Password protecting a webpage causes NS to show loading

[John Connor]

I use the forum software phpBB just like this site. Except it's 3.1.8. I password protect the Adm folder for the ACP in the FTP. When I go to the ACP and enter my password the loading indicator constantly spins in my browser in both Firefox and Pale Moon and says my site is loading although my site is loaded. Through the process of elimination I've narrowed this down to the latest version of NoScrip 2.9.0.10.

This behavior doesn't happen with an old version I was using on a netbook running version 2.9.0.4.

I thought perhaps it was due to the HTTPS upgrade in whitelisted sites, but that wasn't it as the site in the netbook wasn't added to the white list.

The behavior happens if NoScript is disabled allowing basic protection or turned on completely. There's something in this latest version that causes the loading indicator to spin constantly when you access a password protected webpage.

Here is a screen shot of the password protection for a FTP folder I'm referring to.

[barbaz]

Is this a cosmetic issue? IOW, does it actually work despite the loading icon spinning?

If you downgrade NoScript to 2.9.0.4 is that enough to get it back working?
Old NoScript @
https://addons.mozilla.org/addon/noscript/versions
*or*
https://noscript.net/feed?c=100&t=a

[John Connor]

I guess this would be cosmetic. In that it's just the spinning loading indicator that constantly spins. Not sure if other versions of NoScript do this. I just discovered that in my netbook addons were not updated automatically so that's why I had 2.9.0.4 installed. Which was good because I was able to narrow this down to NoScrip using the latest version as the culprit.

[barbaz]

(Odd UA you have there... looks to have an extra dot?)

Code: Select all

Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:45.0.) Gecko/20100101 Firefox/45.0
---------------------------------------------^

I had a server disaster a few days ago that lost my test phpBB boards, so can't actually check it myself atm, sorry.

Does changing about:config > noscript.httpsDefWhitelist to false have any effect?

[John Connor]

I forge the UA since my primary browser is Pale Moon and a lot of sites don't like the UA for PM. I changed that dot.

No, that setting doesn't do anything and I just discovered the same issue happens logging into cPanl for my host.

[barbaz]

I guess this would be cosmetic. In that it's just the spinning loading indicator that constantly spins.

Finally got a server back working enough to test this for myself, and I'm seeing that behavior even in a clean profile without NoScript...

[John Connor]

Using Firefox 28 with NoScript I get the loading circle in the tab constantly spinning logging in.

Using Firefox 28 in safe mode and logging in I don't get the loading circle in the tab constantly spinning.

Using Chrome I don't get a loading circle in the tab constantly spinning either.

Keep in mind this is for a login like you would see for a password protected webpage, like accessing cPanel for example. See my image in the first post at the login box.

This behavior is happening on multiple computers.

[barbaz]

Using Firefox 28 with NoScript I get the loading circle in the tab constantly spinning logging in.

Using Firefox 28 in safe mode and logging in I don't get the loading circle in the tab constantly spinning.

Using Chrome I don't get a loading circle in the tab constantly spinning either.

I was testing in a custom SeaMonkey build based on Firefox 45.0.1. Don't think I have Fx 28 or Chromium on hand atm.
I've tested Pale Moon and confirmed the same there: spins "Connecting..." in a fresh install / clean profile for me, no NoScript.

Keep in mind this is for a login like you would see for a password protected webpage, like accessing cPanel for example. See my image in the first post at the login box.

For my initial testing, I set up a temporary phpBB board then added (in my nginx config) a password protection for its admin panel directory (then later discovered that it really doesn't matter what's on the other side of the password protection).
In case it makes a difference, what kind of server are you running?

[John Connor]

I don't run the server, but my host uses Linux. Not sure which version. So when I log into my two phpBB forums or my host's cPanel for my websites I get that spinning loading indicator in the tab that never goes away. But it does go away for me when I disable NoScrip. Like I said this happens testing on other computers. Maybe it's a DNS thing? I use OpenDNS in the router so all computers use OpenDNS for DNS lookups. I will try a manual Google setting in the network adapter and test and see what happens.

I'm using Apache BTW if that helps.

Another test I could try is using Xampp. I use Xampp to test things in Wordpress and phpBB before I commit to live. I just need to figure out how to password protect a folder in the phpBB file tree in Xampp so I can test. Would you happen to know how to do that? With my live site I use the tool in cPanel to password protect a folder in the FTP file tree.

[barbaz]

Maybe it's a DNS thing?

Could be given that my "DNS" in the test environment is just a dnsmasq instance reading out my HOSTS file.

I'm using Apache BTW if that helps.

Thanks, that's what I wanted to know.
I'm thinking my test environment (connecting to nginx over a VirtualBox host-only network) maybe just too unlike the situation with your server when it comes to details like this. Can you please put up a test password-protection (where too much 401 errors won't get me IP-banned) and PM me the link?

EDIT Do you use Pale Moon 26.1.1? That's the version I was testing with...

Another test I could try is using Xampp. I use Xampp to test things in Wordpress and phpBB before I commit to live. I just need to figure out how to password protect a folder in the phpBB file tree in Xampp so I can test. Would you happen to know how to do that? With my live site I use the tool in cPanel to password protect a folder in the FTP file tree.

Sorry but I've never even heard of it until now. I don't have an actual website. My server is just a VM sitting on a local network.

[John Connor]

Yes, I use Pale Moon 26.1.1 the latest. I have also tried Firefox 28. Check your PMs for the test link to my website.

I did change the NIC to Google DNS and flushed the DNS cache and I had no change.

[barbaz]

Got it, thanks. Testing now...

[barbaz]

Sorry, I was misunderstanding the issue.
I can reproduce the issue on Pale Moon 26.1.1, clean profile with only NoScript installed, using my local server. Issue is not present if NoScript is not present.
Also reproducible in Firefox 24 ESR.

Not reproducible in SeaMonkey 2.42pre (like Firefox 45.0.1).

NoScript 2.9.0.4rc1 is not affected, now to determine a more exact regression range...
2.9.0.8rc1: affected
2.9.0.6: good

Nothing related in Browser Console.

[barbaz]

OK disabling ABE seems to get rid of the issue (in NoScript 2.9.0.10rc1), but finer-grained controlling (that I'm aware of) have no effect...

Moving to NoScript Development.

[John Connor]

Didn't realize there were follow up posts. Yes, I can confirm that disabling ABE makes this issue go away. I'm now using 2.9.0.11.


To clarify the issue. When you log into a password protected webpage the loading indicator continues to spin. Then I also get some other issues as well if I don't restart my browser after I have logged into a password protected webpage. One issue is that I have a brief text popup of a post in my forum and the user's avatar wouldn't show up. This does not happen if I don't log into a password protected webpage.