live.php

<?php
// live.php - router for Xtream-style /live/... links
require_once __DIR__ . '/helpers.php';

// Path: /live/{u}/{pass_or_token}/{id}.{ext}
$uri = parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '';
$parts = array_values(array_filter(explode('/', $uri)));

if (count($parts) < 4 || strtolower($parts[0]) !== 'live') {
  http_response_code(404);
  exit('Not Found');
}

$u = rawurldecode((string)$parts[1]);

// Optional: obfuscated usernames (u_... or u64_...)
if (strpos($u, "u_") === 0 || strpos($u, "u64_") === 0) {
  $dec = gc_user_deobfuscate($u);
  if ($dec === "") {
    http_response_code(400);
    exit("Bad Request");
  }
  $u = $dec;
}

$cred = rawurldecode((string)$parts[2]);

// Basic hardening: prevent path breaking/null bytes
if (strpos($u, '/') !== false || strpos($cred, '/') !== false || strpos($u, "") !== false || strpos($cred, "") !== false) {
  http_response_code(400);
  exit('Bad Request');
}

$idPart = (string)$parts[3];

// Parse id + optional extension (e.g. 123.ts, 123.m3u8, 123.mp4)
$id = 0;
$ext = '';
if (preg_match('~^(\d+)(?:\.([a-z0-9]+))?$~i', $idPart, $m)) {
  $id = (int)$m[1];
  $ext = strtolower($m[2] ?? '');
} else {
  http_response_code(404);
  exit('Not Found');
}

$exp = (int)($_GET['exp'] ?? 0);
$token = '';

// Token-only mode: /live/u/{token}/{id}.ext?exp=...
if (preg_match('/^[a-f0-9]{64}$/i', $cred)) {
  $token = $cred;
  $_GET['p'] = '';
} else {
  // Legacy/basic mode: /live/u/{password}/{id}.ext
  $_GET['p'] = $cred;
  // Optional token can also be passed via querystring
  $token = (string)($_GET['token'] ?? '');
}

$_GET['u'] = $u;
$_GET['id'] = $id;
$_GET['exp'] = $exp;
$_GET['token'] = $token;
// Note: $ext is not required by the stream engine; the upstream URL determines the real container.
$_GET['ext'] = $ext;

require __DIR__ . '/stream/index.php';