/    Sign up×
Community /Pin to ProfileBookmark

Help me understanding how this script works…

Hello all!

I’m trying to understand how a javascript works. My purpose is to make a little youtube utility in java.

In every page source you can find the following variable : “gXSRF_token”; Thanks to some JS, this fields gets populated with a session identifier (looks like random at first sight, but post requests needs a very accurate one…). Now, I’ve been trying to understand what happens !

[CODE]
<script type=”text/javascript”>
function urchinTracker (a) { }
function urchinTrackerDefer (a) { }
function _hbLink (a,b) { return false; }

[B]var gXSRF_token = ”[/B];
var gXSRF_field_name = ”;
var gXSRF_ql_pair = ”;
var onLoadFunctionList = onLoadFunctionList || [];

gXSRF_token = ‘L9SMusiZqK9_RKKaKK7Pef1mXal8MTIzNTEzNTMyOQ==’;
gXSRF_field_name = ‘session_token’;
onLoadFunctionList.push(function() { [B]populate_session_token()[/B] });
gXSRF_ql_pair = ‘session_token=bNU9Mjtxxw03_zwossLLfkg25UV8OA==’;
[/CODE]

The html headers refer to 2 js pages:
[url]http://s.ytimg.com/yt/js/base_all_with_bidi-vfl78390.js[/url]
[url]http://s.ytimg.com/yt/js/channel_all-vfl74155.js[/url]

The populate function is defined in the first one and goes as follows:

[CODE]function populate_session_token()
{
for(var form_pos=0;form_pos<document.forms.length;form_pos++)
{
var skip=false;
for(var exclude_pos=0;
exclude_pos<session_excluded_forms.length;
exclude_pos++)
{
if(document.forms[form_pos].name
==session_excluded_forms[exclude_pos])
{
skip=true;
}
}
var aform=document.forms[form_pos];
if((aform.method.toLowerCase()==’post’)&&(skip==false))
{
var found=false;
for(var elem_pos=0;elem_pos<aform.elements.length;
elem_pos++)
{
var form_field=aform.elements[elem_pos];
if(form_field.name==gXSRF_field_name)
{
found=true;
}
}
if(!found)
{
dynamic_append_session_token(aform);
}
}
}
}[/CODE]

Can’t understand how the “gXSRF_token” variable gets populated there ?

Maybe you can understand this better than I can 🙂
Thanks for your time!

to post a comment
JavaScript

2 Comments(s)

Copy linkTweet thisAlerts:
@toicontienFeb 21.2009 — It's not populating the gXSRF_token variable. It appends a hidden form field to every form on the page so each form has this session token. The value for the gXSRF_token variable must be assigned somewhere else.
Copy linkTweet thisAlerts:
@toicontienFeb 21.2009 — Oh for Pete's sake. You're not talking about the gXSRF_token variable. It pays to read accurately. ?

That function basically looks in every form for a form field named the same as the value of the gXSRF_field_name variable. If a form field is found, it puts the token value in the form field. If no form field was found, it probably creates an <input type="hidden"> field and gives it the token value.
×

Success!

Help @Cornichon spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 5.1,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,

tipper: @Samric24,
tipped: article
amount: 1000 SATS,
)...