Open List items in Modal Dialog from CQWP /XSLT

I was working on a requirement to open list items in Modal dialog listed in Content Query Web Part.  

So what we need to do here is just remove href attribute and adding onclick event to call ModalDialog and open the url (SafeLinkUrl). Also added onmouseover event to show hand as cursor when mouse over on the text.

<a onclick="javascript:SP.UI.ModalDialog.ShowPopupDialog('{$SafeLinkUrl}'); return false;" onmouseover="javascript:this.style.cursor='hand';" title="{@LinkToolTip}">

Here are the steps 

1. Open the root site with in SharePoint designer and go to All items > Style library> XSL Style Sheets.
2. Open ItemStyle.xsl file and edit it (take the backup to be safe)
3. Paste below section to the end of the file just above </xsl:stylesheet>.

<xsl:template name="ModalDialogBullets" match="Row[@Style='ModalDialogBullets']" mode="itemstyle">

        <xsl:variable name="SafeLinkUrl">

            <xsl:call-template name="OuterTemplate.GetSafeLink">

                <xsl:with-param name="UrlColumnName" select="'LinkUrl'"/>

            </xsl:call-template>

        </xsl:variable>

        <xsl:variable name="DisplayTitle">

            <xsl:call-template name="OuterTemplate.GetTitle">

                <xsl:with-param name="Title" select="@Title"/>

                <xsl:with-param name="UrlColumnName" select="'LinkUrl'"/>

            </xsl:call-template>

        </xsl:variable>

        <div class="item link-item bullet">

            <xsl:call-template name="OuterTemplate.CallPresenceStatusIconTemplate"/>

            <a onclick="javascript:SP.UI.ModalDialog.ShowPopupDialog('{$SafeLinkUrl}'); return false;" onmouseover="javascript:this.style.cursor='hand';" title="{@LinkToolTip}">

                        <xsl:value-of select="$DisplayTitle"/>

            </a>

        </div>

    </xsl:template> 

4.      Save the file and check it in. 

5.      You need to update the ItemStyle of CQWP and apply this one.  Edit CQWP > Presentations > ItemStyle.

That’s all. Hope this Help.

SharePoint 2007 vs SharePoint 2010

One place for all of the comparison information between SharePoint 2007 vs SharePoint 2010

Open PDF files in browser

In SharePoint when you try to open a PDF you are forced to download the file. Downloading can be avoided. To fix this we need to do some config changes in Central Admin. There are two options to achieve the same

First option –

• Go to Central Administration > Application Management > Manage web application under web application
• Select the web application then click on general settings from Ribbon > then Change “Browser File Handling” to Permissive.
• Click Ok.

• Do an IISRESET

Note - From a security point of view I don't think it is a good idea to change the 'Browser File Handling' to 'Permissive'.

Here is another option to allow PDF to be opened in browser from Sharepoint.

1. Open the "SharePoint 2010 Management Shell", running as Farm Administrator;
2. Execute the following commands – (Replace < YourSiteURL> with your web application url)  

$webApp = Get-SPWebApplication http://YourSiteURL
$webApp.AllowedInlineDownloadedMimeTypes.Add("application/pdf")
$webApp.Update()

           Or you can save as PowerShell script and execute that

            Here is script  

           $webApp = Get-SPWebApplication http://YourSiteURL

           If ($webApp.AllowedInlineDownloadedMimeTypes -notcontains "application/pdf")

           {

               Write-Host -ForegroundColor White "Adding Pdf MIME Type..."

               $webApp.AllowedInlineDownloadedMimeTypes.Add("application/pdf")

               $webApp.Update()

               Write-Host -ForegroundColor White " Pdf MIME Type added and saved."

            } 

            Else {

                  Write-Host -ForegroundColor White "Pdf MIME type is already added."

            }

      3. Do an IISRESET.

if you want to open an .msg file, or other file type saved in SharePoint without being asked to download it first; you just have to change the MIME type.
Like for .msg file $webApp.AllowedInlineDownloadedMimeTypes.Add("application/vnd.ms-outlook")

Hope that helps anyone out there.

SharePoint prompts user for credentials (login/password)

In MOSS - I found this could be due to following reasons:

1. If you are not using proper authentication in IIS for web app, in this use integrated authentication.
2. It may due to proxy settings(if you are using a proxy server (intranet)) , in this case go to tools in IE--> internet options --> connection--.LAN settings --> advanced --.> exception. Add the site over there.
3. If you have sync setup with mysite or lists with your outlook, in this remove it from your Outlook profile.
4. due to IE unable to authenticate user when using IE 7 and 8 with SP 2007.  To fix that follow these steps.

• Go to Internet Options -> Security tab
• Select Trusted sites Zone -> Click on Sites ->Add the SP site to Trusted Sites. (http://*.yourdomain)
• Then check the settings under Custom Level (for trusted sites) - scroll to the bottom and look at the Security settings for User Authentication. Make sure it's set to Auto Logon with current user name and password.
• Click OK and OK again. Restart IE and try your site.

If SharePoint prompt when opening Office documents, try this registry change:

1. Click Start, type regedit in the Start Search box, and then press ENTER.
2. Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters
3. On the Edit menu, point to New, and then click Multi-String Value.
4. Type AuthForwardServerList, and then press ENTER.
5. On the Edit menu, click Modify.
6. In the Value data box, type in the following:
7. http://*.your domain
8. Exit Registry Editor

Protect SharePoint from Framesniffing Attack

What is Framesniffing attack?

The Framesniffing technique uses an HTML iframe to load a target website inside of an attacker’s webpage. All web browsers have security restrictions that prevent a webpage from directly reading the contents of pages loaded in frames. However, this attack bypasses those measures, allowing a malicious webpage to read certain pieces of information about the structure of a framed page, by using anchor elements.

How does it affect SharePoint?

Even though SharePoint is accessible on internal network, but it’s loading in web browser. By default, SharePoint 2007 and 2010 do not send the X-Frame-Options header. This means that any website that knows the URL of organisation’s SharePoint can load it in an iframe. This attack works by checking for anchors on search result pages.

Watch this demo how Framesniffing works with SharePoint - http://www.contextis.co.uk/research/blog/framesniffing/

The video shows an attacker extracting sensitive information from a fictional corporate SharePoint installation. The attacker then searches the server to discover crucial information about upcoming acquisition. To achieve this, the attacker first lures a user with access to the SharePoint server to a malicious web page. While the user is viewing the page, the attacker uses the Framesniffing to infer information from the SharePoint server through their web browser.

What Microsoft Says about this vulnerability?

“We have concluded our investigation and determined that this is by-design in current versions of SharePoint. We are working to set the X-Frame options in the next version of SharePoint”.

How to protect SharePoint against Framesniffing?

Websites can protect themselves against Framesniffing attacks by sending the X-Frame-Options HTTP header. Protecting SharePoint from this attack is a simple matter of adding the X-Frame-Options header.

Following steps describe how to add the custom header in IIS7. This is for SharePoint as an example, but the instructions will work for any site:

1. Open IIS Manager (Run > InetMgr)
2. In the left pane navigate to the relevant web site ( SharePoint – 80)
3. In the right pane Select the ‘Features View’ present at lower left corner
4. Double-click the ‘HTTP Response Headers’ icon
5. Click the ‘Add…’ link in the right pane
6. Enter ‘X-Frame-Options’ in the name field and ‘SAMEORIGIN’ in the value field. Hit OK.

Note – This setting will prevent SharePoint from being open in frame, it could potentially break SharePoint in some setups – for example if another intranet application uses SharePoint via a frame. Be sure to test this change before putting it into production.

Browser Protection against Framesniffing Attacks

Users of the Firefox browser are already protected against Framesniffing. However the latest versions of Internet Explorer, Chrome and Safari are still vulnerable to these attacks.

SharePoint Code Samples

Microsoft has created 101 code samples for SharePoint 2010. These samples cover a wide range of useful tasks from working with lists and document libraries, to using BCS.
Check them out.
Sharepoint 2010 101 code samples

Removing author from search results

Follow these instructions to remove the author from search results.

- Navigate to the Advanced Search Page;
- Perform a search to return some search results;
- Edit the page (Site Settings | Edit Page);
- Edit the Search Core Results WebPart (Edit | Modify Shared WebPart);
- Under the Data View Properties click the XSL Editor button;
- Select all the XSL and save it somewhere to back up the default XSL;

Remove these lines and save the changes.
< xsl:call-template name="DisplayString">
<xsl:with-param name="str" select="author" />
< /xsl:call-template>

Hope this will help!