Temporarily TRUSTED Requires Reload with 12.6

[scottg]

Starting with NoScript 12.6 on Firefox 138.0.1 (latest), and macOS 15.4.1 (latest), the behavior for "Temporarily set top-level sites to TRUSTED" appears to have changed. The drop-down menu showing website permissions now shows the top-level website as temporarily having custom permissions (4th icon, tooltip is "Temporarily allow (CUSTOM)"). Previously, the top-level website was temporarily trusted (2nd icon, tooltip is "Temp. TRUSTED"). More annoyingly, the new temporary custom permissions don't seem to apply to the website until the page is reloaded.

As a simple example, load https://www.nytimes.com/ with all domains under default settings. Despite nytimes.com showing as Temporarily allow (CUSTOM), dynamic content does not load (usually visible on the right-hand side of the page, and for any carousels). Reload the page, and the dynamic content loads as expected.

Looking at the debug data, I also see that the page is handled with custom permissions -

Code: Select all

"sites": {
  …
  "custom": {
    "§:nytimes.com": {
      "capabilities": [
        "frame",
        "fetch",
        "noscript",
        "other"
      ],
      "contextual": {
        "§:nytimes.com": {
          "capabilities": [
            "script",
            "object",
            "media",
            "frame",
            "font",
            "webgl",
            "fetch",
            "ping",
            "noscript",
            "lazy_load",
            "unchecked_css",
            "lan",
            "other"
          ],
          "temp": true
        }
      },
      "temp": true
    }
  },
  "temp": []
} 

If I manually set nytimes.com to Temporarily TRUSTED (i.e. clicking the 2nd icon in the drop-down menu), I see that the debug data changes -

Code: Select all

 "sites": {
    …
    "custom": {},
    "temp": [
      "§:nytimes.com"
    ]
  }

My expectation is that the setting "Temporarily set top-level sites to TRUSTED" should work without requiring a reload, and that permissions for the website are set to Temporarily TRUSTED instead of Custom, as it previously worked. Is this new behavior expected?

[n4ch74ff3]

push!

I thought I was too stupid to use it...

Thank you @scottg!

[Giorgio Maone]

Starting with NoScript 12.6 on Firefox 138.0.1 (latest), and macOS 15.4.1 (latest), the behavior for "Temporarily set top-level sites to TRUSTED" appears to have changed. The drop-down menu showing website permissions now shows the top-level website as temporarily having custom permissions (4th icon, tooltip is "Temporarily allow (CUSTOM)"). Previously, the top-level website was temporarily trusted (2nd icon, tooltip is "Temp. TRUSTED").

This is expected per issue 417 (please check it for the reasoning behind that, which does make sense to me).

More annoyingly, the new temporary custom permissions don't seem to apply to the website until the page is reloaded.

This is a bug and will be fixed, thanks.

[scottg]

Thank you for the quick reply and forthcoming bug fix! And also, thank you for NoScript!

[Giorgio Maone]

It should be fixed now in latest development build (12.9.901 AKA 13 beta1):

v 12.9.901
============================================================
x Fixed automatic temporary permissions require reload
(thanks scottg for reporting)

[n4ch74ff3]

Thank you very much!

[n4ch74ff3]

It should be fixed now in latest development build (12.9.901 AKA 13 beta1):

v 12.9.901
============================================================
x Fixed automatic temporary permissions require reload
(thanks scottg for reporting)

Hey Giorgio,
Bugfix in 13.0.6.901 seems not to work, I still don't get "temp trusted" but only "individual" permissions for the top-level sites?
Rolling back to 12.1.1 brings back the used to behavior.

Can someone confirm?

[barbaz]

I still don't get "temp trusted" but only "individual" permissions for the top-level sites?

The expected behavior is that if the site is not configured in your permanent NoScript configuration (i.e. it's set to DEFAULT), navigating to a page on that site should result in it being set to a temporary CUSTOM permission where the "ANY SITE" permissions match your DEFAULT preset and the contextual permissions for the site match your TRUSTED preset. Not quite clear from your description if you're seeing this or something else?

[n4ch74ff3]

Ok, your tip has helped @barbaz.
Now the behavior with 13.0.6.901 is as expected, but it remains CUSTOM.
It also seems that reloading is no longer necessary.
No idea how I got so bogged down, thanks for the input!

What I am used to with all old versions up to 12.1.1 for the checked option "Temporarily set top-level sites to TRUSTED" when opening a website:


What I get with the Versions since 12.6 for the checked option "Temporarily set top-level sites to TRUSTED".

This different look on the interface also brings a behavior, that is not the same (pages not working with out setting manually to "temp trusted" and manually reload the page).

To me, that looks like unwanted behavior?

From your description does it sound to me as if I have to change the basic settings for CUSTOM so that they correspond to TEMP. TRUSTED?
But even if I check all the boxes in the CUSTOM settings, the website behavior is not like in 12.1.1 without reloading.


I am for now not sure how to do better and rolled back to 12.1.1.