diff --git a/apps/electron-backend/src/app/events/xtream.events.ts b/apps/electron-backend/src/app/events/xtream.events.ts index cf95d162a..e8ef3d09e 100644 --- a/apps/electron-backend/src/app/events/xtream.events.ts +++ b/apps/electron-backend/src/app/events/xtream.events.ts @@ -279,8 +279,6 @@ ipcMain.handle( // for self-hosted setups. Redirects stay disabled below so a validated // URL cannot bounce to a different private target. try { - // Private/LAN targets are allowed (users probe self-hosted Xtream - // servers); maxRedirects:0 below blocks redirect-based SSRF. await assertRemoteUrlAllowed(payload.url, { allowPrivateNetworks: true, });