See this thread:

• [/questions/1264400] Is anyone else finding that new (as of couple days ago) Firefox isn't displaying embedded fonts correctly?

• https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11730

A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed.

So far i have removed all protection from my machne, i have also put the site on memory stick, it works on firefox on all machines i have tested, not the machine i design on.

I have changed the name of the html file and still no different. i even went for a system restore, no effect. safe mode, no effect.

The website is www.bethesdachapel.co.uk. the page uses js to load a common .html page onto all the pages, i called header.html called via js.

If it was something other than just firefox havinghte problem i would have thought it was a general problem, it seams to be a problem only on this machine.

I hope i dont need to to a complete reinstall of windows 10.

one thing i didnt do, and have just done was to check the version of firefox, the other machine were running v67 and all worked fine, when i updated one to v68 they had the problem.

So it seems to be a serious bug in the latest version... a bit of a bugger when i cannot preview a web design except when it goes live.

This is a security vulnerability that has been fixed in Firefox 68 and placed behind a pref, so you can override at your own risk as you can read in the report.

All resolved fixed security vulnerabilities:

• https://www.mozilla.org/security/known-vulnerabilities/firefox.html
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/

ok i just cannot find the preferences this setting is at.

sorted, a bit of a pain though, i wonder how many other web designers that use firefox will have this problem..

YEP, it's a known issue for web designers. I started a thread over on the Mobirise forum because it is breaking icons displaying locally. No issues using all other web browsers, it's only Firefox 68.0 with the issue.

http://forums.mobirise.com/discussion/21485/issues-with-latest-firefox-68-0-previewing-sites-locally

Mack

Hi atarian and Mack, I filed a bug proposing an exception for fonts. Those are pretty easy to understand.

However, I don't think there is going to be any built-in exception for XMLHttpRequest() to fetch local files. You'll need to turn off the patch (set privacy.file_unique_origin=false) for those cases.

Thankyou jscher2000

Mack

I have a similar problem. Some JS work on a local file but not from the server. Others work from the server but not from a local file. This all started with the last update.

atarian said

For some reason firefox has doesnt run a site how it supposed to on my local hard drive. Which is a pain when you are designing. The web site works fine live from the hosting page. It seems to have stopped running js files. I have even downloaded them from the server and i get exactly the same again. The local site works fine with the dreaded "edge" etc. I am pulling my hair out with this one.

Hi khablow, did you test whether this is caused by the security patch in Firefox 68? The switch to turn that off is:

(1) In a new tab, type or paste about:config in the address bar and press Enter/Return. Click the button promising to be careful or accepting the risk.

(2) In the search box above the list, type or paste uniq and pause while the list is filtered

(3) Double-click the privacy.file_unique_origin preference to switch the value from true (secure) to false (insecure)

As a risk mitigation, always download untrusted HTML to a separate folder from your other HTML files to minimize the risk of code in the file exfiltrating sensitive data.

Now the JKS works on pages loaded locally but on https://www.mindleaf.com/newsandevents-rss.html the JS for the RSS feed does not display. It does when run locally.

Hi khablow, the Web Console shows me there's a mixed active content block because the script is pulled using HTTP in an HTTPS page:

Blocked loading mixed active content “http://feed2js.org//feed2js.php?src=https%3A%2F%2Frss.bizjou…channel%26selectorvalue%3D5&num=8&desc=1&date=y&targ=y&utf=y”

You can open the Web Console in the lower part of the tab using either:

• "3-bar" menu button > Web Developer > Web Console
• (menu bar) Tools > Web Developer > Web Console
• (Windows) Ctrl+Shift+k

Then click the trash can icon to clear the list and reload the page in the upper part of the tab to observe messages displayed during load.

I changed the link to https and it still did not work. I think the linked site may be old and was never set up for https. I need to check on that.

Thanks for your help. Ken

Hi Ken, while you have the DevTools panel open, you can use the Network panel to monitor for failed requests. The list starts after you open the DevTools, so you might need to reload again.

https://developer.mozilla.org/docs/Tools/Network_Monitor

OOPS! Once I hit Refresh a couple of times it work!

Thanks again.