diff --git a/chat_window.php b/chat_window.php
index 257d09a..02ab464 100644
--- a/chat_window.php
+++ b/chat_window.php
@@ -589,7 +589,39 @@ if (empty($user_id)) {
                     // Mensaje multimedia
                     switch (msg.message_type) {
                         case 'image':
-                            contentHtml = `<img src="${msg.media_url}" alt="Imagen" class="message-media-image" onclick="openImageModal('${msg.media_url}')">`;
+                            // Determinar miniatura y URL completa (soporte para local, api/get_media?id= y URLs directas)
+                            let thumbUrl = '';
+                            if (msg.local_thumb) {
+                                thumbUrl = `/${msg.local_thumb}`;
+                            } else if (msg.local_file) {
+                                thumbUrl = `/${msg.local_file}`;
+                            } else if (msg.media_url) {
+                                thumbUrl = msg.media_url;
+                            } else if (msg.media_url_external) {
+                                thumbUrl = msg.media_url_external; // se intentará redirigir/proxear al abrir
+                            }
+
+                            let fullUrl = '';
+                            if (msg.local_file) {
+                                fullUrl = `/api/version/media-url.php?local=${encodeURIComponent(msg.local_file)}`;
+                            } else if (msg.media_url_external) {
+                                if (msg.media_url_external.indexOf('api/get_media.php?id=') !== -1) {
+                                    const parts = msg.media_url_external.split('id=');
+                                    const mid = parts[1] ? decodeURIComponent(parts[1]) : '';
+                                    fullUrl = `/api/version/media-url.php?id=${encodeURIComponent(mid)}`;
+                                } else if (/^https?:\/\//i.test(msg.media_url_external)) {
+                                    fullUrl = `/api/version/media-url.php?url=${encodeURIComponent(msg.media_url_external)}`;
+                                } else {
+                                    fullUrl = `/api/version/media-url.php?url=${encodeURIComponent(msg.media_url_external)}`;
+                                }
+                            } else {
+                                fullUrl = msg.media_url || thumbUrl || '';
+                            }
+
+                            contentHtml = `
+                                <a href="#" onclick="openImageModal(${JSON.stringify(fullUrl)}); return false;" title="Abrir imagen">
+                                    <img src="${thumbUrl || fullUrl}" alt="Imagen" class="message-media-image">
+                                </a>`;
                             break;
                         case 'video':
                             contentHtml = `<video controls class="message-media-video">
@@ -608,7 +640,19 @@ if (empty($user_id)) {
                         case 'document':
                             const filename = msg.filename || msg.content || 'Documento';
                             const fileIcon = getFileIcon(filename);
-                            contentHtml = `<a href="${msg.media_url}" target="_blank" class="message-document" download>
+                            // Construir URL de descarga usando el endpoint proxy que añade Authorization y forzar descarga
+                            let docUrl = msg.media_url || '';
+                            if (docUrl.indexOf('api/get_media.php?id=') !== -1) {
+                                const parts = docUrl.split('id=');
+                                const mid = parts[1] ? decodeURIComponent(parts[1]) : '';
+                                docUrl = `/api/version/media-url.php?id=${encodeURIComponent(mid)}&download=1`;
+                            } else if (/^https?:\/\//i.test(docUrl)) {
+                                docUrl = `/api/version/media-url.php?url=${encodeURIComponent(docUrl)}&download=1`;
+                            } else {
+                                // fallback: intentar tratar el valor como URL
+                                docUrl = `/api/version/media-url.php?url=${encodeURIComponent(docUrl)}&download=1`;
+                            }
+                            contentHtml = `<a href="${docUrl}" class="message-document" rel="noopener noreferrer" target="_blank">
                                 <i class="${fileIcon}"></i>
                                 <span>${escapeHtml(filename)}</span>
                             </a>`;