Site fixes

/**

 * Copyright 2022 Jacob K

 *

 * This program is free software; you can redistribute it

 * and/or modify it under the terms of either:

 * - the GNU General Public License as published by the Free

 *   Software Foundation; either version 3 of the License, or (at

 *   your option) any later version, or

 * - the "A" license: <https://koszko.org/alicense.txt>; explained

 *   at: <https://koszko.org/en/articles/my-new-license.html>

 *

 * As additional permission under GNU GPL version 3 section 7, you

 * may distribute forms of that code without the copy of the GNU

 * GPL normally required by section 4, provided you include this

 * license notice and, in case of non-source distribution, a URL

 * through which recipients can access the Corresponding Source.

 * If you modify file(s) with this exception, you may extend this

 * exception to your version of the file(s), but you are not

 * obligated to do so. If you do not wish to do so, delete this

 * exception statement from your version. If you delete this

 * exception statement from all source files in the program, then

 * also delete it here.

 *

 * As a special exception to the GPL, any HTML file which merely

 * makes function calls to this code, and for that purpose

 * includes it by reference shall be deemed a separate work for

 * copyright law purposes. If you modify this code, you may extend

 * this exception to your version of the code, but you are not

 * obligated to do so. If you do not wish to do so, delete this

 * exception statement from your version.

 */

 // above license statement copied from here: https://api-demo.hachette-hydrilla.org/content/sgoogle_sheets_download/google_sheets_download.js

// meta: match should be https://***.app.box.com/s/* I think (*** instead of * for the first section because otherwise plain app.box.com URLs won't work)

// meta: some test cases (mostly found at https://old.reddit.com/search?q="box.com"&include_over_18=on&sort=new)

	// https://uwmadison.app.box.com/s/ydht2incbdmw1lhpjg5t40adguc0fm14

		// umadison's enrollment report

		// pdf

	// https://app.box.com/s/gc4ygloi4qtimeh98dq9mmydyuydawcn

		// password-protected 7z file (nsfw)

	// https://app.box.com/shared/static/su6xx6zx50cd68zdtbm3wfxhh9kwke8x.zip

		// a soundtrack in a zip file

		// This is a static download, so it works without this script.

	// https://app.box.com/s/vysdh2u78yih3c8leetgq82il954a3g3

		// some gambling add

		// pptx

	// https://app.box.com/s/nnlplkmjhimau404qohh9my10pwmo8es

		// a list of books(?)

		// txt

	// https://ucla.app.box.com/s/mv32q624ojihohzh8d0mhhj0b3xluzbz

		// "COVID-19 Pivot Plan Decision Matrix"

		// cannot be downloaded (403 Forbidden): "This user is not allowed to use direct links. Please email "[support address, changes depending on where you are logged in]" for support"

		// If you load the proprietary scripts on this page, you'll see that there is no download button, so the default script probably should not include one either (a functional download button could be part of an enhancement script, but the user should probably know that the uploader or an organization doesn't want them to save the file permanently)

		// TODO: implement file previews so URLs like this one can be viewed, and hide the download button as it'll be broken anyway

	// TODO: find a public folder link (the private links I have seem to work)

	// TODO: find a (preferably public) link with a folder inside a folder, as these may need to be handled differently

/* Extract data from a script that sets multiple variables. */ // from here: https://api-demo.hachette-hydrilla.org/content/sgoogle_sheets_download/google_sheets_download.js

let prefetchedData = null; // This variable isn't actually used.

for (const script of document.scripts) {

    const match = /Box.prefetchedData = ({([^;]|[^}];)+})/.exec(script.textContent); // looks for "Box.prefetchedData = " in the script files and then grabs the json text after that.

    if (!match)

	continue;

    prefetchedData = JSON.parse(match[1]);

}

let config = null;

for (const script of document.scripts) {

    const match = /Box.config = ({([^;]|[^}];)+})/.exec(script.textContent); // looks for "Box.config = " in the script files and then grabs the json text after that.

    if (!match)

	continue;

    config = JSON.parse(match[1]);

}

let postStreamData = null;

for (const script of document.scripts) {

    const match = /Box.postStreamData = ({([^;]|[^}];)+})/.exec(script.textContent); // looks for "Box.postStreamData = " in the script files and then grabs the json text after that.

    if (!match)

	continue;

    postStreamData = JSON.parse(match[1]);

}

// create div container

const divContainer = document.createElement("div");

document.body.insertBefore(divContainer, document.body.firstElementChild);

// get domain from URL

const domain = document.location.href.split("/")[2]; 

if (postStreamData["/app-api/enduserapp/shared-item"].itemType == "file") {

	// craft the request

	var downloadLinkGet = new XMLHttpRequest();

	downloadLinkGet.open("POST", "https://"+domain+"/index.php?rm=box_download_shared_file&shared_name="+postStreamData["/app-api/enduserapp/shared-item"].sharedName+"&file_id=f_"+postStreamData["/app-api/enduserapp/shared-item"].itemID);

	//downloadLinkGet.setRequestHeader("Host", "uwmadison.app.box.com"); // forbidden

	downloadLinkGet.setRequestHeader("User-Agent", "Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0"); // Would this be set automatically otherwise?

	downloadLinkGet.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8");

	downloadLinkGet.setRequestHeader("Accept-Language",  "en-US,en;q=0.5"); // TODO: find a test case in another language

	//downloadLinkGet.setRequestHeader("Accept-Encoding", "gzip, deflate, br"); // forbidden

	//downloadLinkGet.setRequestHeader("Referer", "https://uwmadison.app.box.com/s/ydht2incbdmw1lhpjg5t40adguc0fm14"); // forbidden

	downloadLinkGet.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

	//downloadLinkGet.setRequestHeader("Content-Length", "78"); // forbidden

	//downloadLinkGet.setRequestHeader("Origin", "https://uwmadison.app.box.com"); // forbidden

	//downloadLinkGet.setRequestHeader("DNT", "1"); // forbidden

	//downloadLinkGet.setRequestHeader("Connection", "keep-alive"); // forbidden

	//downloadLinkGet.setRequestHeader("Cookie", "[REDACTED (not sure if cookies contain login details)]"); // forbidden

	downloadLinkGet.setRequestHeader("Upgrade-Insecure-Requests", "1");

	//downloadLinkGet.setRequestHeader("Sec-Fetch-Dest", "iframe"); // forbidden

	//downloadLinkGet.setRequestHeader("Sec-Fetch-Mode", "navigate"); // forbidden

	//downloadLinkGet.setRequestHeader("Sec-Fetch-Site", "same-origin"); // forbidden

	//downloadLinkGet.setRequestHeader("Sec-Fetch-User", "?1"); // forbidden

	//downloadLinkGet.setRequestHeader("TE", "trailers"); // forbidden

	// create download button

	const downloadButton = document.createElement("a");

	downloadButton.innerText = "download";

	downloadButton.setAttribute("style", "border-radius: 10px; padding: 20px; color: #333; background-color: lightgreen; text-decoration: none; box-shadow: -4px 8px 8px #888; display: inline-block;"); // from https://api-demo.hachette-hydrilla.org/content/sgoogle_sheets_download/google_sheets_download.js

	// create loading icon

	const loadingIcon = document.createElement("h1");

	loadingIcon.innerText = "loading...";

	divContainer.appendChild(loadingIcon);

	downloadLinkGet.onreadystatechange = function() {

		if (downloadLinkGet.readyState === 4) {

			//console.log(downloadLinkGet.status);

			// configure download button and add it

			downloadButton.setAttribute("href", downloadLinkGet.responseURL);

			loadingIcon.remove(); // remove the loading icon, as we are pretty much done loading

			divContainer.appendChild(downloadButton);

		}

	};

	// send the request

	downloadLinkGet.send("request_token="+config.requestToken); // TODO: figure out a way to stop the initial request from following the location it gets and automatically downloading the file ahead of time, and then decicde if that method should be used instead (the current method might download the file twice (once when the page loads, and once when the user clicks), but maybe caching makes that irrelevent

} else if (postStreamData["/app-api/enduserapp/shared-item"].itemType == "folder") {

	const folderHeader = document.createElement("h1");

	folderHeader.innerText = postStreamData["/app-api/enduserapp/shared-folder"].currentFolderName;

	divContainer.appendChild(folderHeader);

	//console.log(postStreamData["/app-api/enduserapp/shared-folder"]);

	postStreamData["/app-api/enduserapp/shared-folder"].items.forEach(function(element) {

		console.log(element);

		const folderButton = document.createElement("a");

		folderButton.setAttribute("style", "border-radius: 10px; padding: 20px; color: #333; background-color: lightgreen; text-decoration: none; box-shadow: -4px 8px 8px #888; display: inline-block;"); // from https://api-demo.hachette-hydrilla.org/content/sgoogle_sheets_download/google_sheets_download.js

		if (element.type == "file") {

			folderButton.innerText = "loading...";

			// craft request

			var downloadLinkGet = new XMLHttpRequest();

			downloadLinkGet.open("POST", "https://"+domain+"/index.php?rm=box_download_shared_file&shared_name="+postStreamData["/app-api/enduserapp/shared-item"].sharedName+"&file_id="+element.typedID);

			downloadLinkGet.setRequestHeader("User-Agent", "Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0"); // Would this be set automatically otherwise?

			downloadLinkGet.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8");

			downloadLinkGet.setRequestHeader("Accept-Language",  "en-US,en;q=0.5"); // TODO: find a test case in another language

			downloadLinkGet.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

			downloadLinkGet.setRequestHeader("Upgrade-Insecure-Requests", "1");

			downloadLinkGet.onreadystatechange = function() {

				if (downloadLinkGet.readyState === 4) {

					//console.log(downloadLinkGet.status);

					// configure download button and add it

					folderButton.setAttribute("href", downloadLinkGet.responseURL);

					folderButton.innerText = element.name; // show the name of the file

				}

			};

			downloadLinkGet.send("request_token="+config.requestToken);

		} else {

			folderButton.innerText = "[folders inside folders not yet supported]";

		}

		divContainer.appendChild(folderButton);

	})

} else {

	console.log("Error: not implemented");

	// TODO: also display an error on the page

}