Noscript blocks https images

[Shiro]

I love noscript, and I've been using it for a good 7 or so years now. However, it always blocks https images that are embedded into websites that I've given permission to. I'm ok with letting all https images through my filters, is there a way to do this? I tried finding a setting, but I couldn't find it. And googling hasn't helped.

Thank you.

[Thrawn]

NoScript doesn't block images.

Is it possible that another addon is doing this? Or Firefox itself?

Does the problem go away when NoScript is disabled?

What options are set in Options-Advanced-HTTPS?

[Shiro]

It's definitely noscript - I first tested by opening firefox in safe mode, and I'm able to see https images. I then opened Firefox in normal mode, and disabled noscript (and only noscript) and was able to see the https images. Upon re-enabling noscript, I was not able to see the https images anymore.

The weird thing is that it is only in embedded pages. I'm a moderator of a forum, and I can edit the user's posts, copy the URL to the image, then open the image in a new tab and view it. The edit function for the posts is done using AJAX (edit in place without a page reload). If I wait for the image to load in the new tab, then cancel the edit in the current page, which reloads the post (and only the post, not the whole page), the image is shown!

I have no options set at all in Options -> Advanced -> HTTPs. Well, 'Forbid active web content unless it comes from a secure (HTTPS) connection' is set to 'Never'. Other than that the other fields are empty, and Cookies are also disabled, with nothing entered into either of the textboxes.

[Shiro]

Sorry, by "The weird thing is that it is only in embedded pages." I mean that images are only blocked if they are embedded in a page using an <img/> tag, with the src of the tag being an external domain with a protocol set to https. Also there is not placeholder or anything, the images simply are not shown at all.

[therube]

URLs where this happens?

[Shiro]

Take a look at this post: http://www.designerstalk.com/forums/961 ... 10024.html

I have no blocked scripts on that site, however the image https://scontent-a-lga.xx.fbcdn.net/hph ... 3624_n.jpg that is embedded into that page doesn't show.

[Thrawn]

It works fine for me - and I haven't even allowed that site.

[Shiro]

While I have no doubt that this is the case for you, it is not for me. Just to be sure I even re-tested again. I went through the following steps:

1) Opened the link that I gave above in a new tab - Image invisible
2) Opened up Firefox add on manager. Clicked 'disable' for noscript. Clicked "Yes, remove ALL protections".
3) Clicked 'restart now'. Firefox restarted.
4) The tab I had previously opened in step 1 was still open - and the image loaded.
5) Went back to the add-on manager. Clicked 'enable' for noscript.
6) Clicked 'restart now'. Firefox restarted.
7) Went back to the tab from step 1 - the image doesn't load.

So it definitely has something to do with noscript. I have no idea what to do or where to look though.

[Thrawn]

Perhaps there's a setting misconfigured in NoScript somewhere?

If you open the Options dialog, you'll see Import-Export-Reset buttons along the bottom. Please try exporting to a file, then resetting, and see if the problem goes away, then import your settings again and see if it comes back.

[Shiro]

Ok, resetting noscript did fix the problem, so it must be a configuration issue.

For me, I'm fine with starting with fresh settings and beginning again. The question is how interested you guys are in getting to the bottom of the issue, in case it comes up again with someone else. If you are happy that my issue has been solved and ready to drop it here, feel free to let me know, but if you'd like to continue trying to debug, let me know and I'll continue working with you on the matter.

[Thrawn]

Can you export the (clean) configuration to a separate file, and send them both to a moderator via private message so we can compare them?

Or you could try posting each of them here inside [ code ] tags, but the spam filter might stop you...

Thanks.

[Thrawn]

Hmm...there's not a lot of differences between those two, but I notice that in the 'dirty' config, 'httpsForcedExceptions' is set to an empty string, whereas it doesn't exist at all in the 'clean' config. On the other hand, looks like mine is probably the same.

Your best option might be to copy your whitelist from the old config into your new one and move on, but I'll pass them along to our fearless leader to see if he has any suggestions.

By the way, is there a reason you had disabled the built-in ABE rule?