* * * The visitor's browser then only talks to your domain. This script fetches the widget files from * https://www.qwissit.com/widget/v1/ and passes them on – only those files, only GET, without the * visitor's IP address, cookies, referrer or browser details. Nothing is stored. * Needs PHP 7.4 or newer with cURL or allow_url_fopen, and PATH_INFO (standard on Apache). * Self-test: open /qwissit-proxy.php/qwissit-widget.js in the browser – you should see JavaScript. */ const QWISSIT_BASE = 'https://www.qwissit.com/widget/v1/'; const QWISSIT_FILES = '#^(qwissit-widget\.js|pool\.js|daily\.js|daily-answer\.js|verify-start\.js|verify-answer\.js|font/(Figtree-Regular|Figtree-SemiBold|BricolageGrotesque-Bold)\.ttf)$#'; $path = ltrim((string)($_SERVER['PATH_INFO'] ?? ''), '/'); $query = (string)($_SERVER['QUERY_STRING'] ?? ''); if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'GET' || !preg_match(QWISSIT_FILES, $path) || strlen($query) > 4000) { http_response_code(404); exit; } $url = QWISSIT_BASE . $path . ($query !== '' ? '?' . $query : ''); $status = 502; $type = 'text/plain; charset=UTF-8'; $cache = 'no-store'; $body = ''; if (function_exists('curl_init')) { $headers = []; $ch = curl_init($url); curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_CONNECTTIMEOUT => 4, CURLOPT_TIMEOUT => 8, CURLOPT_FOLLOWLOCATION => false, CURLOPT_USERAGENT => 'qwissit-proxy/1', CURLOPT_HEADERFUNCTION => function ($ch, $line) use (&$headers) { $parts = explode(':', $line, 2); if (count($parts) === 2) { $headers[strtolower(trim($parts[0]))] = trim($parts[1]); } return strlen($line); }, ]); $result = curl_exec($ch); if ($result !== false) { $body = $result; $status = (int)curl_getinfo($ch, CURLINFO_RESPONSE_CODE); $type = $headers['content-type'] ?? $type; $cache = $headers['cache-control'] ?? $cache; } curl_close($ch); } else { $context = stream_context_create(['http' => [ 'method' => 'GET', 'timeout' => 8, 'ignore_errors' => true, 'follow_location' => 0, 'user_agent' => 'qwissit-proxy/1', ]]); $result = @file_get_contents($url, false, $context); if ($result !== false) { $body = $result; $lines = function_exists('http_get_last_response_headers') ? (http_get_last_response_headers() ?? []) : ($http_response_header ?? []); foreach ($lines as $i => $line) { if ($i === 0 && preg_match('#\s(\d{3})(\s|$)#', $line, $m)) { $status = (int)$m[1]; } elseif (stripos($line, 'content-type:') === 0) { $type = trim(substr($line, 13)); } elseif (stripos($line, 'cache-control:') === 0) { $cache = trim(substr($line, 14)); } } } } http_response_code($status); header('Content-Type: ' . $type); header('Cache-Control: ' . $cache); header('X-Content-Type-Options: nosniff'); echo $body;