Is it NoScript or this site?

[dgermann]

Hi--

This site keeps giving me an error and the webmaster claims I am the only one who has complained, and he suspects it is NoScript. I think it is possibly the site, but don't know, since I have never had a problem with NoScript. It is a church weekly prayer list:

http://www.stpetermishawaka.org/prayers.html

Thanks for letting me know if it is an issue that you can help me narrow down!

:- Doug.

[Tom T.]

This site keeps giving me an error

*What* error? Copy/paste here, please?

I don't get any warnings (XSS, ClearClick, etc.) even after temp-allowing all.

The "current prayers" list is a Flash object that requires NoScript permission to run, because Flash can be, and has been, used for evil. (no pun intended).
Open the menu, point to "Blocked Objects", and click to allow it. This gives you the chance to see what it really is before allowing.

If you like, you can use NoScript's ABE feature to do that automatically for you.
See Site-Specific-Permission Questions? PLEASE READ THIS FIRST! and the info linked from there.

Nothing in the Error Console was of any significance at all.

[dgermann]

Tom--

Thanks for responding to me so quickly.

I get something from the website that says "Error #2048," and I cannot see the prayers list--just a big grey box. I don't see a way I can post a screen shot here or I would.

Menu? Nothing says "Blocked Objects." I click on the blue S in the circle, and have a list of things to forbid, then recently blocked sites, then allow scripts globally, then options, then About NoScript 2.3.4.

Under options, nothing about Blocked Objects. This site is in the whitelist. Blocked Objects is checked in Appearance, Notifications has ABE checked. Don't see anything else that looks like it relates.

I had read that post before posting, and now have read the linked FAQs, but don't see that they apply. I am not a computer guru, so perhaps I don't understand what I am reading.

Not sure where the error console might be found.

Thanks!

I am still lost!

:- Doug.

[Tom T.]

I get something from the website that says "Error #2048," and I cannot see the prayers list--just a big grey box. I don't see a way I can post a screen shot here or I would.

Best way is to use one of the many third-party image-hosting sites, who usually supply you with a link that you copy/paste here, and the image shows.
Like this one:

Menu? Nothing says "Blocked Objects." I click on the blue S in the circle, and have a list of things to forbid, then recently blocked sites, then allow scripts globally, then options, then About NoScript 2.3.4. Under options, nothing about Blocked Objects.

First, do you use the RequestPolicy add-on? If so, you need to allow (or temp-alllow) requests to
scribid.com and scribidassets.com

In NoScript Menu (the blue circle), I allow (temporarily, in my case)

stpetermishawaka.org
scribd.com

This is enough to make the blue NoScript circle become partly red, indicating that some executable content is being blocked, and for the Blocked Objects menu item to appear. Also, a placeholder (NoScript logo in *red*) appears, in the area where the prayers should be. Hovering the mouse pointer over the block-logo, or pointing to Blocked Objects in the NS Menu, reveals the source of the object. Clicking any of those (the top one is the most specific to that object, so that's best) ....

produced the same error you got.

I didn't get the error the first time, because I Temp-Allowed all in ReqPolicy, so as to focus on NoScript issues.

This time, I didn't. A RequestPolicy red flag appeared in the prayer area. Hovering the mouse pointer gave a tooltip, weebly.com. So I TA'd that.

Now the .pdf file becomes downloadable or openable.

To make it appear spontaneously, I TA'd editmysite.com, scribid.com, and scribidassets.com in RP and NS.

*Only now*, in the RP menu appears amazonaws.com. TA-ing that produces the proper load of the prayer list.

Easiest would be to allow all in RP, since NoScript will run Surrogate Script for the data-mining scripts, google-analytics.com and quantserve.com.

The amazon script doesn't show in the NS menu.

Yes, I think this site is coded horrendously. Unfortunately, so are a lot of other sites these days, and the trend is to get worse, not better.
I assume the webmaster, or whoever was hired by the Church, did all this "cascading" garbage. NoScript was the detector and protector, so yes, the site is poor -- don't shoot the messenger.

Not sure where the error console might be found.

Fastest is Ctrl+Shift+J, although the actual path in Fx 11 is Firefox Tools > Web Developer > Error Console.

[rant] In Fx 2.x and 3.x, it was just Tools > Error Console. Please don't ask me to explain why they hid it in Fx 4+, since it isn't just for developers. It's for users to troubleshoot their own problems, *or help us support people troubleshoot them for you*. One reason among many that I'm still on Fx 3.6.x as my default browser.[/rant]

If you can do all that and make it work, I can give you a way to use NoScript's ABE feature to auto-allow that blocked object at that site, and nowhere else.
No guru-ism required, just copy/paste.

ETA: On the general topic of multiple-reload site design, you might find this sticky post to be of interest.

[dgermann]

Tom--

Thanks for detailing a tutorial for me!

No, I do not have RequestPolicy. Ought I get it? Sounds like it would just add another layer to troubleshoot for this problem. Unless it opens some doors we cannot easily open otherwise....

Thanks for showing me where error console is: I just went to this website and got the error #2048 again, and there are no errors in there from the time I went to the site, so that is no help.

Since you got the same error message, then I do not have to find a site for posting the image? If I do need to post an image, what site(s) do you recommend?

I have the church site set to permanently allow all, so I cannot reproduce your sequence. Is there a way to go back to the way it was, that is, just plain neutral? Does "forbid" do that? I think going back might allow me to download.

Yes, your ABE trick might be useful, Tom, thanks!

The Webmaster here is a volunteer member of the congregation who is at this time seeking help from their webhost. I'd guess they will say the problem is on my end and not work to solve it!

:- Doug.

[therube]

(I'm not seeing any issues.)


Appears the 2048 is a (server?) configuration/security issue.

Start FF in Safe Mode.
If the page still does not work, then that rules out NoScript (& every other extension).
At that point, you can look into disabling plugins (except for Flash) & see if anything there helps.

If it does work, then disable all extensions except for NoScript & see if it still works.

What version of Flash are you running?


(A screenshot certainly would help. TinyPic.)

[Tom T.]

(I'm not seeing any issues.)

Did you reproduce exactly my sequence, including in RequestPolicy?

(A screenshot certainly would help. TinyPic.)

No need. I saw it. It's just a small box that says Error 2048 and something about server security issue.

I think I can fix this for OP. Thanks for the 2048 link and the assistance.

No, I do not have RequestPolicy. Ought I get it? Sounds like it would just add another layer to troubleshoot for this problem. Unless it opens some doors we cannot easily open otherwise....

It actually closes more doors, as a privacy issue, with some overlap into security. The developers of both add-ons, NS and RP, agree that each complements the other. But it will add another layer of blocking, and therefore, of some unblocking, which at times is trial-and-error at a new site. Soon, one learns which third parties are often necessary and which are just ads and data-miners. So you may want to hold off until you're comfortable with NoScript, then give it a try.

Thanks for showing me where error console is: I just went to this website and got the error #2048 again, and there are no errors in there from the time I went to the site, so that is no help.

Yes, same as I did before -- nothing in Fx Error Console, but eventually, the warning box on the site itself.
Useful to know the location of the EC though, in case you should have future issues.

Since you got the same error message, then I do not have to find a site for posting the image?

Nope. (Your statement is correct.)

If I do need to post an image, what site(s) do you recommend?

There are a lot out there, and I haven't sorted through very many. Someone recommend imageshack to me, and it seemed satisfactory and reasonably user-friendly. Note therube gave a link to another site, tinypic. So see which of the many suits you best -- I'm not recommending or endorsing, just "this has worked for me".

I have the church site set to permanently allow all, so I cannot reproduce your sequence. Is there a way to go back to the way it was, that is, just plain neutral? Does "forbid" do that?

Yes, and that's a good thing to do. I just did, so that we're "on the same page" (horrible pun, sorry. )

I also went there with RequestPolicy set to "temporarily allow all requests", which is pretty much the same as disabling it. You don't have it, so now we're the same.

Open the NS menu and click Allow (thus adding to the whitelist)

Code: Select all

stpetermishawaka.org
http://cdn1.editmysite.com
scribd.com
scribidassets.com

I recommend marking as Untrusted google-analytics.com and quantserve.com, data-miners for which NoScript will run a "dummy" Surrogate Script to keep the page happy. So they should never be needed anywhere.

At this point, the Blocked Object menu appears. Also, the Flash placeholder appears. Enabling by either method -- clicking the placeholder or in the Blocked Objects sub-menu -- caused the list to load perfectly.

Does this now work for you?

Yes, your ABE trick might be useful, Tom, thanks!

Not just for the Flash object, but also for the third-party sites, editmysite and scribid.com. You may not want them running everywhere.
So I would tell ABE to allow them there, but nowhere else. If you find some other site that requires one or the other, you'll get an ABE warning message that it blocked them. It's easy to edit the ABE rule.

Simplest first: the Flash object.

Open NS Menu > Options > Advanced > ABE, and ensure that "Enable ABE" is checked.
In the left-hand pane, click USER.
In the right-hand pane, you'll see "# User-defined rules. Feel free to experiment here."
In the following code snippet, click Select All, then Copy. Paste it into the ABE box, right under the default entry.

Code: Select all

# St. Peter Church rule (or any comment of your own choosing; the # tells NS it's only a comment, not actual code) 
Site *@http://*.scribdassets.com
Accept from .stpetermishawaka.org
Deny

Click "Refresh", to activate the syntax checker. If nothing turns red, we're good. Click "OK".

I just tested that on Firefox 11.0, and all works as desired, Please confirm.

If we're good, then we add restrictions for the other sites. You can edit ABE like any other text document, or just overwrite the rule we just made with this one:

Code: Select all

# St. Peter Church rule 
Site *@http://*.scribdassets.com .scribidasstets.com .scribid.com .editmysite.com
Accept from .stpetermishawaka.org
Deny 

This restricts the scribid and editmysite to this site only. I haven't run into those particular scripts elsewhere, but if you do, and they seem necessary, let me know -- or perhaps this running start will help you to do it on your own? (Don't forget to click OK after the editing.)

The Webmaster here is a volunteer member of the congregation who is at this time seeking help from their webhost. I'd guess they will say the problem is on my end and not work to solve it!

Typically, yes -- even from large corporations.

It keeps us busy.

ETA: Inadvertently left scribidassets.com out of the sites you should Allow in NS Menu, or add manually to Whitelist. (NS Options > Whitelist.)
Edited the code block way above to reflect this.

And you should do the ABE rule when you're not on that site. Or whitelist the scripts, navigate away from that page or close/restart the browser, add the ABE rules, and navigate back. (not using back arrow, but typing anew in address bar, or using your bookmark, if applicable.) We want it to load freshly and subject itself to our new ABE rule.

[dgermann]

therube and Tom--

Thanks for all your wonderful help.

I will work my way through your advice and report back. Work right now is taking priority, so please don't take my lack of response as being unappreciative and not following your advice!

[dgermann]

Hi--

I used therube's approach and disabled all add-ons. It worked. Then I added them back one by one. The culprit: https-Everywhere.

So I probably need to find their forums or Website and ask there. What do you folks think this points to?

Thanks!

:- Doug.

[Tom T.]

Hi--

I used therube's approach and disabled all add-ons. It worked. Then I added them back one by one. The culprit: https-Everywhere.

So I probably need to find their forums or Website and ask there. What do you folks think this points to?.

That some sites won't accept an https connection; hence, a security warning when you try to force it.

NoScript can duplicate the functions of that add-on -- see HTTPS FAQ. The good thing is, it doesn't try to do it *everywhere*. It does it where you tell it to.
So you can remove from the "Force HTTPS" list any sites that cause problems.