forbidBGRefresh blocks images opened in tab

[therube]

forbidBGRefresh blocks images opened in tab


URL: http://www.pcqanda.com/dc/dcboard.php?a ... e_id=24325

pcqanda.com not Allowed.

Open URL in new (background) tab.

Because the URL is not a "direct" link to the image, & because you're opening in a background tab, & because pcqanda.com is untrusted, the image does not load.

Code: Select all

[NoScript] Blocking refresh on unfocused tab, http://www.pcqanda.com/dc/dcboard.php?az=view_attachment&file_id=24325->http://www.pcqanda.com/dc/user_files2/24325.jpg

Direct link: http://www.pcqanda.com/dc/user_files2/24325.jpg


What's more, without reviewing Error Console, there is no indication as to what happened or why, leading the user to feel that it is just some sort of broken link. Now once at the "blank page", you can refresh the page & the image will load - but you have to realize that too.


PS: I do trust pcqanda.com, though I do not Allow it unless I have some need to so.


*(background) tab. <SeaMonkey>
Edit | Perferences | Browser -> Tabbed Browsing => (uncheck) Switch to new tabs opened from links



Not sure what this one did or didn't do as I only noticed it after the fact:

Code: Select all

[NoScript] Blocking refresh on unfocused tab, http://forums.informaction.com/posting.php?mode=edit&f=8&sid=...&t=4426&p=18644->http://forums.informaction.com/viewtopic.php?f=8&t=4426&p=18644#p18644

[Alan Baxter]

I middle-clicked http://www.pcqanda.com/dc/dcboard.php?a ... e_id=24325 to open it in a new, background tab, which is the Firefox default behavior.
No message appeared in the Error Console.
A notification bar was displayed at the top of the page saying:
Firefox prevented this page from automatically redirecting to another page, with an Allow button on the right-hand side of the bar. Clicking Allow displays the image. Since pcqanda isn't whitelisted, isn't this the expected behavior, therube?

[therube]

(I've revised, clarified <hopefully> my post a number of times ...)

What happens in FF is different it looks like.

Yes FF does present that dialog, like you say (& how annoying is that!).
And in doing so, blocks the issue.
Suppose there's a Preference to disable that dialog ? ...

Appears it should be ... Tools | Options | Advanced -> General => Warn me when web sites try to redirect or reload the page, but that is unchecked, yet still seems enabled?

accessibility.blockautorefresh is false.

KB: Accessibility.blockautorefresh

Something must have happened between FF 3.5.x & 3.6.x cause accessibility.blockautorefresh appears to be working as expected in 3.5 but not in 3.6 ?

Nope, that's probably not it. Thinking that NoScript (.81) must be tagging along in this Preference (in FF but not in SeaMonkey). With .81 installed, the Preference is "True", even though it is not reflected in about:config.

[Alan Baxter]

(I've revised, clarified <hopefully> my post a number of times ...)

Am I looking at the final version yet?
Seriously, I appreciate your editing your posts to improve their clarity. Thank you for bringing that to my attention.

What happens in FF is different it looks like.

I can confirm the behavior you see in SeaMonkey 2.0.4.

Yes FF does present that dialog, like you say (& how annoying is that!).

Not annoying at all (yet). It's providing exactly the protection desired, i.e. notifying me when a forbidden site tries to refresh a background tab. But it looks like it's broken in SeaMonkey. The SeaMonkey behavior would be very misleading.

And in doing so, blocks the issue.
Suppose there's a Preference to disable that dialog ? ...

http://noscript.net/changelog
"Address patterns matching pages which shouldn't be affected can be listed in the noscript.forbidBGRefresh.exceptions preference."
Does that work?

Edit: It doesn't seem to work in Firefox. I modified noscript.forbidBGRefresh.exceptions to a new value:

Code: Select all

.pcqanda.com

But the refresh is still blocked when I middle-click the link in Firefox. I expected it to be automatically allowed.

[therube]

(I get free reign in re-re-re-re-editing until someone posts after me .)

Thinking that NoScript (.81) must be tagging along in this Preference (in FF but not in SeaMonkey). With .81 installed, the Preference is "True", even though it is not reflected in about:config.

noscript.forbidBGRefresh.exceptions preference
Does that work?

Space separated? So, ".mozilla.org .pcqanda.com". But that doesn't seem to have an affect, still being blocked?
Confirmed, per above.

Not annoying at all (yet). It's providing exactly the protection desired

Yes annoying . Yes, it is the desired protection.

i.e. notifying me when a forbidden site tries to refresh a background tab.

Ah, but that is different. That is not part of the (accessibility.blockautorefresh) Preference, that is what Giorgio is throwing into the mix, extending & providing additional capabilities for what was already there.

[Alan Baxter]

(I get free reign in re-re-re-re-editing until someone posts after me .)

In that case I may start quoting your posts in their entirety so you know which version I'm responding to.
Occasionally you're editing while I'm responding.

[Giorgio Maone]

noscript.forbidBGRefresh.exceptions preference
Does that work?

No, it's not working. It's a bug and it's getting fixed, thanks.

[therube]

(& to both of you, I was revising my prior post while alan was posting, but after he had revised his prior post)

[Giorgio Maone]

Actually you can already work around by using noscript.forbidGBRefresh.exceptions instead (notice the inverted "B" and "G").

[therube]

Heh .

"GB", yes that works.


But ... thinking that whitelisting may still be a hassle, might not be a desired approach?

[Alan Baxter]

But ...

What about poor SeaMonkey?

[Giorgio Maone]

But ... thinking that whitelisting may still be a hassle, might not be a desired approach?

I'm actually planning an easier way:

1. Replacing the built-in Firefox notification with one provided by NoScript like the "Forbid META inside NOSCRIPT" one (so Seamonkey 2.x users get the notification as well)
2. Having two buttons in the notification, "Follow" and "Always Follow", the latter of which adds the 2nd level domain to the exceptions pattern.

[Giorgio Maone]

Second thought...
Would this work (and be much simpler) if, rather than blocking with notification, NoScript actually deferred the refresh until the tab gets selected again?

[therube]

Caught me again ... between edits.

Yes, "GB" works in SeaMonkey.

I'll have to think about the whitelisting.

I generally Allow no sites.
I generally always open links in background tabs.
I do want pages to automatically refresh - where I want them to or expect them to, like after making a post here or on other boards.
I do not want pages to automatically refresh on sites where I do not want them to - like bankofamerica.com.

Code: Select all

Post review
At least one new post has been made to this topic. You may wish to review your post in light of this.

Heh.

[therube]

NoScript actually deferred the refresh until the tab gets selected again

But then wouldn't that allow the refresh even on pages where you do not want it too?