[RESOLVED] NoScript blocks ebay menue

[tompp]

ebay is running another site for classified ads. after installing the latest version 2.2.6 NoScript blocks the menues or photos to be enlarged when you put the mouse over. i got ebay on my whitelist but it doesnt work. because the classified ads page is called "kleinanzeigen.ebay.de" and i cannot put this on the whitelist for some reason? i have to disable NoScript at all to let this site work and it doesnt matter if i allow everything here. this problem occured just after installing the latest version. before that it worked fine. maybe its possible to reinstall an older version , and where can i get it?

[Alan Baxter]

Hi, Tom. Sorry to hear you're having trouble. If your being served ads from kleinanzeigen.ebay.de, then may I assume you're accessing ebay with ebay.de and you have ebay.de in your whitelist? If that's the case, then the whitelisting of ebay.de automatically allows all its subdomains, including kleinanzeigen.ebay.de. The Allow button in the NoScript menu is grayed out because it's already allowed. Do you have ebay.de already whitelisted? Are you accessing ebay with ebay.de?

In any event, I've found that I need to allow the ebay helper domains too to get ebay to work right. The menus and photo enlargements work correctly for me on ebay.de as long as these helper domains are allowed.
ebay.com
ebaydesc.com
ebayobjects.com
ebayrtm.com
ebaystatic.com

I'm using NoScript 2.2.6 on Fx 9.0.1 on Windows XP SP3, no other extensions, and NoScript's default settings.

[tompp]

thanx for answering. but the reason why noscript blocks these ebay menues is, surprise, surprise: i have to allow
"google-analytics.com"!?!! thats sounds a bit crazy but its true. i dont know who´s to blame for this kinda strange politics: eBay, Google, or NoScript? in fact: with that older NoScript version it worked fine...

[dhouwn]

Images don't enlarge for me too.

There is actually a surrogate script (dummy replacement) for Google-Analytics for such cases (where page needs it but you do not allow it). Seems like this surrogate would need some updating.

It might be helpful to have the error console output relating to this, I couldn't find anything like this, instead I came across stuff like:

Code: Select all

Error: [Exception... "'NoScript aborted redirection to http://widget.xx.xx.criteo.com/pdf/display.js?p1=…&t1=sendEvent&ref=http%3A%2F%2Fkleinanzeigen.ebay.de%2Fanzeigen%2F&…' when calling method: [nsIChannelEventSink::asyncOnChannelRedirect]"  nsresult: "0x8057001e (NS_ERROR_XPC_JS_THREW_STRING)"  location: "<unknown>"  data: no]

display.js? Sounds like something for displaying images maximised, but that's not the GA domain.

Latest NoScript dev version BTW.

[VersionHistory]

You can get back versions from the AMO NoScript page.
Link is under the heading Version Information and is titled "See complete version history"
https://addons.mozilla.org/en-us/firefo ... /versions/

I'm sure you don't need to be warned about the security dangers of reverting to older versions of a security application
I'm sure the developer would appreciate you confirming that your image zooms definitely do work with previous versions.

[VersionHistory]

Forgot to note you're using a non-Mozilla Firefox port for PPC.
It might be helpful to point this out to the developer if investigation begins.

[Tom T.]

I'm sure you don't need to be warned about the security dangers of reverting to older versions of a security application

Or of using an obsolete browser, Firefox 8. Supported version is Firefox 9.01 at the moment. (or 3.6.25, also supported)

There is actually a surrogate script (dummy replacement) for Google-Analytics for such cases (where page needs it but you do not allow it). Seems like this surrogate would need some updating.

Alan Baxter didn't need an updated G-A surrogate, and didn't list it in his allowed scripts for the site to work for him.

[dhouwn]

Oh, forgot to mention, unlike Alan I can reproduce the issue with enlarging images not working with just the ebay domains allowed.

Apparently I can't enable GA temporarilly even if I would like, it stays under "Untrusted". Suddenly I can, and enabling it enabled the resizing, so it seems that the script for the image resizing is from widget.….criteo.com stuff which then depends on GA being there (and the dummy from the surrogate seems not to suffice).

And the message from the error console seems strange enough that I believe Giorgio might be interested in that.


/edit: @http://kleinanzeigen.ebay.de/REL-83.0.0.17746/js/vap-all.js I see at least some references to Adsense.

[Tom T.]

On Fx 3.6.25, some pages call criteo, some don't.
Google AdSense isn't required.
Some pages call google.com, which is not the same as allowing google-analytics, so, OK.

When necessary, one can "fool" the page by TA G-A.com in NS, but leave it default-blocked in RequestPolicy
This makes the ads clickable -- can't zoom images, but clicking on them, or sometimes, on their links, loads the full ad with full-sized photos.
So it may be a useful work-around in the meantime.

JSView shows the size of G-A as ?? , and can't read the script if you try, thus confirming that G-A is indeed not being allowed to run.
But the page is happy.

RP works as GA surrogate would!

[Tom.de]

Hello,
I have the same Problem here.

But I can't quite follow you:

When necessary, one can "fool" the page by TA G-A.com in NS, but leave it default-blocked in RequestPolicy

Doesn't work here: I have to allow GA in RquestPolicy and in NoScript, in order to get the menu and all photos.

This makes the ads clickable -- can't zoom images, but clicking on them, or sometimes, on their links, loads the full ad with full-sized photos.
So it may be a useful work-around in the meantime.

Can't reproduce.

JSView shows the size of G-A as ?? , and can't read the script if you try, thus confirming that G-A is indeed not being allowed to run.

???

But the page is happy.

Again, not here!

RP works as GA surrogate would!

?

My Questions:
What is now the exact reason the built-in GA surrogate doesn't work as it did before?
and what can I do about it?

I could also write an email to the webmaster, but I don't know what to write.

Tom

[wupna]

I started another thread on this problem on the ABE subforum: viewtopic.php?f=23&t=8028

[Tom T.]

I started another thread on this problem on the ABE subforum: viewtopic.php?f=23&t=8028

I replied there, thanks.

@ Everyone else: wupna's work-around was to create an ABE rule to allow G-A at the site in question, but nowhere else.
That should work, but I'm investigating why it's necessary, this time on Firefox 9.01, to see if there's a different result from 3.6.25.

A language issue occurred to me briefly, but if a German site wants a German-language script, it should call to something like google-analytics.de instead of .com.

@ Tom.de: I don't know why you couldn't reproduce on 3.6.25. I'll list all my settings, etc. after trying on 9.01.
In the meantime, no offense, but your 8.0 really should be updated to 9.01 for the sake of safety, even if it doesn't affect this issue.

Back in a little while, I hope.

[Tom T.]

What is now the exact reason the built-in GA surrogate doesn't work as it did before?

The site works perfectly for me on Firefox 9.01, NoScript 2.2.8rc2, although the latest stable release, 2.2.7, should also be fine.
The changes in the development build would not affect the site in question here. Details below.

I could also write an email to the webmaster, but I don't know what to write.

No webmaster is going to tell you how to use his site with NoScript, which may block third-party ads, costing him money, and also block a data-miner like GA.

Here is what I did:

Go to home page, kleinanzeigen.ebay.de
Temporarily allow exactly the above site, although if you visit it frequently, you may wish to add it to your whitelist.
Allowed session cookies. Firefox Tools > Options > Privacy > Show Cookies shows one folder from kleinanzagen, with three cookies inside it.
In RequestPolicy, allowed requests from ebay.de to classistatic.com, a Netherlands-based server of still images and other content, much like Akamai. I checked; it has a fine reputation.

I see an ad for a car, OPEL ASTRA F-CC 1.4 TÜV- (the rest does not show, but it's:

Code: Select all

http://kleinanzeigen.ebay.de/anzeigen/s-anzeige/nordrhein-westfalen/autos/opel/u556176

Pointing or hovering the mouse does nothing, but clicking the picture takes me to the full-page ad, with one large photo and several smaller ones, price, etc.
I made screenshots if you need to see them, but to me, the site seems to work fine.

So I try a bicycle. The same result. Criterio asks to run, but it's not necessary.

Haus & Garten:
http://kleinanzeigen.ebay.de/anzeigen/s-haus-garten/c80

Erste listing was for schrank-buffeschrank. I click on it.
google.com asks to run, but not necessary.
Clicking still produces the full advertisement. I have a screenshot of that, too.

I know for a fact that G-A.com is not running, because my Windows is configured not to allow *any* browser -- Firefox, IE, Safari, -- to call to G-A.com.
This is via the HOSTS file, a personal choice.
(Mac has one too, and it could be similarly edited. Off-topic here. The point is that GA is most definitely *not* running.)

I can't imagine any other difference between our systems that would make your results different. Unfortunately, I don't have a Mac to test on.
If we can't fix this, I will have to ask fellow Moderator GµårÐïåñ, who has Mac and every other OS known to mankind , or Giorgio, to help us.

My previous advice about allowing G-A in NoScript, but not in RP, does not seem to be necessary. I'll go back to Fx 3.6.25 and see if the above works now. (and answer your questions about that post)

[Tom T.]

But I can't quite follow you:

When necessary, one can "fool" the page by TA G-A.com in NS, but leave it default-blocked in RequestPolicy

Doesn't work here: I have to allow GA in RquestPolicy and in NoScript, in order to get the menu and all photos.

Ignore that. It isn't necessary.

RP works as GA surrogate would!

?

I meant that it seemed that allowing GA in NS, but blocking it in RP, seemed to accomplish the same goal as a GA surrogate: to make the page work properly while not sending any personal data to Google. Again, it does not appear to be necessary as I try it now.

Firefox 3.6.25, NS 2.2.8rc2, but again, 2.2.7 should work the same.

Everything was exactly as in my most recent post, which was using Fx 9.01.

If you had RequestPolicy before, did you allow classistatic.com? This is necessary.

Then everything works as described for Fx 9.01.

[Tom T.]

LIGHTBULB!

ebay.de probably doesn't care whether I let G-A run, because having a US IP address, they figure I'm not a likely customer, and my info is of little value to them.
Probably only those with German, Austrian, or other nearby Eurozone countries are required to run GA.

IIRC, fellow Moderator GµårÐïåñ has a German IP or proxy available, and of course, so does Giorgio.

And I seem to recall that our long-time forum contributor dhouwn has such an address or proxy available to him.

@ dhouwn: Do you care to take over this investigation, at least until one of the Gs shows up?

Or can you hook me up with such an address or proxy -- for free, of course?