InformAction Forums

Giorgio Maone wrote: The way I was going to implement it is pretty simple, i.e. intercepting the load attempt in our nsIContentPolicy.shouldLoad() implementation and, if both the page and the destination match the whitelist, block the current load and restart it it from chrome context (where the check is relaxed).
Anyway I'd love to look at your implementation, thank you.

Y'all are such awesome sauce.

barbaz wrote:

Giorgio Maone wrote:Anyway I'd love to look at your implementation, thank you.

sent by PM

After a bit of testing and scrubbing Mozilla's source code, I've realized your approach, albeit scary and necessarily incomplete, is more feasible than mine: content policies are always called after checkLoadURI checks, unfortunately.

So, if you don't mind, I'm gonna steal your idea, with many thanks.

Giorgio Maone wrote:your approach, albeit scary and necessarily incomplete

I know

Giorgio Maone wrote:So, if you don't mind, I'm gonna steal your idea, with many thanks.

Fine by me, go for it! You're welcome.
(I trust that you'll add the necessary safety and privacy checks, some of which I probably haven't even thought of...)

Please check latest development build 2.6.8.20rc3, thank you.

Well local links seem to work again. At least they open stuff again.
There is only one problem left:
Links to local folders are opened in Firefox' dirlisting now instead of Windows Explorer.
It seems like the locked options for the file-protocol don't seem to work at all.

Koopz wrote:Well local links seem to work again. At least they open stuff again.
There is only one problem left:
Links to local folders are opened in Firefox' dirlisting now instead of Windows Explorer.
It seems like the locked options for the file-protocol don't seem to work at all.

I'm afraid this is not a NoScript-related issue, but a change in Firefox.
If this behavior is critical to your business, drop me a PM or an email and I'll see if we can work out something.

For me, with NS 2.6.8.20 local links (to files) work again in my FF28.0.
Big thanks, I'm much relieved! Hans

Thank you so much for this.

I was going crazy trying to make my subsonic work again on my local computer.

Did you get my mail?

Koopz wrote:Did you get my mail?

I might have lost it in my spam can or something
Could you please tell me the exact subject for me to search it?
Thank you very much!

Giorgio Maone wrote:

Koopz wrote:Did you get my mail?

I might have lost it in my spam can or something
Could you please tell me the exact subject for me to search it?
Thank you very much!

"Open local folders with Windows Explorer"

Then, how are we supposed to enable local links in FF29 if the old CAPS no longer work? Is the only choice to revert to FF28 until this is fixed?

memeguy wrote:Then, how are we supposed to enable local links in FF29 if the old CAPS no longer work? Is the only choice to revert to FF28 until this is fixed?

This will never be fixed in Firefox, but it's partially fixed (see above) if you use NoScript with its "Trusted|Allow local links" option and/or its new, finer grained noscript.allowLocalLinks.* about:config preferences.

Thank you! It does work now if it's a link I directly click on. However, It still fails and I get a Security Error in the Error Console if the local link is in a Location: directive from a redirected link. Am I missing something?

Giorgio Maone wrote:

memeguy wrote:Then, how are we supposed to enable local links in FF29 if the old CAPS no longer work? Is the only choice to revert to FF28 until this is fixed?

This will never be fixed in Firefox, but it's partially fixed (see above) if you use NoScript with its "Trusted|Allow local links" option and/or its new, finer grained noscript.allowLocalLinks.* about:config preferences.

memeguy wrote:Thank you! It does work now if it's a link I directly click on. However, It still fails and I get a Security Error in the Error Console if the local link is in a Location: directive from a redirected link. Am I missing something?

The code I gave Giorgio requires a click on a direct link in order to bypass the security checks. IMO allowing links that redirect to a local location to bypass security checks in the same way would be too dangerous.

ETA Oh, I guess if you can't change the server configuration, you could work around by setting up NoRedirect to block these redirects but not show a DNS error, then you would be presented with the redirect page and a direct local link which you can then click on.