Shitnewspaper “Plus” service bypass
One day I was looking at this one particular shitnewspaper site and felt slightly annoyed over their paywall articles requiring a “Plus” membership. I wanted to know how much of a certain article I would be able to see and it turns out that it’s more than just the ingress!
Disclaimer:
This was not done for monetary reasons but rather to show you what side-effects sloppy features can have. Any info or code used here comes with no liability and is only meant for personal use. If you happen to enjoy the “Plus” content of this shitnewspaper, go ahead and support their service as it’s not expensive.
As you’ve noticed, I’m avoiding using the name of the specific shitnewspaper site. I would rather not have this blog post be indexed with that keyword, hence I refer to this particular shitnewspaper as shitnewspaper.
The paywall
Here you can see how the paywall looks like when you try to look at a “Plus” article. A normal user would just go on to the next article but I decided to stay and see how the paywall has actually been implemented. I’ve heard rumours of bad practices eg. hiding premium content with bare CSS and wanted to know if there would be something similar here. Well, apparently there is something 🔥
The bypass
When having the dev-tools open, you can see that the shitnewspaper loads a ton of stuff on page load, but one of these things is the actual page. The page in itself has a paywall integrated by default, but all the data of the article is visible in the file, however in another format.
At this point, I knew that I could somehow run my own script on the shitnewspaper site and populate the content. As this seemed like too easy I had my bets that someone else had already come up with this and I was right.
Someone had already done the hard work for me, but the script was not that fresh and didn’t work so I decided to fix it to see that something that I had imagined would actually work.
The code
I had little time one evening after some beverages and wanted to give the fix a shot. I used the Tampermonkey chrome plugin to inject scripts on the page and found out that the original code almost worked, I just had to tweak a few parts of it and add some missing styles that the shitnewspaper loads via JS for some reason. Feel free to copy this and remember to edit the scripts @match-attribute to the actual URL.
This script reads the article data from the global set variable and builds up every piece of the article with the respective proper elements (paragraph, heading, subheading, image etc.).
The current script could be improved by getting some event listener connected to the ReactJS that’s being used. I could have used some setTimeout solution but that felt too hacky. In case the Plus content is behind paywall with this solution, just refresh the page and it should be displayed properly.
The conclusion
If you are going to implement a paywall, make sure that you do it right and not in a sloppy way that is easily bypassable. Alma media will probably update this at some point and break the script, but until that day we can use this as an example of how not to do this.
This was a quick funny “project” that I thought would be fun to share 😃 The end result isn’t the best-looking code but as a quick POC, it works just fine. I also don’t see the value in diving too deep into this as it’s clearly something that works only temporarily.