Programmatically Untag FB Photos with Javascript

Question

Hello!

I've spent the past hour hacking away at this: I want to write a Javscript routine to programatically untag myself from photos on Facebook. Once it works, I'll run it in the Firebug console and untag myself from all Facebook photos (there's no way to do this through the GUI).

I wanted to see if you guys had some advice to get me on my journey.

I have a few methods in mind but haven't come too far along quite yet. I've tried an AJAX approach by creating a new HTML request and pointing it to the remove_tag URL, which looks something like this:

/ajax/photo_tagging_ajax.php?pid=(PICTURE_ID)&id=(PICTURE_OWNER_ID)&subject=(SOMETHING)&name=(YOUR+NAME)&action=remove

Not surprisingly, this doesn't work (yet). I've been checking the HTTP response in Firebug and it's quite different than the one when I actually untag a picture. It's not even sending a POST request.

Just to clarify, I've also tried doing a getElementById on the "remove tag" anchor, and then doing a document.location switcharoo, but that doesn't work. I also can't do a .click() on it.

Will this even be possible or am I dreaming? (it's almost 4AM)

Answer 1

Chickenfoot http://groups.csail.mit.edu/uid/chickenfoot/ is a Firefox plugin that might be an alternative to using the Firebug console: you can write macros/scripts to automate repetitive tasks in your browser. The actions you code for are no different to you actually clicking, populating forms or whatever yourself. As far as I can remember there is a DOM interface for traversing html etc.

Answer 2

From DCoder, via Hacker News:

Using Firebug, FireQuery, jQuery no conflict as $jq, from inside a photo page (http://www.facebook.com/photo.php?pid=xxx&id=y) :

  var loc = window.location.href.match(/pid=(\d+)&id=(\d+)/);

  var args = {
    pid: loc[1], // photo ID
    id: loc[2], // request sender id? photo owner id? not sure, haven't tested, but my user ID worked when trying to remove someone from a photo in my album
    subject: loc[2], // user ID to remove
    name: '', // not checked
    action: 'remove',
    __a: 1,
    fb_dtsg: $jq('input[name="fb_dtsg"]').val(),
    post_form_id: $jq('#post_form_id').val(),
    post_form_id_source: 'AsyncRequest'
  };

  $jq.post('/ajax/photo_tagging_ajax.php', args);

It doesn't update the UI. The fb_dtsg and post_form_id are required and seem to be anti-CSRF tokens. Haven't experimented enough to know if they can be reused multiple times.

Answer 3

Since I'm not sure if you picked up my updated version at HN:

  var loc = window.location.href.split('?')[1].split('#')[0].split('&');
  var qs = {};
  $jq.each(loc, function(ix, el) {
   var m = el.split('='), k = m[0], v = m[1];
   qs[k] = v;
  });

  var args = {
    pid: qs.pid, // photo ID
    id: qs.id, // photo owner ID
    subject: Env.user, // user ID to remove
    name: '', // not checked
    action: 'remove',
    __a: 1,
    fb_dtsg: Env.fb_dtsg,
    post_form_id: Env.post_form_id,
    post_form_id_source: 'AsyncRequest'
  };

  $jq.post('/ajax/photo_tagging_ajax.php', args);