Problem with Opera 12 running script from localhost

Problem with Opera 12 running script from localhost

Hi,

This is my first posting so apologies upfront if I post in the wrong place.

OK Im using :- Version 12.00 Build 1467 Platform Win32 System Windows XP

Prior to Vers 12 In order to load local scripts into pages on external websites I could add 127.0.0.1 to my secure internal host list and then use this javascript

function c() { var a=document; if(window.frames.length>0) a=window.main.document; var b=a.createElement('script'); b.type='text/javascript'; b.src='http://127.0.0.1/insanefarm.php?WorldID=' + window.game_data.world + '&MyUser=' + window.game_data.player.name + '&FarmingVillageID='+ window.game_data.village.id + '&FieldRange=30&MinBarb=0&MaxBarb=1999'; a.getElementsByTagName('head')[0].appendChild(b); } c();

To call a webpage which delivered javascript from a locally hosted webserver on 127.0.0.1

If i host the website on an external server it runs fine So Im guessing it may be an issue with the secure internal host list (Although 127.0.0.1 i still present in it) has Anyone have any ideas ?

A look at the developer console just shows 'Linked script not loaded'

Ive searched around but most queries on the error seem to be prior to vers 12

Thanks for any help you can give

How long do folk think I should wait before I raise this as a bug ?

Try it in a standalone installation to a folder on your desktop. If it doesn't work there, then it's probably a bug that needs to be filed.

If you provide an html file that I can put on my site and a js file that I can put on my local 127.0.0.1 server, I can test to see if I can reproduce.

Hi Thanks for the offer to help

Ive tried using a fresh standalone install as per your guide and still the same

Ive simplified the issue into just 2 files

test.php which contains
----------------------------------
<a onclick="jsfunction" href="javascript: function c() { var b=document.createElement('script'); b.type='text/javascript'; b.src='http://127.0.0.1/script.php'; document.getElementsByTagName('head')[0].appendChild(b); } c();void(0);">click me</a>
-----------------------------------

and script.php which contains
-----------------------------------
<?php
print "alert('Hello');";
exit(0);
?>
-----------------------------------


Prior to Opera 12 so long as 127.0.0.1 was in secure internal hosts it works fine
Post Opera 12 no joy

I confirmed that it didn't work by default. But, I added "127.0.0.1" to secure internal hosts and then restarted Opera. Then, I got a "Hello" alert when clicking the link on the page.

I used site.com/test.php and 127.0.0.1/script.js though (didn't feel like setting up php on apache).

Is your script.php sending a mime type of application/javascript like it's supposed to?

script.php:

<?php
    header('Content-Type: application/javascript');
    echo 'alert("Hello");';

Is the 127.0.0.1 on port 80 or a different port? If a different port, does adding 127.0.0.1:port to Opera work or doesn't referencing the port explicitly like this http://127.0.0.1:port/script.php in test.php help?

I also noted that when you add 127.0.0.1 to the secure internal hosts, Opera creates a site preference for 127.0.0.1 under "Ctrl + F12 -> advanced -> content -> manage site preferences". If you add 127.0.0.1 to site preferences first for some reason, maybe that messes with things.

Yes it does work as a .js but wont as a .php sadly the javascript I need to issue depends on parameters its called with so a .js isnt possible

It did work prior to v 12 though

I tried adding the header info but no change

What about the mime type issue I mentioned? Is script.php sending the js as application/javascript? I not, maybe Opera is more strict.

I edited my post above just before you posted, yes I added the header but not joy Im afraid
also normal port 80 and never touched site option just added to secure host list

Confirmed with script.php. No tricks work for me either.

Please file a report.

See <http://my.opera.com/securitygroup/blog/2012/07/03/operas-cross-network-protection> and the comments.

Ah Ok thanks for that

So will it be fixed then ? (Apologies I did read the post but cant figure out if it will be fixed or not)

I checked the allow network cross thing and it was ticked

Originally posted by lonestar1uk:

So will it be fixed then ?

I think so.

Great thanks

I wasnt sure what they meant by regression

as in was it regressed on purpose or was there an accidental regression of code

I looked for the core number they quoted but couldnt find anything

The 12.01 candidate does not include a fix for this. :-(

Paul

Nor the 12.01 final.

Paul

CORE-47183 AllowCrossnetworkNavigation doesn't work for scripts via /etc/hosts
Fixed in Opera 12.10 build 1613 Beta RC. Opera 12.10 should go stable in about a month from now.

what if you call the script via localhost and not the IP, does it work now?

I have some webservers running all the time (one at a time of course)
and I never had a problem like yours with opera so far (currently on 12.02)
only difference is, that I call them most likely by localhost or some fictive name (I added to my hosts file) not by the IP
But I can (just tested) with a file close to your's...
only difference is that I echo a complete html page including a fread javascript;
but that should be too much of a difference I guess