waltzio / waltz

A password-free password manager built on Clef
getwaltz.com
MIT License
158 stars 37 forks source link

Solve Pandora's box #265

Closed lolux closed 10 years ago

lolux commented 10 years ago

Following up on https://github.com/waltzio/waltz/commit/a5d6aad8f2f8d69b3b86101c1a39b5da14ff2b71#commitcomment-5037954, thanks for the much helpful tips. I'm trying to apply them to other cases. First up, Pandora, which seems to be a true Pandora's box for Waltz:

{
    "*://*.pandora.com/*": {
        "name": "Pandora",
        "logout": {
            "cookies": ["at", "atn", "v2regbstage"]
        },
        "login": {
            "urls": [ ],
            "formURL": "https://www.pandora.com/radio/jsonp/v35",
            "method": "GET",
            "usernameField": "email",
            "passwordField": "password",
            "check": ""
        }
    }
}
josephwegner commented 10 years ago

Without actually looking at the problem...

You might be able to use a :visible psuedo-selector for the check. Then it will only match the check elements if they're visible. On Jan 12, 2014 1:31 PM, "lolux" notifications@github.com wrote:

Following up on a5d6aad#commitcomment-5037954https://github.com/waltzio/waltz/commit/a5d6aad8f2f8d69b3b86101c1a39b5da14ff2b71#commitcomment-5037954, thanks for the much helpful tips. I'm trying to apply them to other cases. First up, Pandora, which seems to be a true Pandora's box for Waltz:

  • From all I can tell looking at the Network tab, Pandora's form uses GET instead of POST. I think the formURL is as follows, but I'm not certain.
  • Also, the cookies seem to have the same ninja powers as Wikipedia's: manually deleting all the cookies under .pandora.com in console does not log user out.
  • The check element is playing dirty: all logged in elements that ordinarily work as check elements appear in the page's source regardless of log in state. I think ajax determines which ones to show. So, I can't find an element to serve as a check.

{ "://.pandora.com/*": { "name": "Pandora", "logout": { "cookies": ["at", "atn", "v2regbstage"] }, "login": { "urls": [ ], "formURL": "https://www.pandora.com/radio/jsonp/v35", "method": "GET", "usernameField": "email", "passwordField": "password", "check": "" } } }

— Reply to this email directly or view it on GitHubhttps://github.com/waltzio/waltz/issues/265 .

lolux commented 10 years ago

Hmmm, no joy on attempts to apply :visible pseudo-selector on a element from this line: <a class="signoutMenuItem" href="#" address="true">Sign out</a>

jessepollak commented 10 years ago

Pandora is hard...

jessepollak commented 10 years ago

Fixed by new Waltz.

lolux commented 10 years ago

:bow: :boom: