From f6329ec3e9c8dc214e02ed15cca3f724de323d37 Mon Sep 17 00:00:00 2001 From: Emilien Devos Date: Sat, 8 Oct 2022 15:03:15 +0200 Subject: [PATCH] improve enforce playback from main website --- patches/9-restrict-playback.patch | 136 +++++++++++++++++++++++++++++- 1 file changed, 132 insertions(+), 4 deletions(-) diff --git a/patches/9-restrict-playback.patch b/patches/9-restrict-playback.patch index af4c5fe..5d9785e 100644 --- a/patches/9-restrict-playback.patch +++ b/patches/9-restrict-playback.patch @@ -1,14 +1,116 @@ -From 7a4254f98f823b09c8f3804e9dea2df11be1fe73 Mon Sep 17 00:00:00 2001 +From 3a4ae3220af494c2f1787b95e0727c751dc974f0 Mon Sep 17 00:00:00 2001 From: Emilien Devos Date: Sat, 8 Oct 2022 13:34:52 +0200 Subject: [PATCH 1/1] enforce playback from main website --- - src/invidious/views/components/player.ecr | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) + assets/js/player.js | 4 ++-- + assets/js/watch.js | 3 +++ + src/invidious/routes/api/v1/videos.cr | 16 ++++++++++++++++ + src/invidious/views/components/player.ecr | 11 +++++++---- + src/invidious/views/watch.ecr | 1 + + 5 files changed, 29 insertions(+), 6 deletions(-) +diff --git a/assets/js/player.js b/assets/js/player.js +index 7d59128f..20afae18 100644 +--- a/assets/js/player.js ++++ b/assets/js/player.js +@@ -378,7 +378,7 @@ if (!video_data.params.listen && video_data.params.quality === 'dash') { + } + + player.vttThumbnails({ +- src: '/api/v1/storyboards/' + video_data.id + '?height=90', ++ src: '/api/v1/storyboards/' + video_data.id + '?height=90&hmac_key=' + video_data.hmac_key, + showTimestamp: true + }); + +@@ -404,7 +404,7 @@ if (!video_data.params.listen && video_data.params.annotations) { + } + }); + +- helpers.xhr('GET', '/api/v1/annotations/' + video_data.id, { ++ helpers.xhr('GET', '/api/v1/annotations/' + video_data.id + "?hmac_key=" + video_data.hmac_key, { + responseType: 'text', + timeout: 60000 + }, { +diff --git a/assets/js/watch.js b/assets/js/watch.js +index cff84e4d..a60a7b2d 100644 +--- a/assets/js/watch.js ++++ b/assets/js/watch.js +@@ -167,6 +167,7 @@ function get_reddit_comments() { + + var url = '/api/v1/comments/' + video_data.id + + '?source=reddit&format=html' + ++ '&hmac_key=' + video_data.hmac_key + + '&hl=' + video_data.preferences.locale; + + var onNon200 = function (xhr) { comments.innerHTML = fallback; }; +@@ -217,6 +218,7 @@ function get_youtube_comments() { + var url = '/api/v1/comments/' + video_data.id + + '?format=html' + + '&hl=' + video_data.preferences.locale + ++ '&hmac_key=' + video_data.hmac_key + + '&thin_mode=' + video_data.preferences.thin_mode; + + var onNon200 = function (xhr) { comments.innerHTML = fallback; }; +@@ -274,6 +276,7 @@ function get_youtube_replies(target, load_more, load_replies) { + '?format=html' + + '&hl=' + video_data.preferences.locale + + '&thin_mode=' + video_data.preferences.thin_mode + ++ '&hmac_key=' + video_data.hmac_key + + '&continuation=' + continuation; + if (load_replies) url += '&action=action_get_comment_replies'; + +diff --git a/src/invidious/routes/api/v1/videos.cr b/src/invidious/routes/api/v1/videos.cr +index 1b7b4fa7..e8b5a5c2 100644 +--- a/src/invidious/routes/api/v1/videos.cr ++++ b/src/invidious/routes/api/v1/videos.cr +@@ -27,6 +27,10 @@ module Invidious::Routes::API::V1::Videos + id = env.params.url["id"] + region = env.params.query["region"]? || env.params.body["region"]? + ++ if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, id) != env.params.query["hmac_key"]? ++ return error_json(403, "Incorrect key") ++ end ++ + if id.nil? || id.size != 11 || !id.matches?(/^[\w-]+$/) + return error_json(400, "Invalid video ID") + end +@@ -166,6 +170,10 @@ module Invidious::Routes::API::V1::Videos + id = env.params.url["id"] + region = env.params.query["region"]? + ++ if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, id) != env.params.query["hmac_key"]? ++ return error_json(403, "Incorrect key") ++ end ++ + begin + video = get_video(id, region: region) + rescue ex : VideoRedirect +@@ -241,6 +249,10 @@ module Invidious::Routes::API::V1::Videos + source = env.params.query["source"]? + source ||= "archive" + ++ if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, id) != env.params.query["hmac_key"]? ++ return error_json(403, "Incorrect key") ++ end ++ + if !id.match(/[a-zA-Z0-9_-]{11}/) + haltf env, 400 + end +@@ -310,6 +322,10 @@ module Invidious::Routes::API::V1::Videos + + id = env.params.url["id"] + ++ if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, id) != env.params.query["hmac_key"]? ++ return error_json(403, "Incorrect key") ++ end ++ + source = env.params.query["source"]? + source ||= "youtube" + diff --git a/src/invidious/views/components/player.ecr b/src/invidious/views/components/player.ecr -index c3c02df0..5f66920a 100644 +index c3c02df0..c61ccbf4 100644 --- a/src/invidious/views/components/player.ecr +++ b/src/invidious/views/components/player.ecr @@ -1,10 +1,11 @@ @@ -49,6 +151,32 @@ index c3c02df0..5f66920a 100644 quality = fmt["quality"] mimetype = HTML.escape(fmt["mimeType"].as_s) +@@ -57,11 +60,11 @@ + <% end %> + + <% preferred_captions.each do |caption| %> +- ++ + <% end %> + + <% captions.each do |caption| %> +- ++ + <% end %> + <% end %> + +diff --git a/src/invidious/views/watch.ecr b/src/invidious/views/watch.ecr +index 243ea3a4..19f7d2fd 100644 +--- a/src/invidious/views/watch.ecr ++++ b/src/invidious/views/watch.ecr +@@ -65,6 +65,7 @@ we're going to need to do it here in order to allow for translations. + "premiere_timestamp" => video.premiere_timestamp.try &.to_unix, + "vr" => video.is_vr, + "projection_type" => video.projection_type, ++ "hmac_key" => OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, video.id), + "local_disabled" => CONFIG.disabled?("local") + }.to_pretty_json + %> -- 2.38.0