query('p', ''); if ($b64 === '') abort(400, 'missing p'); // URL-safe base64; pad back to a multiple of 4 for strict decoding. $padded = $b64 . str_repeat('=', (4 - strlen($b64) % 4) % 4); $path = base64_decode(strtr($padded, '-_', '+/'), true); if ($path === false || $path === '') abort(400, 'bad encoding'); $real = realpath($path); if ($real === false || !is_file($real)) abort(404, 'file not found: ' . $path); $allowed = false; foreach ((array) config('rig.music_dirs') as $root) { $rootReal = realpath($root); if ($rootReal && str_starts_with($real . '/', rtrim($rootReal, '/') . '/')) { $allowed = true; break; } } if (!$allowed) abort(403, 'outside allowed roots'); $ext = strtolower(pathinfo($real, PATHINFO_EXTENSION)); $mime = match ($ext) { 'm4a', 'aac' => 'audio/mp4', 'mp3' => 'audio/mpeg', 'opus', 'ogg'=> 'audio/ogg', 'flac' => 'audio/flac', 'webm' => 'audio/webm', 'wav' => 'audio/wav', default => 'application/octet-stream', }; // BinaryFileResponse handles Range requests automatically, which the // HTML5