143934 - compassweb.com - Faulty server-side browser-sniffing makes logging in to bank impossible.

Status: RESOLVED FIXED

(Tech Evangelism Graveyard :: English US, defect)

Description

[dylan]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.9) Gecko/20020501
BuildID:    0.9.9 Ximian

Secure website for banking. Does not submit authentication form (both under
Linux and Windows).

Reproducible: Always
Steps to Reproduce:
1.enter a username
2.enter a password
3.click 'Sign On'
Nothing happens

Actual Results:  Nothing--Does not submit form

Expected Results:  Submit username/password info

Comment 1

[Andrew Schultz]

the page assumes the existence of layers, so I don't know if it would even work
in IE, unless the page is the result of some browser-sniffing redirection.

==> Evang

Comment 2

[Stephen Walker]

*** Bug 171463 has been marked as a duplicate of this bug. ***

Comment 3

[Sander]

*** Bug 176097 has been marked as a duplicate of this bug. ***

Comment 4

[Sander]

Definitely a case of faulty server-side browser-sniffing. What's worse, the IE
code utilizes document.getElementById so would work in Mozilla. Contact
information can be found here: http://www.compassweb.com/contact/ (I have no
experience with Evangelism, and fear I would do more harm then good, so I hope
someone else will contact them.)

As a workaround for the people using this bank, go to xulplanet.com and download
the prefbar, then (please only on this particular website) change your useragent
to IE - you should be able to get in without problems.

Comment 5

[Bob Clary [:bc] (inactive)]

during page load

Error: setting a property that has only a getter
Source File: https://www1.compassweb.com/secure/site.fsp?Module=SignOn
Line: 10

on submit

Error: document.layers has no properties
Source File: https://www1.compassweb.com/secure/site.fsp?Module=SignOn
Line: 60

Comment 6

[Nick Bebout]

SPAM: New Components

Comment 7

[Mats Palmgren (inactive)]

*** Bug 209567 has been marked as a duplicate of this bug. ***

Comment 8

[Mats Palmgren (inactive)]

*** Bug 218504 has been marked as a duplicate of this bug. ***

Comment 9

[Carl Parrish]

I looks like they have fixed this now. 

Comment 10

[chris hofmann]

one of the best references/recommendations I've found for encouraging financial institutions to support firefox is located at bankers on-line web site 

http://www.bankersonline.com/security/security_browserthreat070204.html 

It was written in 2004 during the download.ject attack, but much of it still applies today.  This is a good link to send when contacting banks.

Comment 11

[Andrew Schultz]

looks to be fixed