diff --git a/api/version/media-url.php b/api/version/media-url.php
index 1901870..d103c34 100644
--- a/api/version/media-url.php
+++ b/api/version/media-url.php
@@ -105,6 +105,8 @@ $mediaUrl = null;
 if ($providedUrl) {
     // Reconstruir la URL si fue pasada sin codificar y otros parámetros quedaron como GET separados
     $mediaUrl = $providedUrl;
+    // Normalizar entidades HTML que puedan haber sido almacenadas (ej. & -> &)
+    $mediaUrl = html_entity_decode($mediaUrl, ENT_QUOTES | ENT_HTML5);
     $ignoredKeys = ['url','download','id','local'];
     $extraParts = [];
     foreach ($_GET as $k => $v) {
diff --git a/chat_window.php b/chat_window.php
index 18b8e15..e195db3 100644
--- a/chat_window.php
+++ b/chat_window.php
@@ -707,18 +707,47 @@ if (empty($user_id)) {
                             }
                             break;
                         case 'video':
-                            contentHtml = `<video controls class="message-media-video">
-                                <source src="${msg.media_url}" type="video/mp4">
-                                Tu navegador no soporta video HTML5.
-                            </video>`;
+                            // Determinar mejor fuente de media
+                            const mediaSrcVid = isValidMediaUrl(fullUrl) ? fullUrl : (isValidMediaUrl(thumbUrl) ? thumbUrl : (isValidMediaUrl(msg.media_url) ? msg.media_url : (isValidMediaUrl(msg.media_url_external) ? msg.media_url_external : '')));
+                            console.debug('video media src:', mediaSrcVid, 'fullUrl:', fullUrl, 'thumbUrl:', thumbUrl, 'msg.media_url:', msg.media_url, 'msg.media_url_external:', msg.media_url_external);
+                            if (isValidMediaUrl(mediaSrcVid)) {
+                                contentHtml = `<video controls class="message-media-video">
+                                    <source src="${escapeHtml(mediaSrcVid)}" type="video/mp4">
+                                    Tu navegador no soporta video HTML5.
+                                </video>`;
+                            } else {
+                                contentHtml = `<div class="text-muted"><em>Video no disponible</em></div>`;
+                            }
                             break;
                         case 'audio':
-                            contentHtml = `<audio controls class="message-media-audio">
-                                <source src="${msg.media_url}" type="audio/webm">
-                                <source src="${msg.media_url}" type="audio/mpeg">
-                                <source src="${msg.media_url}" type="audio/ogg">
-                                Tu navegador no soporta audio HTML5.
-                            </audio>`;
+                            // Determinar mejor fuente de media para audio
+                            const mediaSrcAudio = isValidMediaUrl(fullUrl) ? fullUrl : (isValidMediaUrl(thumbUrl) ? thumbUrl : (isValidMediaUrl(msg.media_url) ? msg.media_url : (isValidMediaUrl(msg.media_url_external) ? msg.media_url_external : '')));
+                            if (isValidMediaUrl(mediaSrcAudio)) {
+                                contentHtml = `<audio controls class="message-media-audio">
+                                    <source src="${escapeHtml(mediaSrcAudio)}" type="audio/webm">
+                                    <source src="${escapeHtml(mediaSrcAudio)}" type="audio/mpeg">
+                                    <source src="${escapeHtml(mediaSrcAudio)}" type="audio/ogg">
+                                    Tu navegador no soporta audio HTML5.
+                                </audio>`;
+                                console.debug('audio media src:', mediaSrcAudio, 'effective_media:', msg.effective_media, 'media_url_external:', msg.media_url_external, 'local_file:', msg.local_file);
+                                // Añadir enlace de descarga seguro / proxy si es posible
+                                let audioDownload = null;
+                                let candidate = isValidMediaUrl(msg.effective_media) ? msg.effective_media : (isValidMediaUrl(msg.media_url_external) ? msg.media_url_external : (isValidMediaUrl(msg.local_file) ? msg.local_file : null));
+                                if (candidate && candidate.indexOf && candidate.indexOf('api/get_media.php?id=') !== -1) {
+                                    const parts = candidate.split('id=');
+                                    const mid = parts[1] ? decodeURIComponent(parts[1]) : '';
+                                    audioDownload = `/api/version/media-url.php?id=${encodeURIComponent(mid)}&download=1`;
+                                } else if (candidate && /^https?:\/\//i.test(candidate)) {
+                                    audioDownload = `/api/version/media-url.php?url=${encodeURIComponent(candidate)}&download=1`;
+                                } else if (candidate && candidate === msg.local_file) {
+                                    audioDownload = `/api/version/media-url.php?local=${encodeURIComponent(candidate)}&download=1`;
+                                }
+                                if (audioDownload) {
+                                    contentHtml += `<div class="mt-2"><a href="${audioDownload}" class="btn btn-sm btn-outline-secondary" target="_blank" rel="noopener noreferrer">Descargar audio</a></div>`;
+                                }
+                            } else {
+                                contentHtml = `<div class="text-muted"><em>Audio no disponible</em></div>`;
+                            }
                             break;
                         case 'document':
                             const filename = msg.filename || msg.content || 'Documento';