[Resolved] NoScript and Yandex Maps Panorama

[Rivilis]

I can not set options of NoScript in order to see a panorama on Yandex Maps. For example: http://maps.yandex.ua/?ll=30.501199%2C5 ... 0.46480673
All version of NoScript after 2.5.7 suppress panorama.

[therube]

What button, dropdown, (IOW, what does it say?) gives you this "panorama"?

What domains do you have allowed?

I can get all sorts of maps, just not sure what you're considering "panorama"?

Code: Select all

+yandex.st
+yandex.net
+yandex.ru
+yandex.ua

[Rivilis]

Oh! Sorry! Without NoScript it is look like this:

I've tried varios combination of *.yandex.* but without success.

[therube]

OK "street view" is not loading?

Code: Select all

[NoScript] Blocking cross-site Javascript served from http://yandex.st/swf/panoplayer/3_1/version?_=1361376287829 with wrong type info application/octet-stream and included by http://maps.yandex.ua/?ll=30.501199%2C50.464807&spn=0.914612%2C0.104749&z=11&l=map%2Cstv&ol=stv&oll=30.50119929%2C50.46480673

Code: Select all

[NoScript] Blocking cross-site Javascript served from http://yandex.st/swf/panoplayer/3_1/version?_=1361376669517 with wrong type info application/octet-stream and included by http://maps.yandex.ua/?ll=30.501199%2C50.464807&spn=0.645447%2C0.070125&z=11&l=map%2Cstv&ol=stv&oll=30.50119929%2C50.46480673

So two things going on.
Best to get it fixed on their end.
Though suppose an exception could be entered.
(I'll leave that for others.)
(Sure would be nice when these XSS things hit that we'd be notified.)

[Thrawn]

Code: Select all

[NoScript] Blocking cross-site Javascript served from http://yandex.st/swf/panoplayer/3_1/version?_=1361376287829 with wrong type info application/octet-stream and included by http://maps.yandex.ua/?ll=30.501199%2C50.464807&spn=0.914612%2C0.104749&z=11&l=map%2Cstv&ol=stv&oll=30.50119929%2C50.46480673

Erk. This again.

Best to get it fixed on their end.
Though suppose an exception could be entered.
(I'll leave that for others.)

Yeah...search the forum for 'liberoquotidiano' and you'll find the workaround.

(Sure would be nice when these XSS things hit that we'd be notified.)

It's not actually XSS, it's something else. Unless I'm mistaken, they're importing a script that isn't meant to be imported as a script; it's supposed to be read as binary data.

The strange thing is that it's coming from their own site. Maybe they just messed up their MIME types.

[Giorgio Maone]

Added an exception in latest development build, thanks.
(Still very stupid from Yandex, though).

[Rivilis]

Added an exception in latest development build, thanks.
(Still very stupid from Yandex, though).

O!!!!! Thanks, Thanks, Thanks! It is working like a sharm!