Administrator Notes in AdminCP tweak request

[Snowhog]

No additional errors thrown after clicking the Go to Bottom button. This is the error thrown when clicking the Save button.

[glennrocksvb]

And you don't see those errors on Firefox Ubuntu? Can you try Chrome on Mac?

[Snowhog]

I have Firefox (v95.0.2 (64-bit)) on my iMac and I logged in to the AdminCP and launched the Browser Console. This is what it displayed:



Clicking on the Save or Go to Bottom button didn't add anything else to the Browser Console. The Go to Bottom button continued to work.

[Snowhog]

These are from Chrome on my iMac. First is taken right after logging in to AdminCP. Second is after I clicked the Go to Bottom button first (no additional errors thrown) and then the Save button, which generated a new error.




But the Go to Bottom button remained active and continued to function.

[glennrocksvb]

It looks like Safari is blocking the javascript in the Go to Bottom button after clicking Save button because of the XSS Auditor being enabled. It is expecting that the server returns "X-XSS-Protection" HTTP Header in the response for saving the notes in order to disable XSS Auditor from filtering scripts. Only Safari is doing this. Other browsers such as Chrome, Firefox and Edge are not or has stopped doing this. It is no longer recommended but Safari is still doing it. Please see warning about "X-XSS-Protection" being unnecessary at https://developer.mozilla.org/en-US/...XSS-Protection.

In order to satisfy Safari, you'd have to disable XSS Auditor (for that Save Notes HTTP response only) by adding this code to the same PHP file you edited earlier.

1. Find this line:
   

   if ($_POST['do'] == 'notes')  

2. Inside that code block enclosed by curly braces { and }, find this line:
   

   $_REQUEST['do'] = 'home';  

3. Below that line, add this code
   

   header("X-XSS-Protection: 0;"); // disable XSS Auditor which Safari needs  

4. Save the file.

[Snowhog]

Thank you.

[glennrocksvb]

Did it work?

[Snowhog]

Sorry. I haven’t tried yet. I’ll let you know likely tomorrow.

[Snowhog]

Added the extra line and tested. Yes, both buttons work. Haven't opened the JavaScript Console to see what gets reported; I'll do that later. Heading off to bed now.

Thank you once again!

[glennrocksvb]

Thanks for confirming it works.

[Snowhog]

For your information. On my iMac using Safari.



The first two IndexSizeError entries are present when I launch the JavaScript Console immediately after logging in to the AdminCP. The third IndexSizeError entry appears when I click the Save Button. No errors are added just clicking on the Go to Bottom button.

[glennrocksvb]

Sussed it out. Here is the output when clicking on the Save button.

That "XSS Auditor refused to execute a script" error in the screenshot is gone. That's what was breaking the Go to Bottom button. It refused to execute the Go to Bottom script.