NetGen does load a JS file called ‘persist.js’ which initiates Flash and causes the artifact you describe when the following Chrome setting is on:
Settings / Show advanced settings / Privacy / Content Settings / Plug-ins / Click to play
In Firefox, Click to Play (which I think is default now – note I’m using a Firefox pre-release) causes a similar temporary image in the lower-left corner, along with a drop-down bar at the top asking:
Allow ... to run "Adobe Flash"?
The Firefox Click to Play setting is described here: https://security.berkeley.edu/content/how-do-i-enable-click-play-mozilla-firefox?destination=node/431
It’s especially annoying in Firefox because after any page load in Dashboard, and a slight delay, the screen slides down about 30px to make room for the “Allow” bar. Usually in Dashboard I’m just try to get something done quickly and this one plugin is hassling me by putting the mouse in the wrong place. ?? I have clicked many wrong left-hand menu items due to the slide-down. I could allow Flash for the site permanently, but I’m not sure why it’s even needed.
Flash only loads on Dashboard, not on the front-end. Admin Bar on the front-end does not load it.
To check NextGen is really doing this, comment out the following PHP line and re-test:
Version 2.0.66
nextgen-gallery/products/photocrati_nextgen/modules/ajax/module.ajax.php line 79:
wp_enqueue_script('ngg-store-js');
Here is the offending line it puts in your HTML:
<script type='text/javascript' src='http.../wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/ajax/static/persist.js?ver=3.9.1'></script>
And here is the beginning of the first line of that script:
var swfobject=function(){var UNDEF="undefined",OBJECT="object",SHOCKWAVE_FLASH="Shockwave Flash",SHOCKWAVE_FLASH_AX="ShockwaveFlash.ShockwaveFlash",FLASH_MIME_TYPE="application/x-shockwave-flash",EXPRESS_INSTALL_ID="SWFObjec...
Many plugins load stuff underneath all Dashboard pages, because it’s not so easy to specify. Even plugins that try to get it right forget about DOING_AJAX and DOING_CRON and certain save/redirect cases. (A very weird corner case is plugin activation, which turns any global variable you define into a local.) In order to selectively load your JS you usually need to know what’s going before the HTML header finishes loading.
I’d suggest NextGen do it though, and eliminate Flash except where needed on specific Dashboard pages. This behavior is confusing and hard to track down. No one wants suspicious activity on a login page.
