474735 - Megavideo forces bypass to user confirmation on redirects

Status: RESOLVED WORKSFORME

(Firefox :: Security, defect)

Description

[Michael]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5

When clicking on the red play button on megavideo a new tab is opened and Firefox tells you that it has blocked ...the 'allow' button shows to allow redirect but the window does not pause for user decision after about 1-2 seconds it assumes user allow permission and goes to ad site. 

100% reproducible
 

Reproducible: Always

Steps to Reproduce:
1.go to megavideo.com or though front site. 
2.click on play after choosing a movie
3.it will happen
Actual Results:  
opens an ad site

Expected Results:  
without clicking the allow button it should not be able to open the unwanted site.  

how are they getting past user input required blocks? How deep is the problem?

Comment 1

[Ria Klaassen (not reading all bugmail)]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6pre) Gecko/2009011406 GranParadiso/3.0.6pre

This works fine for me. Maybe malware/adware on your system?

Comment 2

[Michael]

It may depend on if the add contains a redirect or not. 

Works properly on youku - it pauses and waits for you to hit the 'allow' button - not on megavideo 

Click on red button - new window opens - allow option button appears in top right - after short time redirect happens even though you have not hit the 'allow' button. 

tools-options-advanced - warn me when websites try to redirect or reload a page-> must be on. 

Tried on 2 systems - 2 different builds of XP same build of Firefox. other system does not even show allow button just load page. This system pauses on allow then assumes user confirmation. 

It may depends on which ad you get but there is still code that bypasses user option/permissions

Comment 3

[Michael]

It may depend on if the add contains a redirect or not. 

Works properly on youku - it pauses and waits for you to hit the 'allow' button - not on megavideo 

Click on red button - new window opens - allow option button appears in top right - after short time redirect happens even though you have not hit the 'allow' button. 

tools-options-advanced - warn me when websites try to redirect or reload a page-> must be on. 

Tried on 2 systems - 2 different builds of XP same build of Firefox. other system does not even show allow button just load page. This system pauses on allow then assumes user confirmation. 

It may depends on which ad you get but there is still code that bypasses user option/permissions

Comment 4

[Mel]

Still doing it.  No fix yet. :(  I don't understand how Megavideo gets around all of my security and script blockers.  I even have them black listed in cookies, java script, Better Privacy and NoScript, Refresh blocker, & Rediret remover.  What more can I do? Jeez!

_________________________________
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.3) Gecko/20100401 BetterPrivacy-1.47 Firefox 3.6.3 - Build ID: 20100401080539

Comment 5

[mirh]

I guess like this could be closed =)