Harwinder Sekhon
17a401c313
- Session cookies are HttpOnly + SameSite=Lax (Secure on HTTPS), with strict session-ID mode; the CSRF token from GET api/auth.php must now accompany every state-changing request (X-CSRF-Token header, or a csrf body field for the sendBeacon progress save), rotated at login. - Failed sign-ins are throttled per username and IP via login_attempts (created lazily, so existing installs need no migration): 5 failures a username / 20 an IP inside 15 minutes answer 429 with Retry-After. - A video's sibling .srt now appears as a CC button in the player; captions.php converts it to WebVTT (comma timestamps, legacy encodings, and the already-VTT files with out-of-spec 6-digit fractions). - Plyr and Inter ship in assets/vendor/ instead of coming from CDNs, and anime.js is gone along with all scripted animations and the motion setting — the app now runs with no internet access at all. - .htaccess denies direct access to videos/, includes/, config.php and schema.sql, so video URLs cannot bypass login on Apache. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm
30 lines
864 B
PHP
30 lines
864 B
PHP
<?php
|
|
// Serves a video's subtitles as WebVTT, converted on the fly from the .srt
|
|
// file sitting next to the .mp4. Like stream.php, the file is addressed by
|
|
// database ID only — the client never supplies a filesystem path.
|
|
require_once __DIR__ . '/includes/auth.php';
|
|
require_once __DIR__ . '/includes/functions.php';
|
|
|
|
if (currentUserId() === null) {
|
|
http_response_code(403);
|
|
exit('Forbidden');
|
|
}
|
|
|
|
$video = getVideo((int)($_GET['id'] ?? 0));
|
|
$file = $video ? srtFilePath($video) : null;
|
|
if ($file === null) {
|
|
http_response_code(404);
|
|
exit('No subtitles for this video');
|
|
}
|
|
|
|
$srt = file_get_contents($file);
|
|
if ($srt === false) {
|
|
http_response_code(404);
|
|
exit('No subtitles for this video');
|
|
}
|
|
|
|
session_write_close();
|
|
header('Content-Type: text/vtt; charset=utf-8');
|
|
header('Cache-Control: private, max-age=3600');
|
|
echo srtToVtt($srt);
|