Why is Adobe Flash Player starting on these forums now?

Discussion in 'Forum Related Discussions' started by Krusty, Mar 4, 2015.

Page 2 of 3
  1. wshrugged

    wshrugged Registered Member

    Joined:
    Jun 12, 2009
    Posts:
    266
    Same thing with FF 36 for me.

    Saw a difference at line 2 of 'view page source', don't know its full meaningo_O

    With flash allowed ---
    class="Public NoJs LoggedIn NoSidebar Responsive"

    Without ---
    class="Public NoJs LoggedIn NoSidebar RunDeferred Responsive"
     
    wshrugged, Mar 4, 2015
    #26
  2. SweX

    SweX Registered Member

    Joined:
    Apr 21, 2007
    Posts:
    6,429
    Same here Flash ask me to activate it in Firefox latest version. I have Flash set to ask as well.

    For me it seems to only happen in threads. Not if I click the Wilders header that goes to the forum main page wilderssecurity.com. And Not when I open forum sections like "general", "other antivirus", "update alerts" etc etc. It only happen when I open a thread, or navigate from page 1 to page 2,3,4,5 in a thread.
     
    Last edited: Mar 4, 2015
    SweX, Mar 4, 2015
    #27
  3. SweX

    SweX Registered Member

    Joined:
    Apr 21, 2007
    Posts:
    6,429
    It only happens when I am logged in.

    When I browse the forum as a "guest"/not logged in, I can open threads, and navigate from page to page in threads and not a beep from Flash that ask me to activate it.
     
    SweX, Mar 4, 2015
    #28
  4. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,239
    Location:
    Among the gum trees
    Yep! Same here.
     
    Last edited: Mar 4, 2015
    Krusty, Mar 4, 2015
    #29
  5. noone_particular

    noone_particular Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    3,798
    I'm seeing it with both SeaMonkey and Palemoon. The FlashBlock icon that normally appears at the location of the flash content appears at the lower left corner of the individual threads. There's no visible difference in the page when I click on FlashBlocks "play" icon. SeaMonkeys "page info" doesn't show the existence of any flash content. No idea how long this has been there.
     
    noone_particular, Mar 4, 2015
    #30
  6. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,278
    Location:
    New England
    Could you screen image that for us? This is the first we've heard of it happening in anything other than Firefox, (unless I missed someone posting that), and, the exact position and display of the placeholder, might be informative, as well.
     
    LowWaterMark, Mar 4, 2015
    #31
  7. noone_particular

    noone_particular Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    3,798
    Taken from SeaMonkey. Looks exactly the same on PaleMoon.
    forum flash.png
     
    noone_particular, Mar 4, 2015
    #32
  8. act8192

    act8192 Registered Member

    Joined:
    Nov 9, 2006
    Posts:
    1,789
    SeaMonkey here. v2.32.1. I don't see any Flash. If there was one, it would ask to activate.
    No such right-arrow for play(?) under Fluid either.
    I took a peek at the Page source while looking at this thread and see nothing about Adobe nor Flash. Is there some other magic phrase to look for?

    I also looked into Outpost logs - no evidence of plugin container running, which is what normally would show when Flash runs on, for instance, you tube.

    Edit- now in Opera 12.17 also nothing of Flash nature.

    Outpost, while in SeaMonkey, blocked some animated facebook.gif. Unlikely Flash.
     
    Last edited: Mar 4, 2015
    act8192, Mar 4, 2015
    #33
  9. chachazz

    chachazz Updates Team

    Joined:
    Apr 23, 2004
    Posts:
    841
    I've got it too in Aurora 38 (DeveloperEd) with Wilders whitelisted in NoScript.
    In Safe Mode also (all extensions and custom settings disabled; all plugins "Ask to activate"

    Edit: Not on the main board page, but when opening topics; also happens with Beta and Release builds.
     
    Last edited: Mar 4, 2015
    chachazz, Mar 4, 2015
    #34
  10. noone_particular

    noone_particular Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    3,798
    This is a bit baffling. On this thread with both SeaMonkey and PaleMoon, Proxomitron is displaying a notification about a flash object. On other pages with "normal" flash objects, the object is replaced with a toggle button. Here, there is no visible object to toggle.
     
    noone_particular, Mar 4, 2015
    #35
  11. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,146
    Location:
    Nicaragua
    I just discovered. In NoScript Options>Embeddings, if you tick "Apply these restrictions to whitelisted sites too"... plugin container doesn't run at Wilders or messages.

    Bo
     
    bo elam, Mar 4, 2015
    #36
  12. SpousalMilk

    SpousalMilk Registered Member

    Joined:
    Jun 24, 2012
    Posts:
    48
    Location:
    USA
    SpousalMilk, Mar 5, 2015
    #37
  13. wolfrun

    wolfrun Registered Member

    Joined:
    Jul 26, 2009
    Posts:
    702
    Location:
    North America
    In Palemoon now and just testing see what happens.
    Perfect. No flash activating windows showing.:thumb:
     
    wolfrun, Mar 5, 2015
    #38
  14. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,239
    Location:
    Among the gum trees
    Krusty, Mar 5, 2015
    #39
  15. Rmus

    Rmus Exploit Analyst

    Joined:
    Mar 16, 2005
    Posts:
    4,020
    Location:
    California
    Rmus, Mar 5, 2015
    #40
  16. SpousalMilk

    SpousalMilk Registered Member

    Joined:
    Jun 24, 2012
    Posts:
    48
    Location:
    USA
    There's this reference in the attachment_editor.js
    Code:
    "js/swfupload/Flash/swfupload.swf"
     
    SpousalMilk, Mar 5, 2015
    #41
  17. SpousalMilk

    SpousalMilk Registered Member

    Joined:
    Jun 24, 2012
    Posts:
    48
    Location:
    USA
    I'm no javascript expert but I think the attachment.js is being parsed when you're logged in to show that stuff at the bottom of a thread (the quick post area). This is why Firefox thinks adobe flash is being requested. That attachment_editor.js has a url or something to "js/swfupload/Flash/swfupload.swf."

    Googling around I think the SWFupload is used for file attachments on posts. If you attach a large file I'm guessing the swfuploader is supposed to animate the upload progress bar.

    edit: some info about swfupload...
    from an article on threatpost in 2013: https://webcache.googleusercontent....oofing-031213/77617 &cd=6&hl=en&ct=clnk&gl=us
     
    Last edited: Mar 5, 2015
    SpousalMilk, Mar 5, 2015
    #42
  18. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,278
    Location:
    New England
    Our own research has been heading in the same direction while doing testing today. We noticed it was related to the code backing up the "Upload a File" button. So, we ran on a test forum where I disabled the entire attachment system, (no upload function available at all), and the person testing it, (JR, who was able to find the issue 100% of the time in how he was testing), found the alert went away entirely.

    But, there is a problem. That file, while it exists in the code base, is never used on this forum. From the first day that I convert to XenForo, there were a whole bunch of things I disabled because of either... too cutesy (trophies), too "social media" (facebook, twitter, Likes, etc) or a possible security risk (Flash, and other media items). The "Flash Uploader" has always been disabled here. There's a global setting that disables it, and instead it falls back to a standard - one file at a time - upload dialog box.

    To prove that the file is never called, I physically deleted it from the test server. We re-ran the test and with attachments enabled again, the alert still happened even without the .swf file available.

    Our thoughts are heading this way... The reference to the Flash uploader is in the code because there is logic in there that allows for either the standard or the flash uploader method to be used. Some browsers appear to be seeing the vary existence of the "aaaaaa.swf" file reference, and appear to be prefetching Flash in order to be ready to use it, if and when the person actually hits the button to upload a file.

    The tell tale sign that this is correct is... No one here is saying they "hit the upload button" and get the alert. They are simply reading the thread. If the button is never hit, why then would an alert be signal - unless the browser is prefetching it as some kind of performance improvement/browser speed up feature?

    It's maddening because I don't want to hack out all the code from templates and javascript files to satisify an overly aggressive browser feature. It'd be a nightmare to support given how often XenForo release forum upgrades. I'd happily delete the file, if that would fix it, but, as stated, even doing that doesn't matter since the file is never called anyway and the alerts still happen.

    We are still looking for some kind of neat solution. JR is working on it, and doing a great job figuring it all out. But, I'm wondering now if it's worth it.
     
    LowWaterMark, Mar 5, 2015
    #43
  19. act8192

    act8192 Registered Member

    Joined:
    Nov 9, 2006
    Posts:
    1,789
    Is this what you speak of? Opera-Info.jpg
     
    act8192, Mar 5, 2015
    #44
  20. SpousalMilk

    SpousalMilk Registered Member

    Joined:
    Jun 24, 2012
    Posts:
    48
    Location:
    USA
    @act8192 Yep, that's the one I see in Firefox.
     
    SpousalMilk, Mar 5, 2015
    #45
  21. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,239
    Location:
    Among the gum trees
    Hey Admin' Guys / Gals,

    Have you made some changes? I'm hardly seeing the fly-out from HitmaPro.Alert now - almost never! :)

    Sometimes I still see the fly-out but not every time I read a thread like when I first posted about it.
     
    Krusty, Mar 6, 2015
    #46
  22. Flatiron

    Flatiron Registered Member

    Joined:
    Aug 2, 2006
    Posts:
    22
    Location:
    Alabama
    I don't have flash installed & keep getting this in Pale Moon.

    2015-03-12_15h11_02.jpg
     
    Flatiron, Mar 12, 2015
    #47
  23. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    97,817
    Location:
    U.S.A.
    Flatiron, first, there is nothing present in this forum that requires Flash, so there's no need to install Flash to access Wilders. Be aware that video links posted by members could require the use of Flash, however, those links are accessed, via separate tabs or browser windows, outside of this forum.

    As LowWaterMark has stated above, the Flash Uploader (via the Upload a File button) has been disabled since the forum was moved to XenForo software last year, yet, there's something inherent in the Mozilla source code that mere event calls to SWFUpload in the attachment_editor.js, triggers Firefox, Pale Moon, SeaMonkey, etc., to display the Flash Plugin symbol + alerts in these browsers' address bar. It doesn't happen with any other non-Mozilla browser that has been tested so far.

    Short of tweaking JavaScript, we have tried everything we can think of, even installing on the Test Forum a XenForo add-on that uses HTML5 to upload content. Unfortunately, this HTML5 add-on doesn't remove XenForo's core code (which we agree it should not), and for as long as the original attachment_editor.js remains, the calls to SWFUpload will continue to trigger Flash alerts. That's what is happening at the moment.

    Reading future version discussions, perhaps XenForo could switch to an HTML5 content up-loader since that HTML add-on is very popular. We can only hope that in moving to HTML5, Flash JavaScript references in the present XenForo coding are removed, and then, Mozilla users would not see a Flash alert.
     
    JRViejo, Mar 12, 2015
    #48
  24. Compu KTed

    Compu KTed Registered Member

    Joined:
    Dec 18, 2013
    Posts:
    1,412
    Yes , without flash installed you get that popup message . If you select " don't ask again" it should stop.
    This sets the about:config setting (plugins.notifyMissingFlash) to false.
     
    Compu KTed, Mar 13, 2015
    #49
  25. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,239
    Location:
    Among the gum trees
    Sorry to...

    deadhorse.gif

    I just disabled Flash Player and wanted to check if I could still attach images. Obviously I can. :thumb:
     
    Krusty, Dec 22, 2015
    #50
Page 2 of 3
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...