Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites

In the past I've written a lot about the differences between using field controls and Web Parts in SharePoint Server 2007 Publishing sites. For more info, you can read this blog post on the ECM team blog (cross posted here) or my article on MSDN about Prescriptive Guidance for SharePoint Server 2007 Web Content Management Sites. I won't rehash the reasons why you should not use Web Parts for content here... go read those posts for more details...

However, I want to call out one Web Part in particular that causes the most issues in Publishing sites: the Content Editor Web Part (CEWP). AFAIK, this Web Part comes as close to pure evil in Publishing sites as possible for numerous reasons. Links are stored as absolute rather than relative, the content isn't versioned with the page... I could go on. So what to do about it?

Developers and designers creating page layouts have a few options:

Don't add any Web Part Zones to page layouts - then you can't use CEWP's, but you can't use other Web Parts that you might want to let your content owners use. Not a terribly good option.
Delete the CEWP definition from the site collection's Web Part Gallery - but this isn't fool proof as savvy users could still import the Web Part directly into a Web Part Zone through the browser.

Thankfully there is a better option, one I like to use on most of the sites I create for customers. It is fool proof and still allows the use of desirable Web Parts in content pages. All you do is go into the web.config for the Web application where your Publishing site resides and add an entry to the <SafeControls /> section to flag the CEWP as being unsafe:

Now, if you try to add the CEWP to a Web Part Zone, you get this:

I've got a Web Application scoped Feature that will do this for you. The WSP, and source if you're interested, is up on MSDN Code Gallery: http://code.msdn.microsoft.com/ProhibitCEWP. The Feature looks like this once the solution is deployed:

Activating adds the <SafeControl /> entry to the web.config and deactivating removes it.

» MSDN Code Gallery: Prohibit Content Editor Web Part (*.WSP solution & source)

Technorati Tags: sharepoint,moss,publishing site,cewp

posted on Sunday, February 01, 2009 7:43 AM

Feedback

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/1/2009 5:32 PM on3

Hi Andrew,

V.good Article ;)

is it possible if can you please elaborate more about the disadv. of CEWP? and what other solution to replace it?
The reason is i use that webpart quite heavily on my publishing page and maybe others.

Thanks before hand.

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/1/2009 6:27 PM Jeremy Thake

Thanks Andrew, from a users perspective though, even if you have the safe control entry in there...they can still pick the web part when adding it to a web part zone as it will still be in the gallery? Or does your Site Collection Feature also remove the Web Part from the Web Part Gallery too?
I've just read a post by Chris O'Brien where he is customising what they show in their web part zones that might be useful to readers also:

http://www.sharepointnutsandbolts.com/2009/01/extending-web-part-framework-part-1.html

Thanks again Andrew, extremely useful stuff...as always!

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/1/2009 10:26 PM AC [MVP MOSS]

on3 - That is a VERY bad idea to use the CEWP quite a bit on your Publishing sites. Read the links I've provided in the opening paragraph in the post. The alternative? Use the Publishing HTML field. Your CEWP content is not being versioned nor do you have centralized control over the formatting... two very important facets to content managed sites.

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/1/2009 10:28 PM AC [MVP MOSS]

Jeremy-
Removing it from the WPG will remove it from the catalog, but people can still try to import it. Regardless, if you get it on the page, you get the error shown in my post. My Feature isn't a site collection Feature, it's a Web app Feature as it's something that tweaks the web.config.

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/1/2009 10:45 PM Alexander Dombroff

Is it possible to reimport the WPG after it's removed?

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/2/2009 6:56 AM AC [MVP MOSS]

Alexander-
Yup... that's what the 2nd bullet in the post referrs to... anyone with design rights can import WP's onto pages.

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/3/2009 3:32 PM Bella

Hello Andrew,
I have a problem to integrate a Flash in Publishing HTML field, it is not saved in the page, the only solution that I found is using CEWP or XML web part, do you have better solution?

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/3/2009 3:37 PM AC [MVP MOSS]

Bella-
Yup... http://www.codeplex.com/SPWCMFieldControls

This is a MUCH better option as your content owners don't need to know how to tweak the <OBJECT> tag.

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/3/2009 5:12 PM Bella

Thank you for the quick reply, but it seems that the SPWCMFieldControls is not working

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/3/2009 5:23 PM AC [MVP MOSS]

Bella-
Many have used it... you're going to have to be more specific on what's wrong... hard to debug with that info :)

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/3/2009 5:24 PM Matt

I have a question in regard to the code used to make the web.config changes. I've seen some articles that talk about needing to call the Update method of the SPWebApplication object after the changes have been made.

i.e. in the code in this project the final 2 lines of the FeatureActived method would be:

webApp.WebService.ApplyWebConfigModifications();
webApp.Update();

In your experience, is this final line a necessary measure?

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/3/2009 6:04 PM Bella

Hi again, I get the following error mesasge "This control cannot be displayed because its TagPrefix is not registered in this web form" when I add the Multimedia control to a page layout.

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/3/2009 6:10 PM AC [MVP MOSS]

Matt-
I think ApplyWebConfigMods() makes the changes when called... Update() pushes changes to all servers in the farm. I haven't used it here and it works, but calling Update() can't hurt.

Bella-
You haven't registered the custom server control to the page layout. I believe the document in the CodePlex project demonstrates how to do this. If not, it's no different than an ASP2 page that contains a server control. You need to add a <% @Register %> directive to the page layout pointing to the assembly and registering the control.

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 2/4/2009 10:27 AM Bella

Thanks it is working now, but the registration is not mentioned in the documentation

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 4/22/2009 5:25 PM Modiyam

Hi All,

I'm getting "Error : Object required" when i try to access or edit the content in the Page content.

I created one custom site definition using Publishing site template and created one site, this will create one Page Image and Page Content with some default content.

When ever i go like "Edit page" --> Page Content -->"edit content", its opening the Ritch text editor and displaying the above error,

if i debug the application its going to HtmlEditor --> RTE2_SaveHtml() --> emptyPanel.style.display="none" and pop uping the error,

Any suggestions please,

Thanks
Modiyam

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 7/6/2009 7:13 PM Ted

Hi AC:

We had the CEWP come up as a proposed solution for this problem. I'm wondering what you'd suggest as an alternative:

Being able to call a javascript:window.open within the content to open a new window (in a hyperlink). Javascript is ripped out of the RichHTML control, and creating a custom field control doesn't fit this model, as it would be arbitrary as far as page location.

Thoughts on solving this one? Just build a custom page in SPD?

Thanks!

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 7/8/2009 8:49 AM AC [MVP MOSS}

Ted-
I'm of the mindset that JS should not be in content. With that being said, the CEWP is your only option here aside from modifying the source of the page layout. Why no use a target=_new on the link?

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 11/16/2009 11:17 AM Naz

Hiya,

I'm using Sharepoint 2007 - I have a question : on my master page there is a content editor webpart, which when i last edited i add a java script to it, since then i cannot retrieve the Edit tool bar. I want to delete the webpart and create a new one but i'm abit worried incase it won't let me add one again and the last thing i want to do it have a blank page especially when i have alot of users accessing it

Please help

Naz

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 11/18/2009 6:20 AM AC [MVP MOSS]

Naz-
Add "?contents=1" to the URL to get to the Web Part Maint. Page where you can reset/remove/delete Web Parts on a page.

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 1/6/2010 11:39 AM TimB

Hi AC,

Thanks for the useful article, I was unaware that the CEWP could be disabled in this way.

Quick question though... I was wondering if it is possible to disable the CEWP from just running scripts (javascript) instead?

cheers
-Tim

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 1/14/2010 11:08 AM AC [MVP MOSS]

Tim-
Sorry, this method only kills the CEWP. I don't know how you can kill JS in it.

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 3/2/2010 6:34 AM Ameer

Hi Andrew,
Is there any way we can customize the color panel and font list dropdown on the OOTB CEWP and any Richtext control in MOSS 2007.

We bacially we want to limit the color and Fonts displayed in CEWP.

# re: Blocking the use of the Content Editor Web Part in SharePoint Server 2007 Publishing Sites 4/16/2010 2:00 AM Vikram Singh

Andrew,

I need to put an Object tag inside CDATA of content property, i.e. a COM Component. and the problem i am facing is to replace the Classid property of the Object Tag inside CDATA.

Could you please help me out..

Thanks a lot.

Post Feedback

Title:
Name:
Email:	(email will not be displayed)
Url:
Comments:
Please add 8 and 5 and type the answer here: Remember Me?

All Comments Are Filtered & Moderated
Unfortunately comment spammers are just too effecient and are constantly dirtying up blogs with irrelevant and unwanted comments trying to improve their standing on search engines. All comments on this blog are moderated. I do not censor comments, but I don't approve comments with vulger language or those soliciting products. Most of the time comments are approved within a few hours of being submitted with the only exception when I'm traveling.

Why are you asking for my email address?
The only reason I'm asking for your email address, which isn't required to submit a comment, is to provide a gravatar if you've created an account for yourself and associated your email address with a small image. If you have a gravatar created for the email address you submit, it will appear next to your comment. Otherwise nothing will appear.

What is a gravatar?
A gravatar is a "globally recognized avatar." You can get more information about gravatars, as well as create your own for free, at www.gravatar.com. You can also view my gravatar here.

This work is licensed under a Creative Commons License
Site design by Heather Solomon.