we've been moving away from their usage for a while (using SPA style applications with knockoutJS/service framework for a while), so theres not as much as you'd think e.g. we replaced various dropdowns for pages/modules etc., with new controls that dynamically load data via service framework requests. We'll continue this process, iteratively updating code over many versions (ideally implementing alternative code in the wrappers, but if not replacing the use of telerik wrapped controls), but the agreement with telerik gives us the ability to do this carefully in a planned fashion, rather than try to do everything in one big (likely to be buggy) release.

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US

It's debateable how much of an issue it is as the syntax is limited to a small subset of very old browsers - the issue is minor as it only affects users of Internet Explorer 5.5-7 . Users of IE8 or above, or any other browser, cannot be affected. http://blogs.telerik.com/blogs/14-09-24/securing-radeditor-content-and-preventing-xss-attacks covers the details of why this is well.

Note: DNN users of DNN 6.0 and above can use the HTML Editor manager function to enable “RemoveScripts” to fix this issue. Alternatively DNN users can also opt to use an alternative HTML editor such as CkEditor http://www.dnnsoftware.com/wiki/page/html_editor_providers if they need to support IE 5.5, 6 or 7 clients.

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US

No problem Ian, we keep a careful watch on a number of security and vulnerability sites so are usually on top of things (my response is actually from an internal mail I sent 2 weeks ago - I must blog the details). As to the usage of early IE, not much we can do about that - however they are on OS versions that are no longer supported by Microsoft so a minor xss issue is the least of their worries :)

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US