Stop RadEditor from Stripping Onclick Attributes from Buttons/Images After Upgrade

Updated on Oct 20, 2026

Environment

Product	UI for ASP.NET AJAX Editor
Version	2026.2.708

Description

After upgrading to version 2026.2.708, the RadEditor in UI for ASP.NET AJAX removes the onclick attributes from buttons and images. This occurs even when attempting to disable certain content filters programmatically. For example, attributes like onclick="Javascript:window.parent.VN_InitialSelection(); return false;" are stripped, causing functionality to break.

Cause

Starting with the 2025 Q4 release, the StripDomEventAttributes and StripJavaScriptUris filters are enabled by default as part of built-in XSS protection.

• The StripDomEventAttributes filter removes event attributes like onclick.
• The StripJavaScriptUris filter removes attribute values starting with javascript:.

Even if one of these filters is disabled, the other may still remove the attribute.

Solution

To retain onclick attributes in the RadEditor, follow these steps:

1. Upgrade to the Latest Version
   Upgrade to version 2026.3.812 or later from the Release History. This version includes security and performance improvements.

2. Disable the Required Filters
   Disable both StripDomEventAttributes and StripJavaScriptUris filters inline in the markup. Do not rely on programmatic calls like DisableFilter in code-behind, as they may execute too late. Use the following configuration:

   aspx

   <telerik:RadEditor ID="editText" runat="server"
       ContentFilters="RemoveScripts, FixUlBoldItalic, IECleanAnchors, MozEmStrong, ConvertFontToSpan, ConvertToXhtml, IndentHTMLContent, EncodeScripts, OptimizeSpans, ConvertCharactersToEntities, ConvertTags, StripCssExpressions, RemoveExtraBreaks">
   </telerik:RadEditor>

   This configuration removes the StripDomEventAttributes and StripJavaScriptUris filters while retaining the others.

3. Avoid Re-Enabling Filters in Code-Behind
   Ensure no code-behind logic re-enables the filters. Avoid calls to EnableFilter or assignments to ContentFilters after the initial markup configuration.

4. Validate Using the Demo
   Test your approach in the Built-in Content Filters Demo. Switch to HTML mode, paste your button markup, and clear the StripDomEventAttributes and StripJavaScriptUris checkboxes. Click "Update" to confirm the onclick attribute is preserved.

See Also

• RadEditor Built-In Content Filters Demo
• RadEditor Documentation
• Telerik UI for ASP.NET AJAX Release History