Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We have an internet-facing, SharePoint 2010, Publishing Site. The content authors that maintain the site are JavaScript savvy web designers. They would like to be able to add JavaScript to publishing pages when editing them. However, we've noticed that RichHtmlField control is stripping out <script> tags, apparently to prevent JavaScript injection attacks. Because the content authors are experienced with JavaScript, we are not worried about them inadvertently opening us up to JavaScript injection attacks.

What are some approaches to allow content authors to add arbitrary JavaScript to a publishing page?

Thanks!

share|improve this question
    
I have work around for this. Just couple of days I tried this in SharePoint 2007 using RichHtmlField. I just customized the RichHtmlField and it was successfully working. Ofcourse, as per your requirement some code changes would require but we have solution. If you need any technical help or coding help, please contact me on Anand.Thurubatla@gmail.com Thanks, Anand –  user630119 Jul 12 '11 at 9:51

3 Answers 3

up vote 3 down vote accepted

It depends. If you want to add JavaScript to specific publishing pages, then the ContentEditor web part is a good choice.

Alternatively, SharePoint Designer is a good way of doing this too. It would allow you to edit the page layouts - adding JavaScript to all pages using that layout. Alternatively you can 'disconnect' a publishing page from it's layout, and edit it singly.

See http://stackoverflow.com/questions/3628779/how-to-allow-using-javascript-in-richhtmlfield-control also

share|improve this answer

One approach, as an alternative to your RichHtmlField, and short of them having access to editing the entire page, is to use a ContentEditor Web Part. You can put your Javascript in here and not have it stripped out.

share|improve this answer

This approach has worked for me now on a few SharePoint public website projects:

  • Create a Note field called JavaScriptToInject
  • Add this field to my Publishing content type
  • Add the field to an edit panel of my Publishing page layout, allowing the users to edit the value when the page is in edit mode
  • Create a simple field control that checks for this field and writes its contents out to the browser
  • Put the field control in the head section of your master page

I find this approach very useful when I need to have a one-off script run for a particular page.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.