New gmx web interface

[Luigi]

Are you forcing HTTPS on gmx via NoScript?
What if you don't?

Yes.
No change.

[cled12]

hello,
I use gmx.fr; here browser console without Noscript :

Code: Select all

ReferenceError: googletag is not defined logout:16
ReferenceError: googletag is not defined logout:86
ReferenceError: googletag is not defined logout:103
ReferenceError: googletag is not defined logout:109
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. lib-head-final.js:2
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. jquery-min.js:3
Key event not available on some keyboard layouts: key="c" modifiers="accel,alt" browser.xul
Key event not available on some keyboard layouts: key="p" modifiers="control alt" browser.xul
Key event not available on some keyboard layouts: key="q" modifiers="control alt" browser.xul
Key event not available on some keyboard layouts: key="t" modifiers="control alt" browser.xul
ReferenceError: googletag is not defined www.gmx.fr:15
ReferenceError: googletag is not defined www.gmx.fr:96
ReferenceError: googletag is not defined www.gmx.fr:141
ReferenceError: googletag is not defined www.gmx.fr:147
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. lib-head-final.js:2
can't access dead object jquery-min.js:2
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. jquery-1.8.3.min.js:2
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. jquery-min.js:3
Error: Permission denied to access property 'toString'
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. jquery-1.7.1.min.js:3
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. jquery-min.js:3
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. jquery-min.js:3
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. jquery-min.js:3
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. jquery-min.js:3
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. jquery-min.js:3
Use of getPreventDefault() is deprecated.  Use defaultPrevented instead. jquery-min.js:3
KeyboardEvent.key value "Del" is obsolete and will be renamed to "Delete". For more help https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent.key jquery-min.js:3

[Giorgio Maone]

hello,
I use gmx.fr; here browser console without Noscript :

Code: Select all

ReferenceError: googletag is not defined logout:16
ReferenceError: googletag is not defined logout:86
ReferenceError: googletag is not defined logout:103
ReferenceError: googletag is not defined logout:109
[...]

Does by any chance allowing googletag.com help any way?

[cled12]

bonjour,

Je ne sais pas répondre à votre question. Je suis utilisateur et je ne connais pas la programmation.

[barbaz]

bonjour,

Je ne sais pas répondre à votre question. Je suis utilisateur et je ne connais pas la programmation.

NoScript menu -> Temporarily allow googletagservices.com
*ou*
NoScript menu -> Untrusted -> Temporarily allow googletagservices.com

Marche-t-il après faire ça?

[Luigi]

Thread bump: no change with 2.6.8.31 either

Is there some other test I should run?

[cled12]

hello,

no change with 2.6.8.31

NoScript menu -> Temporarily allow googletagservices.com
*ou*
NoScript menu -> Untrusted -> Temporarily allow googletagservices.com

Marche-t-il après faire ça?

No change after this.

[barbaz]

Is there some other test I should run?

Does it work correctly if you completely disable NoScript (Tools -> Add-ons Manager -> NoScript -> Disable -> Yes, remove ALL protections, then restart browser)?
Try also a clean profile, with only NoScript installed, and set "Allow Scripts Globally" (but leave other settings alone). Does it work then?

[Luigi]

Does it work correctly if you completely disable NoScript (Tools -> Add-ons Manager -> NoScript -> Disable -> Yes, remove ALL protections, then restart browser)?
Try also a clean profile, with only NoScript installed, and set "Allow Scripts Globally" (but leave other settings alone). Does it work then?

Tried both and everything appears to be working. I also disabled every other addon on my main profile for good measure, but the test with a clean profile points toward some wrong setting in noscript.

Not sure how to proceed at this point. I suppose I could start with a clean sheet but lose everything or try locating the offending rule, but how?

Thanks.

[barbaz]

Backup your main profile, then try in your main profile (preferably with all other addons disabled), in this order, until something works (or none of these work):

1) Temporarily allow all this page until there aren't any more "cascading" scripts

2) Allow Scripts Globally

3) about:config -> right-click the "noscript.untrusted" pref, reset
restart browser, then repeat (1) and (2)

4) put back your Untrusted list (from backup profile), then
NoScript Options -> Export (at the very bottom of Options)
NoScript Options -> Whitelist -> Export (to save this separately - use the export button unique to the whitelist panel)
then
NoScript Options -> Reset
repeat (1) and (2)

5) if (4) works, try again after
NoScript Options -> Whitelist -> Import (use the button unique to the whitelist panel, and restore the file containing only your whitelist and untrusted list)

Please let us know the results.

(If #4 and #5 both work, keep the exported settings files around, as Giorgio might want to see them.)

[Luigi]

Backup your main profile, then try in your main profile (preferably with all other addons disabled), in this order, until something works (or none of these work):

1) Temporarily allow all this page until there aren't any more "cascading" scripts

2) Allow Scripts Globally

3) about:config -> right-click the "noscript.untrusted" pref, reset
restart browser, then repeat (1) and (2)

4) put back your Untrusted list (from backup profile), then
NoScript Options -> Export (at the very bottom of Options)
NoScript Options -> Whitelist -> Export (to save this separately - use the export button unique to the whitelist panel)
then
NoScript Options -> Reset
repeat (1) and (2)

5) if (4) works, try again after
NoScript Options -> Whitelist -> Import (use the button unique to the whitelist panel, and restore the file containing only your whitelist and untrusted list)

Please let us know the results.

(If #4 and #5 both work, keep the exported settings files around, as Giorgio might want to see them.)

Thanks, but another problem with another extension emerged, so I ended up migrating everything to a fresh firefox profile

I still have a backup though, I'll see if I can manage to find out who the culprit was.

Regards

[cled12]

hello,

there is no change in gmx.fr with NoScript 2.6.8.33.

have a good day.

[barbaz]

@cled12: atm, seems this isn't a NoScript bug. You could try this test - and if it works there for you too, try the steps mentioned above to figure the exact cause of the problem. Please let us know the results, thanks.

[cled12]

hello,

windows 8.1 update 1 - FF 31.0 - Noscript 2.6.8.35

1)- whithout Noscript -> gmx.fr works correctly

2)- Noscript activated (allow scipts globally ) but all addons desabled -> gmx.fr works correctly to start , when logout gmx.fr a XSS script appears from gmx.fr

In "about:config" : noscript.untrusted does not appear ?

End of test

[therube]

> XSS script appears from gmx.fr

And what is the message (from Error Console) ?