How to allow NoScript ClearClick ?

[taglife]

How to allow NoScript ClearClick ?
When edit photo name in https://picasaweb.google.com
It can not click right and Ctrl+V.

Code: Select all

[NoScript ClearClick] Swallowed event click on undefined/0 at https://docs.google.com/picker?protocol=gadgets&relayUrl=https://picasaweb.google.com/s/v/lighthousefe_98.03/rpc_relay.html&hostId=pwa&hl=zh_TW&rpcService=lhid_picker&rpctoken=190exzxazxidp&selectButtonLabel=%E7%A2%BA%E5%AE%9A&title&navHidden=true&multiselectEnabled=true&white=true&chromeMode=none&uploadToAlbumId=5654622536935555297&nav=((%22upload%22,null,%7B%22query%22:%22photos%22,%22data%22:%7B%22owner_name%22:%22109154272040971063932%22,%22disable_asbe_notification%22:%22false%22,%22streamid%22:null%7D%7D))

[NoScript ClearClick] Swallowed event keypress on INPUT/0 at https://docs.google.com/picker?protocol=gadgets&relayUrl=https://picasaweb.google.com/s/v/lighthousefe_98.03/rpc_relay.html&hostId=pwa&hl=zh_TW&rpcService=lhid_picker&rpctoken=190exzxazxidp&selectButtonLabel=%E7%A2%BA%E5%AE%9A&title&navHidden=true&multiselectEnabled=true&white=true&chromeMode=none&uploadToAlbumId=5654622536935555297&nav=((%22upload%22,null,%7B%22query%22:%22photos%22,%22data%22:%7B%22owner_name%22:%22109154272040971063932%22,%22disable_asbe_notification%22:%22false%22,%22streamid%22:null%7D%7D))

[NoScript ClearClick] Swallowed event keyup on INPUT/0 at https://docs.google.com/picker?protocol=gadgets&relayUrl=https://picasaweb.google.com/s/v/lighthousefe_98.03/rpc_relay.html&hostId=pwa&hl=zh_TW&rpcService=lhid_picker&rpctoken=190exzxazxidp&selectButtonLabel=%E7%A2%BA%E5%AE%9A&title&navHidden=true&multiselectEnabled=true&white=true&chromeMode=none&uploadToAlbumId=5654622536935555297&nav=((%22upload%22,null,%7B%22query%22:%22photos%22,%22data%22:%7B%22owner_name%22:%22109154272040971063932%22,%22disable_asbe_notification%22:%22false%22,%22streamid%22:null%7D%7D))

[NoScript ClearClick] Swallowed event mousedown on https://picasaweb.google.com/lh/webUpload?uname=109154272040971063932&aid=5654622536935555297&continue=https%3A%2F%2Fpicasaweb.google.com%2F109154272040971063932%2FScrapbookPhotos%23 (rapid fire from https://docs.google.com in 400ms)

[NoScript ClearClick] Swallowed event mouseup on https://picasaweb.google.com/lh/webUpload?uname=109154272040971063932&aid=5654622536935555297&continue=https%3A%2F%2Fpicasaweb.google.com%2F109154272040971063932%2FScrapbookPhotos%23 (rapid fire from https://docs.google.com in 400ms)

[NoScript ClearClick] Swallowed event click on https://picasaweb.google.com/lh/webUpload?uname=109154272040971063932&aid=5654622536935555297&continue=https%3A%2F%2Fpicasaweb.google.com%2F109154272040971063932%2FScrapbookPhotos%23 (rapid fire from https://docs.google.com in 400ms)

[Tom T.]

Did you receive an actual ClearClick warning, with a six-digit number on it? If so, please produce it again, and click "Generate Report".
This will cause a detailed report to be sent privately to NoScript developer Giorgio Maone for analysis.

In the meantime, if you trust the site completely, there are two quick workarounds possible:

1) Less safe: NoScript Options > Embeddings and uncheck "ClearClick protection on pages ... trusted" (ONLY!)

3) Safer: Instead, open about:config, and in the Filter Bar, type
noscript.clearclick.exceptions
Double-click it to change the value, then add the URL of your site to be exempted, in this case:

Code: Select all

https://picasaweb.google.com/

Do these help?

[taglife]

YES~!! OK~!!!
But it should have a GUI

[taglife]

Hi,
I click myphotos link still errors
https://picasaweb.google.com/lh/myphotos
Can you help me

Code: Select all

[NoScript ClearClick] Swallowed event mousedown on https://picasaweb.google.com/lh/webUpload?uname=109154272040971063932&aid=5654622536935555297&continue=https%3A%2F%2Fpicasaweb.google.com%2F109154272040971063932%2FScrapbookPhotos (rapid fire from https://docs.google.com in 400ms)

[NoScript ClearClick] Swallowed event mouseup on https://picasaweb.google.com/lh/webUpload?uname=109154272040971063932&aid=5654622536935555297&continue=https%3A%2F%2Fpicasaweb.google.com%2F109154272040971063932%2FScrapbookPhotos (rapid fire from https://docs.google.com in 400ms)

[NoScript ClearClick] Swallowed event click on https://picasaweb.google.com/lh/webUpload?uname=109154272040971063932&aid=5654622536935555297&continue=https%3A%2F%2Fpicasaweb.google.com%2F109154272040971063932%2FScrapbookPhotos (rapid fire from https://docs.google.com in 400ms)

[Tom T.]

Sorry, we should have put a wildcard (asterisk) in the Exceptions, to cover all subdomains of the site.

Code: Select all

https://picasaweb.google.com/*

The reason that there isn't a GUI is that it is definitely better to find the root cause of the error. If you did receive a ClearClick warning, please send the report to Giorgio as requested -- click the "Send report" button.

If you do not receive these reports, I'll ask Giorigo to look at this issue, as I don't remember seeing a similar complaint.
Either way, it's better for the site to fix poor coding than to add exceptions. It is theoretically possible that someone may become the victim of a genuine clickjacking attack. See the NS FAQ on clickjacking: ClearClick FAQ

I'm not familiar with the site, but have seen "rapid fire" errors before, where picassa.google.com calls docs.google.ccm, as in your messages, or similar at other sites. Perhaps Giorgio can fine-tune the ClearClick protection if this is all that is required.

Please let us know if you do or do not get a warning box with a way to send report. If not, I'll ask Giorgio to look, thanks.

[Giorgio Maone]

I'm investigating, thank you.

[taglife]

hello test test,
I am taglife ~!!!
no spam...

myphotos link https://picasaweb.google.com/lh/myphotos
I have to click twice to have effect.

[Tom T.]

hello test test,
I am taglife ~!!!
no spam...

myphotos link https://picasaweb.google.com/lh/myphotos
I have to click twice to have effect.

'
Per Giorgio, there was a bug in the spam filter from Sunday afternoon to Monday morning, so you were not the only one affected.
We apologize for the inconvenience.

I clicked your link only once, and was taken to the login page. I do not have an account there, but your link worked well for me with one click.

[taglife]

about:config

noscript.clearClick.exceptions;.mail.yahoo.com https://mail.google.com/ *.ebay.com *.photobucket.com https://picasaweb.google.com

I caught the gif photo !!!

[Tom T.]

about:config

noscript.clearClick.exceptions;.mail.yahoo.com https://mail.google.com/ *.ebay.com *.photobucket.com https://picasaweb.google.com

I caught the gif photo !!!

That's a lot of exceptions. If we add an exception for every site that warns, we may allow an actual compromised site.
I still hope that Giorgio can fine-tune or otherwise make these exceptions unnecessary.

[taglife]

NoScript 2.5.8 in Firefox 16.0.1 this ClearClick have not change...

[Giorgio Maone]

Sorry, I've tried to reproduce by looking at your animated GIF but with no luck yet (I uploaded two pictures so far but everything seems to work fine).

Beside the GIF, could you provide me with step-by-step instructions to reproduce starting from scratch in a fresh profile?

Thank you.

[taglife]

ha~
I use Firefox v19 + noscript-2.6.5.7-sm+fx+fn.xpi
These 2 Picasaweb's problem still exist...
Very hate...

[Tom T.]

Did you try a brand new profile, with only NoScript and no other add-ons, as Giorgio requested?

noscript-2.6.5.7-sm+fx+fn.xpi

What does "sm+fx+fn" mean? I see only 2.6.5.7.xpi as the name of the .xpi installer. (It's now 2.6.5.8)

[therube]

> noscript-2.6.5.7-sm+fx+fn.xpi

Means nothing, it is normal.
I think that is how AMO designates the XPI's.
(Direct from noscript.net does not show that.)