User tests: Successful: Unsuccessful:
Updating TinyMCE to 6.7.2 to fix a mXSS vulnerability, see:
GHSA-v65r-p3vv-jjfv
Apply patch, run npm install to download the updated Tiny version, test the editor.
6.7.2 - 2023-10-25
Fixed
The function getModifierState did not work on events passed through the editor as expected.
Indenting or outdenting a list item that contained non list item siblings after it would result in those siblings being removed.
Removed use of async for editor rendering which caused visual blinking when reloading the editor in-place.
Toggling a list that contained a list item element — <li> — which, in turn, contained another list item element as its first child, removed other content within the first list item element.
6.7.1 - 2023-10-19
Fixed
Specific HTML content caused mXSS when using undo/redo.
Specific HTML content caused mXSS when using the getContent and setContent APIs with the format: 'raw' option, which also affected the resetContent API and the draft restoration feature of the Autosave plugin.
Notification messages containing HTML were not properly XSS sanitized before being displayed.
Status | New | ⇒ | Pending |
Category | ⇒ | NPM Change |
I have tested this item ✅ successfully on a81ed20
Plugin manifest version should be updated too.
Labels |
Added:
Release Blocker
NPM Resource Changed
PR-5.0-dev
|
Category | NPM Change | ⇒ | NPM Change Front End Plugins |
Usually we post the changelog in the first post to help testers especially as in this case we are jumping two releases.
6.7.2 - 2023-10-25
Fixed
The function getModifierState did not work on events passed through the editor as expected.
Indenting or outdenting a list item that contained non list item siblings after it would result in those siblings being removed.
Removed use of async for editor rendering which caused visual blinking when reloading the editor in-place.
Toggling a list that contained a list item element — <li> — which, in turn, contained another list item element as its first child, removed other content within the first list item element.
6.7.1 - 2023-10-19
Fixed
Specific HTML content caused mXSS when using undo/redo.
Specific HTML content caused mXSS when using the getContent and setContent APIs with the format: 'raw' option, which also affected the resetContent API and the draft restoration feature of the Autosave plugin.
Notification messages containing HTML were not properly XSS sanitized before being displayed.
I have tested this item ✅ successfully on cb295dc
Status | Pending | ⇒ | Ready to Commit |
r2c
Status | Ready to Commit | ⇒ | Fixed in Code Base |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2023-10-31 12:33:59 |
Closed_By | ⇒ | HLeithner | |
Labels |
Added:
?
|
thanks
I was confused why you set as minimum 6.7.1 when you say to upgrade to 6.7.2, but found out that the issue is fixed in 6.7.1