From: Jason Woofenden Date: Thu, 25 Jun 2015 01:48:40 +0000 (-0400) Subject: vanilla ckeditor-4.4.6_full X-Git-Url: https://jasonwoof.com/gitweb/?p=ckeditor.git;a=commitdiff_plain;h=dc5b273b4cbd7e7d0167499e7649867ba2a5b408 vanilla ckeditor-4.4.6_full --- diff --git a/CHANGES.md b/CHANGES.md index 9bfaef3..d1c3880 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,6 +1,40 @@ CKEditor 4 Changelog ==================== +## CKEditor 4.4.6 + +**Security Updates:** + +* Fixed XSS vulnerability in the HTML parser reported by [Maco Cortes](https://www.facebook.com/Maaacoooo). + + Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode. + +**An upgrade is highly recommended!** + +New Features: + +* [#12501](http://dev.ckeditor.com/ticket/12501): Allowed dashes in element names in the [string format of allowed content rules](http://docs.ckeditor.com/#!/guide/dev_allowed_content_rules-section-string-format). +* [#12550](http://dev.ckeditor.com/ticket/12550): Added the `
` element to the [`CKEDITOR.dtd`](http://docs.ckeditor.com/#!/api/CKEDITOR.dtd). + +Fixed Issues: + +* [#12506](http://dev.ckeditor.com/ticket/12506): [Safari] Fixed: Cannot paste into inline editor if the page has `user-select: none` style. Thanks to [shaohua](https://github.com/shaohua)! +* [#12683](http://dev.ckeditor.com/ticket/12683): Fixed: [Filter](http://docs.ckeditor.com/#!/guide/dev_acf) fails to remove custom tags. Thanks to [timselier](https://github.com/timselier)! +* [#12489](http://dev.ckeditor.com/ticket/12489) and [#12491](http://dev.ckeditor.com/ticket/12491): Fixed: Various issues related to restoring the selection after performing operations on filler character. See the [fixed cases](http://dev.ckeditor.com/ticket/12491#comment:4). +* [#12621](http://dev.ckeditor.com/ticket/12621): Fixed: Cannot remove inline styles (bold, italic, etc.) in empty lines. +* [#12630](http://dev.ckeditor.com/ticket/12630): [Chrome] Fixed: Selection is placed outside the paragraph when the [New Page](http://ckeditor.com/addon/newpage) button is clicked. This patch significantly simplified the way how the initial selection (a selection after the content of the editable is overwritten) is being fixed. That might have fixed many related scenarios in all browsers. +* [#11647](http://dev.ckeditor.com/ticket/11647): Fixed: The [`editor.blur`](http://docs.ckeditor.com/#!/api/CKEDITOR.editor-event-blur) event is not fired on first blur after initializing the inline editor on an already focused element. +* [#12601](http://dev.ckeditor.com/ticket/12601): Fixed: [Strikethrough](http://ckeditor.com/addon/basicstyles) button tooltip spelling. +* [#12546](http://dev.ckeditor.com/ticket/12546): Fixed: The Preview tab in the [Document Properties](http://ckeditor.com/addon/docprops) dialog window is always disabled. +* [#12300](http://dev.ckeditor.com/ticket/12300): Fixed: The [`editor.change`](http://docs.ckeditor.com/#!/api/CKEDITOR.editor-event-change) event fired on first navigation key press after typing. +* [#12141](http://dev.ckeditor.com/ticket/12141): Fixed: List items are lost when indenting a list item with content wrapped with a block element. +* [#12515](http://dev.ckeditor.com/ticket/12515): Fixed: Cursor is in the wrong position when undoing after adding an image and typing some text. +* [#12484](http://dev.ckeditor.com/ticket/12484): [Blink/Webkit] Fixed: DOM is changed outside the editor area in a certain case. +* [#12688](http://dev.ckeditor.com/ticket/12688): Improved the tests of the [styles system](http://docs.ckeditor.com/#!/api/CKEDITOR.style) and fixed two minor issues. +* [#12403](http://dev.ckeditor.com/ticket/12403): Fixed: Changing the [font](http://ckeditor.com/addon/font) style should not lead to nesting it in the previous style element. +* [#12609](http://dev.ckeditor.com/ticket/12609): Fixed: Incorrect `config.magicline_putEverywhere` name used for a [Magic Line](http://ckeditor.com/addon/magicline) all-encompassing [`config.magicline_everywhere`](http://docs.ckeditor.com/#!/api/CKEDITOR.config-cfg-magicline_everywhere) configuration option. + + ## CKEditor 4.4.5 New Features: @@ -75,7 +109,7 @@ New Features: Fixed Issues: * [#12110](http://dev.ckeditor.com/ticket/12110): Fixed: Editor crash after deleting a table. Thanks to [Alin Purcaru](https://github.com/mesmerizero)! -* [#11897](http://dev.ckeditor.com/ticket/11897): Fixed: **Enter** key used in an empty list item creates a new line instead of breaking the list. Thanks to [noam-si](https://github.com/noam-si)! +* [#11897](http://dev.ckeditor.com/ticket/11897): Fixed: *Enter* key used in an empty list item creates a new line instead of breaking the list. Thanks to [noam-si](https://github.com/noam-si)! * [#12140](http://dev.ckeditor.com/ticket/12140): Fixed: Double-clicking linked widgets opens two dialog windows. * [#12132](http://dev.ckeditor.com/ticket/12132): Fixed: Image is inserted with `width` and `height` styles even when they are not allowed. * [#9317](http://dev.ckeditor.com/ticket/9317): [IE] Fixed: [`config.disableObjectResizing`](http://docs.ckeditor.com/#!/api/CKEDITOR.config-cfg-disableObjectResizing) does not work on IE. **Note**: We were not able to fix this issue on IE11+ because necessary events stopped working. See a [last resort workaround](http://dev.ckeditor.com/ticket/9317#comment:16) and make sure to [support our complaint to Microsoft](https://connect.microsoft.com/IE/feedback/details/742593/please-respect-execcommand-enableobjectresizing-in-contenteditable-elements). diff --git a/build-config.js b/build-config.js index 5ea8379..29cfe7c 100644 --- a/build-config.js +++ b/build-config.js @@ -37,6 +37,7 @@ var CKBUILDER_CONFIG = { '.gitattributes', '.gitignore', 'Gruntfile.js', + 'gruntfile.js', '.idea', '.jscsrc', '.jshintignore', diff --git a/ckeditor.js b/ckeditor.js index d35e8bc..2bedfd2 100644 --- a/ckeditor.js +++ b/ckeditor.js @@ -2,14 +2,14 @@ Copyright (c) 2003-2014, CKSource - Frederico Knabben. All rights reserved. For licensing, see LICENSE.md or http://ckeditor.com/license */ -(function(){if(window.CKEDITOR&&window.CKEDITOR.dom)return;window.CKEDITOR||(window.CKEDITOR=function(){var a=/(^|.*[\\\/])ckeditor\.js(?:\?.*|;.*)?$/i,e={timestamp:"E8PB",version:"4.4.5",revision:"25cdcad",rnd:Math.floor(900*Math.random())+100,_:{pending:[],basePathSrcPattern:a},status:"unloaded",basePath:function(){var f=window.CKEDITOR_BASEPATH||"";if(!f)for(var d=document.getElementsByTagName("script"),c=0;c=0;t--)if(p[t].priority<=e){p.splice(t+1,0,m);return{removeListener:j}}p.unshift(m)}return{removeListener:j}}, -once:function(){var a=Array.prototype.slice.call(arguments),f=a[1];a[1]=function(a){a.removeListener();return f.apply(this,arguments)};return this.on.apply(this,a)},capture:function(){CKEDITOR.event.useCapture=1;var a=this.on.apply(this,arguments);CKEDITOR.event.useCapture=0;return a},fire:function(){var a=0,f=function(){a=1},d=0,b=function(){d=1};return function(h,m,j){var p=e(this)[h],h=a,u=d;a=d=0;if(p){var t=p.listeners;if(t.length)for(var t=t.slice(0),y,n=0;n=0&&d.listeners.splice(b,1)}},removeAllListeners:function(){var a=e(this),f;for(f in a)delete a[f]},hasListeners:function(a){return(a=e(this)[a])&&a.listeners.length> +return{define:function(b,f){var d=a.call(this,b);CKEDITOR.tools.extend(d,f,true)},on:function(b,f,d,e,l){function i(a,m,t,j){a={name:b,sender:this,editor:a,data:m,listenerData:e,stop:t,cancel:j,removeListener:g};return f.call(d,a)===false?false:a.data}function g(){t.removeListener(b,f)}var m=a.call(this,b);if(m.getListenerIndex(f)<0){m=m.listeners;d||(d=this);isNaN(l)&&(l=10);var t=this;i.fn=f;i.priority=l;for(var s=m.length-1;s>=0;s--)if(m[s].priority<=l){m.splice(s+1,0,i);return{removeListener:g}}m.unshift(i)}return{removeListener:g}}, +once:function(){var a=Array.prototype.slice.call(arguments),f=a[1];a[1]=function(a){a.removeListener();return f.apply(this,arguments)};return this.on.apply(this,a)},capture:function(){CKEDITOR.event.useCapture=1;var a=this.on.apply(this,arguments);CKEDITOR.event.useCapture=0;return a},fire:function(){var a=0,f=function(){a=1},d=0,b=function(){d=1};return function(l,i,g){var m=e(this)[l],l=a,t=d;a=d=0;if(m){var s=m.listeners;if(s.length)for(var s=s.slice(0),y,p=0;p=0&&d.listeners.splice(b,1)}},removeAllListeners:function(){var a=e(this),f;for(f in a)delete a[f]},hasListeners:function(a){return(a=e(this)[a])&&a.listeners.length> 0}}}());CKEDITOR.editor||(CKEDITOR.editor=function(){CKEDITOR._.pending.push([this,arguments]);CKEDITOR.event.call(this)},CKEDITOR.editor.prototype.fire=function(a,e){a in{instanceReady:1,loaded:1}&&(this[a]=true);return CKEDITOR.event.prototype.fire.call(this,a,e,this)},CKEDITOR.editor.prototype.fireOnce=function(a,e){a in{instanceReady:1,loaded:1}&&(this[a]=true);return CKEDITOR.event.prototype.fireOnce.call(this,a,e,this)},CKEDITOR.event.implementOn(CKEDITOR.editor.prototype)); CKEDITOR.env||(CKEDITOR.env=function(){var a=navigator.userAgent.toLowerCase(),e={ie:a.indexOf("trident/")>-1,webkit:a.indexOf(" applewebkit/")>-1,air:a.indexOf(" adobeair/")>-1,mac:a.indexOf("macintosh")>-1,quirks:document.compatMode=="BackCompat"&&(!document.documentMode||document.documentMode<10),mobile:a.indexOf("mobile")>-1,iOS:/(ipad|iphone|ipod)/.test(a),isCustomDomain:function(){if(!this.ie)return false;var a=document.domain,d=window.location.hostname;return a!=d&&a!="["+d+"]"},secure:location.protocol== "https:"};e.gecko=navigator.product=="Gecko"&&!e.webkit&&!e.ie;if(e.webkit)a.indexOf("chrome")>-1?e.chrome=true:e.safari=true;var b=0;if(e.ie){b=e.quirks||!document.documentMode?parseFloat(a.match(/msie (\d+)/)[1]):document.documentMode;e.ie9Compat=b==9;e.ie8Compat=b==8;e.ie7Compat=b==7;e.ie6Compat=b<7||e.quirks}if(e.gecko){var c=a.match(/rv:([\d\.]+)/);if(c){c=c[1].split(".");b=c[0]*1E4+(c[1]||0)*100+(c[2]||0)*1}}e.air&&(b=parseFloat(a.match(/ adobeair\/(\d+)/)[1]));e.webkit&&(b=parseFloat(a.match(/ applewebkit\/(\d+)/)[1])); @@ -17,29 +17,28 @@ e.version=b;e.isCompatible=e.iOS&&b>=534||!e.mobile&&(e.ie&&b>6||e.gecko&&b>=2E4 if(e.iOS)e.cssClass=e.cssClass+" cke_browser_ios";if(e.hidpi)e.cssClass=e.cssClass+" cke_hidpi";return e}()); "unloaded"==CKEDITOR.status&&function(){CKEDITOR.event.implementOn(CKEDITOR);CKEDITOR.loadFullCore=function(){if(CKEDITOR.status!="basic_ready")CKEDITOR.loadFullCore._load=1;else{delete CKEDITOR.loadFullCore;var a=document.createElement("script");a.type="text/javascript";a.src=CKEDITOR.basePath+"ckeditor.js";document.getElementsByTagName("head")[0].appendChild(a)}};CKEDITOR.loadFullCoreTimeout=0;CKEDITOR.add=function(a){(this._.pending||(this._.pending=[])).push(a)};(function(){CKEDITOR.domReady(function(){var a= CKEDITOR.loadFullCore,e=CKEDITOR.loadFullCoreTimeout;if(a){CKEDITOR.status="basic_ready";a&&a._load?a():e&&setTimeout(function(){CKEDITOR.loadFullCore&&CKEDITOR.loadFullCore()},e*1E3)}})})();CKEDITOR.status="basic_loaded"}();CKEDITOR.dom={}; -(function(){var a=[],e=CKEDITOR.env.gecko?"-moz-":CKEDITOR.env.webkit?"-webkit-":CKEDITOR.env.ie?"-ms-":"",b=/&/g,c=/>/g,f=//g,f=/"+f+""):d.push('');return d.join("")}, -htmlEncode:function(a){return(""+a).replace(b,"&").replace(c,">").replace(f,"<")},htmlDecode:function(a){return a.replace(g,"&").replace(h,">").replace(m,"<")},htmlEncodeAttr:function(a){return a.replace(d,""").replace(f,"<").replace(c,">")},htmlDecodeAttr:function(a){return a.replace(j,'"').replace(m,"<").replace(h,">")},getNextNumber:function(){var a=0;return function(){return++a}}(),getNextId:function(){return"cke_"+this.getNextNumber()},override:function(a,f){var d=f(a);d.prototype= +htmlEncode:function(a){return(""+a).replace(b,"&").replace(c,">").replace(f,"<")},htmlDecode:function(a){return a.replace(h,"&").replace(l,">").replace(i,"<")},htmlEncodeAttr:function(a){return a.replace(d,""").replace(f,"<").replace(c,">")},htmlDecodeAttr:function(a){return a.replace(g,'"').replace(i,"<").replace(l,">")},getNextNumber:function(){var a=0;return function(){return++a}}(),getNextId:function(){return"cke_"+this.getNextNumber()},override:function(a,f){var d=f(a);d.prototype= a.prototype;return d},setTimeout:function(a,f,d,b,c){c||(c=window);d||(d=c);return c.setTimeout(function(){b?a.apply(d,[].concat(b)):a.apply(d)},f||0)},trim:function(){var a=/(?:^[ \t\n\r]+)|(?:[ \t\n\r]+$)/g;return function(f){return f.replace(a,"")}}(),ltrim:function(){var a=/^[ \t\n\r]+/g;return function(f){return f.replace(a,"")}}(),rtrim:function(){var a=/[ \t\n\r]+$/g;return function(f){return f.replace(a,"")}}(),indexOf:function(a,f){if(typeof f=="function")for(var d=0,b=a.length;d=0?a[d]:null},bind:function(a,f){return function(){return a.apply(f,arguments)}},createClass:function(a){var f=a.$,d=a.base,b=a.privates||a._,c=a.proto,a=a.statics;!f&&(f=function(){d&&this.base.apply(this,arguments)});if(b)var e=f,f=function(){var a=this._||(this._={}),f;for(f in b){var d=b[f];a[f]=typeof d=="function"?CKEDITOR.tools.bind(d,this):d}e.apply(this,arguments)};if(d){f.prototype= this.prototypedCopy(d.prototype);f.prototype.constructor=f;f.base=d;f.baseProto=d.prototype;f.prototype.base=function(){this.base=d.prototype.base;d.apply(this,arguments);this.base=arguments.callee}}c&&this.extend(f.prototype,c,true);a&&this.extend(f,a,true);return f},addFunction:function(f,d){return a.push(function(){return f.apply(d||this,arguments)})-1},removeFunction:function(f){a[f]=null},callFunction:function(f){var d=a[f];return d&&d.apply(window,Array.prototype.slice.call(arguments,1))},cssLength:function(){var a= /^-?\d+\.?\d*px$/,f;return function(d){f=CKEDITOR.tools.trim(d+"")+"px";return a.test(f)?f:d||""}}(),convertToPx:function(){var a;return function(f){if(!a){a=CKEDITOR.dom.element.createFromHtml('
',CKEDITOR.document);CKEDITOR.document.getBody().append(a)}if(!/%$/.test(f)){a.setStyle("width",f);return a.$.clientWidth}return f}}(),repeat:function(a,f){return Array(f+1).join(a)},tryThese:function(){for(var a, f=0,d=arguments.length;f]*?>)|^/i,'$&\n