CuteEditor still strips all script elements though I set EnableStripScriptTags = false

Last post 01-09-2007, 2:27 PM by ytang. 4 replies.
Sort Posts: Previous Next
  •  01-05-2007, 2:04 PM 25580

    CuteEditor still strips all script elements though I set EnableStripScriptTags = false

    I use the version 5.3. For my application, the editor still strips all script elements though I set EnableStripScriptTags = false.
     
    My application is an email editor page that allows users to edit 2 versions of email, html and plain text. There is a CuteEditor for html email and a TEXTAREA for plain text email in the same page. I use 2 radio buttons (postback) to switch between the CuteEditor and TEXTAREA, i.e. when Editor1.Visible=false, TextArea1.Visible=true; when Editor1.Visible=true, TextArea1.Visible=false.
     
    I put some Javascript code into the CuteEditor, then switch to TEXTAREA view. After switching back to the CuteEditor view, those Javascript code has been replaced with <!-- Inject Script Filtered -->. I do set EnableStripScriptTags = false. And, if the CuteEditor view postback to itself, the Javascript code is still there. Looks like switching between Editor1.Visible=true and false causes the issue.
     
    Any ideas? Thanks.
     
  •  01-06-2007, 1:22 AM 25593 in reply to 25580

    Re: CuteEditor still strips all script elements though I set EnableStripScriptTags = false

  •  01-08-2007, 8:32 PM 25638 in reply to 25593

    Re: CuteEditor still strips all script elements though I set EnableStripScriptTags = false

    Thanks for your reply.
     
    But the example is not like my application. In my previous post, I indicated it works fine when the editor just posts back to itself with being visible. But if you make the editor invisible (Editor.Visible=false) in a postback, then make it visible (Editor.Visible=true) in the next postback, all script elements will be stripped out.
     
    Could you please modify your example to add 2 radio buttons: one called "Show Editor" and one called "Hide Editor". When you click the "Show Editor" to postback, set Editor.Visible=true. When you click "Hide Editor", set Editor.Visible=false.
     
    When the editor is visible, you can insert some JS code like "<script>alert();</script>" into the content. Then click the "Hide Editor" to hide it. After you clicked the "Show Editor" to bring the editor back, you can see the JS code has been stripped out.
     
     
  •  01-09-2007, 10:09 AM 25651 in reply to 25638

    Re: CuteEditor still strips all script elements though I set EnableStripScriptTags = false

  •  01-09-2007, 2:27 PM 25676 in reply to 25651

    Re: CuteEditor still strips all script elements though I set EnableStripScriptTags = false

    Thank you for your reply.
     
    Your example works fine, because it doesn't postback to server side to set Editor.Visible=false to hide the editor. It just set DIV's style to hide the editor on the client side.
     
    But it doesn't solve the problem in my application that has to postback to use Editor.Visible=false to hide the editor. In my application I can't just hide the editor on the client side, because I need to do a lot of code conversion on the server side with postback. If it is a bug for CuteEditor with Visible=false, I have to find a workaround to solve the problem, e.g. save the content to ViewState before set Editor.Visible=false, or wrap the editor with a DIV server control so I can hide the DIV control on the server side instead of hiding the editor itself. I haven't tried the second method yet.
     
     
     
     
     
     
View as RSS news feed in XML