Using the latest 2022.3.1109.45, our web application is catching "Invalid Resource Request" exceptions when the Windows7 or Vista (maybe others too) loads the "Editor" control in "Classic" mode. By decoding the URL, the control is having problems locating the image below
WebR
Error Message: This is an invalid webresource request.
Telerik.Web.UI.Skins|Telerik.Web.UI.Skins.Vista.Editor.ToolbarVerticalSprites.gif
Telerik.Web.UI.Skins|Telerik.Web.UI.Skins.Windows7.Editor.ToolbarSprites.gif
Change the skin of the radeditor in the default.aspx to another skin such as "metro" and the problem will not happen. It works OK at least on Black, Metro and Silk but haven't tested others, you can tell it doesn't work when the divider bars in the editor toolbar don't appear properly.
Hi,
I am contacting you today to let you know I have found cross-site scripting vectors within the latest version of the RadEditor. I have attached images of the payloads that seem to bypass the XSS filter.
The second payload only works on Firefox browsers, but the first works on Chrome browsers too. While it still requires users to click on the link to trigger XSS, it can be easily social engineered in most situations.
When using RadEditor with the StripDomEventAttributes content filter enabled, script execution can still occur when switching from HTML to Design mode.
Certain HTML and SVG elements containing attributes such as onload, onclick, or href/to values that start with javascript: are not fully sanitized before the editor’s content is rendered in Design view. As a result, embedded script code can run during the mode transition even though the anti-script filter is active.
Reproduction steps:
Add a RadEditor with the default filters:
<telerik:RadEditor runat="server" ID="RadEditor1"
ContentFilters="DefaultFilters,StripDomEventAttributes">
</telerik:RadEditor>
<svg/onload=alert(1)><svg> <svg onload=alert(1)><svg> # newline char <svg onload=alert(1)><svg> # tab char <svgonload=alert(1)><svg> # new page char (0xc)
I have a RadEditor that is rendered in mobile mode on a mobile device emulator in Chrome browser.
For this editor, I have subscribed to OnClientCommandExecuted event. The event fires, but the problem is that it fires twice for ToggleScreenMode command.
To reproduce this issue, you can use the page code below and render it in Chrome mobile emulator; then press on edit pencil button followed by clicking the check button.
<%@ Page https://goo.gl/ddHuHyLanguage="C#" AutoEventWireup="true" %>
<%@ Register Assembly="Telerik.Web.UI" Namespace="Telerik.Web.UI" TagPrefix="telerik" %>
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title>Command event firing twice for ToggleScreenMode in Mobile Render Mode</title>
<meta name="viewport" content="width=device-width,intial-scale=1.0, maximum-scale= 1.0,,user-scalable=no"/>
</head>
<body>
<form id="form1" runat="server">
<telerik:RadScriptManager ID="RadScriptManager1" runat="server">
<Scripts>
<asp:ScriptReference Assembly="Telerik.Web.UI" Name="Telerik.Web.UI.Common.Core.js"></asp:ScriptReference>
<asp:ScriptReference Assembly="Telerik.Web.UI" Name="Telerik.Web.UI.Common.jQuery.js"></asp:ScriptReference>
<asp:ScriptReference Assembly="Telerik.Web.UI" Name="Telerik.Web.UI.Common.jQueryInclude.js"></asp:ScriptReference>
</Scripts>
</telerik:RadScriptManager>
<div>
<telerik:RadEditor ID="RadEditor1" runat="server" AutoResizeHeight="True" RenderMode="Auto" OnClientCommandExecuted="CommandExecuted" Width="99%">
</telerik:RadEditor>
</div>
<script>
function CommandExecuted(sender, args) {
if (args.get_commandName() === "ToggleScreenMode" && (typeof sender.isFullScreen() === "undefined" ||
sender.isFullScreen() === false)) {
alert("Command Executed Fired for ToggleScreenMode");
}
}
</script>
</form>
</body>
</html>
Workaround:
<telerik:RadEditor ID="RadEditor1" runat="server" AutoResizeHeight="True" RenderMode="Auto" OnClientCommandExecuted="CommandExecuted" Width="99%">
<Content>dadas</Content>
</telerik:RadEditor>
<script>
function CommandExecuted(editor, args) {
if (args.get_commandName() == "ToggleScreenMode") {
var goingIntoReadMode = $telerik.$(editor.get_element()).find(".reIcon.reIconEditContent").is(":visible");
if (goingIntoReadMode == false) {
editor.__modifiedContentAlready = false;
//modify content for edit mode
console.log("modify content for edit mode")
}
if (goingIntoReadMode == true && editor.__modifiedContentAlready == false) {
//modify content for read mode
console.log("modify content for read mode");
editor.__modifiedContentAlready = true;
}
}
}
</script>
Position the cursor between the words SharePoint and Whether in the first paragraph and add a line break, after that press Backspace and you'll see that the new line does not disappear. Adding new sections between existing paragraphs or after the last paragraph seems to work fine, but if you have to break up an existing paragraph into two paragraphs and then want to turn it back into one you won't be able to. https://www.screencast.com/t/NAniQ50c2UU9
Hi,
We are using Material Theme in our application. We see the problem in Rad Editor's Ribbon. Some icons are overlapping the Text. In the demo, it seems to be same behavior.
Regards,
Jamil
Steps to Reproduce: 1. Insert a table and add some data to the table in Chrome 2. Above the Table, insert some text 3. Highlight the text and drag cursor to highlight half of the data in the table 4. Hit Delete on your keyboard Result: The colgroup is removed from the table
In the demo:
https://demos.telerik.com/aspnet-ajax/editor/examples/trackchanges/defaultcs.aspx
1. (Preparation) Disable TrackChange and Remove all text. Enable Track Change back.
2. Insert table, (HTML View)
3. In the design mode set new paragraph after table:
Insertion of the table dissapeared.
How to fix this issue?
Hi
I have a RadEditor control where some toolbar functionalities are not working.
After searching for a possible reason, I used the OnClientCommandExecuting client-side event and noticed that sometimes, instead of the args with its value, I found the item of a RadTreeList control present on the page.
I tried to reproduce the issue by inserting an Editor and a TreeList on a page. I write some text in the Editor and try to change the color or background. Not always (and I can't figure out when), but sometimes the args are incorrect.
For example, if I open a node of the tree, the error is almost certain after that.
I send you an image of my javascript debugger.
I don't know what I can do, do you have any ideas?
Thanks
Michela
I am experiencing an issue in the Telerik Rad Editor where, after copying and pasting a long sentence in a single line, if I apply bold formatting to a word and place the cursor at the beginning of the bolded word, pressing Enter results in an empty line being inserted between the text. This behavior is reproducible on the Telerik webforms editor demo site as well.
I would appreciate any guidance on how to resolve this issue. Thanks in advance.
Hi Telerik Team,
I have encountered a strange issue while working with RadEditor in Track Changes mode, specifically when editing tables. When deleting content inside a table cell, the entire cell behaves abnormally—either disappearing visually or causing layout disruptions. I have attached a screenshot to illustrate the issue.
Steps to Reproduce the Issue:
<telerik:RadTabStrip runat="server" ID="RadTabStrip2" MultiPageID="RadMultiPage2" SelectedIndex="0"> <Tabs> <telerik:RadTab Text="Add Response"></telerik:RadTab> </Tabs></telerik:RadTabStrip><telerik:RadMultiPage runat="server" ID="RadMultiPage2" SelectedIndex="0"> <telerik:RadPageView runat="server" ID="RadPageView11"> <telerik:RadEditor Width="100%" EditModes="Design" ID="reReqCom" runat="server" ContentAreaCssFile="~/AppRoot/Xml/RadEditor/EditorContentArea.css" ToolsFile="~/AppRoot/Xml/RadEditor/BasicTools.xml" Skin="Material" /> </telerik:RadPageView></telerik:RadMultiPage>The Table Wizard dialog, the Table Properties tab shows Cell Padding and Cell Spacing fields, but this fields can only apply values. If you edit them through the HTML mode or the Properties Inspector module, the fields in Table Properties dialog will not be updated.