peji/WebAVP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix: isolate tracker credentials and count static download intent

Browse Source
This commit is contained in:
PageZ948
2026-09-30 03:40:35 +00:00
parent 1693b20d58
commit 7a59d9b405
4 changed files with 89 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/production-pageviews.md
+9 -1
View File
@@ -9,8 +9,16 @@ Automatic Umami tracking is disabled, including history and click hooks. One
manual pageview is sent per loaded document. The before-send hook reconstructs
a strict projection: website, hostname, static title `Alta Export Player`, static path
`/`, empty referrer, validated ordinary browser screen/language. It drops
identity, named/custom events, tags, arbitrary properties, user title, URL,
identity, unknown/custom events, tags, arbitrary properties, user title, URL,
query/fragment, filenames, upload contents, forms and application state.
Only fixed download controls emit fixed event names/properties: `#releaseAction` → `download_desktop_app` (`tool: alta-export-player`, `format: desktop`). Native desktop/update modes are excluded.
These are click intents, not successful-download reports. A capture listener does
not read the link URL or filename, cancel navigation, or await analytics. Unknown events and
caller-provided event data are discarded; whitelisted event data is reconstructed.
The hook is installed before creating/loading the external script, auto tracking
is disabled, and an unavailable bootstrap produces no tracker GET/POST. The script
uses anonymous CORS and no-referrer; collection fetch credentials are omit.
No application data is read. Both script requests and collection requests must
have no Cookie, Authorization or Referer headers. Tracker credentials are omit.