Technical Plugin SecureVideosDirectory

Technical: SecureVideosDirectory plugin

Adds controlled file delivery and protection for hosted video sources.

Audience: developers, advanced administrators and AI-assisted diagnosis. Plugin catalog.

Source baseline

• Review date: 2026-10-29. Method: static source analysis; runtime/provider behavior was not exercised.
• Code ownership: independently versioned plugin repository.
• Reported version: 8.7.
• Source revision: 3a9ed38a35c85bc88c8758f707a90f263c3cdafb.
• Entry class file: SecureVideosDirectory.php.

Confirm the installed plugin version independently of the Streamer version. Configuration defaults below are not a dump of this installation's saved settings.

Behavior and operational checks

Page visibility and file-delivery controls are separate. Inspect rewrite/xsendfile integration and preserve legitimate Encoder, Mobile App, HLS and storage delivery paths.

Dependencies

No literal dependency declaration was extracted. This does not prove the plugin is standalone.

Hook integration

Override	Implementation
getTags()	SecureVideosDirectory.php:14
getModeYouTube($videos_id)	SecureVideosDirectory.php:45
getPluginMenu()	SecureVideosDirectory.php:65
getDataObjectExperimental()	SecureVideosDirectory.php:74
getDataObjectAdvanced()	SecureVideosDirectory.php:88
xsendfilePreVideoPlay()	SecureVideosDirectory.php:291
verifyEmbedSecurity()	SecureVideosDirectory.php:497
getEmbed($videos_id)	SecureVideosDirectory.php:668
getHeadCode()	SecureVideosDirectory.php:672
getFooterCode()	SecureVideosDirectory.php:703
dataSetup()	SecureVideosDirectory.php:761
getVideosManagerListButton()	SecureVideosDirectory.php:774
videoHLSProtectionByPass($videos_id)	SecureVideosDirectory.php:806

Configuration assignments

These are direct assignments inside getEmptyDataObject(), not evaluated effective defaults. Stored plugins.object_data, globals, structured values and conditional branches may alter runtime behavior. Private/default credential values are omitted.

Field	Literal default or expression type	Literal source label/help	Evidence
videosAbsolutePath	Computed/structured; inspect source	Tha absolute path to your videos directory	source
enableToken	Private setting; value omitted	Enable Token on Videos URL: This will prevent your videos URL to be shared in other pages	source
tokenTimeOut	Private setting; value omitted	Token Timeout: How long before the token renew	source
tokenSalt	Private setting; value omitted	Token salt: This is the a secret used to salt your tokes	source
permanentValidateTokenPerUser	Private setting; value omitted	Permanent Validate Token per User: Once a user proves can watch a video, no need to validate the token again. it will save you some resources	source
disableEmbedMode	false	Disable embed mode: It will globaly disable the embed mode. but sites whitelisted will be able to embed your videos	source
playOnlyWhitelisted	false	Play Only Whitelisted: The direcy play will be disabled, you must embed your videos on a page on an app and whitelist them	source
embedWhiteList	Computed/structured; inspect source	Embed Sites Whitelist: Add one website per line. Supports wildcards: .domain.com (all subdomains), domain.com (prefix match), .domain. (subdomain+TLD match). Examples: .mysite.com matches sub.mysite.com; mysite.com matches mysite1.com, mysite-test.com; .mysite. matches any.mysite.com, any.mysite.net	source
usersCanCreateEmbedWhiteList	true	Users can create embed whitelists on his videos	source
userAgentWhitelist	""	User Agent Whitelist: You must use an array sintaxe (JSON array format) to create a list of whitelisted sites. I.E:	source
HTTP_X_REQUESTED_WITHWhitelist	""	HTTP_X_REQUESTED_WITH Whitelist: You can add some REQUESTED_WITH headers, commonly sent from apps, for this you must use the JSON array format with you app domain. I.E:	source
screen_protect	true	Screen protect: Dynamically displays the user's IP address in random positions on the screen when the browser tab loses focus	source
dynamic_watermark	false	Dynamic watermark: If you check this we will display the username and IP address of the user on your, this will avoid screenrecordings. this feature uses HTML and does not cost you hardware resources	source
dynamic_watermark_positions	20	Dynamic watermark positions: How many random positions will be generated	source
dynamic_watermark_min_loop_time	2	Dynamic watermark minimum loop time (Seconds): This is the minimum time that the watermark will appear. 2 = 2 seconds	source
dynamic_watermark_max_loop_time	60	Dynamic watermark maximum loop time (Seconds): This is the maximum time that the watermark will appear, 60 = 1 minute	source
dynamic_watermark_use_encoder	false	Use encoder watermark: This will add the watermark directly into your video, it is a lot more secure than the (Dynamic watermark) but it will consume your encoder resources. Each video/User will consume more resources	source
dynamic_watermark_use_encoder_for_all	false	Use encoder watermark for all videos: This will add watermark dinamically in all your videos, if it is unchecked you need to select what video do you want to watermark	source
dynamic_watermark_ip_whitelist	""	Encoder watermark IP white list: Separate each IP with comma (,), then we will not watermark it. for example we recommend you to watermark the encoder IP and the Streamer IP	source
dynamic_watermark_force_resolution	0	Force resolution: Force a lower resolution to save some resources. make it 0 (zero) to make it automatic and let the user choose	source

Files and request surface

This inventory distinguishes implementation files from an API specification. Includes, templates, callbacks and CLI workers are not interchangeable HTTP endpoints. Request-field names below are direct source references, not a complete schema or permission declaration.

File	Source role	Direct request fields observed
Objects/Videos_watermark.php	class/helper implementation	—
SecureVideosDirectory.php	plugin entry class	debug, dynamic_watermark, file, globalToken, token, watermark_token
View/Videos_watermark/add.json.php	JSON entry point; inspect caller and guard	encoder_server, id, status, videos_id
View/Videos_watermark/delete.json.php	JSON entry point; inspect caller and guard	id
View/Videos_watermark/index.php	PHP page/include/worker; inspect caller	—
View/Videos_watermark/index_body.php	PHP page/include/worker; inspect caller	—
View/Videos_watermark/index_head.php	PHP page/include/worker; inspect caller	—
View/Videos_watermark/list.json.php	JSON entry point; inspect caller and guard	—
View/editor.php	PHP page/include/worker; inspect caller	—
downloadProtection.js	browser/worker JavaScript; verify loader	—
getWatermarkForm.php	PHP page/include/worker; inspect caller	videos_id
install/install.sql	schema/migration SQL	—
page/addVideoWhitelist.php	PHP page/include/worker; inspect caller	videos_id
page/addVideoWhitelistSave.json.php	JSON entry point; inspect caller and guard	embedWhitelist, videos_id
page/check.php	PHP page/include/worker; inspect caller	—
page/editor.php	PHP page/include/worker; inspect caller	—
page/editorSave.php	PHP page/include/worker; inspect caller	videosAbsolutePath
screen-protect.php	PHP page/include/worker; inspect caller	—
setWatermark.json.php	JSON entry point; inspect caller and guard	encoder_server, status, videos_id
videoManagerFooter.php	PHP page/include/worker; inspect caller	—
watermark.js	browser/worker JavaScript; verify loader	—

Data and migrations

Tables named in available CREATE TABLE statements: videos_watermark. Apply installation/update behavior through the owning plugin; this reference is not a script for running historical migrations manually.

Main-file named symbols

Visibility and implementation semantics must be checked in source. Nonempty string defaults are represented as . This is a symbol reference, not a stable public API promise.

Function or method	Source
getTags()	14
getPluginVersion()	23
getDescription()	28
getName()	37
getUUID()	41
getModeYouTube($videos_id)	45
isXsendfile()	54
getPluginMenu()	65
getDataObjectExperimental()	74
getDataObjectAdvanced()	88
getEmptyDataObject()	100
useEncoderWatrermark($videos_id)	153
isEncoderWatrermarkEnabled()	179
useEncoderWatrermarkFromFileName($filename)	188
redirectToEncoderWatermarkIfNeed($file)	197
getWatermarkToken()	273
isTokenWatermark($token)	280
xsendfilePreVideoPlay()	291
filesToArray($files)	365
getToken($filename)	373
addToken($url, $filename)	386
isUserAgentWhiteListed()	395
isHTTP_X_REQUESTED_WITHWhiteListed()	422
isTokenValid($token, $filename, $baseFilename)	446
verifyEmbedSecurity()	497
isWhiteListed()	521
getServerRequestInfo()	561
getEmbedWhitelist($videos_id)	570
isEmbedWhitelisted()	582
getEmbed($videos_id)	668
getHeadCode()	672
getWatermarkText()	683
getFooterCode()	703
getProtectionToken($videos_id)	743
getRandomAnimationsCSS($total = 10)	747
dataSetup()	761
getVideosManagerListButton()	774
getWatermarkedVideosId()	790
getWatermarkInfo($videos_id)	794
isVideoWatermarked($videos_id)	798
videoHLSProtectionByPass($videos_id)	806

Supporting PHP declarations

These symbols are grouped by source file; inspect the class declaration and visibility before calling them.

Objects/Videos_watermark.php

Declared classes: Videos_watermark.

Named symbol	Source
getSearchFieldsNames()	9
getTableName()	13
getAllVideos()	17
setId($id)	38
setStatus($status)	42
setVideos_id($videos_id)	49
setEncoder_server($encoder_server)	53
getId()	58
getStatus()	62
getVideos_id()	66
getEncoder_server()	70
getAllIds()	75
getFromVideos_id($id)	98
saveWatermark($videos_id, $status, $encoder_server)	114

Diagnostics and validation

1. Check the installed/enabled version and the dependencies/settings above.
2. Identify the actual failing page, request, callback or worker and correlate its timestamp with the AVideo log.
3. Follow the linked method and caller. Check business-state changes and output artifacts as well as HTTP status.
4. Reproduce the relevant workflow in a test environment. External provider, Encoder, live-server, storage, payment and authenticated flows require their real integrations.

Shared diagnostic workflow. This page is not a security audit or a claim of end-to-end validation.