Citibank page won't work, yahoo mail attachements don't work

[1andrew]

Can someone please help me fix this problem?

After one of the updates - the citibank page won't work correctly.
I am locked out of my bank account.

Also - I can't attach anything to my emails on yahoo.
I already figured the yahoo must be somehow blocked by the XSS or something, but I don't know what to do to fix it.
The FAQ is worthless - changing the XSS settings doesn't do anything.
But I can see clearly an XSS request being blocked.
It goes very fast - I actually had to film the thing to see - I wonder why would anyone want to have a message appearing on the screen for only 1/10 of a second?

Anyway - is there an easier way to control this program?
Please do not develop it with an intention of having advanced programming users.
It is already too difficult to use anyway.

[1andrew]

and why is there a ^ sign in front of every exception in the XSS box? Is it required? Why?
Do I need to restart the FF after the exception change in XSS box?
If City webpage uses both domains
https://online.citibank.com
https://www.accountonline.com
do I need to have both there?

If I have them both there - why still the damn thing don't work?

[barbaz]

Could you please post here the related messages from the Error Console? (Ctrl-Shift-J)

and why is there a ^ sign in front of every exception in the XSS box? Is it required? Why?

they're regular expressions, that marks the beginning of the thing they're trying to match

Do I need to restart the FF after the exception change in XSS box?

I don't think so

If City webpage uses both domains
https://online.citibank.com
https://www.accountonline.com
do I need to have both there?

probably not

[1andrew]

Could you please post here the related messages from the Error Console? (Ctrl-Shift-J)

Sure: image corrupt or truncated
Ns error xpc - this message is too long to just write and it can't be copied/pasted
So 2 errors only.
There are much more warnings, but can't be copied so do we need those?

and why is there a ^ sign in front of every exception in the XSS box? Is it required? Why?

they're regular expressions, that marks the beginning of the thing they're trying to match

So do I need to put them before the https://online.citibank.com ?
Or not?

[barbaz]

Sure: image corrupt or truncated
Ns error xpc - this message is too long to just write and it can't be copied/pasted
So 2 errors only.
There are much more warnings, but can't be copied so do we need those?

Unfortunately that's not enough of the information for us to figure what's happening. It would be helpful to have those messages in full, and anything that's listed on the Messages tab of the Error Console also.
Warnings are probably irrelevant.
You can copy individual Error Console entries by right-clicking them and selecting "Copy".

If this forum's spam filter is tripping, try again wrapping the messages in code tags, like this

Code: Select all

[code]messages go here

[/code]

[1andrew]

OK.OK. Thanks. I'll copy.

Timestamp: 5/5/2014 9:25:45 PM
Error: TypeError: this.container is undefined
Source File: http://s6.scribdassets.com/aggregated/j ... 1399323313
Line: 181

Timestamp: 5/5/2014 9:25:55 PM
Error: ReferenceError: gadgets is not defined
Source File: https://ssl.gstatic.com/accounts/o/6820 ... gerelay.js
Line: 9

Timestamp: 5/5/2014 9:25:56 PM
Error: ReferenceError: gadgets is not defined
Source File: https://ssl.gstatic.com/accounts/o/6820 ... gerelay.js
Line: 9

Timestamp: 5/5/2014 9:27:32 PM
Error: TypeError: bv is null
Source File: https://online.citibank.com/JFP/js/jque ... y-1.7.2.js
Line: 18


There was something saying "syntax error" - but it disappeared.
I don't know how to get the error when it disappears from the console.
Is there a way?

Timestamp: 5/5/2014 9:30:35 PM
Error: ReferenceError: toggleSecureMessageInFlyOut is not defined
Source File: https://chat.online.citi.com/visitor/ad ... mpleDeploy
Line: 128


Timestamp: 5/5/2014 9:30:37 PM
Error: ReferenceError: toggleSecureMessageInFlyOut is not defined
Source File: https://chat.online.citi.com/visitor/ad ... mpleDeploy
Line: 128

[object XULElement]

Man I can't get those errors because they go away on me before I can copy them!!!!

[Guest]

more:

Timestamp: 5/5/2014 9:36:30 PM
Error: ReferenceError: toggleSecureMessageInFlyOut is not defined
Source File: https://chat.online.citi.com/visitor/ad ... mpleDeploy
Line: 128

Timestamp: 5/5/2014 9:36:54 PM
Error: ReferenceError: toggleSecureMessageInFlyOut is not defined
Source File: https://chat.online.citi.com/visitor/ad ... mpleDeploy
Line: 128

Timestamp: 5/5/2014 9:37:16 PM
Error: ReferenceError: removeFSCookie is not defined
Source File: https://online.citibank.com/US/JPS/portal/Home.do
Line: 1

[barbaz]

Do those sites work if you disable NoScript completely? (Tools -> Add-ons Manager -> NoScript -> Disable -> Yes, remove ALL protections)
If not, NoScript is not causing the problem, you need Standard Diagnostic. Please let us know your findings.
If so, read on...

For citibank, looks like some necessary script is probably not allowed. Does that site work if you Allow Scripts Globally with nothing in Untrusted?

There was something saying "syntax error" - but it disappeared.
I don't know how to get the error when it disappears from the console.
Is there a way?

Not that I know of
I think the maximum number of visible total errors/warnings/messages is configurable, but don't know how to do that. Will look into it.

[object XULElement]

Now that's a strange one, probably not from the webpage. Some other extension maybe?

[Thrawn]

So do I need to put them before the https://online.citibank.com ?

Yes, you do. Otherwise bad things will happen.

I recommend reading a regular expression manual before altering the XSS filter rules. http://www.regular-expressions.info/ is pretty good in my experience, but there are plenty of others online.

[barbaz]

I think the maximum number of visible total errors/warnings/messages is configurable, but don't know how to do that.

OK, so it is configurable but not in any convenient way. Never mind.

[1andrew]

I turned off the no-script and indeed the citibank website still won't work correctly.
So that was a good hint, thank you.
I guess I shouldn't complain about no-script now.
It must have been a coincidence - that the XSS message showed up or there are more than just one problem.
Something must have affected the whole system - not just the no-script.
But the problem remains. Anyway - thank you for all responses.