ani-web

0 Fork 0

Files

T

jozamudi 0cd79dd701 Decode MegaPlay's encrypted getSourcesNew payload

MegaPlay (behind both hianime and anikoto) stopped returning
sources.file in plaintext and now ships the stream URL in an
AES-256-CBC 'enc' field. Key/IV are static, hardcoded in their public
player JS (newclient.min.js) — anti-scrape obscurity, not access
control. Shared megaplay_sources() in upstream.py tolerates both
shapes, so a revert upstream breaks nothing.

Also: hianime master_m3u8 now raises when servers are listed but none
resolve (403s, stale format) instead of returning None — a listed-but
dead server is a provider fault, not 'no dub', and the old None
silently short-circuited the ANI_SOURCE fallback chain.

2026-09-29 17:17:33 +00:00

providers

Decode MegaPlay's encrypted getSourcesNew payload

2026-09-29 17:17:33 +00:00

__init__.py

move server code into server/, update docs

2026-08-19 15:33:31 +00:00

app.py

watched: single DONE_RATIO source constant replaces the seven hardcoded 0.95 literals

2026-09-21 01:41:44 +00:00

auth.py

login: per-source-IP failure budget (auth.py) — username rotation no longer dodges the lockout; sliding window, XFF trusted only behind the proxy (ANIWEB_TRUST_XFF); lockout logic now unit-testable (tests/test_auth.py)