[Solved] Editor with no javascript

[Chris]

Hi,

Can you suggest what is the best way to completely remove all javascript?  I know I can set allowScripts=false.  However, the following example doesn't got removed.
<a href="javascript:doSomething();">Click here</a>

Chris

[Rumen]

Hello Chris,

The AllowScripts="false" property strips only the <script> tags in the content, but it does not strip the event attributes (onclick, onmousedown, onmouseover, etc) applied to the different HTML elements as well as href="javascript:doSomething(); attributes of the link tag.

To strip these events related attributes you can use a content filter as it is shown below:

<telerik:radeditor runat="server" ID="RadEditor1" OnClientLoad="OnClientLoad">
    <Content>
        <a href="javascript:doSomething();" >Click here</a>
        <div onclick="alert();">Click Here</div>
    </Content>
</telerik:radeditor>
<script type="text/javascript">
function OnClientLoad(editor, args)
{
   editor.get_FiltersManager().add(new MyFilter());
}
MyFilter = function()
{
   MyFilter.initializeBase(this);
   this.set_isDom(false);
   this.set_enabled(true);
   this.set_name("RadEditor filter");
   this.set_description("RadEditor filter description");
}
MyFilter.prototype =
{
   getHtmlContent : function(content)
   {
     var dom = document.createElement("DIV");  
     dom.innerHTML = content;  
      
     var elems = dom.getElementsByTagName("*");  
     for (var i=0; i < elems.length; i++)  
     {  
        //Remove all onmouseover, onmouseout, onclick eventhandlers from element        
        var elem = elems[i];
        elem.removeAttribute("onmouseover");
        elem.removeAttribute("onmouseout");
        elem.removeAttribute("onclick");

       
        if (elem.tagName == "A")
        {
            if(elem.href.indexOf("javascript") == 0)
            {
                elem.setAttribute("href", "#");
            }
        }
     }                   
     return dom.innerHTML;   
   }
}
MyFilter.registerClass('MyFilter', Telerik.Web.UI.Editor.Filter);
</script>

Best regards,
Rumen
the Telerik team

Instantly find answers to your questions at the new Telerik Support Center

[Chris]

Thanks for your solution.  After I read the code, it looks like i will have to copy and paste the javascript code to all of my editor instances from the website.  I suggest if this could be made as one of the property to the editor so that it would be much helpful to set it thru it instead of copy and paste the javascript code all over.  Just a suggestion.

Chris

[Rumen]

Hi Chris,

Thank you for your feature request.

We are always trying to keep the editor's properties as much small as we can, because a large number of properties will make the control configuration very difficult.

My suggestion is to put the provided JavaScript code in an external JavaScript file that you will be referenced in your projects and pages with a RadEditor by using SCRIPT tag:

<script type="text/javascript" src="external.js"></script>

Best regards,
Rumen
the Telerik team

Instantly find answers to your questions at the new Telerik Support Center