[RESOLVED] ClearClick Battlefield Heroes Game Launch

[wudds]

The new EA free to play game Battlefield Heroes (http://www.battlefieldheroes.com/) launches from within your web browser by clicking on a flash button which says "Play Now" ( http://cdn.battlefieldheroes.com/static ... Button.swf ) . NoScript pops up when clicking this button and warns of an attempted clickjacking and even when telling NoScript that this is a trusted item it still keeps popping up with the warning no matter how many times you tell it to trust it. This happens when the "Trust all on this page" option is enabled also. Just wondering if it's possible to come up with a workaround to stop the warning coming up and actually allowing the click button to become trusted.

[Tom T.]

It requires a login at the first link you gave. Otherwise, clicking your second link, the "Play Now" button goes nowhere even if everything is allowed. Can you set up a test account for us -- since it's free? Thank you.

[wudds]

signups are disabled for the EA account side at the moment as it's still in beta but logging in with the username NOSCRIPT and the pass NOSCRIPT1 will get you through the first security layer to where you can see the button along the top row.


edit: I'll also add, first one to help conclude with a solution can have the beta key to tie an EA account to so you can play when signups open again

[Tom T.]

I'm sorry, but I've disabled Adbock, whitelisted the site in NS, allowed all plugins, and the login doesn't work. Please check it again, and tell me what I'm missing. Thank you.

[wudds]

ahhh i think possibly i was still logged in. theres no actual logout feature for the first login layer. i have just clicked the link from the first post and i got straight in without having to put the details in. i have closed the browser and cleared the cache and cookies, just once more in case the first post is wrong

user: noscript
pass: noscript1


edit: possibly I shouldn't have put them in uppercase?

[Tom T.]

The uppercase login was the error. No problem with lower case login.

The only thing immediately apparent to me was that as the "Play Now" button oscillates, it overrides a little bit of the logo above, "Heroes", and its blue background. This is apparent if you look at the ClearClick warning box and click the Play Now image inside. It will toggle back and forth, showing the blue background, then not showing it (obstructed by the button). ClearClick is very sensitive, so even though it is a harmless animation, the fact that it covers up another screen element meets the definition.

Try modifying the .swf button, either so it doesn't oscillate, or oscillates only within its own boundaries (envelope or box), not covering the background above. If this doesn't do it, then Giorgio will have to take a deeper look. I have already made a report, Report #176062.

Let us know if this fixes it. Thanks.

[wudds]

great stuff, thank you.

and I PM'd you beta key details

[GµårÐïåñ]

I tested the link you provided with the credentials and I went around and did as much as I could to provoke the issue and I was fine. Not sure if that helps but let me know if something else.

[wudds]

A guy on the forums at BFH came up with a working solution .

http://img44.imageshack.us/i/noscriptoptions.jpg/


Thanks again guys

[GµårÐïåñ]

Of course you can disable it at the root in the options but keep in mind that it will not protect you anymore on ANY trusted site besides this as well. So if a site gets compromised and its on your trusted list, then you will be wide open by your own choice. Good luck.

[Giorgio Maone]

... or add *.battlefieldheroes.com to noscript.clearClick.exceptions in about:config.

[GµårÐïåñ]

Agreed, better to make an extra key for the trusted site rather than open the barn door for everyone.

[wudds]

This has corrected the issue 100% while still being able to keep that checkbox enabled. Thank you to all three of you for your input and help.

[GµårÐïåñ]

You are welcome and glad its working for you. Whenever possible, allow the most restrictive permissions to ensure you don't extend yourself too far. It takes time to find that delicate balance but when you do, its worth it, you will have the comfort of function with the security you need. Anyway, good luck, I will mark this matter resolved.

[Tom T.]

.... but you'll have to advise all of your current and future users who use NoScript to add that exception, and deal with the complaints of those who don't see or read it. (Or *we* will have to...) Wouldn't it be better to configure the button so it doesn't block other elements?

@ Giorgio: Do you agree that it was this button covering other page elements that was triggering the warning, or did you find something else?