peji/WebAVP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix: isolate tracker credentials and count static download intent

Browse Source
This commit is contained in:
PageZ948
2026-09-30 03:40:35 +00:00
parent 1693b20d58
commit 7a59d9b405
4 changed files with 89 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
static/privacy-pageview.js
+23 -6
View File
@@ -1,4 +1,4 @@
/* Production pageviews only. Never pass application/browser DOM data to Umami. */
/* Static production pageviews/download intent. No application data to Umami. */
(() => {
'use strict';
const hostname = "player.nenasets.com";
@@ -11,18 +11,25 @@
&& paths.includes(window.location.pathname);
if (!eligible() || window.__altaPageviewLoaded) return;
window.__altaPageviewLoaded = true;
// Rebuild, don't spread the input: no identity, event properties, referrer,
const controls = {releaseAction: 'download_desktop_app'};
const events = {download_desktop_app: {tool: 'alta-export-player', format: 'desktop'}};
const own = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
// Rebuild, don't spread the input: no identity, arbitrary properties, referrer,
// customer title, query, fragment, form, filename or upload data can survive.
window.altaSafePageview = (type, payload) => {
if (!eligible() || type !== 'event' || !payload || payload.name) return null;
return { website, hostname, url, title, referrer: '',
screen: /^\d{1,5}x\d{1,5}$/.test(payload.screen) ? payload.screen : undefined,
language: /^[a-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/.test(payload.language) ? payload.language : undefined };
if (!eligible() || type !== 'event' || !payload) return null;
if (payload.name && (typeof payload.name !== 'string' || !own(events, payload.name))) return null;
const safe = { website, hostname, url, title, referrer: '',
screen: typeof payload.screen === 'string' && /^\d{1,5}x\d{1,5}$/.test(payload.screen) ? payload.screen : undefined,
language: typeof payload.language === 'string' && /^[a-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/.test(payload.language) ? payload.language : undefined };
if (payload.name) { safe.name = payload.name; safe.data = {...events[payload.name]}; }
return safe;
};
const tracker = document.createElement('script');
tracker.src = 'https://umami.nenasets.com/script.js';
tracker.defer = true;
tracker.referrerPolicy = 'no-referrer';
tracker.crossOrigin = 'anonymous';
for (const [key, value] of Object.entries({
'website-id': website, domains: hostname, 'auto-track': 'false',
'exclude-search': 'true', 'exclude-hash': 'true',
@@ -35,5 +42,15 @@
window.umami.track();
}
};
// Capture intent once, before application handlers; never cancel/await navigation.
// The web download anchor and native desktop/update behavior stay unchanged.
document.addEventListener('click', event => {
if (!eligible() || window.webavpNative || event.button !== 0) return;
const control = event.target.closest?.('a[id]');
if (!control || control.disabled || control.getAttribute('aria-disabled') === 'true'
|| !own(controls, control.id) || !window.umami) return;
const name = controls[control.id];
try { window.umami.track(name, {...events[name]}); } catch (_) { /* Analytics is optional. */ }
}, true);
document.head.appendChild(tracker);
})();