Infragistics Forums

I've just discovered what I consider to be a security risk with the WebSpellChecker control.  Our web app uses the WebSpellChecker control with the U.K version of the dictionary.  We therefore have to set the dictionary in code as follows:

M.Johnson

This is certainly something we'll want to take care of - I definitely understand why you wouldn't want to tell hackers anything about your site/server that they couldn't find out themselves!

I believe the value is sent down with the ASPX page so that it can be sent back up to the server when the secondary webspellcheckerdialog window is displayed.  The problem is that the two pages are distinct and they need to be able to pass information between them.  The solution is to find a state medium, either through session or in this case through the client.  However, that's no reason to broadcast your physical environment, and there should be ways to correct this, even if it comes down to garbling the string. 

It's best if you go directly through our support department with this incident so that a formal ticket can be created and we can give you a case number for reference.  The support options are listed at http://www.infragsitics.com/gethelp, or you can go directly to the online incident reporting page @ http://devcenter.infragistics.com/Protected/SubmitSupportIssue.Aspx

Thanks again for taking the time to report this,

-Tony