Hi,
Here is small (security?) issue with RadScheduler:
If you enter HTML as a value to DataSubjectField of the appointment it will be shown in scheduler window without being encoded.
Try to enter e.g.:
<a href="http://www.google.com">Google</a>
or
<a href="javascript:alert('Hello!');">Say hi!</a>
elsewhere the whole string shown encoded.
Q: Is this error or is it so by design? If this is the design, how should I avoid HTML without making too deep changes?
Thanks,
Mirko
Here is small (security?) issue with RadScheduler:
If you enter HTML as a value to DataSubjectField of the appointment it will be shown in scheduler window without being encoded.
Try to enter e.g.:
<a href="http://www.google.com">Google</a>
or
<a href="javascript:alert('Hello!');">Say hi!</a>
elsewhere the whole string shown encoded.
Q: Is this error or is it so by design? If this is the design, how should I avoid HTML without making too deep changes?
Thanks,
Mirko