Overview

You have noticed that some users are able to inject/insert JavaScript code that will run on the Jive site when saving changes to HTML tiles. You want to prevent those users from being able to insert this code to prevent possible cross-site scripting (XSS).

Information

By default, only users with system administration privileges are able to insert JavaScript code into HTML tiles. To ensure that non-administrator users are not able to insert code into HTML tiles, please follow these steps:

Jive Cloud

Please contact us.

Jive Hosted or On-Premise

1. Log in to the Admin Console.
2. Click on System, then click on System Properties in the left-side menu.
3. In the Property Name textbox, paste in: jive.htmlwidget.cleansejavascript
4. In the Property Value textbox, paste in: true
5. Click on the Save Property button.
6. Clear the Jive System Cache.
7. Browse to the Permissions tab in the Admin Console.
8. Click on Home Page Permissions in the left-side menu.
9. Check that no users or user groups have been granted the Save JavaScript permission override.
10. If there are any users or user groups that have this override:
    • Click on Edit permissions next to their name,
    • Uncheck the Save JavaScript option.
    • Click on the Set Permissions button.