {})):
             formatted_stream = substitute_frigate_vars(stream)
             if is_restricted_go2rtc_source(formatted_stream):
                 print(
-                    f"[ERROR] Stream '{name}' uses a restricted source (echo/expr/exec) which is disabled by default for security. "
+                    f"[ERROR] Stream '{name}' uses a restricted source (echo/expr/exec or ${{VAR}}) which is disabled by default for security. "
                     f"Set GO2RTC_ALLOW_ARBITRARY_EXEC=true to enable arbitrary exec sources."
                 )
                 del go2rtc_config["streams"][name]
@@ -140,7 +139,7 @@ for name in list(go2rtc_config.get("streams", {})):
                 formatted_stream = substitute_frigate_vars(stream_item)
                 if is_restricted_go2rtc_source(formatted_stream):
                     print(
-                        f"[ERROR] Stream '{name}' item {i + 1} uses a restricted source (echo/expr/exec) which is disabled by default for security. "
+                        f"[ERROR] Stream '{name}' item {i + 1} uses a restricted source (echo/expr/exec or ${{VAR}}) which is disabled by default for security. "
                         f"Set GO2RTC_ALLOW_ARBITRARY_EXEC=true to enable arbitrary exec sources."
                     )
                     continue
@@ -156,7 +155,7 @@ for name in list(go2rtc_config.get("streams", {})):
             go2rtc_config["streams"][name] = filtered_streams
         else:
             print(
-                f"[ERROR] Stream '{name}' was removed because all sources were restricted (echo/expr/exec). "
+                f"[ERROR] Stream '{name}' was removed because all sources were restricted (echo/expr/exec or ${{VAR}}). "
                 f"Set GO2RTC_ALLOW_ARBITRARY_EXEC=true to enable arbitrary exec sources."
             )
             del go2rtc_config["streams"][name]

docker/main/rootfs/usr/local/nginx/conf/auth_location.conf

@@ -3,6 +3,8 @@ location /auth {
     ## Essential Proxy Configuration
     internal;
     proxy_pass http://frigate_api/auth;
+    # $go2rtc_stream_proxy is only set by the go2rtc stream locations
+    uninitialized_variable_warn off;
 
     ## Headers