Hello,

As a result of the CSP compliance initiative, we had to remove all kendo templates from the source of our components, as they are not compatible with the unsafe-eval directive.

From now on, the suggested approach to achieve the same attribute binding result, we deliver a new HtmlAttributes overload that accepts a single string parameter, the name of the JS handler that returns the attributes.

e.g.

// column configuration
columns.Bound(p => p.OrderDate).HtmlAttributes("attributesHandler");

//handler

function attributesHandler(data) {
  return { title: `Order Date: ${kendo.toString(data.OrderDate, 'dd-MM-yyyy')} ` }
}

To achieve the same behavior as before, one could create a global handler and pass the attributes as a parameter of the global handler.
e.g,

// column configuration
.HtmlAttributes("globalAttributesHandler.bind({title:'#=Emaiil#'})")

// global handler

    function globalAttributesHandler(data) {
        const result = {};

        for (const attr in this) {
            result[attr] = kendo.template(this[attr])(data)
        }

        return result;
    }

Regards,
Ivan Danchev
Progress Telerik

Hi,

We plan to include a fix in the upcoming release R1 2023 SP1, which is due in mid March.

As a temporary workaround, the value of the title attribute can be set with js after the Grid is loaded with data:

1. Attach a DataBound event handler to the Grid:

.Events(ev => ev.DataBound("onDataBound"))

2. Execute the following logic in the handler:

function onDataBound(e) {
    var grid = e.sender;

    grid.tbody.find("td[title*='Order Date']").each(function () {
        var row = $(this).parents('tr')
        var dataItem = grid.dataItem(row);

        var content = $(this).attr("title");
        var template = kendo.template(content);
        var title = template(dataItem);
        $(this).attr("title", title);
    });
}

Regards,
Ivan Danchev
Progress Telerik