bvandeusen
2394e47370
Operator-flagged 2026-05-27: HF source check 401'd on
`HEAD /?enterAgree=1` even with valid login cookies. Root cause is the
combination of (1) gallery-dl's HF extractor checking
`self.cookies.get("PHPSESSID", domain="www.hentai-foundry.com")` with
`requests`' EXACT domain matching, and (2) the extension's cookies.js
forcibly rewriting every captured cookie to a leading-dot subdomain-wide
form. HF's PHPSESSID is browser-stored as host-only on
`www.hentai-foundry.com`; the rewrite re-anchored it to
`.hentai-foundry.com`, which `cookies.get(...)` no longer matches even
though the cookie is still sent on actual HTTP requests (RFC 6265
subdomain rules). The extractor falls into its unauthenticated
`?enterAgree=1` fallback, which 401s (Cloudflare or HF's anti-bot HEAD
gating).
Two-part fix, no operator action required for existing stored cookies:
1. **Backend** (`credential_service._augment_cookies`) — refactored from
the subscribestar-only single function into a per-platform dispatcher.
New `_augment_hentaifoundry` parses the materialized netscape file
and, for each `.hentai-foundry.com` entry whose name is PHPSESSID or
YII_CSRF_TOKEN, appends a host-only duplicate
(`www.hentai-foundry.com\tFALSE\t...`). Originals preserved. Three
new tests pin: injection fires + originals preserved; idempotent
when host-only already exists; doesn't touch unrelated cookies
(e.g. `_ga`).
2. **Extension** (`cookies.js`) — `toNetscapeFormat` now respects
`c.hostOnly` from the browser instead of blindly forcing a
leading-dot subdomain-wide form. Host-only cookies are written with
the bare host + FALSE flag; non-host-only cookies retain the
leading-dot + TRUE form. Forward-compat — fresh captures from
v1.0.5+ no longer need the backend's host-only duplication.
Extension bumped 1.0.4 → 1.0.5; manifest + package.json in lockstep.
After deploy: the next HF source check on the operator's already-stored
cookies will succeed because the materialized cookies.txt now contains
host-only PHPSESSID. No browser re-export needed.
77 lines
2.1 KiB
JSON
77 lines
2.1 KiB
JSON
{
|
|
"manifest_version": 3,
|
|
"name": "FabledCurator",
|
|
"version": "1.0.5",
|
|
"description": "Export cookies from supported platforms to FabledCurator and add creators as sources in one click.",
|
|
|
|
"browser_specific_settings": {
|
|
"gecko": {
|
|
"id": "fabledcurator@fabledsword.com",
|
|
"strict_min_version": "115.0"
|
|
}
|
|
},
|
|
|
|
"content_security_policy": {
|
|
"_comment": "Override the MV3 default CSP to OMIT upgrade-insecure-requests. FC runs over plain HTTP per the homelab posture (feedback_homelab_http), and the default MV3 CSP would silently upgrade every fetch(http://curator.../...) to https:// and fail with NS_ERROR_GENERATE_FAILURE. Operator-flagged 2026-05-26 after the 'Test connection' button errored despite a working CORS preflight on the backend.",
|
|
"extension_pages": "script-src 'self'; object-src 'self';"
|
|
},
|
|
|
|
"permissions": [
|
|
"cookies",
|
|
"storage",
|
|
"tabs",
|
|
"activeTab",
|
|
"webRequest",
|
|
"webRequestBlocking"
|
|
],
|
|
|
|
"host_permissions": [
|
|
"*://*.patreon.com/*",
|
|
"*://*.subscribestar.com/*",
|
|
"*://*.subscribestar.adult/*",
|
|
"*://*.hentai-foundry.com/*",
|
|
"*://*.discord.com/*",
|
|
"*://*.pixiv.net/*",
|
|
"*://*.deviantart.com/*",
|
|
"*://app-api.pixiv.net/*",
|
|
"*://oauth.secure.pixiv.net/*",
|
|
"*://*/*"
|
|
],
|
|
|
|
"action": {
|
|
"default_popup": "popup/popup.html",
|
|
"default_icon": "icons/icon.svg",
|
|
"default_title": "FabledCurator"
|
|
},
|
|
|
|
"background": {
|
|
"scripts": ["lib/platforms.js", "lib/cookies.js", "lib/api.js", "background/background.js"]
|
|
},
|
|
|
|
"options_ui": {
|
|
"page": "options/options.html",
|
|
"browser_style": true
|
|
},
|
|
|
|
"content_scripts": [
|
|
{
|
|
"matches": [
|
|
"*://*.patreon.com/*",
|
|
"*://*.subscribestar.com/*",
|
|
"*://*.subscribestar.adult/*",
|
|
"*://*.hentai-foundry.com/*",
|
|
"*://*.deviantart.com/*",
|
|
"*://*.pixiv.net/*"
|
|
],
|
|
"js": ["lib/platforms.js", "content/content-script.js"],
|
|
"css": ["content/content-script.css"],
|
|
"run_at": "document_idle"
|
|
}
|
|
],
|
|
|
|
"icons": {
|
|
"48": "icons/icon.svg",
|
|
"96": "icons/icon.svg"
|
|
}
|
|
}
|