Anki is a smart spaced repetition flashcard program
Find a file
Damien Elmes 2fc6b72460 Require an auth token for API access
We were previously inspecting the referrer, but that is spoofable,
and doesn't guard against other processes on the machine.

To accomplish this, we use a request interceptor to automatically
add an auth token to webviews with the right context. Some related
changes were required:

- We avoid storing _page, which was leading to leaks & warning on exit
- At webview creation (or set_kind() invocation), we assign either
an authenticated or unauthenticated web profile.
- Some of our screens initialize the AnkiWebView when calling, e.g.,
aqt.forms.stats.Ui_Dialog(). They then immediately call .set_kind().
This reveals a race condition in our DOM handling code: the webview
initialization creates an empty page with the injected script, which
causes a domDone signal to be sent back. This signal arrives after
we've created another page with .set_kind(), causing our code to think
the DOM is ready when it's not. Then when we try to inject the dynamic
styling, we get an error, as the DOM is not ready yet. In the absence
of better solutions, I've added a hack to set_kind() to deal with this
for now.

(cherry picked from commit 24bca15fd3)
2025-04-17 11:17:47 +10:00
.buildkite Auto-expand bundle progress in Buildkite on Linux 2025-01-26 19:37:34 +11:00
.cargo Switch to SvelteKit (#3077) 2024-03-31 09:16:31 +01:00
.config Drop workspace-hack in favor of workspace deps 2023-06-23 17:41:31 +10:00
.github/ISSUE_TEMPLATE Move away from Bazel (#2202) 2022-11-27 15:24:20 +10:00
.vscode.dist HMR on Windows (#3144) 2024-04-17 21:23:34 +10:00
build Bundling got broken in the revert to Qt 6.6 2025-01-26 19:32:01 +11:00
cargo Latest openssl CVE 2025-02-03 15:17:07 +07:00
docs Ignore SYNC_PORT and SYNC_BASE in syncserver Dockerfile (#3716) 2025-01-25 19:28:55 +11:00
ftl Update translations 2025-02-06 22:59:19 +07:00
proto Fix/re-optimize FSRS if short-term param is weird (#3742) 2025-01-26 10:42:17 +11:00
pylib Bump Rust to 1.84 2025-01-26 18:51:21 +11:00
python Hack in a fix for wheel generation 2025-01-27 01:20:58 +11:00
qt Require an auth token for API access 2025-04-17 11:17:47 +10:00
rslib Fix/disable FSRS short-term scheduler if w[17] or w[18] is zero (#3788) 2025-02-06 14:24:40 +07:00
tools Use Qt 6.8 on ARM Linux; add tools/run-qt6.8 2025-01-25 21:59:31 +11:00
ts Sanitize field content in editor 2025-04-17 11:16:57 +10:00
.deny.toml Allow Unicode-3 license 2024-07-20 18:07:06 +07:00
.dockerignore Add distroless Dockerfile and implement internal health check (#3366) 2024-08-29 17:05:33 +07:00
.dprint.json Switch back to Prettier for Svelte formatting 2025-01-13 15:53:55 +11:00
.eslintrc.cjs Include error message text on page 2024-06-24 15:35:47 +07:00
.gitattributes try again to improve GitHub's language stats 2021-01-20 13:20:45 +10:00
.gitignore Yarn 4 (#3772) 2025-01-26 14:40:17 +11:00
.gitmodules Exclude PyOxidizer from recursive checkout 2023-07-02 18:22:44 +10:00
.isort.cfg Specify Python version for auto-formatters (#3325) 2024-08-04 20:54:14 +07:00
.mypy.ini Enable strict_optional for aqt/tagedit, utils, sync (#3578) 2024-11-15 16:29:19 +03:00
.prettierrc Switch back to Prettier for Svelte formatting 2025-01-13 15:53:55 +11:00
.pylintrc Add ability to restore a notetype to its original configuration (#2472) 2023-04-18 14:07:51 +10:00
.ruff.toml Specify Python version for auto-formatters (#3325) 2024-08-04 20:54:14 +07:00
.rustfmt-empty.toml Move away from Bazel (#2202) 2022-11-27 15:24:20 +10:00
.rustfmt.toml Move ascii_percent_encoding into a separate repo 2023-04-12 08:45:23 +10:00
.version Bump version 2025-04-17 11:16:26 +10:00
.yarnrc.yml Yarn 4 (#3772) 2025-01-26 14:40:17 +11:00
Cargo.lock Latest openssl CVE 2025-02-03 15:17:07 +07:00
Cargo.toml Update to FSRS-rs v2.0.3 (fix simulator) (#3784) 2025-02-02 23:35:34 +07:00
check Add a shortcut to auto-format before running checks 2023-07-02 09:59:05 +10:00
CONTRIBUTORS Update Deck Options strings to clarify Timers (#3792) 2025-02-06 15:17:30 +07:00
LICENSE Replace css_browser_selector with our own implementation (#2854) 2023-11-30 10:57:33 +10:00
ninja Switch to SvelteKit (#3077) 2024-03-31 09:16:31 +01:00
package.json Sanitize field content in editor 2025-04-17 11:16:57 +10:00
pkgkey.asc add public key for release signing 2018-09-18 10:40:45 +10:00
pyproject.toml chore: add initial configuration for pyright (#3361) 2024-08-17 13:10:02 +07:00
README.md Updated README (#2718) 2023-10-11 14:11:07 +10:00
run Fix webengine remote debugging in Qt6 2023-11-05 12:41:17 +10:00
run.bat HMR on Windows (#3144) 2024-04-17 21:23:34 +10:00
rust-toolchain.toml Bump Rust to 1.84 2025-01-26 18:51:21 +11:00
SECURITY.md add SECURITY.md 2021-09-22 22:55:19 +10:00
yarn Switch to SvelteKit (#3077) 2024-03-31 09:16:31 +01:00
yarn.bat Switch to SvelteKit (#3077) 2024-03-31 09:16:31 +01:00
yarn.lock Sanitize field content in editor 2025-04-17 11:16:57 +10:00

Anki

Build status

This repo contains the source code for the computer version of Anki.

About

Anki is a spaced repetition program. Please see the website to learn more.

Getting Started

Anki Betas

If you'd like to try development builds of Anki but don't feel comfortable building the code, please see Anki betas

Developing

For more information on building and developing, please see Development.

Contributing

Want to contribute to Anki? Check out the Contribution Guidelines.

Anki Contributors

CONTRIBUTORS

License

Anki's license: LICENSE