Navigation panes empty with Internet Explorer Enhanced Security enabled

[AMHP]

I have recently discovered the Contents, Index, and Search tabs in the navigation pane in my WebHelp are empty in Internet Explorer 9 when Enhanced Security is enabled.

Things I have tried:

Enabled scripting in the IE options.

Added the location of the files to the trusted sites list - Further investigation reveals that the HTML files have the mark of the web, so I had not done this step correctly. Once I added about:internet to the list of trusted sites, the WebHelp opens and operates correctly. I don't fully understand the security implications of adding this to the list of trusted sites, so if anybody can provide any detail here...

The WebHelp opens in IE with any prompts about JavaScript not beeing enabled, but the nav panes are empty. The "landing page" is visible.

When I disable Enhanced Security, the WebHelp operates correctly.

The WebHelp is produced using RoboHelp 8 on Windows Server 2003 R2. It is a merged WebHelp (created using the very helpful instructions provided by Peter Grainge.)

The OS on which I am viewing the WebHelp is Windows Server 2008 R2, but it is likely all OSs where IE enhanced security is used, but will try other OSs.

So far I have not tested other browsers due to organisational restrictions on the browsers that are allowed.

I see there is a similar post about the navigtation pane being empty with the suggestion to check for changes to security settings, however, not further advice beyond enabling scripting, or what to do if the problem persists.

Message was edited by: AMHP

[Peter Grainge]

My guess is that enhanced security is blocking Active X. If it doesn't give the option to allow that to run, you are snookered.

Is this a real world problem and you have users with that setting? I ask as no one else has reported this.

Not sure but this may only be an issue using skins. Try generating an output without one. Not so pretty but if you are forced to use enhanced security, it may be a solution. Rick Stone will be on the forum later and I believe he will know about this aspect.

---

See www.grainge.org for RoboHelp and Authoring tips

@petergrainge

[AMHP]

I am informed that this is a real world problem in that customer sites will be using enhanced security. Also, am generating WebHelp without skins.

Over the course of yesterday, my issue evolved to become more about how I can get the WebHelp to open correctly without customer sites having to add "about:internet" to the list of trusted sites. On further testing yesterday, all I had to do was add about:internet to the list of trusted sites and the WebHelp worked, including the navigation panes. I have been told that adding about:internet to the list of trusted sites was not a good thing to do from a security perspective.

When I generated the WebHelp, I clicked the "Add the mark of the web" checkbox to avoid the prompt about having to enable JavaScript when the WebHelp is viewed on the same node on which it is installed. In RoboHelp 8, is there a way you can customize the mark of the web that is added to the HTML pages? I'd like to do some testing to add a mark that relates to something that our software installation adds to the list of trusted sites (if that makes sense). (I suppose I could use Notepad++ to perform a search and replace across all my files, but this would have to be done every time the help is generated, and potentially error prone.)

[Captiv8r]

Hi there

Sorry if this sounds dense, but are you seeing this behavior only when running the content locally from the server or is it happening when the content is viewed via HTTP requests? (Intranet or Internet)

If it's only when the content is being viewed locally, the question I would ask is if that's also how you are expecting the users to view it?

Keep in mind that Mark of the Web is something that should only apply if you are viewing the content locally (as in double-clicking the WebHelp start page from Windows Explorer). It *SHOULDN'T* have any effect on pages served via HTTP requests.

Cheers... Rick

[AMHP]

Hi Rick,

Doesn't sound dense at all. The issue is only happening when running the content locally. We have a server-client architecture, and when the WebHelp is called by the client application, it's accessing the WebHelp from the server, and after some testing today, there is no issue on the client with enhanced security enabled. Users can access the WebHelp from the application on the server, which is where the issue is being experienced.

Am about to test changing the mark of the web to something other than

<!-- saved from url=(0014)about:internet -->

Would be good to know if this could be achieved in RoboHelp 8.

Thanks,

Alison

[Captiv8r]

Thanks for the info, Alison

Well, assuming you are determined to leave MOTW enabled, you could run a find and replace operation on the output files and change that line.

If you look, you will see that about:internet is exactly 14 characters long. That is why you see (0014). So you could use some different text there. about:foobear and change the number to (0013).

Cheers... Rick

[Captiv8r]

I might think the simpler approach would be just to turn off MOTW.

[Flaven]

I can attest this is happening with Internet Explorer 11 and Firefox 24. It was not pleasant to discover.