From 395ca1a6f62b7b0e270e654d366a2d57b8042efd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miroslav=20=C5=A0ediv=C3=BD?= <sedivy.miro@gmail.com>
Date: Wed, 5 Aug 2026 16:28:51 +0200
Subject: [PATCH] fix: correct LegacyIsHost boolean logic (#675)

* fix: broken LegacyIsHost method.

* fix: improve LegacyIsHost logic for better access control.
---
 server/internal/session/session.go | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/server/internal/session/session.go b/server/internal/session/session.go
index e96a3e74..114233f7 100644
--- a/server/internal/session/session.go
+++ b/server/internal/session/session.go
@@ -75,8 +75,14 @@ func (session *SessionCtx) IsHost() bool {
 
 // only needed for legacy webrtc handler
 func (session *SessionCtx) LegacyIsHost() bool {
-	implicitHosting := session.manager.Settings().ImplicitHosting
-	return !(!implicitHosting && !session.manager.isHost(session)) || (implicitHosting && !session.profile.CanHost)
+	settings := session.manager.Settings()
+	if !session.profile.CanHost || session.PrivateModeEnabled() {
+		return false
+	}
+	if settings.LockedControls && !session.profile.IsAdmin {
+		return false
+	}
+	return settings.ImplicitHosting || session.manager.isHost(session)
 }
 
 func (session *SessionCtx) SetAsHost() {