How do you allow Content Authors to add Javascript to a Publishing Page?

Question

We have an internet-facing, SharePoint 2010, Publishing Site. The content authors that maintain the site are JavaScript savvy web designers. They would like to be able to add JavaScript to publishing pages when editing them. However, we've noticed that RichHtmlField control is stripping out <script> tags, apparently to prevent JavaScript injection attacks. Because the content authors are experienced with JavaScript, we are not worried about them inadvertently opening us up to JavaScript injection attacks.

What are some approaches to allow content authors to add arbitrary JavaScript to a publishing page?

Thanks!

Answer 1

It depends. If you want to add JavaScript to specific publishing pages, then the ContentEditor web part is a good choice.

Alternatively, SharePoint Designer is a good way of doing this too. It would allow you to edit the page layouts - adding JavaScript to all pages using that layout. Alternatively you can 'disconnect' a publishing page from it's layout, and edit it singly.

See https://stackoverflow.com/questions/3628779/how-to-allow-using-javascript-in-richhtmlfield-control also

Answer 2

One approach, as an alternative to your RichHtmlField, and short of them having access to editing the entire page, is to use a ContentEditor Web Part. You can put your Javascript in here and not have it stripped out.

Answer 3

This approach has worked for me now on a few SharePoint public website projects:

• Create a Note field called JavaScriptToInject
• Add this field to my Publishing content type
• Add the field to an edit panel of my Publishing page layout, allowing the users to edit the value when the page is in edit mode
• Create a simple field control that checks for this field and writes its contents out to the browser
• Put the field control in the head section of your master page

I find this approach very useful when I need to have a one-off script run for a particular page.