archive-ccc8458/video/play.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
<?php
declare(strict_types=1);
require_once __DIR__ . '/lib/hash.php';
$hash = (string)($_GET['id'] ?? '');
$videoUrl = find_video_url($hash);
if ($videoUrl === null) {
http_response_code(404);
echo '<!doctype html><meta charset=utf-8><title>Not found</title><h1>404</h1>';
exit;
}
$pageUrl = SITE_BASE . '/video/' . $hash;
$embedUrl = SITE_BASE . '/video/' . $hash . '/embed';
$fileUrl = SITE_BASE . $videoUrl;
?><!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Video <?= htmlspecialchars($hash) ?></title>
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta property="og:type" content="video.other">
<meta property="og:video" content="<?= htmlspecialchars($fileUrl) ?>">
<meta property="og:url" content="<?= htmlspecialchars($pageUrl) ?>">
<link rel="stylesheet" href="../sianel.css">
</head>
<body class="page-play">
<main>
<video src="<?= htmlspecialchars($videoUrl) ?>" controls playsinline preload="metadata"></video>
<div class="meta">
<p>Share: <code><?= htmlspecialchars($pageUrl) ?></code></p>
<p>Embed: <code><iframe src="<?= htmlspecialchars($embedUrl) ?>" allowfullscreen></iframe></code></p>
</div>
<div class="admin-actions" id="adminActions" hidden>
<button id="deleteBtn" type="button">Delete video</button>
</div>
</main>
<script>
// Show the delete control only if an upload password is stored in this browser.
// The actual authorisation happens server-side via the bearer token.
(function () {
const pw = localStorage.getItem('vidpass');
if (!pw) return;
const HASH = <?= json_encode($hash) ?>;
const actions = document.getElementById('adminActions');
const btn = document.getElementById('deleteBtn');
actions.hidden = false;
btn.onclick = async () => {
if (!confirm('Delete this video?')) return;
btn.disabled = true;
try {
const fd = new FormData();
fd.append('hash', HASH);
const res = await fetch('/video/api/delete', {
method: 'POST',
headers: { 'Authorization': 'Bearer ' + pw },
body: fd,
});
if (res.ok) {
location.href = '/video/';
} else {
const j = await res.json().catch(() => ({}));
alert('Delete failed: ' + (j.error || res.status));
btn.disabled = false;
}
} catch {
alert('Network error.');
btn.disabled = false;
}
};
})();
</script>
</body>
</html>