NerdVPN.de/invidious
1
0
Fork 0
mirror of https://git.nerdvpn.de/NerdVPN.de/invidious synced 2026-02-14 22:51:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

improve enforce playback from main website

Browse Source
This commit is contained in:
Emilien Devos
2022-10-08 15:03:15 +02:00
parent 95adc4bd48
commit f6329ec3e9
1 changed files with 132 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
patches/9-restrict-playback.patch
+132 -4
View File
@@ -1,14 +1,116 @@
From 7a4254f98f823b09c8f3804e9dea2df11be1fe73 Mon Sep 17 00:00:00 2001
From 3a4ae3220af494c2f1787b95e0727c751dc974f0 Mon Sep 17 00:00:00 2001
From: Emilien Devos <contact@emiliendevos.be>
Date: Sat, 8 Oct 2022 13:34:52 +0200
Subject: [PATCH 1/1] enforce playback from main website
---
src/invidious/views/components/player.ecr | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
assets/js/player.js | 4 ++--
assets/js/watch.js | 3 +++
src/invidious/routes/api/v1/videos.cr | 16 ++++++++++++++++
src/invidious/views/components/player.ecr | 11 +++++++----
src/invidious/views/watch.ecr | 1 +
5 files changed, 29 insertions(+), 6 deletions(-)
diff --git a/assets/js/player.js b/assets/js/player.js
index 7d59128f..20afae18 100644
--- a/assets/js/player.js
+++ b/assets/js/player.js
@@ -378,7 +378,7 @@ if (!video_data.params.listen && video_data.params.quality === 'dash') {
}
player.vttThumbnails({
- src: '/api/v1/storyboards/' + video_data.id + '?height=90',
+ src: '/api/v1/storyboards/' + video_data.id + '?height=90&hmac_key=' + video_data.hmac_key,
showTimestamp: true
});
@@ -404,7 +404,7 @@ if (!video_data.params.listen && video_data.params.annotations) {
}
});
- helpers.xhr('GET', '/api/v1/annotations/' + video_data.id, {
+ helpers.xhr('GET', '/api/v1/annotations/' + video_data.id + "?hmac_key=" + video_data.hmac_key, {
responseType: 'text',
timeout: 60000
}, {
diff --git a/assets/js/watch.js b/assets/js/watch.js
index cff84e4d..a60a7b2d 100644
--- a/assets/js/watch.js
+++ b/assets/js/watch.js
@@ -167,6 +167,7 @@ function get_reddit_comments() {
var url = '/api/v1/comments/' + video_data.id +
'?source=reddit&format=html' +
+ '&hmac_key=' + video_data.hmac_key +
'&hl=' + video_data.preferences.locale;
var onNon200 = function (xhr) { comments.innerHTML = fallback; };
@@ -217,6 +218,7 @@ function get_youtube_comments() {
var url = '/api/v1/comments/' + video_data.id +
'?format=html' +
'&hl=' + video_data.preferences.locale +
+ '&hmac_key=' + video_data.hmac_key +
'&thin_mode=' + video_data.preferences.thin_mode;
var onNon200 = function (xhr) { comments.innerHTML = fallback; };
@@ -274,6 +276,7 @@ function get_youtube_replies(target, load_more, load_replies) {
'?format=html' +
'&hl=' + video_data.preferences.locale +
'&thin_mode=' + video_data.preferences.thin_mode +
+ '&hmac_key=' + video_data.hmac_key +
'&continuation=' + continuation;
if (load_replies) url += '&action=action_get_comment_replies';
diff --git a/src/invidious/routes/api/v1/videos.cr b/src/invidious/routes/api/v1/videos.cr
index 1b7b4fa7..e8b5a5c2 100644
--- a/src/invidious/routes/api/v1/videos.cr
+++ b/src/invidious/routes/api/v1/videos.cr
@@ -27,6 +27,10 @@ module Invidious::Routes::API::V1::Videos
id = env.params.url["id"]
region = env.params.query["region"]? || env.params.body["region"]?
+ if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, id) != env.params.query["hmac_key"]?
+ return error_json(403, "Incorrect key")
+ end
+
if id.nil? || id.size != 11 || !id.matches?(/^[\w-]+$/)
return error_json(400, "Invalid video ID")
end
@@ -166,6 +170,10 @@ module Invidious::Routes::API::V1::Videos
id = env.params.url["id"]
region = env.params.query["region"]?
+ if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, id) != env.params.query["hmac_key"]?
+ return error_json(403, "Incorrect key")
+ end
+
begin
video = get_video(id, region: region)
rescue ex : VideoRedirect
@@ -241,6 +249,10 @@ module Invidious::Routes::API::V1::Videos
source = env.params.query["source"]?
source ||= "archive"
+ if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, id) != env.params.query["hmac_key"]?
+ return error_json(403, "Incorrect key")
+ end
+
if !id.match(/[a-zA-Z0-9_-]{11}/)
haltf env, 400
end
@@ -310,6 +322,10 @@ module Invidious::Routes::API::V1::Videos
id = env.params.url["id"]
+ if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, id) != env.params.query["hmac_key"]?
+ return error_json(403, "Incorrect key")
+ end
+
source = env.params.query["source"]?
source ||= "youtube"
diff --git a/src/invidious/views/components/player.ecr b/src/invidious/views/components/player.ecr
index c3c02df0..5f66920a 100644
index c3c02df0..c61ccbf4 100644
--- a/src/invidious/views/components/player.ecr
+++ b/src/invidious/views/components/player.ecr
@@ -1,10 +1,11 @@
@@ -49,6 +151,32 @@ index c3c02df0..5f66920a 100644
quality = fmt["quality"]
mimetype = HTML.escape(fmt["mimeType"].as_s)
@@ -57,11 +60,11 @@
<% end %>
<% preferred_captions.each do |caption| %>
- <track kind="captions" src="/api/v1/captions/<%= video.id %>?label=<%= caption.name %>" label="<%= caption.name %>">
+ <track kind="captions" src="/api/v1/captions/<%= video.id %>?label=<%= caption.name %>&hmac_key=<%= hmac_key %>" label="<%= caption.name %>">
<% end %>
<% captions.each do |caption| %>
- <track kind="captions" src="/api/v1/captions/<%= video.id %>?label=<%= caption.name %>" label="<%= caption.name %>">
+ <track kind="captions" src="/api/v1/captions/<%= video.id %>?label=<%= caption.name %>&hmac_key=<%= hmac_key %>" label="<%= caption.name %>">
<% end %>
<% end %>
</video>
diff --git a/src/invidious/views/watch.ecr b/src/invidious/views/watch.ecr
index 243ea3a4..19f7d2fd 100644
--- a/src/invidious/views/watch.ecr
+++ b/src/invidious/views/watch.ecr
@@ -65,6 +65,7 @@ we're going to need to do it here in order to allow for translations.
"premiere_timestamp" => video.premiere_timestamp.try &.to_unix,
"vr" => video.is_vr,
"projection_type" => video.projection_type,
+ "hmac_key" => OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, video.id),
"local_disabled" => CONFIG.disabled?("local")
}.to_pretty_json
%>
--
2.38.0