Pinterest - Allow for downloading secret boards

[resolritter]

As explained in #83 (comment), 55d4d23 made it impossible to download secret Pinterest boards since those require authentication. The current error goes like this

 > gallery-dl https://pinterest.com/user/SECRET/
[pinterest][error] NotFoundError: Requested board could not be found

Even though the board, in fact, exists.

---

Related to authentication, here's what I've found after digging into php-interest-bot's source.

Default headers are similar to the ones used in this project: link

When building the request, setTokenFromCookies is called: link

And here is setTokenFromCookies: link

Finally, the token is included in the headers: link

As for logging in and getting the token: 1, 2, 3

Currently I see two implementation paths

• Use php-interest-bot's authentication approach. I don't know if there are similar implementations in this library, still.
• Bring back the code removed in 55d4d23 as an alternative back-end, but this time using a custom user token. i.e. the current implementation would stay, but it could switch to the old one if the user supplies a token or the board is not found.

[mikf]

Downloading from secret boards should work with exported cookies.

[resolritter]

Initial naive changes did not work on my end.

Note I chose to modify the source directly because I didn't find a way to configure the headers through the configuration.

  diff --git a/gallery_dl/extractor/pinterest.py b/gallery_dl/extractor/pinterest.py
  index cc89ac52..c5d910ee 100644
  --- a/gallery_dl/extractor/pinterest.py
  +++ b/gallery_dl/extractor/pinterest.py
  @@ -235,6 +235,7 @@ class PinterestAPI():
           "X-Requested-With"    : "XMLHttpRequest",
           "Origin"              : BASE_URL,
           "Referer"             : BASE_URL + "/",
  +        "X-CSRFToken"         : "[TOKEN]",
       }
   
       def __init__(self, extractor):
  @@ -284,6 +285,8 @@ class PinterestAPI():
   
       def _call(self, resource, options):
           url = "{}/resource/{}Resource/get/".format(self.BASE_URL, resource)
  +        options["username"] = "[NAME]"
  +        options["field_set_key"] = "detailed"
           params = {"data": json.dumps({"options": options}), "source_url": ""}
   
           response = self.extractor.request(

X-CSRFToken inclusion follows this line.

"username" and "field_set_keys" follows this and this.

And yes, the token is valid since I'm getting it from the browser. It could be missing a cookie somewhere... Have to dig more into the PHP source I guess?