GridTV/proxy.php

<?php
/**
 * GridTV — proxy.php
 *
 * Proxy HTTP->HTTPS restreint aux hotes explicitement configures dans config.json.
 * Les IP privees et LAN sont autorisees si l'administrateur les a configurees.
 * Les redirections sont suivies manuellement avec revalidation de l'hote a chaque saut.
 */

// ── Whitelist : hotes autorises extraits de config.json ───────────────────────
$config_path = __DIR__ . '/config.json';
$allowed_hosts = [];

if (file_exists($config_path)) {
    $config = json_decode(file_get_contents($config_path), true) ?? [];
    foreach ($config['epg_sources'] ?? [] as $src) {
        foreach (['epg_url', 'm3u_url'] as $key) {
            if (!empty($src[$key])) {
                $host = strtolower(parse_url($src[$key], PHP_URL_HOST) ?? '');
                if ($host !== '') $allowed_hosts[] = $host;
            }
        }
    }
}

// ── Fonctions ─────────────────────────────────────────────────────────────────

function is_allowed_url(string $url, array $allowed_hosts): bool {
    if (!preg_match('#^https?://#i', $url)) return false;
    $host = strtolower(parse_url($url, PHP_URL_HOST) ?? '');
    return $host !== '' && in_array($host, $allowed_hosts, true);
}

function resolve_url(string $base, string $location): string {
    if (preg_match('#^https?://#i', $location)) return $location;
    $parts = parse_url($base);
    $origin = $parts['scheme'] . '://' . $parts['host'];
    if (!empty($parts['port'])) $origin .= ':' . $parts['port'];
    if ($location[0] === '/') return $origin . $location;
    return $origin . rtrim(dirname($parts['path'] ?? '/'), '/') . '/' . $location;
}

/**
 * Fetch avec redirections manuelles — chaque Location: est revalidee contre la whitelist.
 * $stream = true : stream chunk par chunk (segments video)
 * $stream = false : retourne le body complet (playlists m3u8)
 */
function fetch_with_checked_redirects(string $url, array $allowed_hosts, bool $stream = false): array {
    $max_redirects = 5;

    for ($i = 0; $i <= $max_redirects; $i++) {
        if (!is_allowed_url($url, $allowed_hosts)) {
            http_response_code(403); die('Host not allowed after redirect');
        }

        $ua = $_SERVER['HTTP_USER_AGENT'] ?? 'Mozilla/5.0';
        $ch = curl_init($url);
        curl_setopt_array($ch, [
            CURLOPT_FOLLOWLOCATION => false,
            CURLOPT_HEADER         => true,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT        => 30,
            CURLOPT_USERAGENT      => $ua,
            CURLOPT_HTTPHEADER     => ['Accept: */*'],
        ]);

        $response   = curl_exec($ch);
        $code       = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
        curl_close($ch);

        if ($response === false) {
            http_response_code(502); die('Upstream error');
        }

        $raw_headers = substr($response, 0, $header_size);
        $body        = substr($response, $header_size);

        // Redirection
        if ($code >= 300 && $code < 400) {
            if (!preg_match('/^Location:\s*(.+)$/mi', $raw_headers, $m)) {
                http_response_code(502); die('Invalid redirect');
            }
            $url = resolve_url($url, trim($m[1]));
            continue;
        }

        return [$code, $raw_headers, $body, $url];
    }

    http_response_code(508); die('Too many redirects');
}

// ── Valider l'URL initiale ─────────────────────────────────────────────────────
$url = $_GET['url'] ?? '';

if (!is_allowed_url($url, $allowed_hosts)) {
    http_response_code(empty($allowed_hosts) ? 503 : 403);
    die(empty($allowed_hosts) ? 'No sources configured' : 'Host not allowed');
}

// ── Determiner le type de ressource ───────────────────────────────────────────
$path       = parse_url($url, PHP_URL_PATH) ?? '';
$is_segment = preg_match('#\.(ts|aac|mp4|m4s|fmp4)(\?|$)#i', $path);

header('Access-Control-Allow-Origin: *');
header('Cache-Control: no-cache');

// ── Segment binaire — stream chunk par chunk ───────────────────────────────────
if ($is_segment) {
    header('Content-Type: video/MP2T');
    header('X-Content-Type-Options: nosniff');

    if (ob_get_level()) ob_end_clean();

    // Pour les segments, on suit les redirections en streaming direct
    // apres avoir valide l'URL finale via fetch_with_checked_redirects en mode non-stream
    [$code, , , $final_url] = fetch_with_checked_redirects($url, $allowed_hosts, false);

    if ($code >= 400) { http_response_code($code); die(); }

    // Maintenant streamer l'URL finale
    $ua = $_SERVER['HTTP_USER_AGENT'] ?? 'Mozilla/5.0';
    $ch = curl_init($final_url);
    curl_setopt_array($ch, [
        CURLOPT_FOLLOWLOCATION => false,
        CURLOPT_TIMEOUT        => 30,
        CURLOPT_USERAGENT      => $ua,
        CURLOPT_HTTPHEADER     => ['Accept: */*'],
        CURLOPT_RETURNTRANSFER => false,
        CURLOPT_WRITEFUNCTION  => function($ch, $data) {
            echo $data; flush(); return strlen($data);
        },
        CURLOPT_HEADERFUNCTION => function($ch, $header) {
            $h = trim($header);
            if (preg_match('/^Content-Type:/i', $h)) header($h);
            return strlen($header);
        },
    ]);
    $ok   = curl_exec($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    if (!$ok || $code >= 400) http_response_code($code ?: 502);
    curl_close($ch);

// ── Playlist m3u8 — fetch + réécriture URLs ────────────────────────────────────
} else {
    [$code, , $body, $final_url] = fetch_with_checked_redirects($url, $allowed_hosts, false);

    if ($code >= 400) { http_response_code($code); die("Upstream error $code"); }

    header('Content-Type: application/vnd.apple.mpegurl');

    $final_parts = parse_url($final_url);
    $origin      = $final_parts['scheme'] . '://' . $final_parts['host'];
    if (!empty($final_parts['port'])) $origin .= ':' . $final_parts['port'];
    $base = preg_replace('#[^/]*(\?.*)?$#', '', $final_url);

    $proxy_base = (isset($_SERVER['HTTPS']) ? 'https' : 'http')
                . '://' . $_SERVER['HTTP_HOST']
                . strtok($_SERVER['REQUEST_URI'], '?')
                . '?url=';

    $out = [];
    foreach (explode("\n", $body) as $line) {
        $line = rtrim($line);
        if ($line === '' || $line[0] === '#') {
            $line = preg_replace_callback('/URI="([^"]+)"/', function($m) use ($base, $origin, $proxy_base) {
                $seg = strpos($m[1], 'http') === 0 ? $m[1]
                     : ($m[1][0] === '/' ? $origin . $m[1] : $base . $m[1]);
                return 'URI="' . $proxy_base . urlencode($seg) . '"';
            }, $line);
            $out[] = $line;
        } else {
            $seg = strpos($line, 'http') === 0 ? $line
                 : ($line[0] === '/' ? $origin . $line : $base . $line);
            $out[] = $proxy_base . urlencode($seg);
        }
    }
    echo implode("\n", $out);
}