Update app.py

app.py

@@ -7,7 +7,8 @@ HOST = "http://mavpro.xyz:80"
 USER = "uphMjgn0qw"
 PASS = "iSwSA6zx7o"
 USER_AGENT = "IPTVSmarters/1.0.3 (iPad; iOS 13.4.1; Scale/2.00)"
-SECRET_TOKEN = "Soheir@46"
+# This is your new secret path segment
+SECRET_PATH = "mysecret123"
 
 session = requests.Session()
 session.headers.update({'User-Agent': USER_AGENT})
@@ -16,11 +17,9 @@ session.headers.update({'User-Agent': USER_AGENT})
 def status():
     return "SYSTEM_STABLE_150788"
 
-@app.route('/11246.m3u')
+# Playlist link now uses a secure path
+@app.route(f'/{SECRET_PATH}/11246.m3u')
 def get_unified_list():
-    if request.args.get('token') != SECRET_TOKEN:
-        return "Unauthorized: Invalid Token", 401
-
     categories = ["m3u_plus", "vod", "series"]
     def generate():
         yield "#EXTM3U\n"
@@ -31,26 +30,23 @@ def get_unified_list():
                 if r.status_code == 200:
                     for line in r.text.splitlines():
                         if line.startswith("#EXTM3U"): continue
-                        yield line.replace(HOST, f"https://{request.host}") + f"&token={SECRET_TOKEN}\n"
+                        # Replaces host with your Space and injects the secret path
+                        yield line.replace(HOST, f"https://{request.host}/{SECRET_PATH}") + "\n"
             except:
                 continue
     return Response(stream_with_context(generate()), mimetype='text/plain')
 
-@app.route('/<path:path>')
+# The proxy now only triggers if the secret path is the first part of the URL
+@app.route(f'/{SECRET_PATH}/<path:path>')
 def ghost_proxy(path):
-    if request.args.get('token') != SECRET_TOKEN:
-        return "Unauthorized: Missing Token", 401
-
     target_url = f"{HOST}/{path}"
     if request.query_string:
-        clean_query = "&".join([q for q in request.query_string.decode('utf-8').split('&') if not q.startswith('token=')])
-        target_url = f"{HOST}/{path}?{clean_query}"
+        target_url += f"?{request.query_string.decode('utf-8')}"
     
     headers = {k: v for k, v in request.headers if k.lower() not in ['host', 'user-agent']}
     
     try:
         r = session.get(target_url, headers=headers, stream=True, timeout=15)
-        
         excluded_headers = ['content-encoding', 'content-length', 'transfer-encoding', 'connection']
         resp_headers = [(name, value) for (name, value) in r.raw.headers.items()
                         if name.lower() not in excluded_headers]