From 2d6194fb3c6357e06f942d82fa5d0d34a36a173c Mon Sep 17 00:00:00 2001
From: DariusIII <dkrisan@gmail.com>
Date: Fri, 5 Jun 2026 00:08:14 +0200
Subject: [PATCH] Don't cache User cart RSS feed

---
 app/Http/Controllers/Api/ApiController.php |  7 ++++++-
 app/Http/Controllers/Api/RSS.php           |  6 ++++++
 app/Http/Controllers/RssController.php     | 20 +++++++++++++++++++-
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/app/Http/Controllers/Api/ApiController.php b/app/Http/Controllers/Api/ApiController.php
index 2ffff0fb8..0295334db 100644
--- a/app/Http/Controllers/Api/ApiController.php
+++ b/app/Http/Controllers/Api/ApiController.php
@@ -649,11 +649,12 @@ class ApiController extends BasePageController
 
     /**
      * @param  array<string, mixed>  $params
+     * @param  array<string, string>  $headers
      * @return Response|void
      *
      * @throws \Exception
      */
-    public function output(mixed $data, array $params, bool $xml, int $offset, string $type = '')
+    public function output(mixed $data, array $params, bool $xml, int $offset, string $type = '', array $headers = [])
     {
         $this->type = $type;
         $options = [
@@ -682,6 +683,10 @@ class ApiController extends BasePageController
         if ($response === false) {
             return showApiError(201);
         } else {
+            foreach ($headers as $name => $value) {
+                header($name.': '.$value);
+            }
+
             header('Content-Length: '.\strlen($response));
             echo $response;
             exit;
diff --git a/app/Http/Controllers/Api/RSS.php b/app/Http/Controllers/Api/RSS.php
index b83a3ed94..b123c05fa 100644
--- a/app/Http/Controllers/Api/RSS.php
+++ b/app/Http/Controllers/Api/RSS.php
@@ -36,9 +36,11 @@ class RSS extends ApiController
     public function getRss(mixed $cat, mixed $videosId, mixed $aniDbID, int $userID = 0, int $airDate = -1, int $limit = 100, int $offset = 0)
     {
         $catSearch = $cartSearch = '';
+        $isCartFeed = false;
         $catLimit = 'AND r.categories_id BETWEEN '.Category::TV_ROOT.' AND '.Category::TV_OTHER;
         if (\count($cat)) {
             if ((int) $cat[0] === -2) {
+                $isCartFeed = true;
                 $cartSearch = sprintf(
                     'INNER JOIN users_releases ON users_releases.users_id = %d AND users_releases.releases_id = r.id',
                     $userID
@@ -84,6 +86,10 @@ class RSS extends ApiController
                 $limit === -1 ? '' : ' LIMIT '.$limit.' OFFSET '.$offset
             );
 
+        if ($isCartFeed) {
+            return Release::fromQuery($sql);
+        }
+
         $expiresAt = now()->addMinutes(config('nntmux.cache_expiry_medium'));
 
         if (Search::isAvailable() && $cartSearch === '' && $videosId <= 0 && $aniDbID <= 0 && $airDate <= -1) {
diff --git a/app/Http/Controllers/RssController.php b/app/Http/Controllers/RssController.php
index 5384a558c..b26f6ef4b 100644
--- a/app/Http/Controllers/RssController.php
+++ b/app/Http/Controllers/RssController.php
@@ -118,13 +118,31 @@ class RssController extends BasePageController
     {
         $user = $this->userCheck($request);
         if ($user instanceof JsonResponse) {
+            $user->headers->add($this->cartRssNoCacheHeaders());
+
             return $user;
         }
 
         [$userShow, $userAnidb, $userAirDate, $userNum, $userLimit, $outputXML] = $this->parseCommonRssParams($request);
 
         $relData = $this->rss->getRss([-2], $userShow, $userAnidb, $user['user_id'], $userAirDate, $userLimit, $userNum);
-        $this->rss->output($relData, $user['params'], $outputXML, 0, 'rss');
+        $this->rss->output($relData, $user['params'], $outputXML, 0, 'rss', $this->cartRssNoCacheHeaders());
+    }
+
+    /**
+     * Cart RSS must reflect user cart changes immediately and must not be reused by browsers, proxies, or CDNs.
+     *
+     * @return array<string, string>
+     */
+    private function cartRssNoCacheHeaders(): array
+    {
+        return [
+            'Cache-Control' => 'no-cache, no-store, must-revalidate, private, max-age=0, s-maxage=0',
+            'Pragma' => 'no-cache',
+            'Expires' => 'Thu, 01 Jan 1970 00:00:00 GMT',
+            'CDN-Cache-Control' => 'no-store',
+            'Cloudflare-CDN-Cache-Control' => 'no-store',
+        ];
     }
 
     /**