Difficulty with XSS (cross-site scripting) error on my journal site

Question

I earlier posted a question looking for a ticker for my journal website and managed to code something that works just fine as expected. Well, i found a code that does the trick thanks to that kind fella.

My journal site is ijmasr.com and the ticker is on the right hand sidebar of the landing page titled "Latest News".

My problem is the news has to scroll bottom up and there is a javascrip that gets the job done. Unfortunately, the script does not run because of the no nonsense XSS(cross-site scripting) doing a great job. I have read a little about the topic and have learned HTML encoding could fix this but I have no idea how to go about the fix.

Here is the HTML code i inserted in the custom block.

<div class="ticker">
<h3>Latest News</h3>
<ul id="ticker">
<li><a>IJMASR</a> invites multiple types of research including theoretically grounded studies.</li>
<li><a>IJMASR</a> is an international peer-reviewed multidisciplinary journal that accepts papers from all areas of Management, Science and IT.</li>
</ul>
</div>
<script type="mce-mce-text/javascript">// <![CDATA[
function ticker() {
  $('#ticker li:first').slideUp(function() {
    $(this).appendTo($('#ticker')).slideDown();
  });
}

var timer = setInterval(ticker, 3000);

$('#ticker').on({
  mouseenter:function(){
    clearInterval(timer);
  },
  mouseleave:function(){
    timer = setInterval(ticker, 3000);
  }
});
// ]]></script>

I really need this feature on my journal and cant do away with it. For this reason, i need your ever kind help and guide to fix the html code and keep the ticker and XSS working.

Answer 1

When you created the custom block content, did you click the "HTML" icon on the TinyMCE toolbar in order to go to direct entry of HTML content? Paste your HTML into the resulting pop-up.

I did this, and changed mce-mce-text/javascript to text/javscript, and the automatic scrolling started working.

For OJS 2.4.x you'll also need to change the .on to something else, as the version of JQuery included in that branch is quite old. (OJS 3.0, to be released this summer, will be much more modern.)