New Features:
config.styleSet configuration option.config.versionCheck configuration option to learn more.Fixed Issues:
Other Changes:
Note: CKEditor 4.22.1 has been released immediately after 4.22.0 to fix the README issues on npm and contains no changes vs 4.22.0.
Security Updates:
A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed plugins.
This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. See GitHub advisory for more details.
Potential breaking changes
In some rare cases, a security release may introduce a breaking change to your application. We have provided configuration options that will help you mitigate any potential issues with the upgrade:
sandbox attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the config.iframe_attributes option.config.embed_keepOriginalContent option.If you choose to change either of the above options, make sure to properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on your web page.
You can read more details in the relevant security advisory and contact us if you have more questions.
An upgrade is highly recommended!
New Features:
config.uploadImage_supportedTypes configuration option allowing to change the image formats accepted by the Upload Image plugin. Thanks to SilverYoCha!Fixed Issues:
Fixed Issues:
popstate and hashchange events on the window, added by the Maximize plugin, were not removed when destroying the editor instance.change event upon finishing upload, resulting in passing incorrect data in form controls for integration frameworks, like Reactive forms in Angular.API changes:
colorButton_contentsCss configuration option allowing to add custom CSS to the Color Button menu content. Thanks to mihilion!Fixed Issues:
config.baseFloatZIndex config variable is incorrectly applied to parent dialog when the child dialog is closed resulting in the dialog overlay covering up the dialog. Thanks to JenoDK!New Features:
config.tabletools_scopedHeaders configuration option controlling the behaviour of table headers with and without the [scope] attribute.config.image2_defaultLockRatio configuration option allowing to set the default value of the "Lock ratio" option in the Enhanced Image dialog.configDefinition.followingSpace option for the mentions plugin, andconfig.emoji_followingSpace option for the emoji plugin.config.coreStyles_toggleSubSup configuration option which disallows setting the subscript and superscript on the same element simultaneously using UI buttons. This option is turned off by default.Fixed Issues:
config.autolink_urlRegex option produced invalid links when configured directly using the editor instance config. Thanks to Aigars Zeiza!entities_processNumerical = true configuration option.API changes:
config.removeButtons config variable.followingSpace option that finishes an accepted match with a space.Fixed Issues:
backspace key removes the editor editable area and crashes the editor.checkbox.setValue and radio.setValue methods are not chainable as stated in the documentation. Thanks to Jordan Bradford!CKEDITOR.tools#convertToPx() gives invalid results if the helper calculator element was deleted from the DOM.dialog.validate#functions incorrectly composes functions that return an optional error message, like e.g. dialog.validate.number due to unnecessary return type coercion.Enter key.API changes:
config.editorplaceholder_delay configuration option allowing to delay placeholder before it is toggled when changing editor content.CKEDITOR.tools#debounce() function allowing to postpone a passed function execution until the given milliseconds have elapsed since the last time it was invoked.New features:
CKEDITOR.replace, CKEDITOR.inline, CKEDITOR.appendTo).config.shiftLineBreaks allowing to preserve inline elements formatting when the shift+enter keystroke is used.config.applicationTitle configuration option allowing to customize or disable the editor's application region label. This option, combined with config.title, gives much better control over the editor's labels read by screen readers.Fixed Issues:
tab key behavior is inconsistent after adding a new row.use strict directives in a core editor module.jpg, gif, png, not respecting supported types by the Upload Widget plugin.API changes:
CKEDITOR.replace, CKEDITOR.inline, CKEDITOR.appendTo functions are now returning a handle function allowing to cancel the Delayed Editor Creation feature.config.applicationTitle alongside CKEDITOR.editor#applicationTitle to allow customizing editor's application region label.Security Updates:
Fixed an XSS vulnerability in the core module reported by GitHub Security Lab team member Kevin Backhouse.
Issue summary: The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing a JavaScript code. See CVE-2022-24728 for more details.
Fixed a Regular expression Denial of Service (ReDoS) vulnerability in dialog plugin discovered by the CKEditor 4 team during our regular security audit.
Issue summary: The vulnerability allowed to abuse a dialog input validator regular expression, which could cause a significant performance drop resulting in a browser tab freeze. See CVE-2022-24729 for more details.
You can read more details in the relevant security advisory and contact us if you have more questions.
An upgrade is highly recommended!
Highlights:
Web Spell Checker ended support for WebSpellChecker Dialog on December 31st, 2021. This means the plugin is not supported any longer. Therefore, we decided to deprecate and remove the WebSpellChecker Dialog plugin from CKEditor 4 presets.
We strongly encourage everyone to choose one of the other available spellchecking solutions - Spell Check As You Type (SCAYT) or WProofreader.
Fixed issues:
CKEDITOR.tools.convertToPx().select elements with multiple attribute had incorrect styling. Thanks to John R. D'Orazio!Other changes:
CKEDITOR.rnd property to discourage using it in a security-sensitive context.config.emoji_emojiListUrl configuration option.Fixed issues:
MutationObserver used in IFrame Editing Area plugin causes memory leaks.API changes:
config.useComputedState default value to true. Thanks to Shabab Karim!CKEDITOR.appendTimestamp() function was added.CKEDITOR.dom.document#appendStyleSheet() and CKEDITOR.tools.buildStyleHtml() now use the newly added CKEDITOR.appendTimestamp() function to correctly handle caching of CSS files.Other changes:
Highlights:
Due to a regression in CKEeditor 4.17.0 version that was only revealed after the release and affected a limited area of operation, CSS assets loaded via relative links started to point into invalid location when loaded from external resources.
We have therefore decided to immediately release CKEditor 4.17.1 that fixed this problem. If you have already upgraded to v4.17.0, make sure to upgrade to v4.17.1 to avoid this regression.
Fixed issues:
Security Updates:
Fixed XSS vulnerability in the core module reported by William Bowling.
Issue summary: The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. See CVE-2021-41165 for more details.
Fixed XSS vulnerability in the core module reported by Maurice Dauer.
Issue summary: The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. See CVE-2021-41164 for more details.
You can read more details in the relevant security advisory and contact us if you have more questions.
An upgrade is highly recommended!
Highlights:
Adobe ended support of Flash Player on December 31, 2020 and blocked Flash content from running in Flash Player beginning January 12, 2021.
We have decided to deprecate and remove the Flash plugin from CKEditor 4 to help protect users' systems and discourage using insecure software.
New Features:
*) symbol.config.clipboard_handleImages configuration option for enabling and disabling built-in support for pasting and dropping images in the Clipboard plugin. Thanks to FlowIT-JIT!editor#title property for the title of the preview window. Thanks to Ely!Fixed Issues:
CKEDITOR.tools.color.CKEDITOR.tools.color.CKEDITOR.plugins.clipboard.dataTransfer#getTypes() returns no types.CKEDITOR.dialog#setState() method throws error when there is no "OK" button in the dialog.& characters when pasting links into the editor.ENTER_BR enter mode crashes the editor.API Changes:
CKEDITOR.editor#getSelection() now returns null if the editor is in recreating state.CKEDITOR.tools.color.CKEDITOR.plugins.clipboard.dataTransfer#isFileTransfer() method.callback parameter to CKEDITOR.plugins.preview#createPreview() method.Other Changes:
Security Updates:
Fixed XSS vulnerability in the Clipboard plugin reported by Anton Subbotin.
Issue summary: The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. See CVE-2021-32809 for more details.
Fixed XSS vulnerability in the Widget plugin reported by Anton Subbotin.
Issue summary: The vulnerability allowed to abuse undo functionality using malformed Widget HTML, which could result in executing JavaScript code. See CVE-2021-32808 for more details.
Fixed XSS vulnerability in the Fake Objects plugin reported by Mika Kulmala.
Issue summary: The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. See CVE-2021-37695 for more details.
You can read more details in the relevant security advisory and contact us if you have more questions.
An upgrade is highly recommended!
Fixed Issues:
character appears in the editor instead of a space.TypeError is thrown when switching to Source View and back while Autocomplete plugin is enabled.Fixed Issues:
div Enter mode.false is treated as an event cancellation.CKEDITOR.htmlParser does not treat --!> as a comment end tag correctly.Security Updates:
Fixed ReDoS vulnerability in the Autolink plugin.
Issue summary: It was possible to execute a ReDoS-type attack inside CKEditor 4 by persuading a victim to paste a specially crafted URL-like text into the editor and press Enter or Space.
Fixed ReDoS vulnerability in the Advanced Tab for Dialogs plugin.
Issue summary: It was possible to execute a ReDoS-type attack inside CKEditor 4 by persuading a victim to paste a specially crafted text into the Styles dialog.
An upgrade is highly recommended!
New Features:
tabindex attribute. Thanks to Timo Kirkkala!Fixed Issues:
config.fullPage enabled when there is no <body> tag in the editor content.config.width value.API Changes:
CKEDITOR.tools.color class which adds colors validation and methods for converting colors between various formats: named colors, HEX, RGB, RGBA, HSL and HSLA.CKEDITOR.plugins.pastetools.filters.word.images filters to the CKEDITOR.plugins.pastetools.filters.image namespace.CKEDITOR.plugins.pastetools.filters are now available under the CKEDITOR.pasteTools alias.CKEDITOR.ajax specialized loading methods for loading binary (CKEDITOR.ajax.loadBinary()) and text (CKEDITOR.ajax.loadText()) data.Other Changes:
extraPlugins configuration option.Security Updates:
Fixed XSS vulnerability in the Color History feature reported by Mark Wade.
Issue summary: It was possible to execute an XSS-type attack inside CKEditor 4 by persuading a victim to paste a specially crafted HTML code into the Color Button dialog.
An upgrade is highly recommended!
Fixed Issues:
CKEDITOR.inlineAll() method tries to initialize inline editor also on elements with an editor already attached to them.CKEDITOR.domReady() method connected with not removing load event listeners. Thanks to rohit1!auto or 0 value is used.0 on editor resize.API Changes:
stylesRemove editor event.Other Changes:
stylesLoaded variable. Thanks to Levi Carter!1.0.1 version:New features:
colorName property for customizing foreground and background styles in the Color Button plugin via the config.colorButton_foreStyle and config.colorButton_backStyle configuration options.Fixed Issues:
config.dataIndentationChars configuration option to an empty string is ignored and replaced by a tab (\t) character. Thanks to Thomas Grinderslev!selection.scrollIntoView method throws an error when the editor selection is not set.<select> element inside the editor.Fixed Issues:
config.readOnly configuration option not considered for startup read-only mode of inline editor.config.autolink_urlRegex and config.autolink_emailRegex options are not customizable. Thanks to Sergiy Dobrovolsky!editor.resize() method does not work with CSS units.Other Changes:
Security Updates:
Fixed XSS vulnerability in the HTML data processor reported by Michał Bentkowski of Securitum.
Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode or (i) copy the specially crafted HTML code, prepared by the attacker and (ii) paste it into CKEditor in WYSIWYG mode.
Fixed XSS vulnerability in the WebSpellChecker Dialog plugin reported by Pham Van Khanh from Viettel Cyber Security.
Issue summary: It was possible to execute XSS using CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, then (iii) switch back to WYSIWYG mode, and (iv) preview CKEditor content outside CKEditor editable area.
An upgrade is highly recommended!
New features:
aria-selected="true" attribute.widget.getClipboardHtml() support for dragging and dropping multiple widgets.Fixed Issues:
editor.extractSelectedHtml() method after selecting all content.<span> tags when reapplying the same font multiple times.API Changes:
textColor and bgColor commands that apply the selected color chosen by the Color Button plugin.font and fontSize commands that apply the selected font style chosen by the Font plugin.editor.getSelectedRanges() alias.Fixed Issues:
@.CKEDITOR.htmlParser.filter.CKEDITOR.plugins.widget.repository#selected after selecting the whole editor content.API Changes:
CKEDITOR.plugins.clipboard.dataTransfer#getTypes() method.New Features:
<span> element containing just one word creates a correct selection including the clicked <span> only.config.linkDefaultProtocol configuration option that allows setting the default URL protocol for the Link plugin dialog.CKEDITOR.plugins.widget#mask property to allow masking only the specified part of a widget.widgetDefinition.getClipboardHtml() method to customize the widget HTML during copy, cut and drag operations.Fixed Issues:
CKEDITOR.dom.range#_getTableElement() returns null instead of a table element for edge cases.CKEDITOR.tools.promise initializes incorrectly if an AMD loader is present.CKEDITOR.editor#getData() call when inserting content into the editor.CKEDITOR.tools.object.keys() method does not accept non-objects.API Changes:
CKEDITOR.tools.array.some() method.CKEDITOR.plugins.undo.UndoManager.addFilterRule() method that allows filtering undo snapshot contents.CKEDITOR.tools.normalizeMouseButton() method.CKEDITOR.dom.element#fireEventHandler() method.CKEDITOR.tools.bind() method to accept arguments for bound functions.CKEDITOR.dom.text#isEmpty() method.CKEDITOR.plugins.dialog.getModel() and CKEDITOR.plugins.dialog.getMode() methods with their CKEDITOR.plugin.definition counterparts, allowing to get the dialog subject of a change.CKEDITOR.dom.element#isDetached() method.Fixed Issues:
New Features:
CKEDITOR.config.image2_maxSize configuration option for the Enhanced Image plugin that allows setting a maximum size that an image can be resized to with the resizer.Fixed Issues:
config.colorButton_colors configuration option in the form of a label or code do not work correctly.windowtext color is not correctly recognized by the CKEDITOR.tools.style.parse methods.CKEDITOR.tools.extend() method does not work with the DontEnum object property attribute.editor.insertHtml(), editor.insertHtmlIntoRange(), editor.insertElement() and editor.insertElementIntoRange()) pollute the editable with empty <span> elements.config.enterMode set to ENTER_DIV alters pasted content.API Changes:
CKEDITOR.ui.balloonToolbar.reposition() and CKEDITOR.ui.balloonToolbarView.reposition() methods.CKEDITOR.dom.documentFragment.find() and CKEDITOR.dom.documentFragment.findOne() methods.CKEDITOR.tools.array.find() method.CKEDITOR.tools.object.keys() method.CKEDITOR.tools.object.entries() method.CKEDITOR.tools.object.values() method.CKEDITOR.template#source property can now be a function, so it can return the changed template values during the runtime. Thanks to Jacek Pulit!CKEDITOR.plugins.pagebreak.createElement() method allowing to create a Page Break plugin CKEDITOR.dom.element instance.CKEDITOR.htmlParser.element.findOne() method.CKEDITOR.config.pasteFromWord_keepZeroMargins configuration option that allows for keeping any margin-*: 0 style that would be otherwise removed when pasting content with the Paste from Word plugin.CKEDITOR.tools.promise class.CKEDITOR.tools.style.border object wrapping CSS border style helpers under a single type.data-cke-tableselection-ignored attribute.pluginDefinition.isSupportedEnvironment() method.Other Changes:
arguments.callee calls with named function expressions to allow the editor to work in strict mode.CKEDITOR.tools.style.parse.border() as deprecated in favor of the CKEDITOR.tools.style.border.fromCssRule() method.CKEDITOR.tools.objectKeys() as deprecated in favor of the CKEDITOR.tools.object.keys() method.Fixed Issues:
Other Changes:
CKEDITOR.getUrl() when referencing style sheets.CKEDITOR.getUrl() when referencing style sheets.sl_SL) language does not work.U+2019 (Right single quotation mark) are considered separators.Fixed Issues:
config.allowedContent.Fixed Issues:
<figure> tag with an image class is upcasted.getValue() function is defined in the global scope.Other Changes:
package.json file.Fixed Issues:
Security Updates:
Fixed XSS vulnerability in the HTML parser reported by maxarr.
Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode.
An upgrade is highly recommended!
New Features:
aria-haspopup property values. The Menu Button aria-haspopup value is now menu, the Panel Button and Rich Combo aria-haspopup value is now listbox.contextmenu_contentsCss configuration option to allow adding custom CSS to the Context Menu.Fixed Issues:
required attribute is not correctly recognized by the Form Elements plugin dialog. Thanks to Roli Züger!Permission denied is thrown when opening a Panel instance.config.forceSimpleAmpersand option does not work. Thanks to Alex Maris!Escape HTML Entities] plugin with custom additional entities configuration breaks HTML escaping.(Selected) text at the end of the label when clicked.onAbort method of the Upload Widget is not called when the loader is aborted.CKEDITOR.filter.instances is causing memory leaks.API Changes:
CKEDITOR.ui.panel.block.getItems method now also returns input elements in addition to links.CKEDITOR.tools.convertToPx function now converts negative values.insert method now passes editor and commandData. Thanks to marcparmet!tools.eventsBuffer and tools.throttle functions logic into a separate namespace.tools.eventsBuffer was extracted into tools.buffers.event,tools.throttle was extracted into tools.buffers.throttle.CKEDITOR.filter constructor accepts an additional rules parameter allowing to bind the editor and filter together.editor.getCommandKeystroke method accepts an additional all parameter allowing to retrieve an array of all command keystrokes.hasArrow definition option can by identified by the .cke_button_expandable CSS class.Other Changes:
Fixed Issues:
instanceReady.editor.destroy() during the file upload throws an error. Thanks to Maksim Makarevich!id attribute. Thanks to Nathan Samson!<font> tag is not preserved when proper configuration is provided and a style is applied by the Font plugin.object, embed, param are removed from the editor content.API Changes:
editor.plugins.detectConflict() method finding conflicts between provided plugins.New Features:
CKEDITOR.dom.range for matching text.Fixed Issues:
CKEDITOR.dialog.definition.onHide API documentation. Thanks to sunnyone!\u3000) is lost when pasting text.config.forcePasteAsPlainText option is not respected in internal and cross-editor pasting.API Changes:
replace dialog from the Find / Replace plugin with a tabId option in the find command.CKEDITOR.editor.addCommand() method can now accept a CKEDITOR.command instance as a parameter.extraPlugins, removePlugins and plugins configuration options allow whitespace.extraPlugins, removePlugins and plugins configuration options allow passing plugin names as an array.getClientRect() function allowing to retrieve an absolute bounding rectangle of the element, i.e. a position relative to the upper-left corner of the topmost viewport.getClientRects() method to CKEDITOR.dom.range. It returns a list of rectangles for each selected element.CKEDITOR.tools.throttle() function.Other Changes:
gv_GB) and Interlingua (ia_XR).alt attribute for the logo image in the About tab of SCAYT.Security Updates:
Fixed XSS vulnerability in the Enhanced Image (image2) plugin reported by Kyaw Min Thein.
Issue summary: It was possible to execute XSS inside CKEditor using the <img> tag and specially crafted HTML. Please note that the default presets (Basic/Standard/Full) do not include this plugin, so you are only at risk if you made a custom build and enabled this plugin.
We would like to thank the Drupal security team for bringing this matter to our attention and coordinating the fix and release process!