Harwinder Sekhon
e3a054e109
- Session cookies are HttpOnly + SameSite=Lax (Secure on HTTPS), with strict session-ID mode; the CSRF token from GET api/auth.php must now accompany every state-changing request (X-CSRF-Token header, or a csrf body field for the sendBeacon progress save), rotated at login. - Failed sign-ins are throttled per username and IP via login_attempts (created lazily, so existing installs need no migration): 5 failures a username / 20 an IP inside 15 minutes answer 429 with Retry-After. - A video's sibling .srt now appears as a CC button in the player; captions.php converts it to WebVTT (comma timestamps, legacy encodings, and the already-VTT files with out-of-spec 6-digit fractions). - Plyr and Inter ship in assets/vendor/ instead of coming from CDNs, and anime.js is gone along with all scripted animations and the motion setting — the app now runs with no internet access at all. - .htaccess denies direct access to videos/, includes/, config.php and schema.sql, so video URLs cannot bypass login on Apache. Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm
67 lines
2.4 KiB
PHP
67 lines
2.4 KiB
PHP
<?php
|
|
// GET api/progress.php?video_id=N -> saved progress for this user/video
|
|
// POST api/progress.php -> save progress
|
|
// JSON body: {video_id, position, duration}
|
|
// (also accepts form-encoded fields; used by navigator.sendBeacon)
|
|
require_once __DIR__ . '/../includes/auth.php';
|
|
require_once __DIR__ . '/../includes/functions.php';
|
|
|
|
header('Content-Type: application/json');
|
|
$userId = requireLoginApi();
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
|
|
$videoId = (int)($_GET['video_id'] ?? 0);
|
|
$stmt = db()->prepare(
|
|
'SELECT position_seconds, duration_seconds, completed
|
|
FROM video_progress WHERE user_id = ? AND video_id = ?'
|
|
);
|
|
$stmt->execute([$userId, $videoId]);
|
|
echo json_encode($stmt->fetch() ?: ['position_seconds' => 0, 'duration_seconds' => null, 'completed' => 0]);
|
|
exit;
|
|
}
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
http_response_code(405);
|
|
echo json_encode(['error' => 'Method not allowed']);
|
|
exit;
|
|
}
|
|
|
|
$raw = file_get_contents('php://input');
|
|
$data = json_decode($raw, true);
|
|
if (!is_array($data)) {
|
|
parse_str($raw, $data); // sendBeacon posts form-encoded
|
|
}
|
|
verifyCsrfApi($data);
|
|
|
|
$videoId = (int)($data['video_id'] ?? 0);
|
|
$position = max(0, (float)($data['position'] ?? 0));
|
|
$duration = (float)($data['duration'] ?? 0);
|
|
|
|
if ($videoId <= 0 || !getVideo($videoId)) {
|
|
http_response_code(400);
|
|
echo json_encode(['error' => 'Unknown video']);
|
|
exit;
|
|
}
|
|
|
|
$completed = ($duration > 0 && $position / $duration >= COMPLETE_THRESHOLD) ? 1 : 0;
|
|
|
|
$db = db();
|
|
$stmt = $db->prepare(
|
|
'INSERT INTO video_progress (user_id, video_id, position_seconds, duration_seconds, completed)
|
|
VALUES (?, ?, ?, ?, ?)
|
|
ON DUPLICATE KEY UPDATE
|
|
position_seconds = VALUES(position_seconds),
|
|
duration_seconds = VALUES(duration_seconds),
|
|
completed = GREATEST(completed, VALUES(completed))' // once complete, stays complete
|
|
);
|
|
$stmt->execute([$userId, $videoId, $position, $duration > 0 ? $duration : null, $completed]);
|
|
|
|
// Cache the duration on the video row so listings can show it without waiting
|
|
// for someone to play the video (and for files the scanner couldn't parse).
|
|
if ($duration > 0) {
|
|
$db->prepare('UPDATE videos SET duration_seconds = ? WHERE id = ? AND duration_seconds IS NULL')
|
|
->execute([$duration, $videoId]);
|
|
}
|
|
|
|
echo json_encode(['ok' => true, 'completed' => (bool)$completed]);
|