ayrisdev/animexe
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(player,vtt): fix CORS proxy bypass on third-party streams and improve vtt-proxy resilience

Browse Source
This commit is contained in:
Mustafa Yildiz
2026-08-21 14:32:13 +03:00
parent c68c5a4c65
commit ee0fdd587c
2 changed files with 54 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routes/web.php
+44 -10
View File
@@ -498,6 +498,10 @@ Route::get("/stream/proxy", function (\Illuminate\Http\Request $request) {
'aniziumserver.sbs' => 'https://anizium.co/',
'aniziumserver.site' => 'https://anizium.co/',
'aniziumserver.com' => 'https://anizium.co/',
'tau-video.xyz' => 'https://anizium.co/',
'zappy-net.store' => 'https://anizium.co/',
'zappy-net.online' => 'https://anizium.co/',
'pixel-quirk.shop' => 'https://anizium.co/',
];
$referer = null;
foreach ($knownRefs as $domain => $ref) {
@@ -812,28 +816,58 @@ Route::get('/vtt-proxy', function (\Illuminate\Http\Request $request) {
$url = $request->query('url', '');
if (!filter_var($url, FILTER_VALIDATE_URL)) abort(400);
$host = parse_url($url, PHP_URL_HOST) ?? '';
$allowed = ['b-cdn.net', 'bunnycdn.com', 'aniziumserver.site', 'aniziumserver.com', 'aniziumserver.sbs', 'anizium.co'];
$allowed = [
'b-cdn.net', 'bunnycdn.com',
'aniziumserver.site', 'aniziumserver.com', 'aniziumserver.sbs',
'anizium.co', 'anizium.net',
'tau-video.xyz', 'zappy-net.store', 'pixel-quirk.shop'
];
$ok = false;
// Tam eşleşme veya gerçek alt-domain — "evilanizium.co" gibi sahte son ekler geçmez
foreach ($allowed as $a) { if ($host === $a || str_ends_with($host, '.' . $a)) { $ok = true; break; } }
if (!$ok) abort(403);
try {
// Önce anizium.co referer ile dene
$resp = \Illuminate\Support\Facades\Http::timeout(15)
->withoutVerifying()
->withHeaders([
'User-Agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
'User-Agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
'Accept' => 'text/vtt,text/plain,*/*',
'Accept-Language' => 'tr-TR,tr;q=0.9,en;q=0.8',
'Referer' => 'https://x.anizium.co/',
'Referer' => 'https://anizium.co/',
])
->get($url);
if (!$resp->successful()) abort($resp->status());
// Başarısızsa referer'sız dene
if (!$resp->successful()) {
$resp = \Illuminate\Support\Facades\Http::timeout(15)
->withoutVerifying()
->withHeaders([
'User-Agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
'Accept' => '*/*',
])
->get($url);
}
if (!$resp->successful()) abort(502);
$body = $resp->body();
// Cloudflare / Anizium hata sayfası dönmüşse (WEBVTT içermiyor) 502
if (!str_contains(substr($body, 0, 50), 'WEBVTT')) abort(502);
return response($body, 200)
->header('Content-Type', 'text/vtt; charset=utf-8')
->header('Cache-Control', 'public, max-age=3600')
->header('Access-Control-Allow-Origin', '*');
// BOM temizle
$body = preg_replace('/^\xEF\xBB\xBF/', '', $body);
$trimmed = trim($body);
// WEBVTT başlığı eksikse ama timestamp formatı içeriyorsa başa WEBVTT ekle
if (!str_starts_with($trimmed, 'WEBVTT') && str_contains($body, '-->')) {
$body = "WEBVTT\n\n" . $body;
}
return response($body, 200, [
'Content-Type' => 'text/vtt; charset=utf-8',
'Cache-Control' => 'public, max-age=3600',
'Access-Control-Allow-Origin' => '*',
'X-Accel-Buffering' => 'no',
'X-Robots-Tag' => 'noindex, nofollow, noarchive',
]);
} catch (\Exception $e) { abort(502); }
})->name('vtt.proxy');