← back to Dw Photo Capture
add creds-in-URL fetch guard to gated pages (TK-10984)
1407ed7f264cc0168bd2b5d7a0261829428b5dc3 · 2026-08-30 22:57:37 -0700 · Steve Abrams
Files touched
M public/cam.htmlM public/caps.htmlM public/desk.htmlM public/learn.html
Diff
commit 1407ed7f264cc0168bd2b5d7a0261829428b5dc3
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Sun Aug 30 22:57:37 2026 -0700
add creds-in-URL fetch guard to gated pages (TK-10984)
---
public/cam.html | 25 ++++++++++++++++++++++++-
public/caps.html | 25 ++++++++++++++++++++++++-
public/desk.html | 25 ++++++++++++++++++++++++-
public/learn.html | 25 ++++++++++++++++++++++++-
4 files changed, 96 insertions(+), 4 deletions(-)
diff --git a/public/cam.html b/public/cam.html
index 1e0d77a..ccd5c08 100644
--- a/public/cam.html
+++ b/public/cam.html
@@ -1,6 +1,29 @@
<!doctype html>
<html lang="en">
-<head>
+<head><script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, maximum-scale=1, user-scalable=no">
<meta name="apple-mobile-web-app-capable" content="yes">
diff --git a/public/caps.html b/public/caps.html
index af9845f..304f06c 100644
--- a/public/caps.html
+++ b/public/caps.html
@@ -1,4 +1,27 @@
-<!doctype html><html><head><meta charset="utf-8">
+<!doctype html><html><head><script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script><meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1,user-scalable=no">
<title>DW camera capability probe</title>
<style>
diff --git a/public/desk.html b/public/desk.html
index 3b86137..01f0136 100644
--- a/public/desk.html
+++ b/public/desk.html
@@ -1,6 +1,29 @@
<!doctype html>
<html lang="en">
-<head>
+<head><script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>DW Remote Shutter — Desktop</title>
diff --git a/public/learn.html b/public/learn.html
index 7c045d3..fddbd7f 100644
--- a/public/learn.html
+++ b/public/learn.html
@@ -1,6 +1,29 @@
<!doctype html>
<html lang="en">
-<head>
+<head><script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
<title>What the scanner has learned · DW</title>
← e27fa61 auto-data-snapshot: 2026-08-30T04:46:23 (1 data files) — dat
·
back to Dw Photo Capture
·
deploy-safety: exclude data/ from rsync (TK-10984) ac43121 →