Charles Nurse wrote:
Brett Levert wrote:
Adding my voice to the group not happy with the forced script removal.
Used on my website for:
- Inline twitter widget
- AdSense Code
- RSSPump.com news widget
On about 249 pages.
Will be avoiding the upgrade until a work around is given
Brett
There are many ways today to work around this issue while also upgrading to a more secure version of DNN.
I should iterate the security fix ONLY removes script when saving the content in the HTML module. One individual earlier in this thread said that the script was stripped from existing content - that is NOT true. The script is removed when trying to save the content - either when creating a new instance of a module OR when updating the current module.
I would argue that the HTML/Text module is not the correct place to embed javascript in your page. For all of the examples you use I would embed the javascript in my Skin or Container. If I don't want it on every page I would have two versions of my Skin - one with the javascript widgets and one without.
Alternatively I would look at Will Strohl's Open Source Widgets.
Thirdly - you could add the necessary javascript to the Page Header under page settings, but the text editor can be used by registered or anonymous users and is not the right place to allow javascript to be entered.
We may decide to open up some ability in the future - but I would argue that we did the right thing for the right reason. When dealing with Security issues, the first priority is closing the hole as quickly as you can before the information leaks out into the public domain.
Once we have had time to review and fully understand the issue then we can consider mitigating the impact to the average user - by allowing host users to add js or by allowing host users to enable it in certain places.
As a platform we need to protect our Reputation and this is what we did.
I would urge you to upgrade now - protecting your site should be your first priority - and as a Community lets figure out and document a better/safer way to do these types of things.
I do not want to start a flame war here at all, but I do want to at least add a little bit to this from the other side. Injecting scripts in this manner is something that has been allowed in DNN for years, and I mean YEARS. I've been doing it ever since I started using DNN back in the 3.x days.
Why is this important to note? Well my concern here is quite simple, there are some things that you just have to do with script in the Text/HTML module, or within the editor. Some examples have been given before and I can come up with a lot more if you want examples. Google Analytics is one that I'd agree could better go in the skin or use a module, but some of the others are not quite that easy, and sometimes the scripts need to be integrated in the middle of content, etc.
My concern with this issue, and my 15+ customers that have already contacted me about this item have concerns that yes, it has been a security risk, sure, other ways for SOME stuff is possible, but in the end right now, they can upgrade, change something and "boom" be done with their stuff and have no way to go back unless they use other modules/solutions.
I understand security is paramount, but at the same time one of the biggest selling points of DNN has been that you can do what you need as a content editor, this includes the ability to integrate stuff like JavaScript. In my site alone I have 4 objects that this will be an issue with and that will limit me from upgrading. One of the 4 could be mitigated, but the other will not get me the same look and feed if I change the implementation.