InformAction Forums

Using Firefox 7.0.1, the Yahoo Email page Instant Messenger/Chat function does not load when NoScript is loaded and set to "Allow scripts globally" . This is with all other add-ins disabled. The IM/Chat function loads and functions when NoScript is disabled. The IM module loads with all other add-ins active and NoScript disabled. When I close the New Yahoo email page and log into the OLD Yahoo email, the IM/chat loads and function as it should with NoScript and all other add-in's enabled. I get identical results on two computers, one with XP and one with Win7 Pro. The OS and all add-ons are updated to the current versions.

After reverting to version 2.1.7 I am able to see Online Contacts and Facebook Friends entries when in Yahoo Mail. I was also able to open the messenger window and start a chat session

JohnS wrote:After reverting to version 2.1.7 I am able to see Online Contacts and Facebook Friends entries when in Yahoo Mail. I was also able to open the messenger window and start a chat session

The main difference between 2.1.7 and 2.1.8 is protection against reflected script inclusion. (XSSI).

I'll ask Giorgio to look at this, but in the meantime, could you try opening about:config, enter xss in the Filter bar, and toggle
noscript.xss.checkInclusions to False? (double-click it). If the IM then works under all circumstances, then we've isolated the issue.

Thanks for checking the previous NS version.

Investigating, thanks.

Changing noscript.xss.checkInclusions to False? worked. Thanks.

McScott wrote:Changing noscript.xss.checkInclusions to False? worked. Thanks.

A better (safer) work-around is turning that preference back to true and adding .yimg.com to your noscript.xss.checkInclusions.exceptions about:config preference.

McScott wrote:Changing noscript.xss.checkInclusions to False? worked. Thanks.

Sorry, the question mark was because the request was phrased as a question: " .... could you try opening ... ?"
The ? had nothing to do with the checkInclusions or the value of False. IOW, not "False?"

Sorry if this lack of clarity caused any confusion. But no harm, as it toggles properly on its own.

Giorgio Maone wrote:

McScott wrote:Changing noscript.xss.checkInclusions to False? worked. Thanks.

A better (safer) work-around is turning that preference back to true and adding .yimg.com to your noscript.xss.checkInclusions.exceptions about:config preference.

Sorry Giorgio, we cross-posted.

The toggle to False was merely for diagnostics, to isolate it to the XSSI protection.
Thanks for the fast response. Is this closed now, or will there be permanent fix in next dev build?

Even better, please check latest development build 2.1.9rc2

Giorgio Maone wrote:Even better, please check latest development build 2.1.9rc2

That answered that question!

Thanks! Changing noscript.xss.checkInclusions to False resolves the problem.

Hopefully there is a better solution than disabling some level of protection.

JohnS wrote:Thanks! Changing noscript.xss.checkInclusions to False resolves the problem.

Hopefully there is a better solution than disabling some level of protection.

Please see Giorgio's post above:

Giorgio Maone wrote:Even better, please check latest development build 2.1.9rc2

Sorry it took me too long to create my post so I missed all of the information about the development build.

I installed the development build it it works great. Thanks for the quick response and excellent support!

JohnS wrote:Sorry it took me too long to create my post so I missed all of the information about the development build.

I installed the development build it it works great. Thanks for the quick response and excellent support!

You're very welcome. I'll mark this as Resolved.