withhold MJPEG stream URLs until authentication

- main.html fills the url attribute only when a session exists
- doAuth() reloads the frame page after login, so the stream starts
  without a manual refresh
- refreshCameraFrame() skips the refresh while the URL is empty
- frame() marks its response uncacheable

Author: Marijn0

motioneye/handlers/picture.py

@@ -252,6 +252,8 @@ async def list(self, camera_id):
             raise HTTPError(400, 'unknown operation')
 
     async def frame(self, camera_id):
+        self.set_header('Cache-Control', 'private, no-store, must-revalidate')
+
         camera_config = config.get_camera(camera_id)
 
         if (

motioneye/static/js/frame.js

@@ -82,6 +82,10 @@ function refreshCameraFrame() {
 
     if (cameraFrame.proto == 'mjpeg') {
         /* no manual refresh for simple mjpeg cameras */
+        if (!cameraFrame.url) {
+            return; /* the stream URL is withheld until login */
+        }
+
         var url = cameraFrame.url.replace('127.0.0.1', window.location.host.split(':')[0]);
         url += (url.indexOf('?') > 0 ? '&' : '?') + '_=' + new Date().getTime();
         img.src = url;

motioneye/static/js/main.js

@@ -5494,6 +5494,10 @@ function doAuth() {
                 if (!frame) {
                     fetchCurrentConfig(endProgress);
                 }
+                else if (frame && !currentUser) {
+                    /* the page was rendered anonymously and lacks the stream URL */
+                    window.location.reload();
+                }
             } else {
                 // Session invalid, show login dialog
                 runLoginDialog(function () {

motioneye/templates/main.html

@@ -1360,7 +1360,7 @@
     {% else %}
         <div class="camera-frame" id="camera{{camera_id}}"
             streaming_framerate="{{camera_config['stream_maxrate']}}" streaming_server_resize="{{camera_config['@webcam_server_resize']|string|lower}}"
-            proto="{{camera_config['@proto']}}" url="{{camera_config['@url']}}">
+            proto="{{camera_config['@proto']}}" url="{% if current_user %}{{camera_config['@url']}}{% endif %}">
             <div class="camera-container">
                 <div class="camera-placeholder"><img class="no-camera" src="{{static_path}}img/no-camera.svg"></div>
                 <img class="camera">