[Pkg-mozext-maintainers] Bug#797043: xul-ext-noscript: dumbed down menu with iceweasel 38.2.0esr-1~deb7u1 cannot temporarily allow scripts

[Kalle Olavi Niemitalo]

Package: xul-ext-noscript
Version: 2.6.8.19-1~deb7u1
Severity: normal

Originally with these packages:

ii  iceweasel         31.8.0esr-1~deb7u1  amd64  Web browser based on Firefox
ii  xul-ext-noscript  2.6.8.19-1~deb7u1   all    permissions manager for Icew

I reset the noscript settings, restarted Iceweasel, opened
http://www.debian.org/, and hovered over the noscript button in
the navigation bar.  A menu with the following options popped up:

  Salli tilapäisesti debian.org
  Salli debian.org
  ---------------------------------------
  Epäluotettava                         >
  Viimeksi estetyt sivustot             >
  ---------------------------------------
  Tilapäisesti salli kaikki tällä sivulla
  Salli kaikki tällä sivulla
  Salli scriptit yleisesti (turvaton)
  ---------------------------------------
  Asetukset (O)...
  Tietoja NoScript 2.6.8.19istä...

I then quit Iceweasel, upgraded it to 38.2.0esr-1~deb7u1, started
it again, opened http://www.debian.org/, and hovered over the
noscript button in the navigation bar.  A menu with the following
options popped up:

  Viimeksi estetyt sivustot             >
  ---------------------------------------
  Salli scriptit yleisesti (turvaton)
  ---------------------------------------
  Asetukset (O)...
  Tietoja NoScript 2.6.8.19istä...
  
This menu no longer lets me temporarily add sites to the whitelist.
I suppose I could add the sites permanently via the options dialog box,
but that would be rather inconvenient.

It looks like there is some kind of incompatibility between
iceweasel 38.2.0esr-1~deb7u1, which is being offered as a
security update, and xul-ext-noscript 2.6.8.19-1~deb7u1, which is
still in wheezy.

I then installed xul-ext-noscript 2.6.9.3-1 from jessie.
That had no dependency problems and made the menu work again.

In /usr/share/doc/xul-ext-noscript/changelog.gz, this item looks
relevant, because 31.8.0esr-1~deb7u1 < 35 < 38.2.0esr-1~deb7u1:

> v 2.6.8.42rc1
> =============================================================
> x Fixed script sources enumeration breakage in Firefox 35
>  (Moz Bug 1068508, thanks Octoploid for reporting)

Upstream NoScript does not appear to have a public
version-control repository but someone has collected the released
versions to GitHub.  The differences between 2.6.8.41 and
2.6.8.42rc1 are here:

https://github.com/avian2/noscript/commit/0b09ec993cad215af6a20eeba7d20ffa7df12cec

The relevant part appears to be in xpi/components/noscriptService.js.
I installed xul-ext-noscript 2.6.9.3-1 again, and patched it in
place as follows:

--- /usr/share/xul-ext/noscript/components/noscriptService.js.~2.6.8.19~	2014-03-25 04:45:50.000000000 +0200
+++ /usr/share/xul-ext/noscript/components/noscriptService.js	2015-08-27 11:54:02.402450512 +0300
@@ -5280,7 +5280,7 @@
       
       // Collect document / cached plugin URLs
       let win = document.defaultView;
-      let docURI = docURI = document.documentURI;
+      let docURI = document.documentURI;
       let url = this.getSite(docURI);
       
       if (url) {

then restarted Iceweasel -- and now the menu works again.

Can you push this patch to wheezy?

-- System Information:
Debian Release: 7.8
  APT prefers oldstable
  APT policy: (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=fi_FI.utf8, LC_CTYPE=fi_FI.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages xul-ext-noscript depends on:
ii  iceweasel  38.2.0esr-1~deb7u1

xul-ext-noscript recommends no packages.

xul-ext-noscript suggests no packages.

-- no debconf information