Re: New gmx web interface
Posted: Fri Jun 27, 2014 11:13 am
Yes.Giorgio Maone wrote:Are you forcing HTTPS on gmx via NoScript?
What if you don't?
No change.
No change.
InformAction Forums
NoScripters and WebSec nerds of all lands, unite!
https://forums.informaction.com/
New gmx web interface
Page 3 of 4
No change.
Re: New gmx web interface
Posted: Sat Jun 28, 2014 4:58 pm
hello,
I use gmx.fr; here browser console without Noscript :
I use gmx.fr; here browser console without Noscript :
Code: Select all
ReferenceError: googletag is not defined logout:16
ReferenceError: googletag is not defined logout:86
ReferenceError: googletag is not defined logout:103
ReferenceError: googletag is not defined logout:109
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. lib-head-final.js:2
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. jquery-min.js:3
Key event not available on some keyboard layouts: key="c" modifiers="accel,alt" browser.xul
Key event not available on some keyboard layouts: key="p" modifiers="control alt" browser.xul
Key event not available on some keyboard layouts: key="q" modifiers="control alt" browser.xul
Key event not available on some keyboard layouts: key="t" modifiers="control alt" browser.xul
ReferenceError: googletag is not defined www.gmx.fr:15
ReferenceError: googletag is not defined www.gmx.fr:96
ReferenceError: googletag is not defined www.gmx.fr:141
ReferenceError: googletag is not defined www.gmx.fr:147
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. lib-head-final.js:2
can't access dead object jquery-min.js:2
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. jquery-1.8.3.min.js:2
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. jquery-min.js:3
Error: Permission denied to access property 'toString'
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. jquery-1.7.1.min.js:3
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. jquery-min.js:3
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. jquery-min.js:3
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. jquery-min.js:3
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. jquery-min.js:3
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. jquery-min.js:3
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. jquery-min.js:3
KeyboardEvent.key value "Del" is obsolete and will be renamed to "Delete". For more help https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent.key jquery-min.js:3
Re: New gmx web interface
Posted: Sat Jun 28, 2014 7:55 pm
Does by any chance allowing googletag.com help any way?cled12 wrote:hello,
I use gmx.fr; here browser console without Noscript :
Code: Select all
ReferenceError: googletag is not defined logout:16 ReferenceError: googletag is not defined logout:86 ReferenceError: googletag is not defined logout:103 ReferenceError: googletag is not defined logout:109 [...]
Re: New gmx web interface
Posted: Sun Jun 29, 2014 8:01 am
bonjour,
Je ne sais pas répondre à votre question. Je suis utilisateur et je ne connais pas la programmation.
Je ne sais pas répondre à votre question. Je suis utilisateur et je ne connais pas la programmation.
Re: New gmx web interface
Posted: Sun Jun 29, 2014 6:26 pm
NoScript menu -> Temporarily allow googletagservices.comcled12 wrote:bonjour,
Je ne sais pas répondre à votre question. Je suis utilisateur et je ne connais pas la programmation.
*ou*
NoScript menu -> Untrusted -> Temporarily allow googletagservices.com
Marche-t-il après faire ça?
Re: New gmx web interface
Posted: Sat Jul 05, 2014 10:51 am
Thread bump: no change with 2.6.8.31 either 
Is there some other test I should run?
Is there some other test I should run?
Re: New gmx web interface
Posted: Sun Jul 06, 2014 6:31 am
hello,
no change with 2.6.8.31
no change with 2.6.8.31
No change after this.barbaz wrote: NoScript menu -> Temporarily allow googletagservices.com
*ou*
NoScript menu -> Untrusted -> Temporarily allow googletagservices.com
Marche-t-il après faire ça?
Re: New gmx web interface
Posted: Sun Jul 06, 2014 5:22 pm
Does it work correctly if you completely disable NoScript (Tools -> Add-ons Manager -> NoScript -> Disable -> Yes, remove ALL protections, then restart browser)?Luigi wrote:Is there some other test I should run?
Try also a clean profile, with only NoScript installed, and set "Allow Scripts Globally" (but leave other settings alone). Does it work then?
Re: New gmx web interface
Posted: Wed Jul 09, 2014 12:23 pm
Tried both and everything appears to be working. I also disabled every other addon on my main profile for good measure, but the test with a clean profile points toward some wrong setting in noscript.barbaz wrote:Does it work correctly if you completely disable NoScript (Tools -> Add-ons Manager -> NoScript -> Disable -> Yes, remove ALL protections, then restart browser)?
Try also a clean profile, with only NoScript installed, and set "Allow Scripts Globally" (but leave other settings alone). Does it work then?
Not sure how to proceed at this point. I suppose I could start with a clean sheet but lose everything or try locating the offending rule, but how?
Thanks.
Re: New gmx web interface
Posted: Wed Jul 09, 2014 5:49 pm
Backup your main profile, then try in your main profile (preferably with all other addons disabled), in this order, until something works (or none of these work):
1) Temporarily allow all this page until there aren't any more "cascading" scripts
2) Allow Scripts Globally
3) about:config -> right-click the "noscript.untrusted" pref, reset
restart browser, then repeat (1) and (2)
4) put back your Untrusted list (from backup profile), then
NoScript Options -> Export (at the very bottom of Options)
NoScript Options -> Whitelist -> Export (to save this separately - use the export button unique to the whitelist panel)
then
NoScript Options -> Reset
repeat (1) and (2)
5) if (4) works, try again after
NoScript Options -> Whitelist -> Import (use the button unique to the whitelist panel, and restore the file containing only your whitelist and untrusted list)
Please let us know the results.
(If #4 and #5 both work, keep the exported settings files around, as Giorgio might want to see them.)
1) Temporarily allow all this page until there aren't any more "cascading" scripts
2) Allow Scripts Globally
3) about:config -> right-click the "noscript.untrusted" pref, reset
restart browser, then repeat (1) and (2)
4) put back your Untrusted list (from backup profile), then
NoScript Options -> Export (at the very bottom of Options)
NoScript Options -> Whitelist -> Export (to save this separately - use the export button unique to the whitelist panel)
then
NoScript Options -> Reset
repeat (1) and (2)
5) if (4) works, try again after
NoScript Options -> Whitelist -> Import (use the button unique to the whitelist panel, and restore the file containing only your whitelist and untrusted list)
Please let us know the results.
(If #4 and #5 both work, keep the exported settings files around, as Giorgio might want to see them.)
Re: New gmx web interface
Posted: Fri Jul 11, 2014 7:39 am
Thanks, but another problem with another extension emerged, so I ended up migrating everything to a fresh firefox profilebarbaz wrote:Backup your main profile, then try in your main profile (preferably with all other addons disabled), in this order, until something works (or none of these work):
1) Temporarily allow all this page until there aren't any more "cascading" scripts
2) Allow Scripts Globally
3) about:config -> right-click the "noscript.untrusted" pref, reset
restart browser, then repeat (1) and (2)
4) put back your Untrusted list (from backup profile), then
NoScript Options -> Export (at the very bottom of Options)
NoScript Options -> Whitelist -> Export (to save this separately - use the export button unique to the whitelist panel)
then
NoScript Options -> Reset
repeat (1) and (2)
5) if (4) works, try again after
NoScript Options -> Whitelist -> Import (use the button unique to the whitelist panel, and restore the file containing only your whitelist and untrusted list)
Please let us know the results.
(If #4 and #5 both work, keep the exported settings files around, as Giorgio might want to see them.)
I still have a backup though, I'll see if I can manage to find out who the culprit was.
Regards
Re: New gmx web interface
Posted: Tue Jul 22, 2014 10:00 am
hello,
there is no change in gmx.fr with NoScript 2.6.8.33.
have a good day.
there is no change in gmx.fr with NoScript 2.6.8.33.
have a good day.
Re: New gmx web interface
Posted: Tue Jul 22, 2014 3:28 pm
Re: New gmx web interface
Posted: Sat Jul 26, 2014 10:34 am
hello,
windows 8.1 update 1 - FF 31.0 - Noscript 2.6.8.35
1)- whithout Noscript -> gmx.fr works correctly
2)- Noscript activated (allow scipts globally ) but all addons desabled -> gmx.fr works correctly to start , when logout gmx.fr a XSS script appears from gmx.fr
In "about:config" : noscript.untrusted does not appear ?
End of test
windows 8.1 update 1 - FF 31.0 - Noscript 2.6.8.35
1)- whithout Noscript -> gmx.fr works correctly
2)- Noscript activated (allow scipts globally ) but all addons desabled -> gmx.fr works correctly to start , when logout gmx.fr a XSS script appears from gmx.fr
In "about:config" : noscript.untrusted does not appear ?
End of test
Re: New gmx web interface
Posted: Sat Jul 26, 2014 10:52 am
> XSS script appears from gmx.fr
And what is the message (from Error Console) ?
And what is the message (from Error Console) ?