From 3ec98122652ff7c104b95c7d042a9a0fbd223c10 Mon Sep 17 00:00:00 2001
From: Koala <6156589+Shik3i@users.noreply.github.com>
Date: Tue, 2 Jun 2026 08:17:08 +0200
Subject: [PATCH] fix: use server-trusted peerId in relay payload to prevent
 spoofing

---
 server/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/index.js b/server/index.js
index 9c449a8..07d5232 100644
--- a/server/index.js
+++ b/server/index.js
@@ -503,7 +503,7 @@ io.on('connection', (socket) => {
                         mediaTitle:      clamp(data.mediaTitle, 100),
                         volume:          clampNum(data.volume, 0, 1),
                         muted:           validBool(data.muted),
-                        peerId:          typeof data.peerId === 'string' ? data.peerId.substring(0, 16) : undefined,
+                        peerId:          mapping.peerId,
                         status:          typeof data.status === 'string' ? data.status.substring(0, 16) : undefined,
                         expectedTitle:   clamp(data.expectedTitle, 100),
                         title:           clamp(data.title, 100),