Skip to content
This repository

Updates from userscripts.org do not apply with require secure updates on #1555

Closed
arantius opened this Issue May 20, 2012 · 8 comments

3 participants

arantius ConanLoxley nascentt
arantius
Collaborator

https://groups.google.com/forum/#!msg/greasemonkey-users/_8NsgV8gZeI/6k6Ry_AdvvUJ

New profile; install GM; install script; edit script on us.o; clear FF cache; restart FF.
Find Updates = nothing happens.
Turn off GM Secure Updates; Find Updates = update downloads and installs fine.

ConanLoxley

This issue is caused by the resolution to this issue: arantius@7cefe18

This requires that the updateURL uses https when the CDN doesn't support it. The workaround I needed for my script was to use the bit.ly service. My scripts @updateURL points to https://bit.ly/PPzl0Y so it satisfies your check but is in no way more secure than just putting in the direct link to the CDN.

arantius
Collaborator

Thanks for the diagnosis!

arantius
Collaborator

You'll notice that while 7cefe18 (Feb 16) does exist as you pointed out, f796428 (Feb 17) reverted it and then 94c976c was added.

arantius
Collaborator

To test for sure, I just:

  1. Blanked out a completely fresh Firefox profile.
  2. Installed Greasemonkey 0.9.20
  3. Created https://gist.github.com/3227121 with @version 1 and installed it by visiting https://gist.github.com/raw/3227121/update-test.user.js .
  4. Each page load now sends Update test version 1! to the console.
  5. Edited the gist to be @version 2 and dump a 2 in its message.
  6. Opened the Add-ons Manager and saw "Update Test 1" listed. Clicked the tools drop-down button at the top and did check for updates. In just a moment, the AOM now said "Update Test 2" was installed, and the next page load sent Update test version 2! to the console.

One critical difference is, of course, by using Gist as the host, I didn't hit the us.o/coral cache logic. I'll test that soon. (Right now, us.o is not loading for me.)

arantius
Collaborator

I've now repeated with:

  1. Blanked out a completely fresh Firefox profile.
  2. Installed Greasemonkey 0.9.20
  3. Created http://userscripts.org/scripts/show/139833 with @version 1 and installed it by visiting https://userscripts.org/scripts/source/139833.user.js (Note the scheme! This is not yet the default!).
  4. Each page load now sends Update test version 1! to the console.
  5. Edited the script to be @version 2 and dump a 2 in its message.
  6. Opened the Add-ons Manager and saw "Update Test 1" listed. Clicked the tools drop-down button at the top and did check for updates.

Got "no updates found". Problem reproduced.

arantius
Collaborator

When I restarted to diagnose, the next manual check told me it was fetching http://userscripts.org.nyud.net/scripts/source/139833.meta.js (correct) and offered the update. The display never showed the download finish, but when I switched to the user scripts tab, version 2 was installed and working.

arantius arantius closed this in be7f924 August 17, 2012
nascentt

Hi, I have a couple of quick questions. I'm a bit confused by this. Does this mean by default updates wont work unless a secure update option is ticked? So for most users the scripts wont update themselves or will?

The other question is in relation to the earlier proposed way to request greasemonkey addon metadata so that scripts could work out the version installed, and if less than 1.0 to do our own manual update checks. Is this possible in any way, or was the idea scrapped?

Edit: My apologies for putting this in the wrong place, thanks for the answer.

arantius
Collaborator

Questions really belong on the mailing list ( https://groups.google.com/forum/#!msg/greasemonkey-users/ ). But this means that update will work where they did not before. And GM_info ( http://wiki.greasespot.net/GM_info ) has exposed GM version since before GM did updates.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Something went wrong with that request. Please try again.