[CLOSED] NoScript bug with vovici.com?

[amccombs]

1. buy something at GameStop, get a receipt with FeedBack Number
2. load TellGameStop.com (it will forward you to vovici.com)
3. click Continue button
4. "Do you have a receipt" page, click "Yes" to radio button
5. click Continue button
6. enter the Feedback Number in the field provided
7. click Continue button

page reloads with red text that Feedback Number is not valid

8. click on NoScript and Temporarily allow vovici.com
9. enter the Feedback Number in the field provided
10. click Continue button

a vovici.com dialog box appears "FeedBack Number 1 is required."


do steps in IE and works.
Is this a NoScript bug or a vovici.com bug with FireFox 3.5?

[Tom T.]

There are other scripts trying to run at vovici: salesforce.com and clickdensity.com. It might be necessary to temporarily allow one or both of these. (That's vovici's choice; we can't control how they code their site.) Does this help?

[amccombs]

Then there must be a bug in NoScript because neither of those sites appear in the list for me to allow, and they are not listed in the 'Recently blocked sites' list. If I do 'Global allow' than that works, but that is a work-around solution.

How did you know that those sites were there? Did they appear in your list?
I am using 1.9.9.18. What version are you using?

[Tom T.]

Then there must be a bug in NoScript because neither of those sites appear in the list for me to allow, and they are not listed in the 'Recently blocked sites' list. If I do 'Global allow' than that works, but that is a work-around solution.

Are they in your Untrusted list? Go directly to vovici, open the NS menu, and point to Untrusted. It's possible that you had previously marked them as Untrusted when they appeared at another site. Since they are third parties, apparently in the tracking and click-trail business, I don't blame you. But if vovici codes their site so as not to work without allowing these others, we can't control that. You'd have to comply or else not use vovici -- *if* that is the issue.

How did you know that those sites were there? Did they appear in your list?

Yes. After seeing your post, I opened a new tab, went directly to vovici, saw the full-red NoScript logo (hadn't allowed anything), clicked to open the menu, and all three were in the list (as they still are now -- just went there again and double-checked): vocici, salesforce, clickdensity. Also, under the green Blocked Objects, the flash objects for vovici, but I can see their placeholders on the page anyway (red NS block-logos where the Flash videos would otherwise be).

And yes, they also appear in "Recently Blocked".

I am using 1.9.9.18. What version are you using?

My setup is almost identical to yours: XP SP 2, Fx 3.5.5, NS 1.9.9.18. The only difference is that I do not have any version of Microsoft .NET on any of my machines. The .NET has caused a lot of people a lot of problems, but I don't think it's an issue here -- yet.

Configuration: NS Options:

General: "Automatically reload ... permission changes" is checked; nothing else.

Whitelist: (none of the sites involved in this topic)

Embeddings: EVERYTHING is checked -- what I like to call "full lockdown mode".

Appearance: Everything is checked except "status bar label" and, of course, "globally allow".

Notifications: Probably not relevant here, but I have "Show message ..." and "Audio notifications" disabled, because the logo color, then the menu, say it all for me. I *do* check to show warnings on XSS, Meta-redirect, ABE, and Clear Click, also probably not relevant here.

Advanced > Untrusted: Everything is checked except "Hide <NoScript> elements."
Advanced > Trusted: Nothing is checked except "Show NoScript element..."
Advanced > XSS: Both checked, no exceptions. JAR checked, no exceptions. HTTPS not relevant in this topic; no HTTPS involved. ABE: Checked "Enable ABE"; using the default rule only.

What differences are there in your configuration?

[amccombs]

I went to vovici and they both were listed in Recently Blocked Sites. I "Allow all" both of them. However, during the survey I still got the "FeedBack Number 1 is required." error dialog box. And both of those sites are still not listed while entering the Feedback Number.

XP SP3, Fx 3.5.5, all versions of .NET is installed

Configuration: NS Options:

General: "Left clicking ..." then "Base 2nd.."; "Automatically reload ... permission changes" is checked; nothing else.

Whitelist: (none of the sites involved in this topic)

Embeddings: Topmost eight check boxes are checked, then "Apply these .." unchecked, "Block every object" checked, "Show placeholder" checked, next 3 unchecked, "ClearClick" both untrusted and trusted are checked, "Opaque" only untrusted is checked.

Appearance: Everything is checked except "Status bar label" and, "Full Domains", "Full Addresses", "globally allow".

Notifications: "Show message" checked with "Place message", and "XSS", "Show message...META", "ABE" checked. "Audio" unchecked, "ClearClick" and "Display" are checked.

Advanced > Untrusted: Everything is checked except "Hide <NoScript> elements."
Advanced > Trusted: Nothing is checked except "Show NoScript element..."
Advanced > XSS: Both checked, some default exceptions: google, yahoo and wikipedia.
Advanced > JAR: JAR checked, (looks like a sample exception)
Advanced > HTTPS:
Advanced > ABE: Checked "Enable ABE"; using the default rule only.

[Tom T.]

I'm afraid the only way to reproduce your symptom is to go through the actual process. I don't care to buy anything at GameStop at the moment, so can you PM me the Feedback number, in strictest confidence? It will be deleted when the issue is resolved.

Will that Feedback Number be enough for me to enter at vovici and to reproduce your error, or will I need more from GameStop?

[Tom T.]

Received your PM with the Feedback Number, thanks.
Regarding the comment that it had already been used, it's *possible* that since you were never able to complete the survey successfully, it would not have been marked as used. However, it might well have timed out. Most such things that I receive tell you that it is good for only three days or whatever.

But I can't find out yet. The home page of vovici does not provide any place for users to take the actual survey; rather, it's designed to sell their survey and other software to businesses. When you were forwarded there by GameStop, there must have been a longer URL, something like feedback.vovici.com/survey&client=gamestop .... or something. (I just made that up, having nothing to go on.)

Is there any way that you can get the full URL of the redirection from TellGameStop to vovici, without buying something else? I tried using RefControl add-on to forge the referrer as TellGameStop.com, but still couldn't see a button "Do you have a receipt?". The site was still all about selling their services, nowhere for users to enter Feedback numbers.

[amccombs]

when I go to tellgamestop.com it goes to
https://vovici.com/wsb.dll/s/116beg25f3a?renderlang=eng

there is a "continue" button, click that

then you have "Do you have a receipt?", there are 2 radio buttons, "Yes" and "No"
I select the "Yes"
there is a "continue" button, click that

then it should go to a page showing a picture of the receipt.

Maybe try it in IE to see?

[Tom T.]

when I go to tellgamestop.com it goes to
https://vovici.com/wsb.dll/s/116beg25f3a?renderlang=eng

Thanks, that's exactly what was needed. (Notice that it's a secure site - https -- unlike the home page of vovici.)

Maybe try it in IE to see?

No need. It worked fine in Fx. I started the survey -- successfully -- but haven't finished, in the hope that you will still be able to use the number.

I did not allow *anything*, except Temporarily Allow https.//vovici.com. Whitelisted in Adblock (original). Do you have Adblock Plus or any other ad-blocking software?

There was a cookie prompt for stndev.second-to-none.com before entering vovici. I allowed for session only. Did you allow this cookie? Iif not, It might be why the page is not saving your state (information).

This was done on Fx 2.0.0.20, which is deprecated. I used it first, because it doesn't support RequestPolicy, another possible cause of issues. Do you have RP, and if so, what permissions did you set?

I'll attempt it also on current Fx 3.5.5., checking if RP is a factor. But it works.

I hope the number stays good if I don't complete the survey. Will be back soon.

[Tom T.]

I can't make it work with Fx 3.5.5, but I don't get the "Feedback Number 1" message, only "invalid transaction number". I'm afraid that I may have used it up by answering only one survey question, just to see if it would accept it and continue (it did, at the time.)

I tried again with F2, same message. So I think that feedback number is now dead. But at least we got it working.

However, if you buy anything else, be sure to allow all Request Policy requests among gamestop, second-to-none, and vovici, and allow scripting and cookie from second-to-none as well as the others. And whitelist all of the above in any ad-blocker, at least temporarily.

[amccombs]

I don't have Adblock Plus or RequestPolicy or other. I do have in Fx > Tools > Options > Content > Block pop-up windows checked.

Thank you for your time.

[Tom T.]

I don't have Adblock Plus or RequestPolicy or other. I do have in Fx > Tools > Options > Content > Block pop-up windows checked.

As do I. Pop-up windows were never an issue during the successful test.

I *believe* that your issues were with second-to-none.com: the cookie, and probably the allowance of this script from "recently blocked". I never had to allow salesforce or clickdensity.

If this happens again, and the above does not resolve the issue, then please try General Troubleshooting Instructions to check for extension conflicts, corrupt extensions, etc. Let us know.

I'll mark this "Closed" for now, but if you have the same issue again at vovici, you can post it here at this thread. It won't be "locked". "Closed" just lets the other Support Team members know that the topic does not require further attention at this time.

Thank you for your time.

You're quite welcome.