0

I have created a Basic Page and put code in the body for an iframe so we can connect to our university library publication system. I'm doing this for all our users with publications. I had about 20 users completed and the pages worked brilliantly. I came back a few weeks later to complete the rest of the users and IE11 gives me error messages that "Internet Explorer has modified this page to help prevent cross-site scripting." Only 3 of the 20 pages work anymore. I've completed all the users and consistently get the error message.

I've used WinDiff and the only difference between the pages that work and don't work is that & has been replaced with &amp; and <br> and <hr> have been replaced with <br /> and <hr />. If I change that syntax to match it still doesn't work and everything will have been changed back. If I plug the links used into a browser they work fine.

Why does Drupal mess with my code?

Is there something else going on here that I don't understand?

AND now the code that works only has the ALL link working when all 3 links worked before I started typing this.

Links work better in Chrome and Firefox. IE is my bane.

These are the only 3 pages that work partly or wholly.

  1. http://harpseal-clone.ccom.nh/john-kelley-publications
  2. http://harpseal-clone.ccom.nh/carlo-lanzoni-publications
  3. http:// harpseal-clone.ccom.nh/thomas-lippmann-publications

**

  • THIS CODE DOESN'T WORK

**

    <br />
    <p><a href="http://scholars.unh.edu/do/search/?q=author_lname%3A%
    22Alexander%22%20AND%20author_fname%3A%22Lee%22&amp;start=0&amp;
    start_date=05%2F01%2F2012&amp;context=2654425&amp;sort=date_desc"
    target="publications">CCOM Publications</a> | 
    <a href="http://scholars.unh.edu/do/search/?q=author_lname%3A%22
    Alexander%22%20AND%20author_fname%3A%22Lee%22&amp;start=0&amp;
    end_date=05%2F01%2F2012&amp;context=2654425&amp;sort=date_desc"
    target="publications">Pre-CCOM Publications</a> | 
    <a href="http://scholars.unh.edu/do/search/?q=author_lname%3A%22
    Alexander%22%20AND%20author_fname%3A%22Lee%22&amp;start=0&amp;
    context=2654425&amp;sort=date_desc" target="publications">ALL</a></p>
    <p>(place the cursor above the publication data and scroll down
    using the mouse wheel to see more)</p>
    <hr />
    <div class="container" id="wrapper">
    <div class="span-24" id="Content">
    <div id="Icontainer" style="margin: auto; width: 952px; height:2500px;">
<div id="Iouterdiv" style="width: 952px; height: 2204px; overflow:
    hidden; position: relative;">
    <iframe frameborder="0" id="Iinnerdiv" name="publications"
    scrolling="yes" search="" src="http://scholars.unh.edu/do/search/?
    q=author_lname%3A%22Alexander%22%20AND%20author_fname%3A%22Lee%
    22&amp;start=0&amp;start_date=05%2F01%
    2F2012&amp;context=2654425&amp;sort=date_desc" style="left: -170px; 
    top: -690px; width: 1300px; height: 2500px; position: absolute;">
    You need a Frames Capable browser to view this content.</iframe></div>
</div>
</div>
    </div>

**

  • THIS CODE WORKS

**

    <br />
    <p><a href="http://scholars.unh.edu/do/search/?q=author_lname%3A%
    22Kelley%22%20AND%20author_fname%3A%22John%22&amp;start=0&amp;
    start_date=05%2F01%2F2012&amp;context=2654425&amp;sort=date_desc" 
    target="publications">CCOM Publications</a> | 
    <a href="http://scholars.unh.edu/do/search/?q=author_lname%3A%22
    Kelley%22%20AND%20author_fname%3A%22John%22&amp;start=0&amp;
    end_date=05%2F01%2F2012&amp;context=2654425&amp;sort=date_desc"
    target="publications">Pre-CCOM Publications</a> | 
    <a href="http://scholars.unh.edu/do/search/?q=author_lname%3A%22
    Kelley%22%20AND%20author_fname%3A%22John%22&amp;start=0&amp;
    context=2654425&amp;sort=date_desc" target="publications">ALL</a></p>
    <p>(place the cursor above the publication data and scroll down 
    using the mouse wheel to see more)</p>
    <hr />
    <div class="container" id="wrapper">
<div class="span-24" id="Content">
<div id="Icontainer" style="margin: auto; width: 952px; height:2500px;">
<div id="Iouterdiv" style="width: 952px; height: 2204px; overflow:
    hidden; position: relative;">
<iframe frameborder="0" id="Iinnerdiv" name="publications"
    scrolling="yes" search="" src="http://scholars.unh.edu/do/search/?
    q=author_lname%3A%22Kelley%22%20AND%20author_fname%3A%22John%
    22&amp;start=0&amp;start_date=05%2F01%2F2012&amp;
    context=2654425&amp;sort=date_desc" 
    style="left: -170px;  top: -690px; width: 1300px; height: 2500px;
    position: absolute;">You need a Frames Capable browser to view this
    content.</iframe></div>
</div>
</div>
    </div>
  • Drupal can transform the content to remove unwanted or potentially harmful markup. Look at the text format used in the node content and you cal look at the details of the text format under /admin/config/content/formats – cleaver Nov 13 '15 at 16:57
  • You are brilliant cleaver!!! I'm using iframes and <iframe> was not in my list of acceptable tags under the full html section. I added it and IE accepts my script with no cross-site scripting issues! Oh, that was frustrating. So thankful to you for pointing me in the correct direction! :) – jkcrosby3 Nov 18 '15 at 15:38
  • OK, seems like this solves my problem for a limited time then IE throws fits again. I found a how to prevent cross-site scripting cheatsheet (owasp.org/index.php/…), but don't understand how to implement a solution from what it talks about. Anyone have better insight into this? – jkcrosby3 Nov 18 '15 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.