Bug: Noscript forces me to allow scripts globally

[pil]

I'm using 1.9.3.3 and want to load local bookmartlets from my own bookmarks manager. If I allow 'about:blank' these bookmarklets are not allowed being executed unless I allow scripts globally.

This is no good idea. As well as I'm patronized with an unwanted alert every time when I'm trying to allow scripts globally. Don't like to adapt the file noscriptOverlay.js all the time. What about a new preference setting, for example

"Allow script globally without being patronized"?


.

[Giorgio Maone]

I'm using 1.9.3.3 and want to load local bookmartlets from my own bookmarks manager. If I allow 'about:blank' these bookmarklets are not allowed being executed unless I allow scripts globally.

NoScript contains a specific subsystem meant to make most bookmarklet work no matter what the permissions are.
Could you be more specific on your use case? what's your "own bookmarks manager"? an external app or what?

What about a new preference setting, for example "Allow script globally without being patronized"?

Just turn the noscript.globalwarning about:config preference to false

[pil]

Just turn the noscript.globalwarning about:config preference to false

Ok, that works.

Unfortunately my main complaint doesn't work as expected.

I try to call a few bookmarklets on a blank browser window, for example this one

Code: Select all

javascript:c=prompt('Symbol...','');if((c!='')&&(c!=null)){if(c.length>1){alert('Just%20one%20symbol%20at%20a%20time!')}else{document.write('encodeURI%20is%20'+escape(c));void(document.close())}}else{void(null)}

The script uses the method prompt() to type in a character for which the escaped character will be returned. Very handy indeed.

But whatever I try to do, the prompt will not appear unless I allow all scripts globally.



.

[therube]

Not knowing what to expect (& assuming the board did not mangle your code), if I click the bookmarklet & enter an 'X' in the prompt, the page displays, "encodeURI is X"?

[pil]

if I click the bookmarklet & enter an 'X' in the prompt, the page displays, "encodeURI is X"?

Yes, thats right. This is only useful for special characters like umlauts, characters with an accent, !'"&|{}[]()#:; and so on.


.

[therube]

Then in that case, it is working properly for me, without doing anything special - no need to Allow Global or anything like that.

Code: Select all

$ = encodeURI is %24

[pil]

no need to Allow Global or anything like that.

Unfortunately I cannot reproduce this behaviour.

As I said, I can do what I want: Added file:// and about:blank to the whitelist. Nevertheless no prompt will appear unless I allow all scripts globally.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b99) Gecko/20090605 Firefox/3.5b99


.

[therube]

Try what Alan suggested here, http://forums.informaction.com/viewtopi ... 5175#p5175.

[pil]

Try what Alan suggested here, http://forums.informaction.com/viewtopi ... 5175#p5175.

After all I reseted Noscript, deinstalled Noscript, reinstalled Noscript, deleted the mentioned extension files, made a 'Standard diagnostic' of Firefox, removed this and that.

And this is the result: It's possible to call my mentioned bookmarklet from every opened page - even when Javascript is not allowed for that page, the bookmarklet will work as expected without allowing all scripts globally.

But when I try to call the bookmarklet from a blank page no prompt will appear unless I allow all scripts globally. I have no further extensions installed. So I think it's definitely a Noscript bug.



.

[therube]

Ah, OK, it does seem to be an issue in Gecko 1.9.x (FF3), but not in Gecko 1.8.1 (SeaMonkey 1.1.16) which I had been looking at.

Actually what I'm seeing, with a blank tab, the bookmarklet does not work at all regardless of whether about:blank is Allowed or not. It only works when Allow Globally is enabled.

[hgkamath]

I can confirm that I experienced the same thing after upgrading to firefox 3.5 beta fedora-11
bookmarklet does not work on a blank tag opened by right clicking and selecting new tab.
They do work on a whitelisted uri.

my guess is about:blank in handled differently in firefox 3.5
or there is a bug either in ff3.5 or noscript has to factor in this new behavior.

typing about:blank in the url bar can also be seen to dissapear after pressing enter.

So my guess is since about:blank isn't about.blank, the page is not whitelisted (as was about:blank) and hence the bookmarklet does not work.

If I were to set uri to just "about:", even that would allow bookmarklets, but not about.blank.

[Giorgio Maone]

It's fixed in latest development build.

[Samus_]

guys can you confirm this didn't break again? I'm trying the bookmarklet from http://minutedock.com/ but it doesn't work on a blank page (NoScript 2.0.7) I've already tried it on a profile without NoScript and there it works fine.

the bookmarklet's code is:

Code: Select all

javascript:void((function(){function%20md_close()%20{document.body.removeChild(document.getElementById('md_frame'));document.body.removeChild(document.getElementById('md_close'));};if(document.getElementById('md_frame')){md_close();}else{l=document.createElement('img');l.src='http://minutedock.com/images/bmk_ld.gif';l.style.position='fixed';l.style.top='55px';l.style.left=((document.width||document.body.clientWidth)/2)-110+'px';document.body.appendChild(l);f=document.createElement('iframe');f.id='md_frame';f.src='http://minutedock.com/entries/iframe?v=2';f.scrolling='no';f.frameBorder=0;f.allowTransparency=true;f.style.display='none';f.style.position='fixed';f.style.top='40px';f.style.width='100%';f.style.zIndex%20=%209998;f.height='60%';f.onload=function()%20{f.style.display='block';l.style.display='none';c=document.createElement('img');c.src='http://minutedock.com/images/close.png';c.id='md_close';c.style.position='fixed';c.style.top='55px';c.style.left=parseInt(l.style.left)+580+'px';c.style.zIndex=9999;c.style.cursor='pointer';c.onclick=md_close;document.body.appendChild(c);};document.body.appendChild(f);}})())

cheers!

ps: there seems to be a problem with the forum's login, if you don't check "log me automatically on each visit" it kicks you out instantly after leaving the "login successful" page.