Wordpress Press This not working on Linux Mint

[robinedgar]

For some reason to get the wordpress press this bookmarklet to work, I have to enable most of scripts on the site I am trying to bookmark, but only on my Linux Mint machine. On my Windows 7 machine the popup opens no problem. Firefox and Noscript are the same version on both machines.
I have walked through all the settings https://codex.wordpress.org/Press_This with no success (and not needed on windows 7) and have run through the firefox preferences and the noscript preferences, which are identical. I installed the FEBE addon https://addons.mozilla.org/en-US/firefox/addon/febe/ and cloned my windows 7 firefox settings into a new profile on my Linux Mint, but also no luck.

Any ideas? Thanks!

[barbaz]

Can you please post the full bookmarklet code?

This part of their instructions is interesting -

2. Open the NoScript preferences by clicking on the S icon again and choosing Options
3. Click on the Advanced tab. A set of sub-tabs will appear. Click on XSS.
4. In the box that says Anti-XSS Protection Exemptions, add the following (change mydomain.com to your domain):

Code: Select all

^https://mydomain.com/ptw/wp-admin/press-this.php(?:\?|/\1\b)

That is a MASSIVE red flag to any site admin. Have you tried to actually "XSS" that URL on your own Wordpress blog?

[robinedgar]

The full text of the bookmarklet is

Code: Select all

javascript:(function(a,b,c,d){function e(a,c){if("undefined"!=typeof c){var d=b.createElement("input");d.name=a,d.value=c,d.type="hidden",p.appendChild(d)}}var f,g,h,i,j,k,l,m,n,o=a.encodeURIComponent,p=b.createElement("form"),q=b.getElementsByTagName("head")[0],r="_press_this_app",s=!0;if(d){if(!c.match(/^https?:/))return void(top.location.href=d);if(d+="&u="+o(c),c.match(/^https:/)&&d.match(/^http:/)&&(s=!1),a.getSelection?h=a.getSelection()+"":b.getSelection?h=b.getSelection()+"":b.selection&&(h=b.selection.createRange().text||""),d+="&buster="+(new Date).getTime(),s||(b.title&&(d+="&t="+o(b.title.substr(0,256))),h&&(d+="&s="+o(h.substr(0,512)))),f=a.outerWidth||b.documentElement.clientWidth||600,g=a.outerHeight||b.documentElement.clientHeight||700,f=f<800||f>5e3?600:.7*f,g=g<800||g>3e3?700:.9*g,!s)return void a.open(d,r,"location,resizable,scrollbars,width="+f+",height="+g);i=q.getElementsByTagName("meta")||[];for(var t=0;t<i.length&&!(t>200);t++){var u=i[t],v=u.getAttribute("name"),w=u.getAttribute("property"),x=u.getAttribute("content");x&&(v?e("_meta["+v+"]",x):w&&e("_meta["+w+"]",x))}j=q.getElementsByTagName("link")||[];for(var y=0;y<j.length&&!(y>=50);y++){var z=j[y],A=z.getAttribute("rel");"canonical"!==A&&"icon"!==A&&"shortlink"!==A||e("_links["+A+"]",z.getAttribute("href"))}b.body.getElementsByClassName&&(k=b.body.getElementsByClassName("hfeed")[0]),k=b.getElementById("content")||k||b.body,l=k.getElementsByTagName("img")||[];for(var B=0;B<l.length&&!(B>=100);B++)n=l[B],n.src.indexOf("avatar")>-1||n.className.indexOf("avatar")>-1||n.width&&n.width<256||n.height&&n.height<128||e("_images[]",n.src);m=b.body.getElementsByTagName("iframe")||[];for(var C=0;C<m.length&&!(C>=50);C++)e("_embeds[]",m[C].src);b.title&&e("t",b.title),h&&e("s",h),p.setAttribute("method","POST"),p.setAttribute("action",d),p.setAttribute("target",r),p.setAttribute("style","display: none;"),a.open("about:blank",r,"location,resizable,scrollbars,width="+f+",height="+g),b.body.appendChild(p),p.submit()}})(window,document,top.location.href,"https:\/\/blog.edgarbv.com\/wp-admin\/press-this.php?v=8");

I am still struggling with this, but didn't get a notification that this was updated...

[barbaz]

@robinedgar Remember to log in before posting so you don't have to solve the CAPTCHA every time and so you keep getting email notifications if you subscribed to this topic.

I can't quite tell by looking at the bookmarklet whether this is a false positive. When this issue occurs, do you see anything related in the Browser Console? (Ctrl-Shift-J)
(if you don't know what's related, turn off CSS warnings and post everything else you see)


This might be unsafe, but as a test, does this XSS exception help? -

Code: Select all

^https://blog\.edgarbv\.com/wp-admin/press-this\.php\?

(The console messages should give some indication of how safe this is.)

[robinedgar]

Hi, I get the following messages in the console:

Code: Select all

NoScript could not disable scripts for system global [System Principal] WinScript.js:13:11
about:blank : Unable to run script because scripts are blocked internally.  (unknown)
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead.  jquery-1.10.2.min.js:2:26352

(a few are missing due to antispam filters on this site, but one is from lpfulllib.js and another about getPreventDefault is deprecated with jquery)

I have the following exceptions on options -> advanced -> XSS tab:

Code: Select all

^https://blog.edgarbv.com/ptw/wp-admin/press-this.php(?:\?|/\1\b)
^https://edgarbv.com/ptw/wp-admin/press-this.php(?:\?|/\1\b)
^https://blog\.edgarbv\.com/wp-admin/press-this.php\?

When I reload the bookmarklet the console adds the following line:

Code: Select all

about:blank : Unable to run script because scripts are blocked internally.  (unknown)

Thanks for helping!

[barbaz]

Did the XSS exception make any difference?

If so, are those console messages with or without the exception?


BTW I see that I made a small mistake in the exception. I'll fix it in my post.

[robinedgar]

The scripts blocked internally errors are popping up when I work in this forum and as I am testing now and again. The (new) exception doesn't seem to make much difference, even if I put it in and restart Firefox. I have both XSS FAQ options above the Anti-XSS Protection Exceptions crossed.

I use nu.nl and www.linuxmint.com to test. If I have NoScript set to allow nu.nl and linuxmint.com the press this bookmarklet works and opens a popup. If they are not allowed, there is no popup and there is no new output in the console.

Thanks again for looking into this!

[barbaz]

Hmm. Works fine for me in SeaMonkey 2.49 (like Firefox 52.1.3), but I'm getting the same behavior as you on Firefox 54.0. I tested with the bookmarklet modified to point to 127.0.0.1 instead of your site.

I think this is a NoScript bug. So, moving to NoScript Development. Thanks for the report

[robinedgar]

Thanks for looking and good luck fixing it!

[barbaz]

You're welcome.

(Giorgio is the only NoScript dev.)

[robinedgar]

Getting around this by installing the ScribeFire Next addon, but something is still broken here...