8

There was an update in a partner alert about the HTML home page components on February 27th. Now two sentences has been added to this paragraph:

With the Summer '15 release*, Salesforce will no longer support markup that fails the whitelist filter. Any unsupported content will be removed prior to rendering the page. In addition, the Messages & Alerts and Custom Links components will be rewritten and will not include the HTML Home Page Components. We will be phasing these out in Winter ’16.

These sentences are a bit confusing, since HTML Home Page Components were never included in Messages & Alerts and Custom Links.

It would be helpful to get further clarification on this. What exactly will be changed?

4

Now there is official information from Salesforce about this. They will kill this workaround with the Spring '16 Release, which is currently trageted for February 2016.

Email from Salesforce

Admins of Orgs which are using this technique should receive an email like this:

ATTENTION: Messages & Alerts and Custom Link Components Changes

At Salesforce, trust is our #1 value and our priority is to provide customers with the industry’s highest levels of security, availability, and performance. With that in mind, we want to notify you of an important change regarding certain home page components that your organization has used.

What is changing?

The Salesforce Technology team is updating code within the standard Messages & Alerts and Custom Links home page components, including JavaScript and custom HTML markup to comply with our evolving security architecture best practices. These changes will enhance the security of your organization.

How will this affect my organization?

With the Spring ‘16 release*, Salesforce will no longer support code in Messages & Alerts or Custom Links that is not whitelisted. Any unsupported content will be removed prior to rendering the page. This may affect your organization, and we strongly encourage you to plan accordingly to remove any unsupported content in advance.

*Currently targeted for February 2016; date subject to change

What do you recommend?

If you wish to continue using these features, we encourage you to migrate to Visualforce Area home page components, which offer more flexibility and security. These point to a Visualforce page, rendered in an iframe in the home page layout. Alternatively, you can remove or update code that does not pass the markup whitelist.

Note: JavaScript in the Visualforce Area home page component will not be able to interact with standard pages that contain the component.

How can I get more information?

Please see the Message & Alerts and Custom Links Home Page Components changes article for more details. For additional questions, please reach out to Customer Support by opening a case via the Help & Training portal.

Knowledge Article 000229719

https://help.salesforce.com/apex/HTViewSolution?urlname=Message-Alerts-and-Custom-Links-Home-Page-Components-changes&language=en_US&eid=singlesend&d=70130000000NIyh

  1. What is changing and when is the change?

    With the Spring ‘16 release*, changes will be made to better align standard Messages & Alerts and Custom Links home page components markup to comply with our evolving security architecture best practices and we will end support for non-whitelisted content.

    These changes will provide more flexibility in your components and enhance the security of your organization.

    At runtime, standard Messages & Alerts and Custom Links home page components with non-whitelisted markup will no longer be rendered in the page.

*Currently targeted for February 2016; date subject to change

  1. What action do I need to take?

If you wish to continue using these features, we encourage you to migrate to Visualforce Area home page components, which offer more flexibility and security. You can either move the HTML markup to a Visualforce Area component or remove code that does not pass the markup whitelist.

  1. What are Visualforce Area home page components?

Visualforce Area home page components have been available since the Summer ‘14 release. These point to a Visualforce page rendered in an iframe in the home page layout. The iframe takes the full width of the column (narrow or wide) but users specify the height.

Some information about the containing page is passed into the Visualforce page: see #5, How do Visualforce home page components work?

  1. How will I know if there is JavaScript in standard Messages & Alerts and Custom Links home page components?

If you have customized the standard Messages & Alerts or Custom Links home page components with HTML code, you will need to manually review the inserted code to look for the presence of Javascript with a tag or other methods, such as onclick(). To manually review the inserted code, follow these steps:

1) From Setup, click Customize > Home > Home Page Components. Click Edit next to either Messages & Alerts or Custom Links; both components need review and are in the Standard Components related list.

Example of Home Page Components page: Screenshot 1

2) Review the text for HTML code. If the text is plain text, there is no action necessary.

3) If HTML code is present in the text, use the browser search capabilities to search the text block for offending content with a <script> or other methods, such as onclick(). If you find any offending content, either you will need to remove it or replace the entire component with a Visualforce component.

Example of Message & Alerts page with offending content: Screenshot 2

Example of Custom Links page: Screenshot 3

b. An example of acceptable content in the Bookmark fields in standard Custom Links components is as follows:

Bookmark = Salesforce Success Community

URL = https://success.salesforce.com/

If you have manually entered offending content in the Bookmark fields in standard Custom Links components Javascript with a tag or other methods, such as onclick(), either you will need to remove it or replace the entire component with a Visualforce component.

  1. How do Visualforce home page components work?

    • Visualforce home page components allow you to specify a Visualforce page to show on either the home page or in the sidebar on other pages. Visualforce home page components:

    • Can be added to the narrow or wide column of the home page layout.

    • Can use a standard or custom controller.

Are rendered in an iframe in the home page layout. The iframe takes the full width of the column (narrow or wide); you specify the height at design time.

Sometimes receive information as query string parameters, allowing the Visualforce page to display information specific to the top-level page:

  • The path of the top-level page

  • The ID of the record, if the Visualforce home page component is in the narrow column and included in all pages

  • May contain JavaScript, but the JavaScript will not be able to interact with the page containing the iframe as Visualforce pages are served on a different domain.

    1. Based on the record/tab I'm viewing, can I use a Visualforce home page component to render different information in the sidebar?

Yes, as long as the rendered content is contained within the iframe in the sidebar. For example, if you have a list of links that change depending on whether you're viewing an account or an opportunity, then you can use a Visualforce home page component.

  1. Can I use a Visualforce home page component that shows up in the sidebar for some pages, but not others?

No, you can choose to have sidebar components display only on the home page or display on all pages in the User Interface settings. But if the component displays on all pages, then it displays on all pages -- for example, there's no way to display it only on record detail pages.

  1. Can I use JavaScript in a Visualforce home page component?

Yes, Visualforce pages used in home page components have no additional restrictions compared to Visualforce pages used in tabs (see Using JavaScript in Visualforce Pages in Help & Training). However, the JavaScript cannot interact with elements outside the iframe.

  1. On a record detail page, can I use JavaScript in a Visualforce home page component to hide or show content?

No, Visualforce pages are served on a different domain and are rendered in an iframe. They cannot interact with pages served in the Salesforce domain.

  1. If I’d like to change the style of headings or other elements in a record detail page, can I use JavaScript in a Visualforce home page component?

No, Visualforce pages are served on a different domain and are rendered in an iframe. They cannot interact with pages served in the Salesforce domain.

  1. What happens if my standard Messages & Alerts and Custom Links home page components used an iframe to point to a page that's not a Visualforce page?

These components will not allow iframes as part of the whitelisted markup. You can create a Visualforce home page component and redirect to another page from within the Visualforce page.

  1. I have customized Salesforce to leverage JavaScript in standard Messages & Alerts and Custom Links home page components, and this change is going to eliminate a lot of my customizations. How can I avoid eliminating my customizations?

We realize that this change may cause inconvenience for you, yet you will not be able to avoid the customizations from being eliminated. This notice should provide time to replace standard Messages & Alerts and Custom Links home page components with Visualforce home page components. Salesforce does not recommend or support the use of JavaScript in home page components (and never has) -- particularly if the JavaScript is used to interact with markup served by Salesforce, because we can't guarantee that our page markup will remain the same between releases.

3

It looks like this means that Messages & Alerts and Custom Links will be rewritten and filter out unsupported markup and JavaScript. Another interpretation could be that the Messages & Alerts and Custom Links Components will be removed at all.

This would also align with the explanations from Robert Sussland here End of javascript sidebar workarounds?

As a result all Sidebar workarounds might no longer be possible using the patterns discussed in the question above.

  • 1
    With the release of Winter '16 to sandboxes now, have you been able to determine whether this is true? Is there a way to automatically execute javascript in the sidebar? – Nick Cook Oct 1 '15 at 1:20
  • 1
    It seems that with Winter'16 the REQUIRESCRIPT function does not work as reliable as before - at least on one Org I can reproduce it. Will let you know as soon I checked in other Orgs. On the Org where it did not work anymore I used Messages&Alerts as a workaround - but be aware that even this will be shutdown soon as described in my second answer. – Uwe Heim Oct 8 '15 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.