完善观众端目录与回放状态降级

backend/routes/streams.py

@@ -2,6 +2,7 @@ import json
 import secrets
 import asyncio
 import time
+import ntpath
 from pathlib import Path
 
 from fastapi import APIRouter, HTTPException, Depends, Request
@@ -62,7 +63,8 @@ def _media_path(filename: str | None) -> Path | None:
         return None
     root = Path(settings.replay_media_dir).resolve()
     supplied = Path(filename)
-    if supplied.is_absolute() or supplied.drive or ".." in supplied.parts:
+    windows_drive, _ = ntpath.splitdrive(filename)
+    if supplied.is_absolute() or supplied.drive or windows_drive or ".." in supplied.parts:
         raise HTTPException(status_code=422, detail="回放文件不在允许的媒体目录中")
     candidate = (root / supplied).resolve()
     if candidate != root and root not in candidate.parents: