Client Side Node Edit Problem

4 posts, 0 answers
  1. Rob
    Rob avatar
    23 posts
    Member since:
    Apr 2013

    Posted 20 Mar 2014 Link to this post

    Hi,
    I am using Client Side Node Edit. If I put <script type="text/javascript">alert();</script> in the node name, the script executes. Is there any way to prevent it?
  2. Princy
    Princy avatar
    17421 posts
    Member since:
    Mar 2007

    Posted 20 Mar 2014 in reply to Rob Link to this post

    Hi Rob,

    Please try the following sample code snippet which works fine at my end. Please elaborate your requirement if it doesn't help.

    ASPX:
    <telerik:RadTreeView ID="RadTreeView1" runat="server" OnClientNodeEditing="Editing" AllowNodeEditing="true">
        <Nodes>
            <telerik:RadTreeNode Text="Node1">
            </telerik:RadTreeNode>
            <telerik:RadTreeNode Text="Node2">
            </telerik:RadTreeNode>
        </Nodes>
    </telerik:RadTreeView>

    JavaScript:
    <script type="text/javascript">
        function Editing(sender, args) {
            //your code
        }
    </script>

    Thanks,
    Princy.
  3. UI for ASP.NET Ajax is Ready for VS 2017
  4. Rob
    Rob avatar
    23 posts
    Member since:
    Apr 2013

    Posted 20 Mar 2014 in reply to Princy Link to this post

    Hi, Princy,

    If you go to http://demos.telerik.com/aspnet-ajax/treeview/examples/programming/clientevents/defaultcs.aspx
    and try to rename tree node to <script type="text/javascript">alert();</script>, JavaScript will execute. Is there any way to avoid this behavior?
  5. Princy
    Princy avatar
    17421 posts
    Member since:
    Mar 2007

    Posted 21 Mar 2014 in reply to Rob Link to this post

    Hi Rob,

    Please try the following JavaScript code in OnClientNodeEditing event of RadTreeView to achieve your scenario.

    JavaScript:
    <script type="text/javascript">
        function Editing(sender, args) {
            var newText = args.get_newText();
            var splChars = "*|,\":<>[]{}`\';()@&$#%";
            for (var i = 0; i < newText.length; i++) {
                if (splChars.indexOf(newText.charAt(i)) != -1) {
                    //cancel the event if the new text contains any special symbol
                    args.set_cancel(true);
                }
            }
        }
    </script>

    Thanks,
    Princy.
Back to Top