Anki/qt/aqt
Damien Elmes 24bca15fd3 Require an auth token for API access
We were previously inspecting the referrer, but that is spoofable,
and doesn't guard against other processes on the machine.

To accomplish this, we use a request interceptor to automatically
add an auth token to webviews with the right context. Some related
changes were required:

- We avoid storing _page, which was leading to leaks & warning on exit
- At webview creation (or set_kind() invocation), we assign either
an authenticated or unauthenticated web profile.
- Some of our screens initialize the AnkiWebView when calling, e.g.,
aqt.forms.stats.Ui_Dialog(). They then immediately call .set_kind().
This reveals a race condition in our DOM handling code: the webview
initialization creates an empty page with the injected script, which
causes a domDone signal to be sent back. This signal arrives after
we've created another page with .set_kind(), causing our code to think
the DOM is ready when it's not. Then when we try to inject the dynamic
styling, we get an error, as the DOM is not ready yet. In the absence
of better solutions, I've added a hack to set_kind() to deal with this
for now.
2025-04-15 19:07:44 +10:00
..
browser
data
forms Feat/grade now (#3840) 2025-03-15 17:30:40 +07:00
import_export
operations Feat/grade now (#3840) 2025-03-15 17:30:40 +07:00
qt
__init__.py
_macos_helper.py
about.py
addcards.py
addons.py
ankihub.py
changenotetype.py
clayout.py
colors.py
customstudy.py
dbcheck.py
debug_console.py Increase font size in debug console (#3743) 2025-01-20 06:47:33 +03:00
deckbrowser.py
deckchooser.py
deckconf.py Improve exception handling (#3290) 2024-08-04 20:51:13 +07:00
deckdescription.py
deckoptions.py
editcurrent.py
editor.py
emptycards.py
errors.py
exporting.py
fields.py Add title for some dialogs and avoid hardcoding the text of the discard changes dialog (#3846) 2025-03-10 15:53:43 +07:00
filtered_deck.py
flags.py
gui_hooks.py
importing.py
legacy.py
log.py
main.py
mediacheck.py
mediasrv.py Require an auth token for API access 2025-04-15 19:07:44 +10:00
mediasync.py
modelchooser.py
models.py
mpv.py
notetypechooser.py
overview.py Fix mypy errors 2024-10-26 19:07:43 -07:00
package.py
preferences.py
profiles.py
progress.py
props.py
py.typed
reviewer.py
schema_change_tracker.py
sound.py Require an auth token for API access 2025-04-15 19:07:44 +10:00
stats.py Allow choosing filtered decks in stats (#3687) 2025-01-04 17:39:16 +03:00
studydeck.py
stylesheets.py
switch.py
sync.py
tagedit.py
taglimit.py
taskman.py
theme.py
toolbar.py
tts.py
undo.py
update.py
utils.py
webview.py Require an auth token for API access 2025-04-15 19:07:44 +10:00
widgetgallery.py
winpaths.py