? Release Blocker NPM Resource Changed PR-5.0-dev Pending

User tests: Successful: Unsuccessful:

avatar SniperSister
SniperSister
28 Oct 2023

Summary of Changes

Updating TinyMCE to 6.7.2 to fix a mXSS vulnerability, see:
GHSA-v65r-p3vv-jjfv

Testing Instructions

Apply patch, run npm install to download the updated Tiny version, test the editor.


6.7.2 - 2023-10-25
Fixed
The function getModifierState did not work on events passed through the editor as expected.

Indenting or outdenting a list item that contained non list item siblings after it would result in those siblings being removed.

Removed use of async for editor rendering which caused visual blinking when reloading the editor in-place.

Toggling a list that contained a list item element — <li> — which, in turn, contained another list item element as its first child, removed other content within the first list item element.

6.7.1 - 2023-10-19
Fixed
Specific HTML content caused mXSS when using undo/redo.

Specific HTML content caused mXSS when using the getContent and setContent APIs with the format: 'raw' option, which also affected the resetContent API and the draft restoration feature of the Autosave plugin.

Notification messages containing HTML were not properly XSS sanitized before being displayed.
avatar SniperSister SniperSister - open - 28 Oct 2023
avatar SniperSister SniperSister - change - 28 Oct 2023
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 28 Oct 2023
Category NPM Change
avatar HLeithner
HLeithner - comment - 28 Oct 2023

I was confused why you set as minimum 6.7.1 when you say to upgrade to 6.7.2, but found out that the issue is fixed in 6.7.1

avatar dgrammatiko dgrammatiko - test_item - 28 Oct 2023 - Tested successfully
avatar dgrammatiko
dgrammatiko - comment - 28 Oct 2023

I have tested this item ✅ successfully on a81ed20


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/42240.

avatar heelc29
heelc29 - comment - 28 Oct 2023

Plugin manifest version should be updated too.

avatar SniperSister SniperSister - change - 28 Oct 2023
Labels Added: Release Blocker NPM Resource Changed PR-5.0-dev
avatar joomla-cms-bot joomla-cms-bot - change - 28 Oct 2023
Category NPM Change NPM Change Front End Plugins
avatar SniperSister
SniperSister - comment - 28 Oct 2023

Good catch @heelc29 , done!

avatar brianteeman
brianteeman - comment - 28 Oct 2023

Usually we post the changelog in the first post to help testers especially as in this case we are jumping two releases.


6.7.2 - 2023-10-25
Fixed
The function getModifierState did not work on events passed through the editor as expected.

Indenting or outdenting a list item that contained non list item siblings after it would result in those siblings being removed.

Removed use of async for editor rendering which caused visual blinking when reloading the editor in-place.

Toggling a list that contained a list item element — <li> — which, in turn, contained another list item element as its first child, removed other content within the first list item element.

6.7.1 - 2023-10-19
Fixed
Specific HTML content caused mXSS when using undo/redo.

Specific HTML content caused mXSS when using the getContent and setContent APIs with the format: 'raw' option, which also affected the resetContent API and the draft restoration feature of the Autosave plugin.

Notification messages containing HTML were not properly XSS sanitized before being displayed.
avatar SniperSister SniperSister - change - 28 Oct 2023
The description was changed
avatar SniperSister SniperSister - edited - 28 Oct 2023
avatar Fedik Fedik - test_item - 31 Oct 2023 - Tested successfully
avatar Fedik
Fedik - comment - 31 Oct 2023

I have tested this item ✅ successfully on cb295dc


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/42240.

avatar Fedik Fedik - change - 31 Oct 2023
Status Pending Ready to Commit
avatar Fedik
Fedik - comment - 31 Oct 2023

r2c


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/42240.

avatar HLeithner HLeithner - close - 31 Oct 2023
avatar HLeithner HLeithner - merge - 31 Oct 2023
avatar HLeithner HLeithner - change - 31 Oct 2023
Status Ready to Commit Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 2023-10-31 12:33:59
Closed_By HLeithner
Labels Added: ?
avatar HLeithner
HLeithner - comment - 31 Oct 2023

thanks

Add a Comment

Login with GitHub to post a comment