Prevent cookie injection

core/rankingCalendar.go

@@ -46,12 +46,12 @@ func GetRankingCalendar(r *http.Request, mode string, year, month int) (HTML, er
 	if err != nil {
 		return HTML(""), err
 	}
+	
 	req.Header.Add("User-Agent", "Mozilla/5.0")
-	req.Header.Add("Cookie", "PHPSESSID="+token)
-	// req.AddCookie(&http.Cookie{
-	// 	Name:  "PHPSESSID",
-	// 	Value: token,
-	// })
+	req.AddCookie(&http.Cookie{
+		Name:  "PHPSESSID",
+		Value: token,
+	})
 
 	resp, err := utils.HttpClient.Do(req)
 	if err != nil {

routes/actions.go

@@ -21,19 +21,18 @@ func pixivPostRequest(r *http.Request, url, payload, token, csrf string, isJSON
 	}
 	req.Header.Add("User-Agent", "Mozilla/5.0")
 	req.Header.Add("Accept", "application/json")
-	req.Header.Add("Cookie", "PHPSESSID="+token)
 	req.Header.Add("x-csrf-token", csrf)
+	req.AddCookie(&http.Cookie{
+		Name:  "PHPSESSID",
+		Value: token,
+	})
 
 	if isJSON {
 		req.Header.Add("Content-Type", "application/json; charset=utf-8")
 	} else {
 		req.Header.Add("Content-Type", "application/x-www-form-urlencoded; charset=utf-8")
 	}
-	// req.AddCookie(&http.Cookie{
-	// 	Name:  "PHPSESSID",
-	// 	Value: token,
-	// })
-
+	
 	resp, err := utils.HttpClient.Do(req)
 	if err != nil {
 		return errors.New("Failed to do this action.")

routes/settings.go

@@ -45,7 +45,7 @@ func setToken(w http.ResponseWriter, r *http.Request) error {
 
 		body, err := io.ReadAll(resp.Body)
 		if err != nil {
-			return errors.New("Cannot parse the response from Pixiv. Please report this issue.")
+			return errors.New("Cannot fetch the response body from Pixiv. Please report this issue.")
 		}
 
 		// CSRF token