Client Side Node Edit Problem

[Rob]

Hi,
I am using Client Side Node Edit. If I put <script type="text/javascript">alert();</script> in the node name, the script executes. Is there any way to prevent it?

[Princy]

Hi Rob,

Please try the following sample code snippet which works fine at my end. Please elaborate your requirement if it doesn't help.

ASPX:

<telerik:RadTreeView ID="RadTreeView1" runat="server" OnClientNodeEditing="Editing" AllowNodeEditing="true">
    <Nodes>
        <telerik:RadTreeNode Text="Node1">
        </telerik:RadTreeNode>
        <telerik:RadTreeNode Text="Node2">
        </telerik:RadTreeNode>
    </Nodes>
</telerik:RadTreeView>

JavaScript:

<script type="text/javascript">
    function Editing(sender, args) {
        //your code
    }
</script>

Thanks,
Princy.

[Rob]

Hi, Princy,

If you go to http://demos.telerik.com/aspnet-ajax/treeview/examples/programming/clientevents/defaultcs.aspx
and try to rename tree node to <script type="text/javascript">alert();</script>, JavaScript will execute. Is there any way to avoid this behavior?

[Princy]

Hi Rob,

Please try the following JavaScript code in OnClientNodeEditing event of RadTreeView to achieve your scenario.

JavaScript:

<script type="text/javascript">
    function Editing(sender, args) {
        var newText = args.get_newText();
        var splChars = "*|,\":<>[]{}`\';()@&$#%";
        for (var i = 0; i < newText.length; i++) {
            if (splChars.indexOf(newText.charAt(i)) != -1) {
                //cancel the event if the new text contains any special symbol
                args.set_cancel(true);
            }
        }
    }
</script>

Thanks,
Princy.