Embeded Google Blocked

[kylerk]

The latest version of NoScript blocks embedded Google Calender on my Google Site Start Page. If I disable NoScript, it works fine. I cannot find a setting that allows the embedded calendar to be displayed. Is this a bug or a hidden setting?

[therube]

Calender looks to display fine for me with only google.com & gstatic.com Allowed.
Is there more to it then that?

[kylerk]

this is not iGoogle, rather the Google PartnerPage Start Page

http://partnerpage.google.com/kyler.com

[therube]

Error Console says:

Code: Select all

X-FRAME-OPTIONS: blocked http://www.google.com/calendar/hosted/kyler.com/ig?up_calendarFeeds=(ken%2540kyler.com)&up_calendarColors=(%232952A3)&up_firstDay=0&up_dateFormat=0&up_timeFormat=1:00pm&up_showDatepicker=1&up_hideAgenda=0&up_showEmptyDays=0&up_showExpiredEvents=1&lang=en&country=us&.lang=en&.country=us&synd=ig&mid=2&ifpctok=-5902631653555151212&exp_track_js=1&exp_ids=17259&parent=http://partnerpage.google.com&libs=TCKbIJfsw0w/lib/liberror_tracker.js,EWuBKGlH0vk/lib/libcore.js,tzq-hbKD87Q/lib/libdynamic-height.js,iNE3XEZGB9I/lib/libsetprefs.js,NXPKwAquBT0/lib/libviews.js&view=home

Have to wait for others to determine what that means, if anything.

[Giorgio Maone]

The initial calendar URL you link does not want to be framed (in order to prevent Clickjacking attacks), and NoScript honors this choice expressed through the X-Frame-Options: SAMEORIGIN header.
However that URL is also a redirection, and the ultimate destination has no X-Frame-Options header.
Looks like IE8 and Chrome (WebKit), which implement X-Frame-Options as well, don't honor it unless the resource exposing it is a final destination, while NoScript up to 1.9.8.87 honors it always (like in your case).
I'm "fixing" making it compatible to Microsoft's implementation because it should be innocuous and we don't really need X-Frame-Options anyway, at least as long as ClearClick is enabled
Please get latest development build 1.9.8.88, which contains the fix.

[kylerk]

How bizarre. Today I start the browser and it works - I did nothing. Maybe Google did something on their end?

[kylerk]

even more bizarre! it quit working again just minutes later

[Giorgio Maone]

As I said, it depends on the headers sent by the server, and anyway it's fixed in latest development build.

[kylerk]

the latest development build 1.9.8.88 works fine - have tested it on both computers

[Smumdax]

... and what does this all mean for simple people trying to use Google Calendar on their desktop ???

[GCal Whiteout]

This issue seems to be a problem again.

I can enable all scripts on the page that the Google Calendar is embedded on but all I get is a white space where the calendar should be. Everything works fine when i totally disable the NoScripts extension though.

It would help if there was some sort of workaround to just temporarily allow the GCal to come through.

[Giorgio Maone]

This issue seems to be a problem again.

I can enable all scripts on the page that the Google Calendar is embedded on but all I get is a white space where the calendar should be. Everything works fine when i totally disable the NoScripts extension though.

I doubt it's the same issue. URL of the page where this happens?