5 ms·

Iirc that's a safety feature to tech unsavy users from executing copy pasted code in the url bar. You'll need to manually type javascript: at the beginning. S

by j-bos 4y ago

Iirc that's a safety feature to tech unsavy users from executing copy pasted code in the url bar. You'll need to manually type javascript: at the beginning. Same applies to chrome.

Reason077 4y ago
I couldn't get it to work (with random web pages) in Safari. Trying to paste it to the URL bar gives the error: "Safari doesn’t allow JavaScript from the Smart Search Field. To allow this, choose “Allow JavaScript from Smart Search Field” from the Develop menu." But even after enabling that option, it still doesn't work. Javascript console shows the errors: [Error] Refused to load http://kathack.com/js/kh.js because it does not appear in the script-src directive of the Content Security Policy. [Error] Refused to load http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js because it does not appear in the script-src directive of the Content Security Policy.
- j-bos 4y ago
  Hmm, I ran into the same issue (without the notification) on chrome and firefox for android..
  - j-bos 4y ago
    Seems the issue is the request being fired off to get the actual script (xss concerns?), my guess is that it would work by copying the requested script into the js url string, rather than requestimg it.
- aendruk 4y ago
  Content Security Policy is a way for websites to ask the browser to disable certain functionality that the website expects to not need. That website evidently has asked the browser to not run arbitrary third-party (or non-https?) scripts. Ideally your browser would recognize that you, the human operator, have authority to override the requests of strangers on your own computer. Sadly, the days of your user agent actually acting on your behalf are waning.
- zaidhaan 4y ago
  To get it to work, I just copied the contents of both the scripts using the command below and ran it in the developer console. wget -q -O - http://kathack.com/js/kh.js http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js | xclip -sel c

by j-bos 4y ago

Iirc that's a safety feature to tech unsavy users from executing copy pasted code in the url bar. You'll need to manually type javascript: at the beginning. Same applies to chrome.

Reason077 4y ago

I couldn't get it to work (with random web pages) in Safari. Trying to paste it to the URL bar gives the error: "Safari doesn’t allow JavaScript from the Smart Search Field. To allow this, choose “Allow JavaScript from Smart Search Field” from the Develop menu." But even after enabling that option, it still doesn't work. Javascript console shows the errors: [Error] Refused to load http://kathack.com/js/kh.js because it does not appear in the script-src directive of the Content Security Policy. [Error] Refused to load http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js because it does not appear in the script-src directive of the Content Security Policy.

j-bos 4y ago
Hmm, I ran into the same issue (without the notification) on chrome and firefox for android..
- j-bos 4y ago
  Seems the issue is the request being fired off to get the actual script (xss concerns?), my guess is that it would work by copying the requested script into the js url string, rather than requestimg it.
aendruk 4y ago
Content Security Policy is a way for websites to ask the browser to disable certain functionality that the website expects to not need. That website evidently has asked the browser to not run arbitrary third-party (or non-https?) scripts. Ideally your browser would recognize that you, the human operator, have authority to override the requests of strangers on your own computer. Sadly, the days of your user agent actually acting on your behalf are waning.
zaidhaan 4y ago
To get it to work, I just copied the contents of both the scripts using the command below and ran it in the developer console. wget -q -O - http://kathack.com/js/kh.js http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js | xclip -sel c