new changes

9 files changed, 11 insertions, 11 deletions

diff --git a/services/stream/__init__.py b/services/stream/__init__.py
index e69de29b..e69de29b 100644..100755
--- a/services/stream/__init__.py
+++ b/services/stream/__init__.py
diff --git a/services/stream/admin.py b/services/stream/admin.py
index 8c38f3f3..8c38f3f3 100644..100755
--- a/services/stream/admin.py
+++ b/services/stream/admin.py
diff --git a/services/stream/apps.py b/services/stream/apps.py
index 88d26a10..88d26a10 100644..100755
--- a/services/stream/apps.py
+++ b/services/stream/apps.py
diff --git a/services/stream/migrations/__init__.py b/services/stream/migrations/__init__.py
index e69de29b..e69de29b 100644..100755
--- a/services/stream/migrations/__init__.py
+++ b/services/stream/migrations/__init__.py
diff --git a/services/stream/models.py b/services/stream/models.py
index 71a83623..71a83623 100644..100755
--- a/services/stream/models.py
+++ b/services/stream/models.py
diff --git a/services/stream/songs.py b/services/stream/songs.py
index a39e310f..a39e310f 100644..100755
--- a/services/stream/songs.py
+++ b/services/stream/songs.py
diff --git a/services/stream/tests.py b/services/stream/tests.py
index 7ce503c2..7ce503c2 100644..100755
--- a/services/stream/tests.py
+++ b/services/stream/tests.py
diff --git a/services/stream/urls.py b/services/stream/urls.py
index aaedb926..aaedb926 100644..100755
--- a/services/stream/urls.py
+++ b/services/stream/urls.py
diff --git a/services/stream/views.py b/services/stream/views.py
index a646d185..fb5158b2 100644..100755
--- a/services/stream/views.py
+++ b/services/stream/views.py
@@ -69,20 +69,20 @@ def stream_song(request, song_id: int) -> HttpResponse:
 
 
 def anime_stream(request):
-    if not request.COOKIES.get("csrftoken"):
-        return HttpResponseForbidden("Invalid request")
-
-    referrer = request.META.get("HTTP_REFERER")
-    if not referrer:
-        return HttpResponseForbidden("Direct access not allowed")
+    url = request.GET.get("url")
+    if not request.user.is_authenticated:
+        return HttpResponseForbidden()
 
-    parsed_uri = urlparse(referrer)
-    referrer_host = parsed_uri.netloc.split(":")[0]
+    if not str(url).endswith(".vtt"):
+        referrer = request.META.get("HTTP_REFERER")
+        if not referrer:
+            return HttpResponseForbidden()
 
-    if referrer_host not in settings.ALLOWED_HOSTS:
-        return HttpResponseForbidden("Access not allowed")
+        parsed_uri = urlparse(referrer)
+        referrer_host = parsed_uri.netloc.split(":")[0]
 
-    url = request.GET.get("url")
+        if referrer_host not in settings.ALLOWED_HOSTS:
+            return HttpResponseForbidden()
 
     if not url:
         return HttpResponse("No URL provided", status=400)