FTP Online Client by APi™

Editing: dash.php.bak

<?php
declare(strict_types=1);

/* =======================
   Created by TRIKI Seyfeddine
======================= */

/* =======================
   CORS
======================= */
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: GET, POST, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization, User-Agent, Referer");

if (($_SERVER['REQUEST_METHOD'] ?? '') === 'OPTIONS') {
    http_response_code(200);
    exit;
}

/* =======================
   إعدادات الحماية
======================= */
$allowedDomains = [
    'netflyapp.online',
    'livedash.online',
    'alraqi-tv.com',
    'alraqi.site',
    'ftvlist.live',
];

$allowedUserAgents = [
    'Mozilla/5.0',
    'Chrome',
    'aLraqi',
];

/* =======================
   Helpers
======================= */
function jsonOut(array $data, int $code = 200): never {
    http_response_code($code);
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    exit;
}

function logEvent(string $msg): void {
    $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
    file_put_contents(
        __DIR__ . '/access.log',
        "[" . date('Y-m-d H:i:s') . "] $ip - $msg\n",
        FILE_APPEND
    );
}

/* =======================
   فحص الدومين
======================= */
function normalizeHost(string $host): string {
    // إزالة البورت إن وجد (example.com:443)
    $host = trim($host);
    $host = preg_replace('/:\d+$/', '', $host) ?? $host;
    return strtolower($host);
}

function isDomainAllowed(string $host, string $referer, array $allowed): bool {
    $host = normalizeHost($host);

$refHost = '';
    if ($referer !== '') {
        $parsed = parse_url($referer);
        if (is_array($parsed) && isset($parsed['host'])) {
            $refHost = normalizeHost((string)$parsed['host']);
        }
    }

$allowed = array_map(fn($d) => strtolower(trim($d)), $allowed);

return in_array($host, $allowed, true) || ($refHost !== '' && in_array($refHost, $allowed, true));
}

$host    = $_SERVER['HTTP_HOST'] ?? '';
$referer = $_SERVER['HTTP_REFERER'] ?? '';

if (!isDomainAllowed($host, $referer, $allowedDomains)) {
    logEvent("Blocked domain: $host | referer: $referer");
    jsonOut(['error' => 'Domain not allowed'], 403);
}

/* =======================
   فحص User-Agent
======================= */
$ua = $_SERVER['HTTP_USER_AGENT'] ?? '';
$validUA = false;

foreach ($allowedUserAgents as $a) {
    if ($a !== '' && stripos($ua, $a) !== false) {
        $validUA = true;
        break;
    }
}

if (!$validUA) {
    logEvent("Blocked UA: $ua");
    jsonOut(['error' => 'User-Agent not allowed'], 403);
}

/* =======================
   تحميل Mapping
======================= */
$mapFile = __DIR__ . '/url_apollo.json';
if (!file_exists($mapFile)) {
    jsonOut(['error' => 'Mapping file missing'], 500);
}

$map = json_decode((string)file_get_contents($mapFile), true);
if (!is_array($map)) {
    jsonOut(['error' => 'Mapping file invalid JSON'], 500);
}

// ملاحظة: array_flip قد يطيح بالقيم المكررة، لكن نُبقي نفس المنطق
$reverse = array_flip($map);

/* =======================
   قراءة المسار
======================= */
$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
$input  = (string)file_get_contents('php://input');

$path = '';
$json = null;

if ($method === 'POST') {
    $decoded = json_decode($input, true);
    if (is_array($decoded)) {
        $json = $decoded;
        if (isset($json['cors'])) {
            $path = (string)$json['cors'];
        }
    }
} elseif ($method === 'GET') {
    if (isset($_GET['cors'])) {
        $path = (string)$_GET['cors'];
    }
}

// منع مسارات خبيثة
if ($path === '' || preg_match('/\.\./', $path)) {
    jsonOut(['error' => 'Invalid path'], 400);
}

/* =======================
   Endpoint خاص
======================= */
if ($path === 'logo') {
    jsonOut([
        'logo_url' => 'https://ftvlist.live/assets/logo.png',
        'position' => 'top-right'
    ], 200);
}

/* =======================
   sanitizePath
======================= */
function sanitizePath(string $path, array $map, array $reverse): string {
    $path = ltrim($path, "/ \t\n\r\0\x0B");

// منع إدخال روابط كاملة أو بروتوكولات
    if (preg_match('#^(https?:)?//#i', $path)) {
        jsonOut(['error' => 'Invalid path'], 400);
    }

$parts = explode('/', $path);
    $key   = $parts[0] ?? '';

// منع الوصول المباشر للمسارات الحقيقية (reverse mapping)
    if ($key !== '' && isset($reverse[$key])) {
        jsonOut(['error' => 'Direct access forbidden'], 404);
    }

// تطبيق الماب
    if ($key !== '' && isset($map[$key])) {
        $parts[0] = (string)$map[$key];
    }

return implode('/', $parts);
}

$cleanPath = sanitizePath($path, $map, $reverse);

/* =======================
   Proxy Request
======================= */
$baseURL = "https://ftvlist.live/";
$url     = $baseURL . ltrim($cleanPath, '/');

// getallheaders() ليست متاحة أحيانًا في بعض البيئات
if (!function_exists('getallheaders')) {
    function getallheaders(): array {
        $headers = [];
        foreach ($_SERVER as $name => $value) {
            if (str_starts_with($name, 'HTTP_')) {
                $key = str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))));
                $headers[$key] = $value;
            }
        }
        return $headers;
    }
}

$headers = [];
foreach (getallheaders() as $k => $v) {
    // نُبقي نفس المنطق: تمرير Authorization و Content-Type فقط
    if (in_array($k, ['Authorization', 'Content-Type'], true)) {
        $headers[] = "$k: $v";
    }
}

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_TIMEOUT        => 10,
    CURLOPT_HTTPHEADER     => array_merge($headers, [
        "User-Agent: $ua",
        "Referer: $referer",
    ]),
    CURLOPT_CUSTOMREQUEST  => $method,
]);

if ($method === 'POST' && is_array($json)) {
    // نفس المنطق: إزالة cors ثم إرسال باقي البيانات JSON
    unset($json['cors']);
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($json, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));
}

$response = curl_exec($ch);
$ctype    = (string)curl_getinfo($ch, CURLINFO_CONTENT_TYPE);
$code     = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($response === false || $code >= 400) {
    logEvent("Upstream error $code : $url");
    jsonOut(['error' => 'Upstream failed'], 502);
}

/* =======================
   تعديل MPD
======================= */
if ($path !== '' && str_ends_with($path, '.mpd')) {
    // تصحيح أخطاء الـ namespaces في وسم MPD:
    // xsi="..."  -> xmlns:xsi="..."
    // xlink="..." -> xmlns:xlink="..."
    // schemaLocation="..." -> xsi:schemaLocation="..."
    $response = str_replace(
        [
            ' xsi="http://www.w3.org/2001/XMLSchema-instance"',
            ' xlink="http://www.w3.org/1999/xlink"',
            ' schemaLocation="',
        ],
        [
            ' xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"',
            ' xmlns:xlink="http://www.w3.org/1999/xlink"',
            ' xsi:schemaLocation="',
        ],
        (string)$response
    );

// الحماية المدنية 🤣🤣🤣
    if ($path !== '' && str_ends_with($path, '.mpd')) {
       
        $response = str_replace(
            ['initialization', 'm4s', 'video'],
            ['initialisation', 'm4s', 'video'],
            (string)$response
        );
    }
}

/* =======================
   تحديد نوع المحتوى
======================= */
function getContentType(string $path, string $fallback = 'application/octet-stream'): string {
    $extension = strtolower(pathinfo($path, PATHINFO_EXTENSION));
    return match ($extension) {
        'mpd'  => 'application/dash+xml',
        'm4s'  => 'video/iso.segment',
        'mp4'  => 'video/mp4',
        'webm' => 'video/webm',
        'ts'   => 'video/mp2t',
        'mkv'  => 'video/x-matroska',
        'avi'  => 'video/x-msvideo',
        'mov'  => 'video/quicktime',
        'mp3'  => 'audio/mpeg',
        'aac'  => 'audio/aac',
        'wav'  => 'audio/wav',
        'ogg'  => 'audio/ogg',
        'flac' => 'audio/flac',
        default => $fallback,
    };
}

/* =======================
   إرسال الاستجابة
======================= */
// إصلاح: كان $contentType غير مُعرّف. الآن نستخدم نوع cURL إن وجد، وإلا نحدده من الامتداد.
$contentType = $ctype !== '' ? $ctype : getContentType($path);

header("Content-Type: " . $contentType);
header("Cache-Control: no-cache, no-store, must-revalidate");
header("Pragma: no-cache");
header("Expires: 0");
header('Content-Disposition: inline; filename="' . basename($path) . '"');

echo $response;

❌ Cancel

Version	8.4.17
SAPI	litespeed
Operating System	Linux
Architecture	x86_64
Server Software	LiteSpeed
Document Root	/home/ftvlistl/ftponlineclient.ftvlist.live
Current Time	2026-02-02 21:25:33 CET
Timezone	Africa/Algiers

Memory Limit	2048M
Current Usage	2 MB
Peak Usage	2 MB
Max Execution Time	180s
Post Max Size	2048M
Upload Max Filesize	2048M
Max File Uploads	20

Total Space	1.83 TB
Free Space	904.85 GB
Used Space	968.87 GB

Zip	Loaded
Gd	Loaded
Curl	Loaded
Mbstring	Loaded
Json	Loaded
Openssl	Loaded
Pdo	Loaded
Mysqli	Loaded
Sqlite3	Loaded
Xml	Loaded
Fileinfo	Loaded
Exif	Loaded
Imagick	Not Available

Current Dir Writable	Yes
Current Dir Readable	Yes
Temp Directory	/tmp
Temp Dir Writable	Yes
Upload Tmp Dir	/tmp
Open Basedir	Not set
Safe Mode	Removed in PHP 5.4+

🗂️ FTP Online Client by APi™

🐘 PHP Information

💾 Memory & Limits

💿 Disk Space

🔧 PHP Extensions

📁 File System

🔒 Security Settings

🌐 Server Environment

🖥️ Client Information

Editing: dash.php.bak

Bulk Operations (0 selected)

Processing...

Allow URL fopen	Enabled
Allow URL include	Disabled
Display Errors	Off
Log Errors	On
Error Log	error_log
Expose PHP	Off

Server Name	www.ftponlineclient.ftvlist.live
Server Port	443
HTTPS	Enabled
Request Method	GET
Remote Address	216.73.216.189
Script Name	/index.php

🗂️ FTP Online Client by APi™

🐘 PHP Information

💾 Memory & Limits

💿 Disk Space

🔧 PHP Extensions

📁 File System

🔒 Security Settings

🌐 Server Environment

🖥️ Client Information

Editing: dash.php.bak

Bulk Operations (0 selected)

Processing...

Create New File

Create New Folder

Upload Files

Drag & Drop Files Here

Selected Files:

Upload Progress

Rename Item