Custom code security measures

Org Chart provides flexible customization features. In most cases, it doesn’t require any custom code but sometimes customers need complex modifications of the org chart. For cases like this, the web part supports advanced capabilities specifically designed to safely customize your org chart. It includes custom HTML, CSS, and JavaScript that can be applied to Org Chart boxes.

The web part implements security measures to make this possible. Here is how it works.

Only Tenant Administrator can edit JavaScript

The web part stores all JavaScript customizations in SharePoint Tenant Properties. It guarantees that nobody except the Tenant Administrator (Global Administrator) can edit them. If you are not a Tenant Administrator you may see this screen when trying to access the JavaScript code:

JavaScript editing not available

HTML templates are sanitized before rendering

HTML templates are applied only to Org Chart user interface:

  • Boxes

  • Tooltips

  • Search results

Any user-defined HTML templates are sanitized before rendering. It means no custom JavaScript can be inserted into templates. Only valid HTML markup passes sanitizer.

CSS styles are sanitized before executing

Custom CSS styles are used for advanced boxes customization. All styles are sanitized before applying to the web part. No JavaScript can be inserted into styles.

JavaScript customizations can be disabled on tenant level

Tenant Administrators can disable JavaScript customizations on the tenant level. Contact for guidance.