|
1
|
/**
|
|
2
|
* SPDX-License-Identifier: LicenseRef-GPL-3.0-or-later-WITH-js-exceptions
|
|
3
|
*
|
|
4
|
* Copyright 2022 Jacob K
|
|
5
|
* Copyright 2022 Wojtek Kosior <koszko@koszko.org>
|
|
6
|
*
|
|
7
|
* This program is free software: you can redistribute it and/or modify
|
|
8
|
* it under the terms of the GNU General Public License as published by
|
|
9
|
* the Free Software Foundation, either version 3 of the License, or
|
|
10
|
* (at your option) any later version.
|
|
11
|
*
|
|
12
|
* This program is distributed in the hope that it will be useful,
|
|
13
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
14
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
15
|
* GNU General Public License for more details.
|
|
16
|
*
|
|
17
|
* As additional permission under GNU GPL version 3 section 7, you
|
|
18
|
* may distribute forms of that code without the copy of the GNU
|
|
19
|
* GPL normally required by section 4, provided you include this
|
|
20
|
* license notice and, in case of non-source distribution, a URL
|
|
21
|
* through which recipients can access the Corresponding Source.
|
|
22
|
* If you modify file(s) with this exception, you may extend this
|
|
23
|
* exception to your version of the file(s), but you are not
|
|
24
|
* obligated to do so. If you do not wish to do so, delete this
|
|
25
|
* exception statement from your version.
|
|
26
|
*
|
|
27
|
* As a special exception to the GPL, any HTML file which merely
|
|
28
|
* makes function calls to this code, and for that purpose
|
|
29
|
* includes it by reference shall be deemed a separate work for
|
|
30
|
* copyright law purposes. If you modify this code, you may extend
|
|
31
|
* this exception to your version of the code, but you are not
|
|
32
|
* obligated to do so. If you do not wish to do so, delete this
|
|
33
|
* exception statement from your version.
|
|
34
|
*
|
|
35
|
* You should have received a copy of the GNU General Public License
|
|
36
|
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
37
|
*
|
|
38
|
* I, Wojtek Kosior, thereby promise not to sue for violation of this file's
|
|
39
|
* license. Although I request that you do not make use of this code in a
|
|
40
|
* proprietary program, I am not going to enforce this in court.
|
|
41
|
*/
|
|
42
|
|
|
43
|
/*
|
|
44
|
* Use with https://***.app.box.com/s/*
|
|
45
|
* '***' instead of '*' for the first section because otherwise plain app.box.com
|
|
46
|
* URLs won't work.
|
|
47
|
*/
|
|
48
|
|
|
49
|
// TODO: find a public folder link (the private links I have seem to work)
|
|
50
|
// TODO: find a (preferably public) link with a folder inside a folder, as these may need to be handled differently
|
|
51
|
|
|
52
|
/* Extract data from a script that sets multiple variables. */ // from here: https://api-demo.hachette-hydrilla.org/content/sgoogle_sheets_download/google_sheets_download.js
|
|
53
|
|
|
54
|
let prefetchedData = null; // This variable isn't actually used.
|
|
55
|
for (const script of document.scripts) {
|
|
56
|
const match = /Box.prefetchedData = ({([^;]|[^}];)+})/.exec(script.textContent); // looks for "Box.prefetchedData = " in the script files and then grabs the json text after that.
|
|
57
|
if (!match)
|
|
58
|
continue;
|
|
59
|
prefetchedData = JSON.parse(match[1]);
|
|
60
|
}
|
|
61
|
|
|
62
|
let config = null;
|
|
63
|
for (const script of document.scripts) {
|
|
64
|
const match = /Box.config = ({([^;]|[^}];)+})/.exec(script.textContent); // looks for "Box.config = " in the script files and then grabs the json text after that.
|
|
65
|
if (!match)
|
|
66
|
continue;
|
|
67
|
config = JSON.parse(match[1]);
|
|
68
|
}
|
|
69
|
|
|
70
|
let postStreamData = null;
|
|
71
|
for (const script of document.scripts) {
|
|
72
|
const match = /Box.postStreamData = ({([^;]|[^}];)+})/.exec(script.textContent); // looks for "Box.postStreamData = " in the script files and then grabs the json text after that.
|
|
73
|
if (!match)
|
|
74
|
continue;
|
|
75
|
postStreamData = JSON.parse(match[1]);
|
|
76
|
}
|
|
77
|
|
|
78
|
// get domain from URL
|
|
79
|
const domain = document.location.href.split("/")[2];
|
|
80
|
|
|
81
|
/* Replace current page contents. */
|
|
82
|
const replacement_html = `\
|
|
83
|
<!DOCTYPE html>
|
|
84
|
<html>
|
|
85
|
<head>
|
|
86
|
<style>
|
|
87
|
button, .button {
|
|
88
|
border-radius: 10px;
|
|
89
|
padding: 20px;
|
|
90
|
color: #333;
|
|
91
|
background-color:
|
|
92
|
lightgreen;
|
|
93
|
text-decoration: none;
|
|
94
|
display: inline-block;
|
|
95
|
}
|
|
96
|
button:hover, .button:hover {
|
|
97
|
box-shadow: -4px 8px 8px #888;
|
|
98
|
}
|
|
99
|
|
|
100
|
.hide {
|
|
101
|
display: none;
|
|
102
|
}
|
|
103
|
|
|
104
|
#download_button .unofficial, #download_button .red_note {
|
|
105
|
display: none;
|
|
106
|
}
|
|
107
|
#download_button.unofficial .unofficial {
|
|
108
|
display: inline;
|
|
109
|
}
|
|
110
|
#download_button.unofficial .red_note {
|
|
111
|
display: block;
|
|
112
|
}
|
|
113
|
.red_note {
|
|
114
|
font-size: 75%;
|
|
115
|
color: #c55;
|
|
116
|
font-style: italic;
|
|
117
|
text-align: center;
|
|
118
|
}
|
|
119
|
</style>
|
|
120
|
</head>
|
|
121
|
<body>
|
|
122
|
<h1 id="loading" class="hide">loading...</h1>
|
|
123
|
<h1 id="error" class="hide">error occured :(</h1>
|
|
124
|
<h1 id="title" class="hide"></h1>
|
|
125
|
<div id="single_file_section" class="hide">
|
|
126
|
<a id="download_button" class="button">
|
|
127
|
<span class="unofficial">unofficial</span> download
|
|
128
|
<aside class="red_note">(officially disallowed)</aside>
|
|
129
|
</a>
|
|
130
|
<aside></aside>
|
|
131
|
<h2>File info</h2>
|
|
132
|
<div id="file_info"></div>
|
|
133
|
</div>
|
|
134
|
</body>
|
|
135
|
</html>
|
|
136
|
`;
|
|
137
|
|
|
138
|
/*
|
|
139
|
* We could instead use document.write(), but browser's debugging tools would
|
|
140
|
* not see the new page contents.
|
|
141
|
*/
|
|
142
|
const parser = new DOMParser();
|
|
143
|
const alt_doc = parser.parseFromString(replacement_html, "text/html");
|
|
144
|
document.documentElement.replaceWith(alt_doc.documentElement);
|
|
145
|
|
|
146
|
const nodes = {};
|
|
147
|
document.querySelectorAll('[id]').forEach(node => nodes[node.id] = node);
|
|
148
|
|
|
149
|
function show_error() {
|
|
150
|
nodes.loading.classList.add("hide");
|
|
151
|
nodes.error.classList.remove("hide");
|
|
152
|
}
|
|
153
|
|
|
154
|
function show_title(text) {
|
|
155
|
nodes.title.innerText = text;
|
|
156
|
nodes.loading.classList.add("hide");
|
|
157
|
nodes.title.classList.remove("hide");
|
|
158
|
}
|
|
159
|
|
|
160
|
async function hack_file() {
|
|
161
|
nodes.loading.classList.remove("hide");
|
|
162
|
|
|
163
|
const tokens_url = "/app-api/enduserapp/elements/tokens";
|
|
164
|
const file_nr = postStreamData["/app-api/enduserapp/shared-item"].itemID;
|
|
165
|
const file_id = `file_${file_nr}`;
|
|
166
|
const shared_name = postStreamData["/app-api/enduserapp/shared-item"].sharedName;
|
|
167
|
|
|
168
|
/*
|
|
169
|
* We need to perform a POST to obtain a token that will be used later to
|
|
170
|
* authenticate against Box's API endpoint.
|
|
171
|
*/
|
|
172
|
const tokens_response = await fetch(tokens_url, {
|
|
173
|
method: "POST",
|
|
174
|
headers: {
|
|
175
|
"Accept": "application/json",
|
|
176
|
"Content-Type": "application/json",
|
|
177
|
"Request-Token": config.requestToken,
|
|
178
|
"X-Box-Client-Name": "enduserapp",
|
|
179
|
"X-Box-Client-Version": "20.712.2",
|
|
180
|
"X-Box-EndUser-API": `sharedName=${shared_name}`,
|
|
181
|
"X-Request-Token": config.requestToken
|
|
182
|
},
|
|
183
|
body: JSON.stringify({"fileIDs": [file_id]})
|
|
184
|
});
|
|
185
|
console.log("tokens_response", tokens_response);
|
|
186
|
|
|
187
|
const access_token = (await tokens_response.json())[file_id].read;
|
|
188
|
console.log("access_token", access_token);
|
|
189
|
|
|
190
|
const fields = [
|
|
191
|
"permissions", "shared_link", "sha1", "file_version", "name", "size",
|
|
192
|
"extension", "representations", "watermark_info",
|
|
193
|
"authenticated_download_url", "is_download_available",
|
|
194
|
"content_created_at", "content_modified_at", "created_at", "created_by",
|
|
195
|
"modified_at", "modified_by", "owned_by", "description",
|
|
196
|
"metadata.global.boxSkillsCards", "expires_at", "version_limit",
|
|
197
|
"version_number", "is_externally_owned", "restored_from",
|
|
198
|
"uploader_display_name"
|
|
199
|
];
|
|
200
|
|
|
201
|
const file_info_url =
|
|
202
|
`https://api.box.com/2.0/files/${file_nr}?fields=${fields.join()}`;
|
|
203
|
|
|
204
|
/*
|
|
205
|
* We need to perform a GET to obtain file metadata. The fields we curently
|
|
206
|
* make use of are "authenticated_download_url" and "file_version", but in
|
|
207
|
* the request we also include names of other fields that the original Box
|
|
208
|
* client would include. The metadata is then dumped as JSON on the page, so
|
|
209
|
* the user, if curious, can look at it.
|
|
210
|
*/
|
|
211
|
const file_info_response = await fetch(file_info_url, {
|
|
212
|
headers: {
|
|
213
|
"Accept": "application/json",
|
|
214
|
"Authorization": `Bearer ${access_token}`,
|
|
215
|
"BoxApi": `shared_link=${document.URL}`,
|
|
216
|
"X-Box-Client-Name": "ContentPreview",
|
|
217
|
"X-Rep-Hints": "[3d][pdf][text][mp3][json][jpg?dimensions=1024x1024&paged=false][jpg?dimensions=2048x2048,png?dimensions=2048x2048][dash,mp4][filmstrip]"
|
|
218
|
},
|
|
219
|
});
|
|
220
|
console.log("file_info_response", file_info_response);
|
|
221
|
|
|
222
|
const file_info = await file_info_response.json();
|
|
223
|
console.log("file_info", file_info);
|
|
224
|
|
|
225
|
const params = new URLSearchParams();
|
|
226
|
params.set("preview", true);
|
|
227
|
params.set("version", file_info.file_version.id);
|
|
228
|
params.set("access_token", access_token);
|
|
229
|
params.set("shared_link", document.URL);
|
|
230
|
params.set("box_client_name", "box-content-preview");
|
|
231
|
params.set("box_client_version", "2.82.0");
|
|
232
|
params.set("encoding", "gzip");
|
|
233
|
|
|
234
|
/* We use file metadata from earlier requests to construct the link. */
|
|
235
|
const download_url =
|
|
236
|
`${file_info.authenticated_download_url}?${params.toString()}`;
|
|
237
|
console.log("download_url", download_url);
|
|
238
|
|
|
239
|
show_title(file_info.name);
|
|
240
|
|
|
241
|
nodes.download_button.href = download_url;
|
|
242
|
if (!file_info.permissions.can_download)
|
|
243
|
nodes.download_button.classList.add("unofficial");
|
|
244
|
nodes.file_info.innerText = JSON.stringify(file_info);
|
|
245
|
nodes.single_file_section.classList.remove("hide");
|
|
246
|
}
|
|
247
|
|
|
248
|
if (postStreamData["/app-api/enduserapp/shared-item"].itemType == "file") {
|
|
249
|
/*
|
|
250
|
* We call hack_file and in case it asynchronously throws an exception, we
|
|
251
|
* make an error message appear.
|
|
252
|
*/
|
|
253
|
hack_file().then(() => {}, show_error);
|
|
254
|
} else if (postStreamData["/app-api/enduserapp/shared-item"].itemType == "folder") {
|
|
255
|
show_title(postStreamData["/app-api/enduserapp/shared-folder"].currentFolderName);
|
|
256
|
|
|
257
|
// TODO: implement a download folder button (included in proprietary app)
|
|
258
|
/*
|
|
259
|
The original download folder button sends a GET request that gets 2 URLs
|
|
260
|
in the response. 1 of those URLs downloads the file, and a POST request
|
|
261
|
is sent after (or maybe while in some cases?) a file is downloaded, to
|
|
262
|
let the server know how much is downloaded.
|
|
263
|
*/
|
|
264
|
// for each item in the folder, show a button with a link to download it
|
|
265
|
postStreamData["/app-api/enduserapp/shared-folder"].items.forEach(function(item) {
|
|
266
|
console.log("item", item);
|
|
267
|
|
|
268
|
const file_direct_url = "https://"+domain+"/index.php?rm=box_download_shared_file&shared_name="+postStreamData["/app-api/enduserapp/shared-item"].sharedName+"&file_id="+item.typedID;
|
|
269
|
|
|
270
|
const folderButton = nodes.download_button.cloneNode(false);
|
|
271
|
folderButton.removeAttribute("id");
|
|
272
|
|
|
273
|
if (item.type == "file") {
|
|
274
|
folderButton.href = file_direct_url;
|
|
275
|
folderButton.innerText = item.name; // show the name of the file
|
|
276
|
} else if (item.type == "folder") {
|
|
277
|
folderButton.innerText = "[folders inside folders not yet supported]";
|
|
278
|
} else {
|
|
279
|
folderButton.innerText = "[this item type is not supported]";
|
|
280
|
}
|
|
281
|
|
|
282
|
document.body.appendChild(folderButton);
|
|
283
|
});
|
|
284
|
} else {
|
|
285
|
console.log('expected "folder" or "file" as the item type (postStreamData["/app-api/enduserapp/shared-item"].itemType) but got ' + postStreamData["/app-api/enduserapp/shared-item"].itemType + ' instead; this item type is not implemented');
|
|
286
|
show_error();
|
|
287
|
}
|