From 52ff05647446b9295db7a522d8c2d67b98ace516 Mon Sep 17 00:00:00 2001
From: legiz-ru <legiz.ru@gmail.com>
Date: Tue, 23 Sep 2025 14:21:41 +0300
Subject: [PATCH] fix: hwid ignore for browsers

---
 app/bot.php | 77 ++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 58 insertions(+), 19 deletions(-)

diff --git a/app/bot.php b/app/bot.php
index 618d3a7..27dad0a 100644
--- a/app/bot.php
+++ b/app/bot.php
@@ -4932,30 +4932,26 @@ DNS-over-HTTPS with IP:
             return true;
         }
 
-        $devices = $this->getHwidDevicesByUser($client['id']);
-        $hwid    = trim($_SERVER['HTTP_X_HWID'] ?? '');
-        $over    = false;
+        $devices   = $this->getHwidDevicesByUser($client['id']);
+        $hwid      = trim($_SERVER['HTTP_X_HWID'] ?? '');
+        $isBrowser = $this->isBrowserRequest();
 
         if ($hwid === '') {
-            if (count($devices) >= $limit) {
-                $over = true;
-            }
-        } else {
-            $isNew = !isset($devices[$hwid]);
-            if ($isNew && count($devices) >= $limit) {
-                $over = true;
-            } else {
-                $this->setHwidDevice($client['id'], $hwid, [
-                    'time'         => time(),
-                    'user_agent'   => $_SERVER['HTTP_USER_AGENT'] ?? '',
-                    'device_os'    => $_SERVER['HTTP_X_DEVICE_OS'] ?? '',
-                    'os_version'   => $_SERVER['HTTP_X_VER_OS'] ?? '',
-                    'device_model' => $_SERVER['HTTP_X_DEVICE_MODEL'] ?? '',
-                ]);
+            if ($isBrowser) {
+                return true;
             }
+
+            $message = 'HWID device limit exceeded';
+            header('announce: base64:' . base64_encode($message));
+            header('X-HWID-Status: ' . $message);
+            header('HTTP/1.1 429 Too Many Requests', true, 429);
+
+            return false;
         }
 
-        if ($over) {
+        $isNew = !isset($devices[$hwid]);
+
+        if ($isNew && count($devices) >= $limit) {
             $message = 'HWID device limit exceeded';
             header('announce: base64:' . base64_encode($message));
             header('X-HWID-Status: ' . $message);
@@ -4963,9 +4959,52 @@ DNS-over-HTTPS with IP:
             return false;
         }
 
+        $this->setHwidDevice($client['id'], $hwid, [
+            'time'         => time(),
+            'user_agent'   => $_SERVER['HTTP_USER_AGENT'] ?? '',
+            'device_os'    => $_SERVER['HTTP_X_DEVICE_OS'] ?? '',
+            'os_version'   => $_SERVER['HTTP_X_VER_OS'] ?? '',
+            'device_model' => $_SERVER['HTTP_X_DEVICE_MODEL'] ?? '',
+        ]);
+
         return true;
     }
 
+    protected function isBrowserRequest()
+    {
+        $userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
+        $accept    = $_SERVER['HTTP_ACCEPT'] ?? '';
+
+        if ($userAgent === '' && $accept === '') {
+            return false;
+        }
+
+        $browserPatterns = [
+            'Mozilla/',
+            'Chrome/',
+            'Safari/',
+            'Firefox/',
+            'Edge/',
+            'Edg/',
+            'MSIE ',
+            'Trident/',
+            'Opera/',
+            'OPR/',
+        ];
+
+        foreach ($browserPatterns as $pattern) {
+            if (stripos($userAgent, $pattern) !== false) {
+                return true;
+            }
+        }
+
+        if (stripos($accept, 'text/html') !== false) {
+            return true;
+        }
+
+        return false;
+    }
+
     public function switchSilence()
     {
         $c = $this->getPacConf();