Update index.php

[Reprezent-RZ]

Pridané tlačidlá na kopírovanie a inštaláciu doplnku priamo na úvodnej stránke

---

Summary by cubic

Adds a simple landing page at / that lets users copy the manifest URL and install the addon directly into Stremio. This replaces the redirect to /manifest.json and makes onboarding easier.

• New Features
  • Copy manifest URL to clipboard with a short success message.
  • Install into Stremio via stremio:// scheme, with a fallback alert if the app doesn’t open.
  • Manifest URL is generated from the current host.

^{Written for commit 5a80a82. Summary will update automatically on new commits.}

[cubic-dev-ai]

2 issues found across 1 file

Prompt for AI agents (all 2 issues)

Understand the root cause of the following 2 issues and fix them.


<file name="index.php">

<violation number="1" location="index.php:88">
Escape host-derived manifestUrl before embedding it into the JavaScript string to avoid Host-header-driven XSS.</violation>

<violation number="2" location="index.php:89">
Sanitize or encode the host value before inserting it into the JavaScript literal to prevent Host-header-based XSS.</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Ask questions if you need clarification on any suggestion

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

[cubic-dev-ai]

Sanitize or encode the host value before inserting it into the JavaScript literal to prevent Host-header-based XSS.

Prompt for AI agents

Address the following comment on index.php at line 89:

<comment>Sanitize or encode the host value before inserting it into the JavaScript literal to prevent Host-header-based XSS.</comment>

<file context>
@@ -14,9 +14,108 @@
+
+        &lt;script&gt;
+            const manifestUrl = &quot;&lt;?php echo $manifestUrl; ?&gt;&quot;;
+            const hostOnly = &quot;&lt;?php echo $host; ?&gt;/manifest.json&quot;;
 
-$_SERVER[&#39;REQUEST_URI&#39;] = $uri;
</file context>

Suggested change

	const hostOnly = "<?php echo $host; ?>/manifest.json";
	const hostOnly = <?php echo json_encode($host . '/manifest.json'); ?>;

[cubic-dev-ai]

Escape host-derived manifestUrl before embedding it into the JavaScript string to avoid Host-header-driven XSS.

Prompt for AI agents

Address the following comment on index.php at line 88:

<comment>Escape host-derived manifestUrl before embedding it into the JavaScript string to avoid Host-header-driven XSS.</comment>

<file context>
@@ -14,9 +14,108 @@
+        &lt;div id=&quot;copy-info&quot;&gt;✅ Odkaz bol skopírovaný do schránky!&lt;/div&gt;
+
+        &lt;script&gt;
+            const manifestUrl = &quot;&lt;?php echo $manifestUrl; ?&gt;&quot;;
+            const hostOnly = &quot;&lt;?php echo $host; ?&gt;/manifest.json&quot;;
 
</file context>

Suggested change

	const manifestUrl = "<?php echo $manifestUrl; ?>";
	const manifestUrl = <?php echo json_encode($manifestUrl); ?>;