Adjusting comments into files.

proxy.php

@@ -2,12 +2,12 @@
 /**
  * GridTV — proxy.php
  *
- * Proxy HTTP->HTTPS restreint aux hotes explicitement configures dans config.json.
- * Les IP privees et LAN sont autorisees si l'administrateur les a configurees.
- * Les redirections sont suivies manuellement avec revalidation de l'hote a chaque saut.
+ * HTTP->HTTPS proxy restricted to hosts explicitly configured in config.json.
+ * Private and LAN IPs are allowed only when the administrator configured them.
+ * Redirects are followed manually and the host is revalidated at every hop.
  */
 
-// ── Whitelist : hotes autorises extraits de config.json ───────────────────────
+// ── Allowlist: authorized hosts extracted from config.json ────────────────────
 $config_path = __DIR__ . '/config.json';
 $allowed_hosts = [];
 
@@ -23,7 +23,7 @@ if (file_exists($config_path)) {
     }
 }
 
-// ── Fonctions ─────────────────────────────────────────────────────────────────
+// ── Helpers ────────────────────────────────────────────────────────────────────
 
 function is_allowed_url(string $url, array $allowed_hosts): bool {
     if (!preg_match('#^https?://#i', $url)) return false;
@@ -41,9 +41,10 @@ function resolve_url(string $base, string $location): string {
 }
 
 /**
- * Fetch avec redirections manuelles — chaque Location: est revalidee contre la whitelist.
- * $stream = true : stream chunk par chunk (segments video)
- * $stream = false : retourne le body complet (playlists m3u8)
+ * Fetch with manual redirect handling so every Location header is checked
+ * against the allowlist before following it.
+ * $stream = true: stream the response chunk by chunk (video segments)
+ * $stream = false: return the full body (m3u8 playlists)
  */
 function fetch_with_checked_redirects(string $url, array $allowed_hosts, bool $stream = false): array {
     $max_redirects = 5;
@@ -76,7 +77,7 @@ function fetch_with_checked_redirects(string $url, array $allowed_hosts, bool $s
         $raw_headers = substr($response, 0, $header_size);
         $body        = substr($response, $header_size);
 
-        // Redirection
+        // Follow redirects manually so each hop is rechecked against the allowlist.
         if ($code >= 300 && $code < 400) {
             if (!preg_match('/^Location:\s*(.+)$/mi', $raw_headers, $m)) {
                 http_response_code(502); die('Invalid redirect');
@@ -91,7 +92,7 @@ function fetch_with_checked_redirects(string $url, array $allowed_hosts, bool $s
     http_response_code(508); die('Too many redirects');
 }
 
-// ── Valider l'URL initiale ─────────────────────────────────────────────────────
+// ── Validate the initial URL ───────────────────────────────────────────────────
 $url = $_GET['url'] ?? '';
 
 if (!is_allowed_url($url, $allowed_hosts)) {
@@ -99,27 +100,27 @@ if (!is_allowed_url($url, $allowed_hosts)) {
     die(empty($allowed_hosts) ? 'No sources configured' : 'Host not allowed');
 }
 
-// ── Determiner le type de ressource ───────────────────────────────────────────
+// ── Detect the resource type ───────────────────────────────────────────────────
 $path       = parse_url($url, PHP_URL_PATH) ?? '';
 $is_segment = preg_match('#\.(ts|aac|mp4|m4s|fmp4)(\?|$)#i', $path);
 
 header('Access-Control-Allow-Origin: *');
 header('Cache-Control: no-cache');
 
-// ── Segment binaire — stream chunk par chunk ───────────────────────────────────
+// ── Binary segment: stream chunk by chunk ──────────────────────────────────────
 if ($is_segment) {
     header('Content-Type: video/MP2T');
     header('X-Content-Type-Options: nosniff');
 
     if (ob_get_level()) ob_end_clean();
 
-    // Pour les segments, on suit les redirections en streaming direct
-    // apres avoir valide l'URL finale via fetch_with_checked_redirects en mode non-stream
+    // For segments, resolve redirects first and only stream once the final URL
+    // has already been validated.
     [$code, , , $final_url] = fetch_with_checked_redirects($url, $allowed_hosts, false);
 
     if ($code >= 400) { http_response_code($code); die(); }
 
-    // Maintenant streamer l'URL finale
+    // Stream the validated final URL.
     $ua = $_SERVER['HTTP_USER_AGENT'] ?? 'Mozilla/5.0';
     $ch = curl_init($final_url);
     curl_setopt_array($ch, [
@@ -142,7 +143,7 @@ if ($is_segment) {
     if (!$ok || $code >= 400) http_response_code($code ?: 502);
     curl_close($ch);
 
-// ── Playlist m3u8 — fetch + réécriture URLs ────────────────────────────────────
+// ── m3u8 playlist: fetch and rewrite URLs ──────────────────────────────────────
 } else {
     [$code, , $body, $final_url] = fetch_with_checked_redirects($url, $allowed_hosts, false);