[Solved] Internet Explorer has modified this page to help prevent cross-site scripting. Click here for more information...

[Akzhol The Kyrgyz]

Hi, Telerik Team

I began to receive following error after applying two filters for the grid (It seems this feature for the IE 8 came after recent updates).

Internet Explorer has modified this page to help prevent cross-site scripting. Click here for more information...

Query String is:

page=1&orderBy=~&groupBy=~&filter=substringof(SID%2C'2')~and~substringof(MemberNo%2C'1')

So does this mean that from now on telerik grid will not compatable with IE8 or is there any other solution to this problem?

Thanks.

[Atanas Korchev]

Hello Akzhol The Kyrgyz,

 It seems that IE8 incorrectly thinks that there is cross site scripting based on the URL of the grid (the filtering query string arguments in particular). As a result it modifies the output of the grid and hyperlinks for paging and sorting no longer work. Of course this is not present in any other browser or older IE versions.

We will investigate which part of the server binding URL triggers that behavior. We can probably work that around with a patch but nothing would ensure future compatibility. I have the feeling that those XSS checks will be enhanced in future updates of IE8 and the grid server filtering will break again.

As an immediate workaround I can suggest using  Ajax binding which will prevent this "feature" of IE8. 

Regards,
Atanas Korchev
the Telerik team

[Akzhol The Kyrgyz]

Hi, Atanas 

Thanks for your quick response (as always).

Unfortunately,   it's not possible for me to use Ajax Binding for several reasons:
1 - Due to serialization "infinite loop" problem
2 - Due to the fact that system is very big and it's very costly and late to change it in this stage

New patch would be greatly appreciated. As a temporary workaround I would suggest users to disable this feature.

[Atanas Korchev]

Hello Akzhol The Kyrgyz,

 It is still not clear when (and if possible at all) we will be able to address this issue. We obviously have to change the way server filtering works and we also must support the current behavior. And hope that Internet Explorer does not decide yet again that the grid is generating XSS threats.

By the way the "infinite loop" problem has a few known solutions. You can check my blog post and the associated help topic.

All the best,
Atanas Korchev
the Telerik team

[Akzhol The Kyrgyz]

Hi, Atanas

About serialization problem: 
The only solution that's suitable for my application is "ViewModel" one, but that way
1- - I'll have to create about 40-50 ViewModels
2-  Initialization of ViewModel is costly (because my data is usually order of millions records) 

Hoping that MS will stop breaking updates.

[Atanas Korchev]

Hello Akzhol The Kyrgyz,

I think I found an easy workaround for the time being. Add this code in your master page:

<%
        Response.AddHeader("X-XSS-Protection", "0");    
  %>

It would disable the XSS filter for your web application. This workaround was described in the IEBlog.

Regards,
Atanas Korchev
the Telerik team

[Akzhol The Kyrgyz]

Thanks very much. 
It solved the problem.