Harden remote access and path handling

app.py

@@ -49,6 +49,7 @@ from app_support import (
     WORKER_SHUTDOWN_TIMEOUT_SECONDS,
     background_workers_enabled,
     client_address_is_local,
+    clear_remote_access_sessions,
     debug_log,
     load_json,
     migrate_legacy_state_storage,
@@ -57,8 +58,10 @@ from app_support import (
     normalize_episode_offset,
     normalize_media_type,
     now_iso,
+    remote_access_session_fingerprint,
     sanitize_path_component,
     thumbnail_file_path,
+    validate_discord_webhook_url,
     write_json,
 )
 from http_handler import HandlerContext, build_handler_class, server_host, server_port
@@ -2647,12 +2650,16 @@ def save_runtime_config(config):
     if isinstance(config, dict):
         merged.update(config)
     normalized = normalize_config(merged)
+    previous_fingerprint = remote_access_session_fingerprint(current)
+    next_fingerprint = remote_access_session_fingerprint(normalized)
     scheduler = None
     with RUNTIME_LOCK:
         global CONFIG
         CONFIG = dict(normalized)
         write_json(CONFIG_PATH, CONFIG)
         scheduler = WATCHLIST_AUTO_REFRESH
+    if previous_fingerprint and previous_fingerprint != next_fingerprint:
+        clear_remote_access_sessions({"fingerprint": previous_fingerprint})
     if scheduler is not None:
         scheduler.notify_config_changed()
     return dict(CONFIG)
@@ -2662,6 +2669,7 @@ def test_discord_webhook_config(config):
     normalized = normalize_config(config)
     if not normalized.get("discord_webhook_url"):
         raise ValueError("Discord webhook URL is required for testing.")
+    validate_discord_webhook_url(normalized["discord_webhook_url"])
     send_discord_webhook_event(normalized, "test", force=True)
     return {"message": "Discord webhook test notification sent."}