Technical Plugin VideoHLS

Technical: VideoHLS plugin

Integrates multibitrate/encrypted HLS playback and key/delivery controls.

Audience: developers, advanced administrators and AI-assisted diagnosis. Plugin catalog.

Source baseline

• Review date: 2026-10-29. Method: static source analysis; runtime/provider behavior was not exercised.
• Code ownership: independently versioned plugin repository.
• Reported version: 25.9.
• Source revision: 244073b7c386ee186fb837efd441086a4541beae.
• Entry class file: VideoHLS.php.

Confirm the installed plugin version independently of the Streamer version. Configuration defaults below are not a dump of this installation's saved settings.

Behavior and operational checks

Master/variant playlists, media segments and keys form a playback chain. Test the actual player/client and all dependent resources. An accessible master playlist alone does not prove successful playback.

Dependencies

No literal dependency declaration was extracted. This does not prove the plugin is standalone.

Literal runtime plugin references: CDN, CustomizeUser, Live, VideoResolutionSwitcher. These calls do not mean every referenced plugin is mandatory.

Hook integration

Override	Implementation
getTags()	VideoHLS.php:9
getDataObjectAdvanced()	VideoHLS.php:42
getDataObjectDeprecated()	VideoHLS.php:56
getHeadCode()	VideoHLS.php:90
getFooterCode()	VideoHLS.php:113
dataSetup()	VideoHLS.php:778
getVideosManagerListButton()	VideoHLS.php:880
onNewVideo($videos_id)	VideoHLS.php:1074
executeEveryMinute()	VideoHLS.php:1082
executeEveryHour()	VideoHLS.php:1090

Configuration assignments

These are direct assignments inside getEmptyDataObject(), not evaluated effective defaults. Stored plugins.object_data, globals, structured values and conditional branches may alter runtime behavior. Private/default credential values are omitted.

Field	Literal default or expression type	Literal source label/help	Evidence
qualitySelector	true	—	source
downloadProtection	true	—	source
AlwaysAllowChromeCast	true	—	source
LabelLow	"Low"	—	source
LabelSD	"SD"	—	source
LabelHD	"HD"	—	source
IPWhitelist	Computed/structured; inspect source	—	source
whitelistAndroid	true	—	source
RefferWhitelist	Computed/structured; inspect source	—	source
UserAgentWhitelist	Computed/structured; inspect source	—	source
DenyIfUserAgentIsNotWhitelist	false	—	source
TSFilesCDN	''	—	source
overrideNative	false	—	source
returnAllSources	false	—	source
saveMP4CopyOnCDNStorageToAllowDownload	true	—	source
saveMP3CopyOnCDNStorageToAllowDownload	true	—	source
p2p_media_loader	false	—	source
completeTokenVerification	Private setting; value omitted	—	source
verifyTokenTimeout	Private setting; value omitted	—	source
verifyTokenIP	Private setting; value omitted	—	source
autoConvertToMp4	false	—	source

Files and request surface

This inventory distinguishes implementation files from an API specification. Includes, templates, callbacks and CLI workers are not interchangeable HTTP endpoints. Request-field names below are direct source references, not a complete schema or permission declaration.

File	Source role	Direct request fields observed
HLSAudioManager.php	class/helper implementation	—
ManifestGenerator.php	class/helper implementation	—
VideoHLS.php	plugin entry class	debug, debugResolution, filename, globalToken
avideoResolutionFix.js	browser/worker JavaScript; verify loader	—
debug.js	browser/worker JavaScript; verify loader	—
download.json.php	JSON entry point; inspect caller and guard	token
downloadButtons.php	PHP page/include/worker; inspect caller	videos_id
downloadHLS.php	PHP page/include/worker; inspect caller	—
downloadProgress.json.php	JSON entry point; inspect caller and guard	token
downloadProtection.js	browser/worker JavaScript; verify loader	—
downloadProtection.php	PHP page/include/worker; inspect caller	debug, filename, key, print, token
getToken.json.php	JSON entry point; inspect caller and guard	videos_id
languages/delete.json.php	JSON entry point; inspect caller and guard	language, videos_id
languages/get_languages.json.php	JSON entry point; inspect caller and guard	videos_id
languages/index.php	PHP page/include/worker; inspect caller	videos_id
languages/rename_language.json.php	JSON entry point; inspect caller and guard	newLanguage, oldLanguage, videos_id
languages/upload.json.php	JSON entry point; inspect caller and guard	isDefault, language, mp3file, videos_id
loadAudio.js	browser/worker JavaScript; verify loader	—
loadAudio.player.ready.js	browser/worker JavaScript; verify loader	—
p2p.js	browser/worker JavaScript; verify loader	—
p2p_head.js	browser/worker JavaScript; verify loader	—
playerStart.js	browser/worker JavaScript; verify loader	—
tools/convertToMP4.php	PHP page/include/worker; inspect caller	—
tools/prepareHLSDownload.php	PHP page/include/worker; inspect caller	—

Data and migrations

No CREATE TABLE names were extracted from available plugin SQL. The plugin can still use core tables, PHP-created schema or another component's data. Apply installation/update behavior through the owning plugin; this reference is not a script for running historical migrations manually.

Main-file named symbols

Visibility and implementation semantics must be checked in source. Nonempty string defaults are represented as . This is a symbol reference, not a stable public API promise.

Function or method	Source
getTags()	9
getPluginVersion()	19
getDescription()	24
getName()	32
getUUID()	37
getDataObjectAdvanced()	42
getDataObjectDeprecated()	56
getEmptyDataObject()	63
getHeadCode()	90
getFooterCode()	113
useDownloadProtection()	176
useQualitySelector()	199
getHLSDurationFromFile($file)	226
getHLSHigestResolutionFromFile($file)	241
updateHLSDurationIfNeed($videoObject)	310
getSourceFile($fileName, $includeS3 = false)	352
getToken($videos_id)	402
getRequestIpCandidates()	418
compareIP($ip1, $ip2)	445
tokenMatchesRequestIp($objToken)	475
verifyToken($token)	507
ignore()	630
isUserAgentWhitelisted()	750
dataSetup()	778
getCDNDownloadLink($videos_id, $format = '<string>')	817
getLocalDownloadLink($videos_id, $format = '<string>')	836
getDownloadLink($videos_id, $format = '<string>')	855
getMP3ANDMP4DownloadLinks($videos_id)	865
getVideosManagerListButton()	880
convertM3U8ToMP4($videos_id, $callback = '', $forceRecreate = false)	893
convertM3U8ToMP4AndSync($videos_id, $forceRecreate = false)	971
sync($videos_id)	993
autoConvert()	1042
onNewVideo($videos_id)	1074
executeEveryMinute()	1082
executeEveryHour()	1090

Supporting PHP declarations

These symbols are grouped by source file; inspect the class declaration and visibility before calling them.

HLSAudioManager.php

Declared classes: HLSAudioManager.

Named symbol	Source
getURLAndFile($videos_id)	5
addAudioTrack($videos_id, $mp3FilePath, $language, $isDefault = false)	34
removeAudioTrack($videos_id, $language)	77
convertMp3ToHLS($mp3FilePath, $outputDir)	100
deleteDirectory($dir)	129
getLanguages($videos_id)	157
replaceCDNMAnifest($videos_id)	178
languageExists($videos_id, $language)	218
clearDirName($language)	245
renameLanguage($videos_id, $oldLanguage, $newLanguage)	252

ManifestGenerator.php

Declared classes: ManifestGenerator.

Named symbol	Source
generateManifest($baseFolder)	14
findAudioManifest($baseFolder)	51
getBandwidthForResolution($resolution)	69

downloadProtection.php

Named symbol	Source
_getRemoteAddrFromServerArray($server)	10
_isPrivateOrLoopbackIP($ip)	24
_getForwardedClientIpFromServerArray($server)	33
_getRealIpAddr()	61
_isWindows()	78
getClientIdentifier()	90
getTmpFilePath($key)	103
isRequestValid()	110
handleRequest()	146
debugError($msg)	192

Diagnostics and validation

1. Check the installed/enabled version and the dependencies/settings above.
2. Identify the actual failing page, request, callback or worker and correlate its timestamp with the AVideo log.
3. Follow the linked method and caller. Check business-state changes and output artifacts as well as HTTP status.
4. Reproduce the relevant workflow in a test environment. External provider, Encoder, live-server, storage, payment and authenticated flows require their real integrations.

Shared diagnostic workflow. This page is not a security audit or a claim of end-to-end validation.