InformAction Forums

Using FFox 42 on Win7 x64 along with Lastpass 3.2.21 extension. In Lastpass when one goes to the Lastpass Vault there is a menu on the left hand side of the vault allowing you access to various pages in Lastpass. Discovered a number of these menu options do not work. When you click on say Account Settings nothing happens and subsequent clicks on other menu items are no longer clickable. You have to refresh the page in Firefox to try other links. The issue is Noscript since if I disable the Noscript extension all together the Lastpass menu items work.

Noscript shows no blocked scripts.

Try Allowing Scripts Globally.

If that does not work: when this issue occurs, do you see anything related in the Browser Console? (Ctrl-Shift-J)
(if you don't know what's related, turn off CSS warnings and post everything else you see)

I use LastPass, and it works if I allow lastpass.com.

I allowed scripts globally and the lastpass vault links in the left menu now work. There is no indication that NoScript is actually blocking any scripts In particular the Account Settings menu is one of the items that does not work unless I disable scripts globally. I already have trusted Lastpass.com and that made no difference.

Thrawn wrote:I use LastPass, and it works if I allow lastpass.com.

When you say it works are you talking about the Account Settings option in the left hand menu in LastPass Vault when you select My LastPass Vault in the Firefox extension?

pcguy wrote:When you say it works are you talking about the Account Settings option in the left hand menu in LastPass Vault when you select My LastPass Vault in the Firefox extension?

Yep (personally I access the vault via Ctrl+Alt+H; same thing).

With https://lastpass.com allowed, the Account Settings link works (pops up a message saying my session has expired and asking me to log on again, which takes me to the lastpass.com website).
If I block https://lastpass.com, the link does nothing.

Thrawn wrote:

pcguy wrote:When you say it works are you talking about the Account Settings option in the left hand menu in LastPass Vault when you select My LastPass Vault in the Firefox extension?

Yep (personally I access the vault via Ctrl+Alt+H; same thing).

With https://lastpass.com allowed, the Account Settings link works (pops up a message saying my session has expired and asking me to log on again, which takes me to the lastpass.com website).
If I block https://lastpass.com, the link does nothing.

I think we are talking about two different issues here. My issue is concerning the "Account Settings" menu item which is displayed when one selects LastPass Vault while I am already authenticated with LastPass. I have no problem getting the LasdtPass Vault to display (chrome://lastpass/content/home2.xul) it is the "Account Settings" menu which fails to do anything i.e it does not cause the appropriate window to open up in a pop up window if NoScript is not set to globally allow scripts.

pcguy wrote:I think we are talking about two different issues here. My issue is concerning the "Account Settings" menu item which is displayed when one selects LastPass Vault while I am already authenticated with LastPass.

Nope, we're definitely talking about the same link.
I go to my vault (either through the addon icon + menu, or by the shortcut Ctrl+Alt+H), at chrome://lastpass/content/home2.xul.
On the left is a menu with links 'Add Site', 'Add Secure Note', etc.
One of those links is 'Account Settings'.
If I allow lastpass.com to run scripts, then the Account Settings link works (takes me to the lastpass.com website to log in and view my account).
If I block lastpass.com, the link does nothing.

When you visit your vault, which sites show up on the NoScript menu, including Blocked Objects and Untrusted submenus?
When you try to click on the link, does anything appear in the Browser Console (Ctrl+Shift+J)?

Thrawn wrote:

pcguy wrote:I think we are talking about two different issues here. My issue is concerning the "Account Settings" menu item which is displayed when one selects LastPass Vault while I am already authenticated with LastPass.

Nope, we're definitely talking about the same link.
I go to my vault (either through the addon icon + menu, or by the shortcut Ctrl+Alt+H), at chrome://lastpass/content/home2.xul.
On the left is a menu with links 'Add Site', 'Add Secure Note', etc.
One of those links is 'Account Settings'.
If I allow lastpass.com to run scripts, then the Account Settings link works (takes me to the lastpass.com website to log in and view my account).
If I block lastpass.com, the link does nothing.

When you visit your vault, which sites show up on the NoScript menu, including Blocked Objects and Untrusted submenus?
When you try to click on the link, does anything appear in the Browser Console (Ctrl+Shift+J)?

Only thing that shows up on NoScript menu is "forbid Chrome:". I have lastpass.com in the whitelist so under Untrusted there is the option to Mark Lastpass.com as untrusted and that is it.


When I click on Account Settings link I see the following regarding Lastpass:

GET
https://lastpass.com/acctsiframe.php [HTTP/1.1 200 OK 261ms]
GET
https://lastpass.com/m.php/rev2014css [HTTP/1.1 200 OK 73ms]
GET
https://lastpass.com/m.php/default_ext2

If I enable scripts globally and click on Account settings a separate pop up window opens up with me needing to authenticate at all and gives me a variety of account settings for Lastpass account/.

I found that the Account Settings link works if I uncheck "Cacasde top document's permissions to third party scripts" under the Trusted tab. I believe that needed to be checked on for another website to work properly.

pcguy wrote:I have lastpass.com in the whitelist so under Untrusted there is the option to Mark Lastpass.com as untrusted and that is it.

If you have the option to Mark lastpass.com as Untrusted, then it is not on your whitelist. You would instead have the option to Forbid lastpass.com, and only after forbidding it would you have the option to Mark as Untrusted.

If you go to Options-Appearance, which items are enabled?

Thrawn wrote:

pcguy wrote:I have lastpass.com in the whitelist so under Untrusted there is the option to Mark Lastpass.com as untrusted and that is it.

If you have the option to Mark lastpass.com as Untrusted, then it is not on your whitelist. You would instead have the option to Forbid lastpass.com, and only after forbidding it would you have the option to Mark as Untrusted.

If you go to Options-Appearance, which items are enabled?

The things that are NOT enabled on that screen are Status Bar Label, Contextual menu, Full Domains, Full Addresses. The rest of the options are enabled.

But the option to allow lastpass.com isn't showing up?

Can you enable the Full Addresses option and check again?

What if you Mark lastpass.com as Untrusted, then go to the Untrusted submenu again and allow it from there?

Thrawn wrote:But the option to allow lastpass.com isn't showing up?

Can you enable the Full Addresses option and check again?

What if you Mark lastpass.com as Untrusted, then go to the Untrusted submenu again and allow it from there?

Before going any further did you see my post of Nov 12th:

I found that the Account Settings link works if I uncheck "Cacasde top document's permissions to third party scripts" under the Trusted tab. I believe that needed to be checked on for another website to work properly.

Hmm. That would certainly explain why lastpass.com is not showing up on the menu.

I would certainly recommend disabling cascaded permissions if you can. They should never be *necessary*, only convenient in some cases. However, if enabling cascade actually breaks the vault when it would otherwise work, then that does sound like a bug.

Perhaps cascading doesn't work properly when the top-level domain is a privileged protocol (like chrome:)? Giorgio would be better placed to answer that.

Can you try going to Options-Whitelist and manually adding https://lastpass.com to the whitelist?