FEDORA-EPEL-2019-6091317017

security update in Fedora EPEL 7 for ckeditor

Status: stable 2 months ago

CKEditor 4.11.2

Fixed Issues:

  • #2403: Fixed: Styling inline editor initialized inside a table with the Table Selection plugin is causing style leaks.
  • #2514: Fixed: Pasting table data into inline editor initialized inside a table with the Table Selection plugin inserts pasted content into the wrapping table.
  • #2451: Fixed: The Remove Format plugin changes selection.
  • #2546: Fixed: The separator in the toolbar moves when buttons are focused.
  • #2506: Fixed: Enhanced Image throws a type error when an empty <figure> tag with an image class is upcasted.
  • #2650: Fixed: Table dialog validator fails when the getValue()function is defined in the global scope.
  • #2690: Fixed: Decimal characters are removed from the inside of numbered lists when pasting content using the Paste from Word plugin.
  • #2205: Fixed: It is not possible to add new list items under an item containing a block element.
  • #2411, #2438 Fixed: Apply numbered list option throws a console error for a specific markup.
  • #2430 Fixed: Color Button and List Block items are draggable.

Other Changes:

  • Updated the WebSpellChecker (WSC) plugin:
    • #52 Fixed: Clicking "Finish Checking" without a prior action would hang the Spell Checking dialog.
  • #2603: Corrected the GPL license entry in the package.json file.

CKEditor 4.11.1

Fixed Issues:

  • #2571: Fixed: Clicking the categories in the Emoji dropdown panel scrolls the entire page.

CKEditor 4.11

Security Updates:

  • Fixed XSS vulnerability in the HTML parser reported by maxarr.

    Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode.

An upgrade is highly recommended!

New Features:

  • #2062: Added the emoji dropdown that allows the user to choose the emoji from the toolbar and search for them using keywords.
  • #2154: The Link plugin now supports phone number links.
  • #1815: The Auto Link plugin supports typing link completion.
  • #2478: Link can be inserted using the <kbd>Ctrl</kbd>/<kbd>Cmd</kbd> + <kbd>K</kbd> keystroke.
  • #651: Text pasted using the Paste from Word plugin preserves indentation in paragraphs.
  • #2248: Added support for justification in the BBCode plugin. Thanks to Matěj Kmínek!
  • #706: Added a different cursor style when selecting cells for the Table Selection plugin.
  • #2072: The UI Button plugin supports custom aria-haspopup property values. The Menu Button aria-haspopup value is now menu, the Panel Button and Rich Combo aria-haspopup value is now listbox.
  • #1176: The Balloon Panel can now be attached to a selection instead of an element.
  • #2202: Added the contextmenu_contentsCss configuration option to allow adding custom CSS to the Context Menu.

Fixed Issues:

  • #1477: Fixed: On destroy, Balloon Toolbar does not destroy its content.
  • #2394: Fixed: Emoji dropdown does not show up with repeated symbols in a single line.
  • #1181: [Chrome] Fixed: Opening the context menu in a read-only editor results in an error.
  • #2276: [iOS] Fixed: Button state does not refresh properly.
  • #1489: Fixed: Table contents can be removed in read-only mode when the Table Selection plugin is used.
  • #1264 Fixed: Right-click does not clear the selection created with the Table Selection plugin.
  • #586 Fixed: The required attribute is not correctly recognized by the Form Elements plugin dialog. Thanks to Roli Züger!
  • #2380 Fixed: Styling HTML comments in a top-level element results in extra paragraphs.
  • #2294 Fixed: Pasting content from Microsoft Outlook and then bolding it results in an error.
  • #2035 [Edge] Fixed: Permission denied is thrown when opening a Panel instance.
  • #965 Fixed: The config.forceSimpleAmpersand option does not work. Thanks to Alex Maris!
  • #2448: Fixed: The [Escape HTML Entities] plugin with custom additional entities configuration breaks HTML escaping.
  • #898: Fixed: Enhanced Image long alternative text protrudes into the editor when the image is selected.
  • #1113: [Firefox] Fixed: Nested contenteditable elements path is not updated on focus with the Div Editing Area plugin.
  • #1682 Fixed: Hovering the Balloon Toolbar panel changes its size, causing flickering.
  • #421 Fixed: Expandable Button puts the (Selected) text at the end of the label when clicked.
  • #1454: Fixed: The onAbort method of the Upload Widget is not called when the loader is aborted.
  • #1451: Fixed: The context menu is incorrectly positioned when opened with <kbd>Shift</kbd>+<kbd>F10</kbd>.
  • #1722: CKEDITOR.filter.instances is causing memory leaks.
  • #2491: Fixed: The Mentions plugin is not matching diacritic characters.
  • #2519: Fixed: The Accessibility Help dialog should display all available keystrokes for a single command.

API Changes:

Other Changes:

  • #1713: Removed the redundant lang.title entry from the Clipboard plugin.

CKEditor 4.10.1

Fixed Issues:

  • #2114: Fixed: Autocomplete cannot be initialized before instanceReady.
  • #2107: Fixed: Holding and releasing the mouse button is not inserting an autocomplete suggestion.
  • #2167: Fixed: Matching in Emoji plugin is not case insensitive.
  • #2195: Fixed: Emoji shows the suggestion box when the colon is preceded with other characters than white space.
  • #2169: [Edge] Fixed: Error thrown when pasting into the editor.
  • #1084 Fixed: Using the "Automatic" option with Color Button on a text with the color already defined sets an invalid color value.
  • #2271: Fixed: Custom color name not used as a label in the Color Button plugin. Thanks to Eric Geloen!
  • #2296: Fixed: The Color Button plugin throws an error when activated on content containing HTML comments.
  • #966: Fixed: Executing editor.destroy() during the file upload throws an error. Thanks to Maksim Makarevich!
  • #1719: Fixed: <kbd>Ctrl</kbd>/<kbd>Cmd</kbd> + <kbd>A</kbd> inadvertently focuses inline editor if it is starting and ending with a list. Thanks to theNailz!
  • #1046: Fixed: Subsequent new links do not include the id attribute. Thanks to Nathan Samson!
  • #1348: Fixed: Enhanced Image plugin aspect ratio locking uses an old width and height on image URL change.
  • #1791: Fixed: Image and Enhanced Image plugins can be enabled when Easy Image is present.
  • #2254: Fixed: Image ratio locking is too precise for resized images. Thanks to Jonathan Gilbert!
  • #1184: [IE8-11] Fixed: Copying and pasting data in read-only mode throws an error.
  • #1916: [IE9-11] Fixed: Pressing the <kbd>Delete</kbd> key in read-only mode throws an error.
  • #2003: [Firefox] Fixed: Right-clicking multiple selected table cells containing empty paragraphs removes the selection.
  • #1816: Fixed: Table breaks when <kbd>Enter</kbd> is pressed over the Table Selection plugin.
  • #1115: Fixed: The <font> tag is not preserved when proper configuration is provided and a style is applied by the Font plugin.
  • #727: Fixed: Custom styles may be invisible in the Styles Combo plugin.
  • #988: Fixed: ACF-enabled custom elements prefixed with object, embed, param are removed from the editor content.

API Changes:

CKEditor 4.10

New Features:

  • #1751: Introduced the Autocomplete feature that consists of the following plugins:
  • #1703: Introduced the Mentions plugin providing smart completion feature for custom text matches based on user input starting with a chosen marker character.
  • #1746: Introduced the Emoji plugin providing completion feature for emoji ideograms.
  • #1761: The Auto Link plugin now supports email links.

Fixed Issues:

  • #1458: [Edge] Fixed: After blurring the editor it takes 2 clicks to focus a widget.
  • #1034: Fixed: JAWS leaves forms mode after pressing the <kbd>Enter</kbd> key in an inline editor instance.
  • #1748: Fixed: Missing CKEDITOR.dialog.definition.onHide API documentation. Thanks to sunnyone!
  • #1321: Fixed: Ideographic space character (\u3000) is lost when pasting text.
  • #1776: Fixed: Empty caption placeholder of the Image Base plugin is not hidden when blurred.
  • #1592: Fixed: The Image Base plugin caption is not visible after paste.
  • #620: Fixed: The config.forcePasteAsPlainText option is not respected in internal and cross-editor pasting.
  • #1467: Fixed: The resizing cursor of the Table Resize plugin appearing in the middle of a merged cell.

API Changes:

Other Changes:

  • Updated SCAYT (Spell Check As You Type) and WebSpellChecker (WSC) plugins:
    • Language dictionary update: Added support for the Uzbek Latin language.
    • Languages no longer supported as additional languages: Manx - Isle of Man (gv_GB) and Interlingua (ia_XR).
    • Extended and improved language dictionaries: Georgian and Swedish. Also added the missing word "Ensure" to the American, British and Canada English language.
    • #141 Fixed: SCAYT throws "Uncaught Error: Error in RangyWrappedRange module: createRange(): Parameter must be a Window object or DOM node".
    • #153 [Chrome] Fixed: Correcting a word in the widget in SCAYT moves focus to another editable.
    • #155 [IE8] Fixed: SCAYT throws an error and does not work.
    • #156 [IE10] Fixed: SCAYT does not seem to work.
    • Fixed: After some text is dragged and dropped, the markup is not refreshed for grammar problems in SCAYT.
    • Fixed: Request to FastCGI fails when the user tries to replace a word with non-English characters with a proper suggestion in WSC.
    • [Firefox] Fixed: <kbd>Ctrl</kbd>+<kbd>Z</kbd> removes focus in SCAYT.
    • Grammar support for default languages was improved.
    • New application source URL was added in SCAYT.
    • Removed green marks and legend related to grammar-supported languages in the Languages tab of SCAYT. Grammar is now supported for almost all the anguages in the list for an additional fee.
    • Fixed: JavaScript error in the console: "Cannot read property 'split' of undefined" in SCAYT and WSC.
    • [IE10] Fixed: Markup is not set for a specific case in SCAYT.
    • Fixed: Accessibility issue: No alt attribute for the logo image in the About tab of SCAYT.

CKEditor 4.9.2

Security Updates:

  • Fixed XSS vulnerability in the Enhanced Image (image2) plugin reported by Kyaw Min Thein.

    Issue summary: It was possible to execute XSS inside CKEditor using the <img> tag and specially crafted HTML. Please note that the default presets (Basic/Standard/Full) do not include this plugin, so you are only at risk if you made a custom build and enabled this plugin.

We would like to thank the Drupal security team for bringing this matter to our attention and coordinating the fix and release process!

CKEditor 4.9.1

Fixed Issues:

CKEditor 4.9

New Features:

  • #932: Introduced Easy Image feature for inserting images that are automatically rescaled, optimized, responsive and delivered through a blazing-fast CDN. Three new plugins were added to support it:
  • #1338: Keystroke labels are displayed for function keys (like F7, F8).
  • #643: The File Browser plugin can now upload files using XHR requests. This allows for setting custom HTTP headers using the config.fileTools_requestHeaders configuration option.
  • #1365: The File Browser plugin uses XHR requests by default.
  • #1399: Added the possibility to set CKEDITOR.config.startupFocus as start or end to specify where the editor focus should be after the initialization.
  • #1441: The Magic Line plugin line element can now be identified by the data-cke-magic-line="1" attribute.

Fixed Issues:

  • #595: Fixed: Pasting does not work on mobile devices.
  • #869: Fixed: Empty selection clears cached clipboard data in the editor.
  • #1419: Fixed: The Widget Selection plugin selects the editor content with the <kbd>Alt+A</kbd> key combination on Windows.
  • #1274: Fixed: Balloon Toolbar does not match a single selected image using the contextDefinition.cssSelector matcher.
  • #1232: Fixed: Balloon Toolbar buttons should be registered as focusable elements.
  • #1342: Fixed: Balloon Toolbar should be re-positioned after the change event.
  • #1426: [IE8-9] Fixed: Missing Balloon Toolbar background in the Kama skin. Thanks to Christian Elmer!
  • #1470: Fixed: Balloon Toolbar is not visible after drag and drop of a widget it is attached to.
  • #1048: Fixed: Balloon Panel is not positioned properly when a margin is added to its non-static parent.
  • #889: Fixed: Unclear error message for width and height fields in the Image and Enhanced Image plugins.
  • #859: Fixed: Cannot edit a link after a double-click on the text in the link.
  • #1013: Fixed: Paste from Word does not work correctly with the config.forcePasteAsPlainText option.
  • #1356: Fixed: Border parse function does not allow spaces in the color value.
  • #1010: Fixed: The CSS border shorthand property was incorrectly expanded ignoring the border-color style.
  • #1535: Fixed: Widget mouseover border contrast is insufficient.
  • #1516: Fixed: Fake selection allows removing content in read-only mode using the <kbd>Backspace</kbd> and <kbd>Delete</kbd> keys.
  • #1570: Fixed: Fake selection allows cutting content in read-only mode using the <kbd>Ctrl</kbd>/<kbd>Cmd</kbd> + <kbd>X</kbd> keys.
  • #1363: Fixed: Paste notification is unclear and it might confuse users.

API Changes:

Other Changes:

  • Updated SCAYT (Spell Check As You Type) and WebSpellChecker (WSC) plugins:
    • SCAYT scayt_minWordLength configuration option now defaults to 3 instead of 4.
    • SCAYT default number of suggested words in the context menu changed to 3.
    • #90: Fixed: Selection is lost on link creation if SCAYT highlights the word.
    • Fixed: SCAYT crashes when the browser localStorage is disabled.
    • [IE11] Fixed: Unable to get property type of undefined or null reference error in the browser console when SCAYT is disabled/enabled.
    • #46: Fixed: Editing is blocked when remote spell checker server is offline.
    • Fixed: User Dictionary cannot be created in WSC due to You already have the dictionary error.
    • Fixed: Words with apostrophe ' on the replacement make the WSC dialog inaccessible.
    • Fixed: SCAYT/WSC causes the Uncaught TypeError error in the browser console.
  • #1337: Updated the samples layout with the new CKEditor 4 logo and color scheme.
  • #1591: CKBuilder and language tools are now downloaded over HTTPS. Thanks to August Detlefsen!

CKEditor 4.8

Important Notes:

New Features:

  • #933: Introduced Balloon Toolbar plugin.
  • #662: Introduced image inlining for the Paste from Word plugin.
  • #468: [Edge] Introduced support for the Clipboard API.
  • #607: Manually inserted Hex color is prefixed with a hash character (#) if needed. It ensures a valid Hex color value is used when setting the table cell border or background color with the Color Dialog window.
  • #584: Font size and Family and Format drop-downs are not toggleable anymore. Default option to reset styles added.
  • #856: Introduced the CKEDITOR.tools.keystrokeToArray() method. It converts a keystroke into its string representation, returning every key name as a separate array element.
  • #1053: Introduced the CKEDITOR.tools.object.merge() method. It allows to merge two objects, returning the new object with all properties from both objects deeply cloned.
  • #1073: Introduced the CKEDITOR.tools.array.every() method. It invokes a given test function on every array element and returns true if all elements pass the test.

Fixed Issues:

  • #796: Fixed: A list is pasted from OneNote in the reversed order.
  • #834: [IE9-11] Fixed: The editor does not save the selected state of radio buttons inserted by the Form Elements plugin.
  • #704: [Edge] Fixed: Using <kbd>Ctrl</kbd>/<kbd>Cmd</kbd> + <kbd>Z</kbd> breaks widget structure.
  • #591: Fixed: A column is inserted in a wrong order inside the table if any cell has a vertical split.
  • #787: Fixed: Using Cut inside a nested table does not cut the selected content.
  • #842: Fixed: List style not restored when toggling list indent level in the Indent List plugin.
  • #711: Fixed: Dragging widgets should only work with the left mouse button.
  • #862: Fixed: The "Object Styles" group in the Styles Combo plugin is visible only if the whole element is selected.
  • #994: Fixed: Typo in the CKEDITOR.focusManager.focus() API documentation. Thanks to benjy!
  • #1014: Fixed: The Table Tools Cell Properties dialog is now Advanced Content Filter aware — it is not possible to change the cell width or height if corresponding styles are disabled.
  • #877: Fixed: A list with custom bullets with exotic characters crashes the editor when pasted from Word.
  • #605: Fixed: Inline widgets do not preserve trailing spaces.
  • #1008: Fixed: Shorthand Hex colors from the config.colorButton_colors option are not correctly highlighted in the Color Button Text Color or Background Color panel.
  • #1094: Fixed: Widget definition upcast methods are called for every element.
  • #1057: Fixed: The Notification plugin overwrites Web Notifications API due to leakage to the global scope.
  • #1068: Fixed: Upload widget paste listener ignores changes to the uploadWidgetDefinition.
  • #921: Fixed: [Edge] CKEditor erroneously perceives internal copy and paste as type "external".
  • #1213: Fixed: Multiple images uploaded using Upload Image plugin are randomly duplicated or mangled.
  • #532: Fixed: Removed an outdated user guide link from the About dialog.
  • #1221: Fixed: Invalid CSS loaded by Balloon Panel plugin when config.skin is loaded using a custom path.
  • #522: Fixed: Widget selection is not removed when widget is inside table cell with Table Selection plugin enabled.
  • #1027: Fixed: Cannot add multiple images to the table with Table Selection plugin in certain situations.
  • #1069: Fixed: Wrong shape processing by Paste from Word plugin.
  • #995: Fixed: Hyperlinked image gets inserted twice by Paste from Word plugin.
  • #1287: Fixed: Widget plugin throws exception if included in editor build but not loaded into editor's instance.

API Changes:

Other Changes:

  • #815: Removed Node.js dependency from the CKEditor build script.
  • #1041, #1131: Updated URLs pointing to CKSource and CKEditor resources after the launch of new websites.

CKEditor 4.7.3

New Features:

Fixed Issues:

  • #554: Fixed: change event not fired when typing the first character after pasting into the editor. Thanks to Daniel Miller!
  • #566: Fixed: The CSS border shorthand property with zero width (border: 0px solid #000;) causes the table to have the border attribute set to 1.
  • #779: Fixed: The Remove Format plugin removes elements with language definition inserted by the Language plugin.
  • #423: Fixed: The Paste from Word plugin pastes paragraphs into the editor even if CKEDITOR.config.enterMode is set to CKEDITOR.ENTER_BR.
  • #719: Fixed: Image inserted using the Enhanced Image plugin can be resized when the editor is in read-only mode.
  • #577: Fixed: The "Delete Columns" command provided by the Table Tools plugin throws an error when trying to delete columns.
  • #867: Fixed: Typing into a selected table throws an error.
  • #817: Fixed: The Save plugin does not work in Source Mode.

Other Changes:

CKEditor 4.7.2

New Features:

Fixed Issues:

  • #663: [Chrome] Fixed: Clicking the scrollbar throws an Uncaught TypeError: element.is is not a function error.
  • #694: Refactoring in the Table Selection plugin:
  • #520: Fixed: Widgets cannot be properly pasted into a table cell.
  • #460: Fixed: Editor gone after pasting into an editor within a table.
  • #579: Fixed: Internal cke_table-faked-selection-table class is visible in the Stylesheet Classes field of the Table Properties dialog.
  • #545: [Edge] Fixed: Error thrown when pressing the Select All button in Source Mode.
  • #582: Fixed: Double slash in the path to stylesheet needed by the Table Selection plugin. Thanks to Marius Dumitru Florea!
  • #491: Fixed: Unnecessary dependency on the Editor Toolbar plugin inside the Notification plugin.
  • #646: Fixed: Error thrown into the browser console after opening the Styles Combo plugin menu in the editor without any selection.
  • #501: Fixed: Double click does not open the dialog for modifying anchors inserted via the Link plugin.
  • #9780: [IE8-9] Fixed: Clicking inside an empty read-only editor throws an error.
  • #16820: [IE10] Fixed: Clicking below a single horizontal rule throws an error.
  • #426: Fixed: The range.cloneContents() method selects the whole element when the selection starts at the beginning of that element.
  • #644: Fixed: The range.extractContents() method returns an incorrect result when multiple nodes are selected.
  • #684: Fixed: The elementPath.contains() method incorrectly excludes the last element instead of root when the fromTop parameter is set to true.

Other Changes:

CKEditor 4.7.1

New Features:

Fixed Issues:

  • #515: [Chrome] Fixed: Mouse actions on CKEditor scrollbar throw an exception when the Table Selection plugin is loaded.
  • #493: Fixed: Selection started from a nested table causes an error in the browser while scrolling down.
  • #415: [Firefox] Fixed: <kbd>Enter</kbd> key breaks the table structure when pressed in a table selection.
  • #457: Fixed: Error thrown when deleting content from the editor with no selection.
  • #478: [Chrome] Fixed: Error thrown by the Enter Key plugin when pressing <kbd>Enter</kbd> with no selection.
  • #424: Fixed: Error thrown by Tab Key Handling and Indent List plugins when pressing <kbd>Tab</kbd> with no selection in inline editor.
  • #476: Fixed: Anchors inserted with the Link plugin on collapsed selection cannot be edited.
  • #417: Fixed: The Table Resize plugin throws an error when used with a table with only header or footer rows.
  • #523: Fixed: The editor.getCommandKeystroke() method does not obtain the correct keystroke.
  • #534: [IE] Fixed: Paste from Word does not work in Quirks Mode.
  • #450: Fixed: CKEDITOR.filter incorrectly transforms the margin CSS property.

CKEditor 4.7

Important Notes:

  • #13793: The embed_provider configuration option for the Media Embed and Semantic Media Embed plugins is no longer preset by default.
  • The UI Color plugin now uses a custom color picker instead of the YUI 2.7.0 library which has some known vulnerabilities (it's a security precaution, there was no security issue in CKEditor due to the way it was used).

New Features:

Fixed Issues:

  • #16935: [Chrome] Fixed: Blurring the editor in Source Mode throws an error.
  • #16825: [Chrome] Fixed: Error thrown when destroying a focused inline editor.
  • #16857: Fixed: <kbd>Ctrl+Shift+V</kbd> blocked by Copy Formatting.
  • #16845: [IE] Fixed: Cursor jumps to the top of the scrolled editor after focusing it when the Copy Formatting plugin is enabled.
  • #16786: Fixed: Added missing translations for the Copy Formatting plugin.
  • #14714: [WebKit/Blink] Fixed: Exception thrown on refocusing a blurred inline editor.
  • #16913: [Firefox, IE] Fixed: Paste as Plain Text keystroke does not work.
  • #16968: Fixed: [Safari] Paste as Plain Text is not handled by the editor.
  • #16912: Fixed: Exception thrown when a single image is pasted using Paste from Word.
  • #16821: Fixed: Extraneous <span> elements with height style stacked when pasting from Word.
  • #16866: [IE, Edge] Fixed: Whitespaces not preserved when pasting from Word.
  • #16860: Fixed: Paragraphs which only look like lists incorrectly transformed into them when pasting from Word.
  • #16817: Fixed: When pasting from Word, paragraphs are transformed into lists with some corrupted data.
  • #16833: [IE11] Fixed: Malformed list with headers pasted from Word.
  • #16826: [IE] Fixed: Superfluous paragraphs within lists pasted from Word.
  • #12465: Fixed: Cannot change the state of checkboxes or radio buttons if the properties dialog was invoked with a double-click.
  • #13062: Fixed: Impossible to unlink when the caret is at the edge of the link.
  • #13585: Fixed: Error when wrapping two adjacent <div> elements with a <div>.
  • #16811: Fixed: Table alignment is not preserved by the Paste from Word plugin.
  • #16810: Fixed: Vertical align in tables is not supported by the Paste from Word plugin.
  • #11956: [Blink, IE] Fixed: Link dialog does not open on a double click on the second word of the link with a background color or other styles.
  • #10472: Fixed: Unable to use Table Resize on table header and footer.
  • #14762: Fixed: Hovering over an empty table (without rows or cells) throws an error when the Table Resize plugin is active.
  • #16777: [Edge] Fixed: The Clipboard plugin does not allow to drop widgets into the editor.
  • #14894: [Chrome] Fixed: The editor scrolls to the top after focusing or when a dialog is opened.
  • #14769: Fixed: URLs with '-' in host are not detected by the Auto Link plugin.
  • #16804: Fixed: Focus is not on the first menu item when the user opens a context menu or a drop-down list from the editor toolbar.
  • #14407: [IE] Fixed: Non-editable widgets can be edited.
  • #16927: Fixed: An error thrown if a bundle containing the Color Button plugin is run in ES5 strict mode. Thanks to Igor Rubinovich!
  • #16920: Fixed: Several plugins not using the Dialog plugin as a direct dependency.
  • PR#336: Fixed: Typo in CKEDITOR.getCss() API documentation. Thanks to knusperpixel!
  • #17027: Fixed: Command event data should be initialized as an empty object.
  • Fixed the behavior of HTML parser when parsing src/srcdoc attributes of the <iframe> element in a CKEditor setup with ACF turned off and without the Iframe Dialog plugin. The issue was originally reported as a security issue by Sriramk21 from Pegasystems and was later downgraded by the security team into a normal issue due to the requirement of having ACF turned off. Disabling Advanced Content Filter is against security best practices, so the problem described above has not been considered a security issue as such.

Other Changes:

CKEditor 4.6.2

New Features:

Fixed Issues:

CKEditor 4.6.1

New Features:

Fixed Issues:

  • #11064: [Blink, WebKit] Fixed: Cannot select all editor content when a widget or a non-editable element is the first or last element of the content. Also fixes this issue in the Select All plugin.
  • #14755: [Blink, WebKit, IE8] Fixed: Browser hangs when a table is inserted in the place of a selected list with an empty last item.
  • #16624: Fixed: Improved the Color Button plugin which will now normalize the CSS background property if it only contains a color value. This fixes missing background colors when using Paste from Word.
  • #16600: [Blink, WebKit] Fixed: Error thrown occasionally by an uninitialized editable for multiple CKEditor instances on the same page.

CKEditor 4.6

New Features:

Fixed Issues:

Other Changes:

  • Updated SCAYT (Spell Check As You Type) and WebSpellChecker plugins:
    • Support for the new default Moono-Lisa skin.
    • #121: Fixed: Basic Styles do not work when SCAYT is enabled.
    • #125: Fixed: Inline styles are not continued when writing multiple lines of styled text with SCAYT enabled.
    • #127: Fixed: Uncaught TypeError after enabling SCAYT in the CKEditor <div> element.
    • #128: Fixed: Error thrown after enabling SCAYT caused by conflicts with RequireJS.

CKEditor 4.5.11

Security Updates:

  • [Severity: minor] Fixed the target="_blank" vulnerability reported by James Gaskell.

    Issue summary: If a victim had access to a spoofed version of ckeditor.com via HTTP (e.g. due to DNS spoofing, using a hacked public network or mailicious hotspot), then when using a link to the ckeditor.com website it was possible for the attacker to change the current URL of the opening page, even if the opening page was protected with SSL.

An upgrade is recommended.

New Features:

Fixed Issues:

  • #13362: [Blink, WebKit] Fixed: Active widget element is not cached when it is losing focus and it is inside an editable element.
  • #13755: [Edge] Fixed: Pasting images does not work.
  • #13548: [IE] Fixed: Clicking the elements path disables Cut and Copy icons.
  • #13812: Fixed: When aborting file upload the placeholder for image is left.
  • #14659: [Blink] Fixed: Content scrolled to the top after closing the dialog in a <div>-based editor.
  • #14825: [Edge] Fixed: Focusing the editor causes unwanted scrolling due to dropped support for the setActive() method.

CKEditor 4.5.10

Fixed Issues:

  • #10750: Fixed: The editor does not escape the font-style family property correctly, removing quotes and whitespace from font names.
  • #14413: Fixed: The Auto Grow plugin with the config.autoGrow_onStartup option set to true does not work properly for an editor that is not visible.
  • #14451: Fixed: Numeric element ID not escaped properly. Thanks to Jakub Chalupa!
  • #14590: Fixed: Additional line break appearing after inline elements when switching modes. Thanks to dpidcock!
  • #14539: Fixed: JAWS reads "selected Blank" instead of "selected <widget name="">" when selecting a widget.</widget>
  • #14701: Fixed: More precise labels for Enhanced Image and Placeholder widgets.
  • #14667: [IE] Fixed: Removing background color from selected text removes background color from the whole paragraph.
  • #14252: [IE] Fixed: Styles drop-down list does not always reflect the current style of the text line.
  • #14275: [IE9+] Fixed: onerror and onload events are not used in browsers it could have been used when loading scripts dynamically.

CKEditor 4.5.9

Fixed Issues:

CKEditor 4.5.8

New Features:

Fixed Issues:

CKEditor 4.5.7

New Features:

Fixed Issues:

CKEditor 4.5.6

New Features:

Other Changes:

  • Updated SCAYT (Spell Check As You Type):
    • New features:
    • Fixed issues:
      • #98: SCAYT affects dialog double-click. Fixed in SCAYT core.
      • #102: SCAYT core performance enhancements.
      • #104: SCAYT's spans leak into the clipboard and after pasting.
      • #105: A JavaScript error fired in case of multiple instances of CKEditor on one page.
      • #107: SCAYT should not check non-editable parts of content.
      • #108: Latest SCAYT copies the ID of the editor element to the iframe.
      • SCAYT stops working when CKEditor Undo plugin not enabled.
      • Issue with pasting SCAYT markup in CKEditor.
      • SCAYT stops working after pressing the Cancel button in the WSC dialog.

CKEditor 4.5.5

Fixed Issues:

  • #13887: Fixed: Link plugin alters the target attribute value. Thanks to SamZiemer!
  • #12189: Fixed: The Link plugin dialog does not display the subject of email links if the subject parameter is not lowercase.
  • #9192: Fixed: An undefined string is appended to an email address added with the Link plugin if subject and email body are empty and config.emailProtection is set to encode.
  • #13790: Fixed: It is not possible to destroy the editor <iframe> after the editor was detached from DOM. Thanks to Stefan Rijnhart!
  • #13803: Fixed: The editor cannot be destroyed before being fully initialized. Thanks to Cyril Fluck!
  • #13867: Fixed: CKEditor does not work when the classList polyfill is used.
  • #13885: Fixed: Enhanced Image requires the Link plugin to link an image.
  • #13883: Fixed: Copying a table using the context menu strips off styles.
  • #13872: Fixed: Cutting is possible in the read-only mode.
  • #12848: [Blink] Fixed: Opening the Find and Replace dialog window in the read-only mode throws an exception.
  • #13879: Fixed: It is not possible to prevent the editor.drop event.
  • #13361: Fixed: Skin images fail when the site path includes parentheses because the background-image path needs single quotes around the URL value.
  • #13771: Fixed: The contents.css style is not used if the IFrame Editing Area plugin is missing.
  • #13782: Fixed: Unclear log messages.
  • #13919: [Edge] Fixed: Browser window crashes when accessing the isContentEditable property of an <input> DOM element.

Other Changes:

  • #13859: Test cases created with bender.tools.createTestsForEditors will also receive editor bot as a second parameter.

CKEditor 4.5.4

New Features:

  • #13632: Introduce error logging mechanism.
  • #13730: Switch to the new error logging mechanism.

Fixed Issues:

  • #9856: Fixed: Cannot use the native context menu together with the Div Editing Area plugin. Thanks to Mark Wade!
  • #12733: [IE9+] Fixed: Radio button onChange does not work. Thanks to Iliya Kostadinov!
  • #13142: [Edge] Fixed: Ctrl+A and then Backspace result in an empty <div> element.
  • #13599: Fixed: Cross-editor drag and drop of an inline widget results in error/artifacts.
  • #13640: [IE] Fixed: Dropping a widget outside the <body> element is not handled correctly.
  • #13533: Fixed: No progress during upload.
  • #13680: Fixed: The parser should allow the <h1-6> element to be a child of the <summary> element.
  • #11724: [Touch devices] Fixed: Drop-downs often hide right after opening them.
  • #13690: Fixed: Copying content from IE to Chrome adds an extra paragraph.
  • #13284: Fixed: Cannot drag and drop a widget if the text caret is placed just after the widget instance.
  • #13516: Fixed: CKEditor removes empty HTML5 anchors without the name attribute.
  • #13765: [Safari 9] Fixed: Problems with rendering samples.

Other Changes:

CKEditor 4.5.3

New Features:

Fixed Issues:

  • #13590: Fixed: Various issues related to the Paste from Word feature. Fixes also:
  • #11215,
  • #8780,
  • #12762.
  • #13386: [Edge] Fixed: Issues with selecting and editing images.
  • #13568: Fixed: The editor.getSelectedHtml() method returns invalid results for entire content selection.
  • #13453: Fixed: Drag&drop of entire editor content throws an error.
  • #13465: Fixed: Error is thrown and the widget is lost on drag&drop if it is the only content of the editor.
  • #13414: Fixed: Content auto paragraphing in a nested editable despite editor configuration.
  • #13429: Fixed: Incorrect selection after content insertion by the Auto Embed plugin.
  • #13388: Fixed: Table Resize integration with Undo is broken.

Other Changes:

  • #13637: Several icons were refactored.
  • Updated Bender.js to 0.3.0 and introduced the ability to run tests via HTTPs (#13265).

CKEditor 4.5.2

Fixed Issues:

  • #13609: [Edge] Fixed: The browser crashes when switching to the source mode. Thanks to Andrew Williams and Mark Smeed!
  • PR#201: Fixed: Buttons in the toolbar configurator cause form submission. Thanks to colemanw!
  • #13422: Fixed: A monospaced font should be used in the <textarea> element storing editor configuration in the toolbar configurator.
  • #13494: Fixed: Error thrown in the toolbar configurator if plugin requirements are not met.
  • #13409: Fixed: List elements incorrectly merged when pressing Backspace or Delete.
  • #13434: Fixed: Dialog state indicator broken in Right–To–Left environments.
  • #13460: [IE8] Fixed: Copying inline widgets is broken when Advanced Content Filter is disabled.
  • #13495: [Firefox, IE] Fixed: Text is not word-wrapped in the Paste dialog window.
  • #13528: [Firefox@Windows] Fixed: Content copied from Microsoft Word and other external applications is pasted as a plain text. Removed the CKEDITOR.plugins.clipboard.isHtmlInExternalDataTransfer property as the check must be dynamic.
  • #13583: Fixed: DataTransfer.getData() should work consistently in all browsers and should not strip valuable content. Fixed pasting tables from Microsoft Excel on Chrome.
  • #13468: [IE] Fixed: Binding drag&drop dataTransfer does not work if text data was set in the meantime.
  • #13451: [IE8-9] Fixed: One drag&drop operation may affect following ones.
  • #13184: Fixed: Web page reloaded after a drop on editor UI.
  • #13129 Fixed: Block widget blurred after a drop followed by an undo.
  • #13397: Fixed: Drag&drop of a widget inside its nested widget crashes the editor.
  • #13385: Fixed: editor.getSnapshot() may return a non-string value.
  • #13419: Fixed: The Auto Link plugin does not encode double quotes in URLs.
  • #13420: Fixed: The Auto Embed plugin ignores encoded characters in URL parameters.
  • #13410: Fixed: Error thrown in the Auto Embed plugin when undoing right after pasting a link.
  • #13566: Fixed: Suppressed notifications in the Media Embed Base plugin.
  • #11616: [Chrome] Fixed: Resizing the editor while it is not displayed breaks the editable. Fixes also #9160 and #9715.
  • #11376: [IE11] Fixed: Loss of text when pasting bulleted lists from Microsoft Word.
  • #13143: [Edge] Fixed: Focus lost when opening the panel.
  • #13387: [Edge] Fixed: "Permission denied" error thrown when loading the editor with developer tools open.
  • #13574: [Edge] Fixed: "Permission denied" error thrown when opening editor dialog windows.
  • #13441: [Edge] Fixed: The Clipboard plugin breaks the state of Undo commands after a paste.
  • #13554: [Edge] Fixed: Paste dialog's iframe does not receive focus on show.
  • #13440: [Edge] Fixed: Unable to paste a widget.

Other Changes:

CKEditor 4.5.1

Fixed Issues:

  • #13486: Fixed: The Upload Image plugin should log an error, not throw an error when upload URL is not set.

CKEditor 4.5

New Features:

Fixed Issues:

  • #13334: Fixed: Error after nesting widgets and playing with undo/redo.
  • #13118: Fixed: The editor.getSelectedHtml() method throws an error when called in the source mode.
  • #13158: Fixed: Error after canceling a dialog when creating a widget.
  • #13197: Fixed: Linked inline Enhanced Image alignment class is not transferred to the widget wrapper.
  • #13199: Fixed: Semantic Embed does not support widget classes.
  • #13003: Fixed: Anchors are uploaded when moving them by drag and drop.
  • #13032: Fixed: When upload is done, notification update should be marked as important.
  • #13300: Fixed: The internalCommit argument in the Image dialog seems to be never used.
  • #13036: Fixed: Notifications are moved 10px to the right.
  • #13280: [IE8] Fixed: Undo after inline widget drag&drop throws an error.
  • #13186: Fixed: Content dropped into a nested editable is not filtered by Advanced Content Filter.
  • #13140: Fixed: Error thrown when dropping a block widget right after itself.
  • #13176: [IE8] Fixed: Errors on drag&drop of embed widgets.
  • #13015: Fixed: Dropping an image file on Enhanced Image causes a page reload.
  • #13080: Fixed: Ugly notification shown when the response contains HTML content.
  • #13011: [IE8] Fixed: Anchors are duplicated on drag&drop in specific locations.
  • #13105: Fixed: Various issues related to CKEDITOR.tools.htmlEncode() and CKEDITOR.tools.htmlDecode() methods.
  • #11976: [Chrome] Fixed: Copy&paste and drag&drop lists from Microsoft Word.
  • #13128: Fixed: Various issues with cloning element IDs:
  • Fixed the default behavior of range.cloneContents() and range.extractContents() methods which now clone IDs similarly to their native counterparts.
  • Added cloneId arguments to the above methods, range.splitBlock() and element.breakParent(). Mind the default values and special behavior in the extractContents() method!
  • Fixed issues where IDs were lost on copy&paste and drag&drop.
  • Toolbar configurators:
  • #13185: Fixed: Wrong position of the suggestion box if there is not enough space below the caret.
  • #13138: Fixed: The "Toggle empty elements" button label is unclear.
  • #13136: Fixed: Autocompleter is far too intrusive.
  • #13133: Fixed: Tab leaves the editor.
  • #13173: Fixed: config.removeButtons is ignored by the advanced toolbar configurator.

Other Changes:

CKEditor 4.5 Beta

New Features:

  • Clipboard (copy&paste, drag&drop) and file uploading features and improvements (#11437).

  • Major features:

    • Support for dropping and pasting files into the editor was introduced. Through a set of new facades for native APIs it is now possible to easily intercept and process inserted files.
    • File upload tools were introduced in order to simplify controlling the loading, uploading and handling server response, properly handle new upload configuration options, etc.
    • Upload Image widget was introduced to upload dropped images. A base class for the upload widget was exposed, too, to make it simple to create new types of upload widgets which can handle any type of dropped file, show the upload progress and update the content when the process is done. It also handles editing and undo/redo operations when a file is being uploaded and integrates with the notification aggregator to show progress and success or error.
    • All drag and drop operations were integrated with the editor. All dropped content is passed through the editor#paste event and a set of new editor events was introduced — dragstart, drop, dragend.
    • The Data Transfer facade was introduced to unify access to data in various types and files. Data Transfer is now always available in the editor#paste event.
    • Switched from the pastebin to using the native clipboard access whenever possible. This solved many issues related to pastebin such as unnecessary scrolling or data loss. Additionally, on copy and cut from the editor the clipboard data is set. Therefore, on paste the editor has access to clean data, undisturbed by the browsers.
    • Drag and drop of inline and block widgets was integrated with the standard clipboard APIs. By listening to drag events you will thus be notified about widgets, too. This opens a possibility to filter pasted and dropped widgets.
    • The editor#paste event can have the range parameter so it is possible to change the paste position in the listener or paste in the not selectable position. Also the editor.insertHtml() method now accepts range as an additional parameter.
    • #11621: A configurable paste filter was introduced. The filter is by default turned to 'semantic-content' on Webkit and Blink for all pasted content coming from external sources because of the low quality of HTML that these engines put into the clipboard. Internal and cross-editor paste is safe due to the change explained in the previous point.
  • Other changes and related fixes:

    • #12095: On drag and copy of widgets the same method is used to get selected HTML as in the normal case. Thanks to that styles applied to inline widgets are not lost.
    • #11219: Fixed: Dragging a captioned image does not fire the editor#paste event.
    • #9554: [Webkit Mac] Fixed: Editor scrolls on paste.
    • #9898: [Webkit&Divarea] Fixed: Pasting causes undesirable scrolling.
    • #11993: [Chrome] Fixed: Pasting content scrolls the document.
    • #12613: Show the user that they can not drop on editor UI (toolbar, bottom bar).
    • #12851: [Blink/Webkit] Fixed: Formatting disappears when pasting content into cells.
    • #12914: Fixed: Copy/Paste of table broken in div-based editor.
  • Browser support.
    Browser support for related features varies significantly (see http://caniuse.com/clipboard).

    • File APIs needed to operate and file upload is not supported in Internet Explorer 9 and below.
    • Only Chrome and Safari on Mac OS support setting custom data items in the clipboard, so currently it is possible to recognize the origin of the copied content in these browsers only. All drag and drop operations can be identified thanks to the new Data Transfer facade.
    • No Internet Explorer browser supports the standard clipboard API which results in small glitches like where only plain text can be dropped from outside the editor. Thanks to the new Data Transfer facade, internal and cross-editor drag and drop supports the full range of data.
    • Direct access to clipboard could only be implemented in Chrome, Safari on Mac OS, Opera and Firefox. In other browsers the pastebin must still be used.
  • #12875: Samples and toolbar configuration tools.

  • The old set of samples shipped with every CKEditor package was replaced with a shiny new single-page sample. This change concluded a long term plan which started from introducing the CKEditor SDK and CKEditor Functionality Overview section in the documentation which essentially redefined the old samples.
  • Toolbar configurators with live previews were introduced. They will be shipped with every CKEditor package and are meant to help in configuring toolbar layouts.

  • #10925: The Media Embed and Semantic Media Embed plugins were introduced. Read more about the new features in the Embedding Content article.

  • #10931: Added support for nesting widgets. It is now possible to insert one widget into another widget's nested editable. Note that unless nested editable's allowed content is defined precisely, starting from CKEditor 4.5 some widget buttons may become enabled. This feature is not supported in IE8. Included issues:
  • #12018: Fixed and reviewed: Nested widgets garbage collection.
  • #12024: [Firefox] Fixed: Outline is extended to the left by unpositioned drag handlers.
  • #12006: Fixed: Drag and drop of nested block widgets.
  • #12008: Fixed various cases of inserting a single non-editable element using the editor.insertHtml() method. Fixes pasting a widget with a nested editable inside another widget's nested editable.

  • Notification system:

  • #11580: Introduced the notification system.
  • #12810: Introduced a notification aggregator for the notification system which simplifies displaying progress of many concurrent tasks.
  • #11636: Introduced new, UX-focused, methods for getting selected HTML and deleting it — editor.getSelectedHtml() and editor.extractSelectedHtml().
  • #12416: Added the widget.definition.upcastPriority property which gives more control over widget upcasting order to the widget author.
  • #12036: Initialize the editor in read-only mode when the <textarea> element has a readonly attribute.
  • #11905: The resize event passes the current dimensions in its data.
  • #12126: Introduced config.image_prefillDimensions and config.image2_prefillDimensions to make pre-filling width and height configurable for the Enhanced Image.
  • #12746: Added a new configuration option to hide the Enhanced Image resizer.
  • #12150: Exposed the getNestedEditable() and is* widget helper functions (see the static methods).
  • #12448: Introduced the editable.insertHtmlIntoRange method.
  • #12143: Added the config.floatSpacePreferRight configuration option that switches the alignment of the floating toolbar. Thanks to InvisibleBacon!
  • #10986: Added support for changing dialog input and textarea text directions by using the Shift+Alt+Home/End keystrokes. The direction is stored in the value of the input by prepending the \u202A or \u202B marker to it. Read more in the documentation. Thanks to edithkk!
  • #12770: Added support for passing widget's startup data as a widget command's argument. Thanks to Rebrov Boris and Tieme van Veen!
  • #11583: Added support for the HTML5 required attribute in various form elements. Thanks to Steven Busse!

Changes:

  • #12858: Basic Spartan browser compatibility. Full compatibility will be introduced later, because at the moment Spartan is still too unstable to be used for tests and we see many changes from version to version.
  • #12948: The config.mathJaxLibrary option does not default to the MathJax CDN any more. It needs to be configured to enable the Mathematical Formulas plugin now.
  • #13069: Fixed inconsistencies between editable.insertHtml() and editable.insertElement() when the range parameter is used. Now, the editor.insertElement() method works on a higher level, which means that it saves undo snapshots and sets the selection after insertion. Use the editable.insertElementIntoRange() method directly for the pre 4.5 behavior of editable.insertElement().
  • #12870: Use editor.showNotification() instead of alert() directly whenever possible. When the Notification plugin is loaded, the notification system is used automatically. Otherwise, the native alert() is displayed.
  • #8024: Swapped behavior of the Split Cell Vertically and Horizontally features of the Table Tools plugin to be more intuitive. Thanks to kevinisagit!
  • #10903: Performance improvements for the dom.element.addClass(), dom.element.removeClass() and dom.element.hasClass() methods. Note: The previous implementation allowed passing multiple classes to addClass() although it was only a side effect of that implementation. The new implementation does not allow this.
  • #11856: The jQuery adapter throws a meaningful error if CKEditor or jQuery are not loaded.

Fixed issues:

  • #11586: Fixed: range.cloneContents() should not change the DOM in order not to affect selection.
  • #12148: Fixed: dom.element.getChild() should not modify a passed array.
  • #12503: [Blink/Webkit] Fixed: Incorrect result of Select All and Backspace or Delete.
  • #13001: [Firefox] Fixed: The <br /> filler is placed in the wrong position by the range.fixBlock() method due to quirky Firefox behavior.
  • #13101: [IE8] Fixed: Colons are prepended to HTML5 element names when cloning them.

CKEditor 4.4.8

Security Updates:

  • Fixed XSS vulnerability in the HTML parser reported by Dheeraj Joshi and Prem Kumar.

    Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode.

An upgrade is highly recommended!

Fixed Issues:

Other Changes:

CKEditor 4.4.7

Fixed Issues:

  • #12825: Fixed: Preventing the Table Resize plugin from operating on elements outside the editor. Thanks to Paul Martin!
  • #12157: Fixed: Lost text formatting on pressing Tab when the config.tabSpaces configuration option value was greater than zero.
  • #12777: Fixed: The table-layout CSS property should be reset by skins. Thanks to vita10gy!
  • #12812: Fixed: An uncaught security exception is thrown when Line Utilities are used in an inline editor loaded in a cross-domain iframe. Thanks to Vitaliy Zurian!
  • #12735: Fixed: config.fillEmptyBlocks should only apply when outputting data.
  • #10032: Fixed: Paste from Word filter is executed for every paste after using the button.
  • #12597: [Blink/WebKit] Fixed: Multi-byte Japanese characters entry not working properly after Shift+Enter.
  • #12387: Fixed: An error is thrown if a skin does not have the chameleon property defined and config.uiColor is defined.
  • #12747: [IE8-10] Fixed: Opening a drop-down for a specific selection when the editor is maximized results in incorrect drop-down panel position.
  • #12850: [IEQM] Fixed: An error is thrown after focusing the editor.

CKEditor 4.4.6

Security Updates:

  • Fixed XSS vulnerability in the HTML parser reported by Maco Cortes.

    Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode.

An upgrade is highly recommended!

New Features:

Fixed Issues:

  • #12506: [Safari] Fixed: Cannot paste into inline editor if the page has user-select: none style. Thanks to shaohua!
  • #12683: Fixed: Filter fails to remove custom tags. Thanks to timselier!
  • #12489 and #12491: Fixed: Various issues related to restoring the selection after performing operations on filler character. See the fixed cases.
  • #12621: Fixed: Cannot remove inline styles (bold, italic, etc.) in empty lines.
  • #12630: [Chrome] Fixed: Selection is placed outside the paragraph when the New Page button is clicked. This patch significantly simplified the way how the initial selection (a selection after the content of the editable is overwritten) is being fixed. That might have fixed many related scenarios in all browsers.
  • #11647: Fixed: The editor.blur event is not fired on first blur after initializing the inline editor on an already focused element.
  • #12601: Fixed: Strikethrough button tooltip spelling.
  • #12546: Fixed: The Preview tab in the Document Properties dialog window is always disabled.
  • #12300: Fixed: The editor.change event fired on first navigation key press after typing.
  • #12141: Fixed: List items are lost when indenting a list item with content wrapped with a block element.
  • #12515: Fixed: Cursor is in the wrong position when undoing after adding an image and typing some text.
  • #12484: [Blink/WebKit] Fixed: DOM is changed outside the editor area in a certain case.
  • #12688: Improved the tests of the styles system and fixed two minor issues.
  • #12403: Fixed: Changing the font style should not lead to nesting it in the previous style element.
  • #12609: Fixed: Incorrect config.magicline_putEverywhere name used for a Magic Line all-encompassing config.magicline_everywhere configuration option.

CKEditor 4.4.5

New Features:

Fixed Issues:

  • #12423: [Safari7.1+] Fixed: Enter key moved cursor to a strange position.
  • #12381: [iOS] Fixed: Selection issue. Thanks to Remiremi!
  • #10804: Fixed: CKEDITOR_GETURL is not used with some plugins where it should be used. Thanks to Thomas Andraschko!
  • #9137: Fixed: The <base> tag is not created when <head> has an attribute. Thanks to naoki.fujikawa!
  • #12377: Fixed: Errors thrown in the Image plugin when removing preview from the dialog window definition. Thanks to Axinet!
  • #12162: Fixed: Auto paragraphing and Enter key in nested editables.
  • #12315: Fixed: Marked config.autoParagraph as deprecated.
  • #12113: Fixed: A code snippet should be presented in the elements path as "code snippet" (translatable).
  • #12311: Fixed: Remove Format should also remove <cite> elements.
  • #12261: Fixed: The filter is not destroyed and removed from CKEDITOR.filter.instances on editor destroy.
  • #12398: Fixed: Maximize does not work on an instance without a title.
  • #12097: Fixed: JAWS not reading the number of options correctly in the Text Color and Background Color button menu.
  • #12411: Fixed: Page Break used directly in the editable breaks the editor.
  • #12354: Fixed: Various issues in undo manager when holding keys.
  • #12324: [IE8] Fixed: Undo steps are not recorded when changing the caret position by clicking below the body.
  • #12332: Fixed: Lowered DOM events listeners' priorities in undo manager in order to avoid ambiguity.
  • #12402: [Blink] Fixed: Workaround for Blink bug with document.title which breaks updating title in the full HTML mode.
  • #12338: Fixed: The CKEditor package contains unoptimized images.

CKEditor 4.4.4

Fixed Issues:

  • #12268: Cleanup of UI Color YUI styles. Thanks to CasherWest!
  • #12263: Fixed: Paste from Word filter does not properly normalize semicolons style text. Thanks to Alin Purcaru!
  • #12243: Fixed: Text formatting lost when pasting from Word. Thanks to Alin Purcaru!
  • #111739: Fixed: keypress listeners should not be used in the undo manager. A complete rewrite of keyboard handling in the undo manager was made. Numerous smaller issues were fixed, among others:
  • #10926: [Chrome@Android] Fixed: Typing does not record snapshots and does not fire the editor.change event.
  • #11611: [Firefox] Fixed: The editor.change event is fired when pressing Arrow keys.
  • #12219: [Safari] Fixed: Some modifications of the UndoManager.locked property violate strict mode in the Undo plugin.
  • #10916: Fixed: Magic Line icon in Right-To-Left environments.
  • #11970: [IE] Fixed: CKEditor paste event is not fired when pasting with Shift+Ins.
  • #12111: Fixed: Linked image attributes are not read when opening the image dialog window by doubleclicking.
  • #10030: [IE] Fixed: Prevented "Unspecified Error" thrown in various cases when IE8-9 does not allow access to document.activeElement.
  • #12273: Fixed: Applying block style in a description list breaks it.
  • #12218: Fixed: Minor syntax issue in CSS files.
  • #12178: [Blink/WebKit] Fixed: Iterator does not return the block if the selection is located at the end of it.
  • #12185: [IE9QM] Fixed: Error thrown when moving the mouse over focused editor's scrollbar.
  • #12215: Fixed: Basepath resolution does not recognize semicolon as a query separator.
  • #12135: Fixed: Remove Format does not work on widgets.
  • #12298: [IE11] Fixed: Clicking below <body> in Compatibility Mode will no longer reset selection to the first line.
  • #12204: Fixed: Editor's voice label is not affected by config.title.
  • #11915: Fixed: With SCAYT enabled, cursor moves to the beginning of the first highlighted, misspelled word after typing or pasting into the editor.
  • SCAYT: Fixed: Error thrown in the console after enabling SCAYT and trying to add a new image.

Other Changes:

  • #12296: Merged benderjs-ckeditor into the main CKEditor repository.

CKEditor 4.4.3

Security Updates:

  • Fixed XSS vulnerability in the Preview plugin reported by Mario Heiderich of Cure53.

An upgrade is highly recommended!

New Features:

  • #12164: Added the "Justify" option to the "Horizontal Alignment" drop-down in the Table Cell Properties dialog window.

Fixed Issues:

  • #12110: Fixed: Editor crash after deleting a table. Thanks to Alin Purcaru!
  • #11897: Fixed: Enter key used in an empty list item creates a new line instead of breaking the list. Thanks to noam-si!
  • #12140: Fixed: Double-clicking linked widgets opens two dialog windows.
  • #12132: Fixed: Image is inserted with width and height styles even when they are not allowed.
  • #9317: [IE] Fixed: config.disableObjectResizing does not work on IE. Note: We were not able to fix this issue on IE11+ because necessary events stopped working. See a last resort workaround and make sure to support our complaint to Microsoft.
  • #9638: Fixed: There should be no information about accessibility help available under the Alt+0 keyboard shortcut if the Accessibility Help plugin is not available.
  • #8117 and #9186: Fixed: In HTML5 <meta> tags should be allowed everywhere, including inside the <body> element.
  • #10422: Fixed: config.fillEmptyBlocks not working properly if a function is specified.

CKEditor 4.4.2

Important Notes:

  • The CKEditor testing environment is now publicly available. Read more about how to set up the environment and execute tests in the CKEditor Testing Environment guide. Please note that the tests/ directory which contains editor tests is not available in release packages. It can only be found in the development version of CKEditor on GitHub.

New Features:

Fixed Issues:

  • #11757: Fixed: Imperfections in the Moono skin. Thanks to danyaPostfactum!
  • #10091: Blockquote should be treated like an object by the styles system. Thanks to dan-james-deeson!
  • #11478: Fixed: Issue with passing jQuery objects to adapter configuration.
  • #10867: Fixed: Issue with setting encoded URI as image link.
  • #11983: Fixed: Clicking a nested widget does not focus it. Additionally, performance of the widget.repository.getByElement() method was improved.
  • #12000: Fixed: Nested widgets should be initialized on editor.setData() and nestedEditable.setData().
  • #12022: Fixed: Outer widget's drag handler is not created at all if it has any nested widgets inside.
  • #11960: [Blink/WebKit] Fixed: The caret should be scrolled into view on Backspace and Delete (covers only the merging blocks case).
  • #11306: [OSX][Blink/WebKit] Fixed: No widget entries in the context menu on widget right-click.
  • #11957: Fixed: Alignment labels in the Enhanced Image dialog window are not translated.
  • #11980: [Blink/WebKit] Fixed: <span> elements created when joining adjacent elements (non-collapsed selection).
  • #12009: [Nested widgets] Integration with the Magic Line plugin.
  • #11387: Fixed: role="radiogroup" should be applied only to radio inputs' container.
  • #7975: [IE8] Fixed: Errors when trying to select an empty table cell.
  • #11947: [Firefox+IE11] Fixed: Shift+Enter in lists produces two line breaks.
  • #11972: Fixed: Feature detection in the element.setText() method should not trigger the layout engine.
  • #7634: Fixed: The Flash Dialog plugin omits the allowFullScreen parameter in the editor data if set to true.
  • #11910: Fixed: Enhanced Image does not take config.baseHref into account when updating image dimensions.
  • #11753: Fixed: Wrong checkDirty() method value after focusing or blurring a widget.
  • #11830: Fixed: Impossible to pass some arguments to CKBuilder when using the /dev/builder/build.sh script.
  • #11945: Fixed: Form Elements plugin should not change a core method.
  • #11384: [IE9+] Fixed: IndexSizeError thrown when pasting into a non-empty selection anchored in one text node.

CKEditor 4.4.1

New Features:

  • #9661: Added the option to configure anchor tags with JavaScript code in the href attribute.

Fixed Issues:

  • #11861: [WebKit/Blink] Fixed: Span elements created while joining adjacent elements. Note: This patch only covers cases when Backspace or Delete is pressed on a collapsed (empty) selection. The remaining case, with a non-empty selection, will be fixed in the next release.
  • #10714: [iOS] Fixed: Selection and drop-downs are broken if a touch event listener is used due to a WebKit bug. Thanks to Arty Gus!
  • #11911: Fixed setting the dir attribute for a preloaded language in CKEDITOR.lang. Thanks to Akash Mohapatra!
  • #11926: Fixed: Code Snippet does not decode HTML entities when loading code from the <code> element.
  • #11223: Fixed: Issue when Protected Source was not working in the <title> element.
  • #11859: Fixed: Removed the Source Dialog plugin dependency from the Code Snippet sample.
  • #11754: [Chrome] Fixed: Infinite loop when content includes not closed attributes.
  • #11848: [IE] Fixed: editor.insertElement() throwing an exception when there was no selection in the editor.
  • #11801: Fixed: Editor anchors unavailable when linking the Enhanced Image widget.
  • #11626: Fixed: Table Resize sets invalid column width.
  • #11872: Made element.addClass() chainable symmetrically to element.removeClass().
  • #11813: Fixed: Link lost while pasting a captioned image and restoring an undo snapshot (Enhanced Image).
  • #11814: Fixed: Link and Unlink entries persistently displayed in the Enhanced Image context menu.
  • #11839: [IE9] Fixed: The caret jumps out of the editable area when resizing the editor in the source mode.
  • #11822: [WebKit] Fixed: Editing anchors by double-click is broken in some cases.
  • #11823: [IE8] Fixed: Table Resize throws an error over scrollbar.
  • #11788: Fixed: It is not possible to change the language back to Not set in the Code Snippet dialog window.
  • #11788: Fixed: Filter rules are not applied inside elements with the contenteditable attribute set to true.
  • #11798: Fixed: Inserting a non-editable element inside a table cell breaks the table.
  • #11793: Fixed: Drop-down is not "on" when clicking it while the editor is blurred.
  • #11850: Fixed: Fake objects with the contenteditable attribute set to false are not downcasted properly.
  • #11811: Fixed: Widget's data is not encoded correctly when passed to an attribute.
  • #11777: Fixed encoding ampersand in the Mathematical Formulas plugin.
  • #11880: [IE8-9] Fixed: Linked image has a default thick border.

Other Changes:

  • #11807: Updated jQuery version used in the sample to 1.11.0 and tested CKEditor jQuery Adapter with version 1.11.0 and 2.1.0.
  • #9504: Stopped using deprecated attribute.specified in all browsers except Internet Explorer.
  • #11809: Changed tab size in <pre> to 4 spaces.

CKEditor 4.4

Important Notes:

  • Marked the editor.beforePaste event as deprecated.
  • The default class of captioned images has changed to image (was: caption). Please note that once edited in CKEditor 4.4+, all existing images of the caption class (<figure class="caption">) will be filtered out unless the config.image2_captionedClass option is set to caption. For backward compatibility (i.e. when upgrading), it is highly recommended to use this setting, which also helps prevent CSS conflicts, etc. This does not apply to new CKEditor integrations.
  • Widgets without defined buttons are no longer registered automatically to the Advanced Content Filter. Before CKEditor 4.4 widgets were registered to the ACF which was an incorrect behavior (#11567). This change should not have any impact on standard scenarios, but if your button does not execute the widget command, you need to set allowedContent and requiredContent properties for it manually, because the editor will not be able to find them.
  • The Show Borders plugin was added to the Standard installation package in order to ensure that unstyled tables are still visible for the user (#11665).
  • Since CKEditor 4.4 the editor instance should be passed to CKEDITOR.style methods to ensure full compatibility with other features (e.g. applying styles to widgets requires that). We ensured backward compatibility though, so the CKEDITOR.style will work even when the editor instance is not provided.

New Features:

Other Changes:

  • #11377: Unified internal representation of empty anchors using the fake objects.
  • #11422: Removed Firefox 3.x, Internet Explorer 6 and Opera 12.x leftovers in code.
  • #5217: Setting data (including switching between modes) creates a new undo snapshot. Besides that:
  • Introduced the editable.status property.
  • Introduced a new forceUpdate option for the editor.lockSnapshot event.
  • Fixed: Selection not being unlocked in inline editor after setting data (#11500).
  • The WebSpellChecker plugin was updated to the latest version.

Fixed Issues:

  • #10190: Fixed: Removing block style with editor.removeStyle() should result in a paragraph and not a div.
  • #11727: Fixed: The editor tries to select a non-editable image which was clicked.

CKEditor 4.3.5

New Features:

  • Added new translation: Tatar.

Fixed Issues:

CKEditor 4.3.4

Fixed Issues:

  • #11597: [IE11] Fixed: Error thrown when trying to open the preview using the keyboard.
  • #11544: Placeholders will no longer be upcasted in parents not accepting <span> elements.
  • #8663: Fixed element.renameNode() not clearing the element.getName() cache.
  • #11574: Fixed: Backspace destroying the DOM structure if an inline editable is placed in a list item.
  • #11603: Fixed: Table Resize attaches to tables outside the editable.
  • #9205, #7805, #8216: Fixed: {cke_protected_1} appearing in data in various cases where HTML comments are placed next to " or '.
  • #11635: Fixed: Some attributes are not protected before the content is passed through the fix bin.
  • #11660: [IE] Fixed: Table content is lost when some extra markup is inside the table.
  • #11641: Fixed: Switching between modes in the classic editor removes content styles for the inline editor.
  • #11568: Fixed: Styles drop-down list is not enabled on selection change.

CKEditor 4.3.3

Fixed Issues:

How to install

sudo dnf upgrade --advisory=FEDORA-EPEL-2019-6091317017

Comments 6

This update has been submitted for testing by siwinski.

This update has been pushed to testing.

This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes

This update has been submitted for batched by siwinski.

This update has been submitted for stable by bodhi.

This update has been pushed to stable.


Add Comment & Feedback
Toggle Preview

Comment fields support Fedora-Flavored Markdown. Comments are governed under this privacy policy.

-1 0 +1 Feedback Guidelines

Is the update generally functional? (karma)

You need to be logged in to add karma!

#1597924 ckeditor-4.11.2 is available
#1651705 CVE-2018-17960 ckeditor: XSS involving a source-mode paste [epel-all]
Content Type
RPM
Status
stable
Test Gating
Submitted by
Update Type
security
Update Severity
medium
Karma
0
stable threshold: 3
unstable threshold: -3
Autopush
Enabled
Dates
submitted 3 months ago
in testing 3 months ago
in stable 2 months ago

Related Bugs 2

00 #1597924 ckeditor-4.11.2 is available
00 #1651705 CVE-2018-17960 ckeditor: XSS involving a source-mode paste [epel-all]

Automated Test Results