ms security updates and dhtml drag-n-drop

Re: updates

While removing all my crap about butterflies dragged on to dandelions I deleted a bit there. For xtd, ydt subst. posLeft/posTop of dragged object which has onClick=down(this)

function down(o)
{
doDrag=true;
e = window.event;
xoff = e.clientX-o.style.posLeft;
yoff = e.clientY-o.style.posTop;
etc

Re: updates

So the MS suggested workarounds don't work? If so, only thing I can think of is not to use the provided drag methods and do it the old fashioned way:

var xoff,yoff;
var dodrag;

function down()
{
doDrag=true;
e = window.event;
xoff = e.clientX-xtd;
yoff = e.clientY-ytd;
}

document.onmouseup = MouseUp
function MouseUp()
{
if (doDrag)
{
doDrag=false;

//Drop code here, eg copy contents of dragged item to item dragged over

}
}

document.onmousemove = MouseMove
function MouseMove()
{
//If dragging
if (doDrag)
{

//Get mouse position
e = window.event;
x=e.clientX; y=e.clientY;

//Position dragged elements as mouse with appropriate offset eg:
with (document.getElementById("word").style) {posLeft = x-xoff; posTop = y-yoff;}
}

updates

the updates are on the client.

there are security issues with drag & drop ... support.microsoft.com/kb/888534 support.microsoft.com/?kbid=834707 & support.microsoft.com/kb/887614

other dhtml is working (layers, fancy shmancy menus etc)

Updates on the host or the client they are using to view site?Noticed myself that any disabling of scripting in settings only seems to apply to Internet usage, it all still works in hard disc files.

Security mods would disable risk areas, file handling etc, but drag and drop is surely harmless. Maybe worth checking to see if any DHTML is working, if not, I believe one can get a small patch to repair simply the scripting facility alone from the MS website. Otherwise must be some specific feature you are using. Perhaps post code or supply ref?

hi all,

can anyone help?

a client has been using dhtml drag-n-drop functionality on their website. recent ms security updates seem to have disabled this. the internet settings seem to be fine still (all set to enabled), all registry entries are correct, and when i run the pages locally (i.e. off the c: drive), dragging works fine. It's just not working when connected to via the internet.

anyone come across this, and have a solution (that doesnt involve uninstalling the ms security patches) ?

cheers