InformAction Forums

Hi I'm having a problem with the new NoScript 10.1.2.

Firstly, all default settings allow "script, media, frame, font, webgl, and other" from the start. Which i think is a failure as they should all be unchecked by default if it's the same as old NoScript.

Secondly, when i select a site to be Untrusted, as soon as I click away from the menu nothing happens and if i return to the noscript drop down, the site I previously selected is back at Default. When i check the options page, the sites I've selected are registered as Untrusted, but on the page themselves they are still operating as default and with scripts, etc functioning.

I've tried removing NoScript and reinstalling through the firefox extensions page, which has had no effect.

Ideas?

I try to get page Trusted but it comes always back default Untrusted.
So i cannot use Noscript at this page .. .maceamachinery.fi

jouko1964 wrote:I try to get page Trusted but it comes always back default Untrusted.
So i cannot use Noscript at this page .. .maceamachinery.fi

Again, this is likely because you are on websites that have http URLs only. Set the padlock symbol to red instead of green and both http and https site will be loaded.

lglethal wrote:Hi I'm having a problem with the new NoScript 10.1.2.

Firstly, all default settings allow "script, media, frame, font, webgl, and other" from the start. Which i think is a failure as they should all be unchecked by default if it's the same as old NoScript.

Are you sure? It shouldn't do that unless you accidentally changed this manually? My version had all boxes unchecked as it should be. Did you also use version 10.1.1 and updated from there and thus maybe migrated older settings?

lglethal wrote: Secondly, when i select a site to be Untrusted, as soon as I click away from the menu nothing happens and if i return to the noscript drop down, the site I previously selected is back at Default. When i check the options page, the sites I've selected are registered as Untrusted, but on the page themselves they are still operating as default and with scripts, etc functioning.

I've tried removing NoScript and reinstalling through the firefox extensions page, which has had no effect.

Hm, aside from the auto-refresh issue (which seems not working in v. 10.1.2 at the moment), I'm not able to reproduce this failure. Could you go to your options' list and set the specific site to default? This would delete it from the list. Then just start over and see whether this resolves that issue.
I had a similar entry-issue too which wouldn't correspond with its web extension counterpart. After I had deleted it from the list and changed settings, it worked just fine.

And for Default, In general, untick all boxes just to make sure, scripts are not being run.


At the moment, for me personally, Untrusted never seems to have any effect whatsoever. Despite none of the checkboxes under that option are ticked, the site will load everything regardless. This is odd because in the older version, it would show some html text and no content.

Hi, thanks for the quick answer Noscriptian,

NoScriptian wrote: Are you sure? It shouldn't do that unless you accidentally changed this manually? My version had all boxes unchecked as it should be. Did you also use version 10.1.1 and updated from there and thus maybe migrated older settings?

I got the automatic update from Firefox. I did not manually re-install NoScript. So I dont know if it went through v10.1.1 on the way or not. However, this default to everything be allowed is for every site, not site specific. For example, I had never visited this forum before today and yet all scripts, media etc are allowed. So this problem is not from left over site specific allowances. It is a general failure on my machine - all sites are allowed full access on default which basically removes the functionality of noscript.

lglethal wrote: Secondly, when i select a site to be Untrusted, as soon as I click away from the menu nothing happens and if i return to the noscript drop down, the site I previously selected is back at Default. When i check the options page, the sites I've selected are registered as Untrusted, but on the page themselves they are still operating as default and with scripts, etc functioning.

I've tried removing NoScript and reinstalling through the firefox extensions page, which has had no effect.

NoScriptian wrote: Hm, aside from the auto-refresh issue (which seems not working in v. 10.1.2 at the moment), I'm not able to reproduce this failure. Could you go to your options' list and set the specific site to default? This would delete it from the list. Then just start over and see whether this resolves that issue.
I had a similar entry-issue too which wouldn't correspond with its web extension counterpart. After I had deleted it from the list and changed settings, it worked just fine.

And for Default, In general, untick all boxes just to make sure, scripts are not being run.

I've tried setting things to default in the options list, but it has no effect. So after setting them to default, returning them to untrusted back on the webpage has no effect, and they again show as untrusted on the options page (with everything unchecked), but on the actual page they operate with full scripts, media, etc, in operation.

I have deactivated all other extensions (the only other extension i had was ghostery). I even tried uninstalling and resinstalling NoScript with Ghostery deactivated, no change.

Any further Ideas?

lglethal wrote:Hi, thanks for the quick answer Noscriptian,

NoScriptian wrote: Are you sure? It shouldn't do that unless you accidentally changed this manually? My version had all boxes unchecked as it should be. Did you also use version 10.1.1 and updated from there and thus maybe migrated older settings?

I got the automatic update from Firefox. I did not manually re-install NoScript. So I dont know if it went through v10.1.1 on the way or not. However, this default to everything be allowed is for every site, not site specific. For example, I had never visited this forum before today and yet all scripts, media etc are allowed. So this problem is not from left over site specific allowances. It is a general failure on my machine - all sites are allowed full access on default which basically removes the functionality of noscript.

My guess is you fiddled with the settings in v. 10.1.1 and it remembered these tweaks in the updated version. So, if you now set all boxes in Default to uncheck, this will be the inital setup for each and every website you'll be visiting in the future because this is the master template. Since it was set to "allow scripts etc.", it therefore allowed all visited sites to load scripts.

lglethal wrote: I've tried setting things to default in the options list, but it has no effect. So after setting them to default, returning them to untrusted back on the webpage has no effect, and they again show as untrusted on the options page (with everything unchecked), but on the actual page they operate with full scripts, media, etc, in operation.

I have deactivated all other extensions (the only other extension i had was ghostery). I even tried uninstalling and resinstalling NoScript with Ghostery deactivated, no change.

Any further Ideas?

When you make changes to your options list, maybe you should refresh your tab or close it and bring it back on in order to take effect. At least that's what I experienced so far. After that, take a look at the padlock symbol in your web extension menu. If it's green and you visit a http-only website, you'll need to change it to red (http + https). Maybe this is the cause why it doesn't remember your settings in the web extension but writes them to the list.

NoScriptian wrote: At the moment, for me personally, Untrusted never seems to have any effect whatsoever. Despite none of the checkboxes under that option are ticked, the site will load everything regardless. This is odd because in the older version, it would show some html text and no content.

have you made the untrusted rule apply to both http and https?
It's a currently unintended "feature" that although the locks aren't shown when setting to "untrusted", in the background it is still working off of the distinction (default green lock).
Try setting it to trusted and redlock and THEN to untrusted.

The locks aren't shown because when you block it should block both, but apparently that's not what's happening.

lglethal wrote: I got the automatic update from Firefox. I did not manually re-install NoScript. So I dont know if it went through v10.1.1 on the way or not. However, this default to everything be allowed is for every site, not site specific. For example, I had never visited this forum before today and yet all scripts, media etc are allowed. So this problem is not from left over site specific allowances. It is a general failure on my machine - all sites are allowed full access on default which basically removes the functionality of noscript.

Either way, just change it, then.
The default setting should have no checkmarks (unless you really want some...).
There probably was a migratory issue, or you set a custom "allow all" rule between Sunday the 19th and Wednesday 22nd (which was when 10.1.1 was active with a bug)

Secondly, when i select a site to be Untrusted, as soon as I click away from the menu nothing happens and if i return to the noscript drop down, the site I previously selected is back at Default. When i check the options page, the sites I've selected are registered as Untrusted, but on the page themselves they are still operating as default and with scripts, etc functioning.

This is also the same issue as the problem of "trusted" not being saved, but a bit more sneaky. And happens also mostly with pages imported from old settings.

Basically NS ALWAYS makes the distinction between HTTPS and "HTTP and HTTPS". Even on "distrusted". If you have made a "block only HTTPS rule" (which shouldn't happen, which is why it doesn't show the padlocks to begin with) but the page is HTTP, the HTTP part acts like default, because there is no rule for it. If your default settings are "allow all", then the block does nothing.

Basically currently if you want to set a site to untrusted (or have imported an old rule), chances are it only blocks https.

So your most important steps right now:
1. Fix your default settings to have no checkmarks.
2. Recheck your "untrusted" rules for each entry by switching to trusted, select the red lock and switch back to untrusted.

edit: basically all your "untrusted" rules should have red text instead of black text where the source is named.

OK something must have gone wrong when NoScript upgraded.

Thanks for your advice everyone, here is how to fix it if someone else has this exact problem:
Under the options page -> Debug (very bottom of the page)

Once you tick debug, a box of script will open up below. In my failed case it read: It should read: So in short, simply delete the capabilities under default. And it's back to working how we know and love!

Cheers everyone...

lglethal wrote:OK something must have gone wrong when NoScript upgraded.

Thanks for your advice everyone, here is how to fix it if someone else has this exact problem:
Under the options page -> Debug (very bottom of the page)

Once you tick debug, a box of script will open up below. In my failed case it read:


So in short, simply delete the capabilities under default. And it's back to working how we know and love!

Cheers everyone...

Or, you can just click on the default button for any source that applies to and remove the checkmarks.

The three presets (default trusted and untrusted) can be changed on any of those buttons in the interface for all members of the preset at the same time.

Pansa wrote:
Or, you can just click on the default button for any source that applies to and remove the checkmarks.

The three presets (default trusted and untrusted) can be changed on any of those buttons in the interface for all members of the preset at the same time.

I dont get what you mean by that Pansa? When i click on any website and change the checkboxes it only affects that speciifc "link" on the website? For example if i change the checkmarks for informaction.com it only applies to informaction.com and not to the under links like google.com even though they are both set to default. I dont see how you can affect all of the defaults from one site change. I also would not want that. Sometimes I'm on a site with dozens of links and i only want one to activate, so i'll activate scripts on each one individually until i find the one that I'm looking for. I dont want them all turning on when I change just one of them.

Am i misunderstanding what you meant?

lglethal wrote:

Pansa wrote:
Or, you can just click on the default button for any source that applies to and remove the checkmarks.

The three presets (default trusted and untrusted) can be changed on any of those buttons in the interface for all members of the preset at the same time.

I dont get what you mean by that Pansa? When i click on any website and change the checkboxes it only affects that speciifc "link" on the website? For example if i change the checkmarks for informaction.com it only applies to informaction.com and not to the under links like google.com even though they are both set to default. I dont see how you can affect all of the defaults from one site change. I also would not want that. Sometimes I'm on a site with dozens of links and i only want one to activate, so i'll activate scripts on each one individually until i find the one that I'm looking for. I dont want them all turning on when I change just one of them.

Am i misunderstanding what you meant?

If you change the checkmarks on "default" it changes the default. For all pages in default.
If you change the checkmarks on "trusted" it changes the trusted preset. for all pages that are set to trusted.
That is why "custom" exists. Custom creates a special rule for that page only.

The code you posted is basically the representation of the UI. As you can see in the code, there is no seperate "default" set for every page, but there are individual "custom" rules for the sources you set to custom.

You can check that by changing some checkmarks, then reloading and seeing that all pages in default now follow that changed rule.

edit: I understand that this might seem "weird" when one only goes by the number of buttons, but if you go by what they say, you might see that the interpretation between default and custom makes very little sense otherwise. If each page had their seperate default, it would be a custom setting, and not a default.

Pansa wrote:

NoScriptian wrote: At the moment, for me personally, Untrusted never seems to have any effect whatsoever. Despite none of the checkboxes under that option are ticked, the site will load everything regardless. This is odd because in the older version, it would show some html text and no content.

have you made the untrusted rule apply to both http and https?
It's a currently unintended "feature" that although the locks aren't shown when setting to "untrusted", in the background it is still working off of the distinction (default green lock).
Try setting it to trusted and redlock and THEN to untrusted.

The locks aren't shown because when you block it should block both, but apparently that's not what's happening.

I tried to follow your advice but it didn't have any effect either. When I set Youtube to Trusted and red lock it and then switch to Untrusted, nothing happens and YT still loads as if it was in Trusted mode. Not even deleting YT from my whitelist and starting over did the trick.

Edit: I just reviewed the debug code and figured out that under Untrusted, script, fetch, objects etc. was listed (even though nothing was ticked in the WE). Deleting those entries manually did help as it looks like and now only shows "capabilities": []. However, before I deleted just these very entries for Untrusted I tried and deleted the entire debug code, then re-entered the debug window but it would still return those "wrong" settings (i.e. script, objects, fetch etc.). I'm not sure what caused this issue.

Edit 2: Now I tried another website to see how Untrusted works out. When I set www.nikon.de to Untrusted, it would still load (maybe a tad restricted) and I could still click links etc. even though NS tells me that it blocks all available scripts. The debug code window added "§:nikon.de" as expected and thus should block all things on there. With youtube I get an entirely blank page now when set to Untrusted, so I was expecting kind of the same thing on Nikon's site too. or am I mistaken?

NoScriptian wrote:The debug code window added "§:nikon.de" as expected and thus should block ...

... "https://[...]nikon.de". It wouldn't block your link because it's a plain HTTP link.

https://forums.informaction.com/viewtop ... 098#p92098

NoScriptian wrote:
Edit: I just reviewed the debug code and figured out that under Untrusted, script, fetch, objects etc. was listed (even though nothing was ticked in the WE). Deleting those entries manually did help as it looks like and now only shows "capabilities": []. However, before I deleted just these very entries for Untrusted I tried and deleted the entire debug code, then re-entered the debug window but it would still return those "wrong" settings (i.e. script, objects, fetch etc.). I'm not sure what caused this issue.

I just had to double check, and somehow untrusted was set to
"capabilities":[
"script"
]

without the according checkmark here, too. What the hell!

barbaz wrote:

NoScriptian wrote:The debug code window added "§:nikon.de" as expected and thus should block ...

... "https://[...]nikon.de". It wouldn't block your link because it's a plain HTTP link.

https://forums.informaction.com/viewtop ... 098#p92098

Is that a confirmation that the § in the log corresponds to the green lock explicitly?

Basically NO address in "untrusted" should ever have a § in front?

Pansa wrote:Is that a confirmation that the § in the log corresponds to the green lock explicitly?

Basically NO address in "untrusted" should ever have a § in front?

Looks like it to me, based on watching "Debug" while toggling the green lock for one of the listed site, the leading "§:" gets toggled on/off with it.