From 3170038db7b67c3edb744605169ab286a7f72f9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= <raphael@vinot.info>
Date: Wed, 3 Aug 2022 12:07:41 +0200
Subject: [PATCH] new: dropdown to pass DoNotTrack HTTP header

Improvments on the capture page.
---
 bin/async_capture.py               |  5 ++++-
 website/web/__init__.py            |  3 +++
 website/web/templates/capture.html | 26 +++++++++++++++++++++++---
 3 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/bin/async_capture.py b/bin/async_capture.py
index 8eff459..eb48b67 100755
--- a/bin/async_capture.py
+++ b/bin/async_capture.py
@@ -76,6 +76,8 @@ class AsyncCapture(AbstractManager):
                             header, h_value = splitted
                             if header and h_value:
                                 headers[header.strip()] = h_value.strip()
+            if to_capture.get('dnt'):
+                headers['DNT'] = to_capture['dnt']
 
             self.logger.info(f'Capturing {to_capture["url"]} - {uuid}')
             self.thirdparty_submit(to_capture)
@@ -105,7 +107,8 @@ class AsyncCapture(AbstractManager):
 
     async def _capture(self, url: str, *, perma_uuid: str, cookies_pseudofile: Optional[Union[BufferedIOBase, str]]=None,
                        listing: bool=True, user_agent: Optional[str]=None,
-                       referer: Optional[str]=None, headers: Optional[Dict[str, str]]=None,
+                       referer: Optional[str]=None,
+                       headers: Optional[Dict[str, str]]=None,
                        proxy: Optional[Union[str, Dict]]=None, os: Optional[str]=None,
                        browser: Optional[str]=None, parent: Optional[str]=None) -> Tuple[bool, str]:
         '''Launch a capture'''
diff --git a/website/web/__init__.py b/website/web/__init__.py
index 5af59b1..724b1e8 100644
--- a/website/web/__init__.py
+++ b/website/web/__init__.py
@@ -866,6 +866,9 @@ def capture_web():
         if request.form.get('referer'):
             capture_query['referer'] = request.form['referer']
 
+        if request.form.get('dnt'):
+            capture_query['dnt'] = request.form['dnt']
+
         if request.form.get('headers'):
             capture_query['headers'] = request.form['headers']
 
diff --git a/website/web/templates/capture.html b/website/web/templates/capture.html
index 7846fae..b99ad0d 100644
--- a/website/web/templates/capture.html
+++ b/website/web/templates/capture.html
@@ -151,12 +151,24 @@
     <div id="collapseConfigCapture" class="collapse">
       <div class="card card-body">
         <div class="row mb-3">
-          <label for="referer" class="col-sm-2 col-form-label">Referer:</label>
+          <label for="referer" class="col-sm-2 col-form-label"><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer">Referer</a>:</label>
           <div class="col-sm-10">
             <input type="text" class="form-control" name="referer" id=referer placeholder="Pass referer of the URL">
           </div>
         </div>
 
+        <div class="row mb-3">
+          <label for="dnt" class="col-sm-2 col-form-label"><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT">Do not Track</a>:</label>
+          <div class="col-sm-10">
+            <select class="form-select" name="dnt" id="dnt" aria-label="Select a value for the Do Not Track HTTP Header">
+              <option value="" selected>Select a value for the DNT header (header not set otherwise)</button>
+              <option value="0">0 (The user prefers to allow tracking on the target site.)</option>
+              <option value="1">1 (The user prefers not to be tracked on the target site.)</option>
+              <option value="null">null (The user has not specified a preference about tracking.)</option>
+            </select>
+          </div>
+        </div>
+
         <div class="row mb-3">
           <label for="headers" class="col-sm-2 col-form-label">Other HTTP headers:</label>
           <div class="col-sm-10">
@@ -172,9 +184,17 @@
         </div>
 
         <div class="row mb-3">
-          <label for="cookies" class="col-sm-6 col-form-label">Cookies (JSON export from the Firefox plugin Cookie Quick Manager)</label>
-          <div class="col-sm-4">
+          <label for="cookies" class="col-sm-2 col-form-label">Cookies:</label>
+          <div class="col-sm-10">
             <input type="file" class="form-control-file" id="cookies" name="cookies">
+            <div>The file can either be the JSON export from the Firefox plugin <a href="https://addons.mozilla.org/en-US/firefox/addon/cookie-quick-manager/">Cookie Quick Manager</a> <b>or</b> from an other Lookyloo capture.</div>
+            <div class="alert alert-danger" role="alert">
+              The cookies will be stored on the lookyloo instance and potentially
+              accessed by third parties (either because the Lookyloo instance is public,
+              or people other than you have access to the instance).
+              If that's the case, please make sure none of them can be used to login as yourself
+              on websites.
+            </div>
           </div>
         </div>
       </div>