mirror of
https://github.com/Vateron-Media/XC_VM.git
synced 2026-10-17 04:03:05 +02:00
rootandClaude Opus 5
74ef365f7d
Stream-link tokens were AES-CBC with a fixed IV and no MAC. A modified token decrypts to modified bytes, and a padding error answers differently from a bad credential (auth.php: BAD_TOKEN vs everything after), so with enough requests anyone holding a link could read its username and password, or write a token of their own. Several consumers trust a token's contents as they stand: the live / vod / timeshift JSON (user_info, channel_info), HLS segment and key tokens, the web player's proxy URL (fetched server-side) and the MAG portal's verify token (passed to igbinary_unserialize). Encryption::seal()/open() add AES-256-GCM with a random nonce, as base64url(nonce ‖ ciphertext ‖ tag) — the same URL-safe alphabet, so no nginx route or pattern changes. Every stream-link token is now made with mintToken() and read with readToken(); StreamTokenCallSitesTest keeps new code from calling the legacy encrypt()/decrypt() for one. Deterministic encryption of stored data (HMAC keys looked up by ciphertext, image cache names) stays as it was. The new setting secure_stream_tokens (Settings → Tamper-proof Stream Tokens): - on: tokens are sealed, and the legacy format is refused wherever a token's contents are trusted. /play/ playlist and portal links, RTMP tokens and probe's /play/ links still read the old format — they carry credentials that are looked up again, and saved playlists hold them — and every token auth.php cannot read now counts against the address (BruteforceGuard), which stops reading an old one through the error responses. - off: legacy tokens are minted and every format is read. Servers on an older version cannot read sealed tokens, so migration 021 turns it off on a panel that has other servers (on for a single server, and for new installs); turn it on once every server is updated. key.php now also refuses a token that does not read, instead of serving the key of stream 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BbYsGKhirq9eRK8e6wsCHR
XC_VM IPTV Panel
A modern, open-source IPTV panel inspired by Xtream Codes. Lightweight, fast, and community-driven.
What Is It?
XC_VM is a modern IPTV panel built on PHP, Nginx, FFmpeg, and MariaDB.
XC_VM helps you deploy a full IPTV infrastructure:
- Management of Live TV, Movies, and Series
- Reseller and user management
- Load Balancing
- EPG and VOD system
- Monitoring tools and API
💡 Completely free. No licenses. No server locks.
Features
- 🚀 Modern IPTV panel architecture
- 🔀 Built-in load balancer support
- 🎥 Management of VOD and live streams
- 🧩 API compatible with Xtream Codes
- 🔐 Enhanced security fixes
- 📦 Fast FFmpeg-based transcoding
- 🌍 Multi-language documentation
- 🧭 Simple and intuitive interface
- 🛠 Modular extension system
Technologies
- Nginx — reverse proxy & web server
- PHP 8.1 — core backend
- MariaDB — database
- KeyDB — cache/session engine
- FFmpeg 8.0 — transcoding
- yt-dlp — media acquiring
XC_VM officially supports Ubuntu 22.04 and is tested on 24.04.
Community
XC_VM is a fully community-driven project.
- 💬 Issues
- ⭐ GitHub Stars: support the project by giving it a star
- 🔧 Pull Requests: welcome
If you want to contribute, read the:
Contributing Guide
Installation
Installation on Ubuntu 22.04+:
sudo apt update && sudo apt full-upgrade -y
sudo apt install -y python3-pip unzip
latest_version=$(curl -s https://api.github.com/repos/Vateron-Media/XC_VM/releases/latest | grep '"tag_name":' | cut -d '"' -f 4)
wget "https://github.com/Vateron-Media/XC_VM/releases/download/${latest_version}/XC_VM.zip"
unzip XC_VM.zip
sudo python3 install
Disclaimer
You are fully responsible for your own use of this software.