Hi,

2 Of our production webservers got infected last week with Bitcoin miner software and after thorough research, it appears that the Telerik Web UI CVE-2019-18935 vulnerability was used to initiate the attack. More information regarding this attack can be found here: https://www.baco.sk/posts/xmrig-blue-mockingbird/

At the moment, all of our systems are at risk as we've got hundreds of websites running on multiple servers which use the Telerik control, varying from as old as version 2013.3.1114, till the more recent versions, such as 2019.3.1023.

As a (panic) reaction to mitigate this problem, we've replaced the existing Telerik.Web.UI.dll files on the affected server with the 'patched' version downloaded on the product download patch: https://www.telerik.com/account/product-download?product=RCAJAX 

However, after more research, I read on https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization that the only way to fix this problem is to upgrade to version R3 2019 SP1 or later. Can you tell me what the patched version is for then? What does it patch?

Also, can you please advise on how we can fix this problem with the least amount of effort, as we literally have hundreds of websites using this DLL. Is there a way that we do not have to upgrade to the latest version and can have it fixed by an IIS setting perhaps? We basically only use the Telerik Editor.

Thank you.

I was working on a simple test page and decided to load the latest Telerik DLLs (2020.3.915) for my asp.net webforms website.  I added a RadWizard to the page, all was working fine until I updated the page directive to set the ClientIDMode to Static. 

Using the devtools in Chrome, it shows the following error coming from ScriptResource.axd 

"Uncaught RangeError: Maximum call stack size exceeded"

I also noticed in the rendered HTML markup that the RadWizard did NOT use a static id.  In VS, the control was given an id of "wizardMain", but in the rendered HTML, I got the asp.net mangled version instead:

<div id="ctl00_ContentPlaceHolder1_wizardMain" class="RadWizard RadWizard_Default rwzHorizontal">

...

In general, the whole wizard markup was kind of messed up.  Take the ClientIDMode out of the page directive and it goes back to rendering and working as expected (so far).

Version loaded into project via nuget:

  <package id="Telerik.UI.for.AspNet.Ajax.Net45" version="2020.3.915" targetFramework="net48" />

One of YAxis has negative value that throwing other out of balance

I attached current and desired pictures

Ideas?

Hello:

I am looking for some examples that show how I can create a set of cards (RadCards) dynamically.

Any pointer would be appreciated.

Thanks

I am using pagination for my RadGrid and I have a telerik:GridClientSelectColumn at page load the page size is set to 10 however when I change from 10 to 20 in the page size dropdown the checkboxes 11 and grater to do not display on UI (see attachment). 

Hello,

We are working on multiple document pages, that we want to have the same XML source file to populate both pages but with different data from the XML file.

For example if we had a baseball.XML file that listed all the teams in MLB and we have a page for American league and a separate page for Nation league.

We want both pages to get the data from the same XML file and populate multiple treeviews.  We also want to break it down by division.  We want the name of the team to be a link to the team homepage.

This is an example of one of the pages:

American League

-AL East

  -Tampa Bay

  -New York

+AL Central

+AL West

Is this possible with XML and treeview control?  Thank you for any help or direction you can give me. 

Had a few sites on the same server that suddenly stopped working and started having issues

looking into the issues found the following weird entry appear in the root web.config:

<location path="Telerik.Web.UI.WebResource.axd">
    <system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>

Also found the following folders had been created:

"ScriptResource.axd" - Blank web.config

"Telerik.Web.UI.WebResource.axd" - contains a web.config as follows:

<configaration>
<location path="Telerik.Web.UI.WebResource.axd">
<system.webServer>
<httpRedirect enabled="true" destination="ROOT" httpResponseStatus="Permanent" />
</system.webServer>
</location>
</configaration>

"WebResource.axd" - Blank web.config

Anyone else ever seen this?

Is it a hack?

Thanks

Hi, We need help here. I want to call this 

var editor = $find("<%=editor1.ClientID %>");

var someContent = editor.get_html();

from .JS file instead of .aspx file. But when I am calling $find method from function which reside in .JS file, getting "$find is not defined" error.

Please advice how to fix this.