diff --git a/ckeditor/static/ckeditor/ckeditor/CHANGES.md b/ckeditor/static/ckeditor/ckeditor/CHANGES.md index fd29057..d1c3880 100644 --- a/ckeditor/static/ckeditor/ckeditor/CHANGES.md +++ b/ckeditor/static/ckeditor/ckeditor/CHANGES.md @@ -1,6 +1,68 @@ CKEditor 4 Changelog ==================== +## CKEditor 4.4.6 + +**Security Updates:** + +* Fixed XSS vulnerability in the HTML parser reported by [Maco Cortes](https://www.facebook.com/Maaacoooo). + + Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode. + +**An upgrade is highly recommended!** + +New Features: + +* [#12501](http://dev.ckeditor.com/ticket/12501): Allowed dashes in element names in the [string format of allowed content rules](http://docs.ckeditor.com/#!/guide/dev_allowed_content_rules-section-string-format). +* [#12550](http://dev.ckeditor.com/ticket/12550): Added the `
` element to the [`CKEDITOR.dtd`](http://docs.ckeditor.com/#!/api/CKEDITOR.dtd). + +Fixed Issues: + +* [#12506](http://dev.ckeditor.com/ticket/12506): [Safari] Fixed: Cannot paste into inline editor if the page has `user-select: none` style. Thanks to [shaohua](https://github.com/shaohua)! +* [#12683](http://dev.ckeditor.com/ticket/12683): Fixed: [Filter](http://docs.ckeditor.com/#!/guide/dev_acf) fails to remove custom tags. Thanks to [timselier](https://github.com/timselier)! +* [#12489](http://dev.ckeditor.com/ticket/12489) and [#12491](http://dev.ckeditor.com/ticket/12491): Fixed: Various issues related to restoring the selection after performing operations on filler character. See the [fixed cases](http://dev.ckeditor.com/ticket/12491#comment:4). +* [#12621](http://dev.ckeditor.com/ticket/12621): Fixed: Cannot remove inline styles (bold, italic, etc.) in empty lines. +* [#12630](http://dev.ckeditor.com/ticket/12630): [Chrome] Fixed: Selection is placed outside the paragraph when the [New Page](http://ckeditor.com/addon/newpage) button is clicked. This patch significantly simplified the way how the initial selection (a selection after the content of the editable is overwritten) is being fixed. That might have fixed many related scenarios in all browsers. +* [#11647](http://dev.ckeditor.com/ticket/11647): Fixed: The [`editor.blur`](http://docs.ckeditor.com/#!/api/CKEDITOR.editor-event-blur) event is not fired on first blur after initializing the inline editor on an already focused element. +* [#12601](http://dev.ckeditor.com/ticket/12601): Fixed: [Strikethrough](http://ckeditor.com/addon/basicstyles) button tooltip spelling. +* [#12546](http://dev.ckeditor.com/ticket/12546): Fixed: The Preview tab in the [Document Properties](http://ckeditor.com/addon/docprops) dialog window is always disabled. +* [#12300](http://dev.ckeditor.com/ticket/12300): Fixed: The [`editor.change`](http://docs.ckeditor.com/#!/api/CKEDITOR.editor-event-change) event fired on first navigation key press after typing. +* [#12141](http://dev.ckeditor.com/ticket/12141): Fixed: List items are lost when indenting a list item with content wrapped with a block element. +* [#12515](http://dev.ckeditor.com/ticket/12515): Fixed: Cursor is in the wrong position when undoing after adding an image and typing some text. +* [#12484](http://dev.ckeditor.com/ticket/12484): [Blink/Webkit] Fixed: DOM is changed outside the editor area in a certain case. +* [#12688](http://dev.ckeditor.com/ticket/12688): Improved the tests of the [styles system](http://docs.ckeditor.com/#!/api/CKEDITOR.style) and fixed two minor issues. +* [#12403](http://dev.ckeditor.com/ticket/12403): Fixed: Changing the [font](http://ckeditor.com/addon/font) style should not lead to nesting it in the previous style element. +* [#12609](http://dev.ckeditor.com/ticket/12609): Fixed: Incorrect `config.magicline_putEverywhere` name used for a [Magic Line](http://ckeditor.com/addon/magicline) all-encompassing [`config.magicline_everywhere`](http://docs.ckeditor.com/#!/api/CKEDITOR.config-cfg-magicline_everywhere) configuration option. + + +## CKEditor 4.4.5 + +New Features: + +* [#12279](http://dev.ckeditor.com/ticket/12279): Added a possibility to pass a custom evaluator to [`node.getAscendant()`](http://docs.ckeditor.com/#!/api/CKEDITOR.dom.node-method-getAscendant). + +Fixed Issues: + +* [#12423](http://dev.ckeditor.com/ticket/12423): [Safari7.1+] Fixed: *Enter* key moved cursor to a strange position. +* [#12381](http://dev.ckeditor.com/ticket/12381): [iOS] Fixed: Selection issue. Thanks to [Remiremi](https://github.com/Remiremi)! +* [#10804](http://dev.ckeditor.com/ticket/10804): Fixed: `CKEDITOR_GETURL` is not used with some plugins where it should be used. Thanks to [Thomas Andraschko](https://github.com/tandraschko)! +* [#9137](http://dev.ckeditor.com/ticket/9137): Fixed: The `` tag is not created when `` has an attribute. Thanks to [naoki.fujikawa](https://github.com/naoki-fujikawa)! +* [#12377](http://dev.ckeditor.com/ticket/12377): Fixed: Errors thrown in the [Image](http://ckeditor.com/addon/image) plugin when removing preview from the dialog window definition. Thanks to [Axinet](https://github.com/Axinet)! +* [#12162](http://dev.ckeditor.com/ticket/12162): Fixed: Auto paragraphing and *Enter* key in nested editables. +* [#12315](http://dev.ckeditor.com/ticket/12315): Fixed: Marked [`config.autoParagraph`](http://docs.ckeditor.com/#!/api/CKEDITOR.config-cfg-autoParagraph) as deprecated. +* [#12113](http://dev.ckeditor.com/ticket/12113): Fixed: A [code snippet](http://ckeditor.com/addon/codesnippet) should be presented in the [elements path](http://ckeditor.com/addon/elementspath) as "code snippet" (translatable). +* [#12311](http://dev.ckeditor.com/ticket/12311): Fixed: [Remove Format](http://ckeditor.com/addon/removeformat) should also remove `` elements. +* [#12261](http://dev.ckeditor.com/ticket/12261): Fixed: Filter has to be destroyed and removed from [`CKEDITOR.filter.instances`](http://docs.ckeditor.com/#!/api/CKEDITOR.filter-static-property-instances) on editor destroy. +* [#12398](http://dev.ckeditor.com/ticket/12398): Fixed: [Maximize](http://ckeditor.com/addon/maximize) does not work on an instance without a [title](http://docs.ckeditor.com/#!/api/CKEDITOR.config-cfg-title). +* [#12097](http://dev.ckeditor.com/ticket/12097): Fixed: JAWS not reading the number of options correctly in the [Text Color and Background Color](http://ckeditor.com/addon/colorbutton) button menu. +* [#12411](http://dev.ckeditor.com/ticket/12411): Fixed: [Page Break](http://ckeditor.com/addon/pagebreak) used directly in the editable breaks the editor. +* [#12354](http://dev.ckeditor.com/ticket/12354): Fixed: Various issues in undo manager when holding keys. +* [#12324](http://dev.ckeditor.com/ticket/12324): [IE8] Fixed: Undo steps are not recorded when changing the caret position by clicking below the body. +* [#12332](http://dev.ckeditor.com/ticket/12332): Fixed: Lowered DOM events listeners' priorities in undo manager in order to avoid ambiguity. +* [#12402](http://dev.ckeditor.com/ticket/12402): [Blink] Fixed: Workaround for Blink bug with `document.title` which breaks updating title in the full HTML mode. +* [#12338](http://dev.ckeditor.com/ticket/12338): Fixed: The CKEditor package contains unoptimized images. + + ## CKEditor 4.4.4 Fixed Issues: @@ -47,7 +109,7 @@ New Features: Fixed Issues: * [#12110](http://dev.ckeditor.com/ticket/12110): Fixed: Editor crash after deleting a table. Thanks to [Alin Purcaru](https://github.com/mesmerizero)! -* [#11897](http://dev.ckeditor.com/ticket/11897): Fixed: **Enter** key used in an empty list item creates a new line instead of breaking the list. Thanks to [noam-si](https://github.com/noam-si)! +* [#11897](http://dev.ckeditor.com/ticket/11897): Fixed: *Enter* key used in an empty list item creates a new line instead of breaking the list. Thanks to [noam-si](https://github.com/noam-si)! * [#12140](http://dev.ckeditor.com/ticket/12140): Fixed: Double-clicking linked widgets opens two dialog windows. * [#12132](http://dev.ckeditor.com/ticket/12132): Fixed: Image is inserted with `width` and `height` styles even when they are not allowed. * [#9317](http://dev.ckeditor.com/ticket/9317): [IE] Fixed: [`config.disableObjectResizing`](http://docs.ckeditor.com/#!/api/CKEDITOR.config-cfg-disableObjectResizing) does not work on IE. **Note**: We were not able to fix this issue on IE11+ because necessary events stopped working. See a [last resort workaround](http://dev.ckeditor.com/ticket/9317#comment:16) and make sure to [support our complaint to Microsoft](https://connect.microsoft.com/IE/feedback/details/742593/please-respect-execcommand-enableobjectresizing-in-contenteditable-elements). diff --git a/ckeditor/static/ckeditor/ckeditor/build-config.js b/ckeditor/static/ckeditor/ckeditor/build-config.js index 6c22e8b..29cfe7c 100644 --- a/ckeditor/static/ckeditor/ckeditor/build-config.js +++ b/ckeditor/static/ckeditor/ckeditor/build-config.js @@ -29,15 +29,20 @@ var CKBUILDER_CONFIG = { preset: 'full', ignore: [ '.bender', - '.DS_Store', - '.gitignore', - '.gitattributes', - '.idea', - '.mailmap', 'bender.js', 'bender-err.log', 'bender-out.log', 'dev', + '.DS_Store', + '.gitattributes', + '.gitignore', + 'Gruntfile.js', + 'gruntfile.js', + '.idea', + '.jscsrc', + '.jshintignore', + '.jshintrc', + '.mailmap', 'node_modules', 'package.json', 'README.md', diff --git a/ckeditor/static/ckeditor/ckeditor/ckeditor.js b/ckeditor/static/ckeditor/ckeditor/ckeditor.js index 474e5ba..2bedfd2 100644 --- a/ckeditor/static/ckeditor/ckeditor/ckeditor.js +++ b/ckeditor/static/ckeditor/ckeditor/ckeditor.js @@ -2,44 +2,43 @@ Copyright (c) 2003-2014, CKSource - Frederico Knabben. All rights reserved. For licensing, see LICENSE.md or http://ckeditor.com/license */ -(function(){if(window.CKEDITOR&&window.CKEDITOR.dom)return;window.CKEDITOR||(window.CKEDITOR=function(){var a=/(^|.*[\\\/])ckeditor\.js(?:\?.*|;.*)?$/i,e={timestamp:"E7KD",version:"4.4.4",revision:"1ba5105",rnd:Math.floor(900*Math.random())+100,_:{pending:[],basePathSrcPattern:a},status:"unloaded",basePath:function(){var f=window.CKEDITOR_BASEPATH||"";if(!f)for(var d=document.getElementsByTagName("script"),c=0;c=0;y--)if(n[y].priority<=e){n.splice(y+1,0,l);return{removeListener:h}}n.unshift(l)}return{removeListener:h}}, -once:function(){var a=arguments[1];arguments[1]=function(f){f.removeListener();return a.apply(this,arguments)};return this.on.apply(this,arguments)},capture:function(){CKEDITOR.event.useCapture=1;var a=this.on.apply(this,arguments);CKEDITOR.event.useCapture=0;return a},fire:function(){var a=0,f=function(){a=1},d=0,b=function(){d=1};return function(j,l,h){var n=e(this)[j],j=a,t=d;a=d=0;if(n){var y=n.listeners;if(y.length)for(var y=y.slice(0),z,o=0;o=0&&d.listeners.splice(b,1)}},removeAllListeners:function(){var a=e(this),f;for(f in a)delete a[f]},hasListeners:function(a){return(a=e(this)[a])&&a.listeners.length>0}}}()); -CKEDITOR.editor||(CKEDITOR.editor=function(){CKEDITOR._.pending.push([this,arguments]);CKEDITOR.event.call(this)},CKEDITOR.editor.prototype.fire=function(a,e){a in{instanceReady:1,loaded:1}&&(this[a]=true);return CKEDITOR.event.prototype.fire.call(this,a,e,this)},CKEDITOR.editor.prototype.fireOnce=function(a,e){a in{instanceReady:1,loaded:1}&&(this[a]=true);return CKEDITOR.event.prototype.fireOnce.call(this,a,e,this)},CKEDITOR.event.implementOn(CKEDITOR.editor.prototype)); +a,!1),d()):document.attachEvent&&"complete"===document.readyState&&(document.detachEvent("onreadystatechange",a),d())}catch(c){}}function d(){for(var a;a=c.shift();)a()}var c=[];return function(d){function b(){try{document.documentElement.doScroll("left")}catch(m){setTimeout(b,1);return}a()}c.push(d);"complete"===document.readyState&&setTimeout(a,1);if(1==c.length)if(document.addEventListener)document.addEventListener("DOMContentLoaded",a,!1),window.addEventListener("load",a,!1);else if(document.attachEvent){document.attachEvent("onreadystatechange", +a);window.attachEvent("onload",a);d=!1;try{d=!window.frameElement}catch(e){}document.documentElement.doScroll&&d&&b()}}}()},b=window.CKEDITOR_GETURL;if(b){var c=e.getUrl;e.getUrl=function(a){return b.call(e,a)||c.call(e,a)}}return e}()); +CKEDITOR.event||(CKEDITOR.event=function(){},CKEDITOR.event.implementOn=function(a){var e=CKEDITOR.event.prototype,b;for(b in e)a[b]==null&&(a[b]=e[b])},CKEDITOR.event.prototype=function(){function a(a){var f=e(this);return f[a]||(f[a]=new b(a))}var e=function(a){a=a.getPrivate&&a.getPrivate()||a._||(a._={});return a.events||(a.events={})},b=function(a){this.name=a;this.listeners=[]};b.prototype={getListenerIndex:function(a){for(var f=0,d=this.listeners;f=0;s--)if(m[s].priority<=l){m.splice(s+1,0,i);return{removeListener:g}}m.unshift(i)}return{removeListener:g}}, +once:function(){var a=Array.prototype.slice.call(arguments),f=a[1];a[1]=function(a){a.removeListener();return f.apply(this,arguments)};return this.on.apply(this,a)},capture:function(){CKEDITOR.event.useCapture=1;var a=this.on.apply(this,arguments);CKEDITOR.event.useCapture=0;return a},fire:function(){var a=0,f=function(){a=1},d=0,b=function(){d=1};return function(l,i,g){var m=e(this)[l],l=a,t=d;a=d=0;if(m){var s=m.listeners;if(s.length)for(var s=s.slice(0),y,p=0;p=0&&d.listeners.splice(b,1)}},removeAllListeners:function(){var a=e(this),f;for(f in a)delete a[f]},hasListeners:function(a){return(a=e(this)[a])&&a.listeners.length> +0}}}());CKEDITOR.editor||(CKEDITOR.editor=function(){CKEDITOR._.pending.push([this,arguments]);CKEDITOR.event.call(this)},CKEDITOR.editor.prototype.fire=function(a,e){a in{instanceReady:1,loaded:1}&&(this[a]=true);return CKEDITOR.event.prototype.fire.call(this,a,e,this)},CKEDITOR.editor.prototype.fireOnce=function(a,e){a in{instanceReady:1,loaded:1}&&(this[a]=true);return CKEDITOR.event.prototype.fireOnce.call(this,a,e,this)},CKEDITOR.event.implementOn(CKEDITOR.editor.prototype)); CKEDITOR.env||(CKEDITOR.env=function(){var a=navigator.userAgent.toLowerCase(),e={ie:a.indexOf("trident/")>-1,webkit:a.indexOf(" applewebkit/")>-1,air:a.indexOf(" adobeair/")>-1,mac:a.indexOf("macintosh")>-1,quirks:document.compatMode=="BackCompat"&&(!document.documentMode||document.documentMode<10),mobile:a.indexOf("mobile")>-1,iOS:/(ipad|iphone|ipod)/.test(a),isCustomDomain:function(){if(!this.ie)return false;var a=document.domain,d=window.location.hostname;return a!=d&&a!="["+d+"]"},secure:location.protocol== "https:"};e.gecko=navigator.product=="Gecko"&&!e.webkit&&!e.ie;if(e.webkit)a.indexOf("chrome")>-1?e.chrome=true:e.safari=true;var b=0;if(e.ie){b=e.quirks||!document.documentMode?parseFloat(a.match(/msie (\d+)/)[1]):document.documentMode;e.ie9Compat=b==9;e.ie8Compat=b==8;e.ie7Compat=b==7;e.ie6Compat=b<7||e.quirks}if(e.gecko){var c=a.match(/rv:([\d\.]+)/);if(c){c=c[1].split(".");b=c[0]*1E4+(c[1]||0)*100+(c[2]||0)*1}}e.air&&(b=parseFloat(a.match(/ adobeair\/(\d+)/)[1]));e.webkit&&(b=parseFloat(a.match(/ applewebkit\/(\d+)/)[1])); e.version=b;e.isCompatible=e.iOS&&b>=534||!e.mobile&&(e.ie&&b>6||e.gecko&&b>=2E4||e.air&&b>=1||e.webkit&&b>=522||false);e.hidpi=window.devicePixelRatio>=2;e.needsBrFiller=e.gecko||e.webkit||e.ie&&b>10;e.needsNbspFiller=e.ie&&b<11;e.cssClass="cke_browser_"+(e.ie?"ie":e.gecko?"gecko":e.webkit?"webkit":"unknown");if(e.quirks)e.cssClass=e.cssClass+" cke_browser_quirks";if(e.ie)e.cssClass=e.cssClass+(" cke_browser_ie"+(e.quirks?"6 cke_browser_iequirks":e.version));if(e.air)e.cssClass=e.cssClass+" cke_browser_air"; if(e.iOS)e.cssClass=e.cssClass+" cke_browser_ios";if(e.hidpi)e.cssClass=e.cssClass+" cke_hidpi";return e}()); "unloaded"==CKEDITOR.status&&function(){CKEDITOR.event.implementOn(CKEDITOR);CKEDITOR.loadFullCore=function(){if(CKEDITOR.status!="basic_ready")CKEDITOR.loadFullCore._load=1;else{delete CKEDITOR.loadFullCore;var a=document.createElement("script");a.type="text/javascript";a.src=CKEDITOR.basePath+"ckeditor.js";document.getElementsByTagName("head")[0].appendChild(a)}};CKEDITOR.loadFullCoreTimeout=0;CKEDITOR.add=function(a){(this._.pending||(this._.pending=[])).push(a)};(function(){CKEDITOR.domReady(function(){var a= CKEDITOR.loadFullCore,e=CKEDITOR.loadFullCoreTimeout;if(a){CKEDITOR.status="basic_ready";a&&a._load?a():e&&setTimeout(function(){CKEDITOR.loadFullCore&&CKEDITOR.loadFullCore()},e*1E3)}})})();CKEDITOR.status="basic_loaded"}();CKEDITOR.dom={}; -(function(){var a=[],e=CKEDITOR.env.gecko?"-moz-":CKEDITOR.env.webkit?"-webkit-":CKEDITOR.env.ie?"-ms-":"",b=/&/g,c=/>/g,f=//g,f=/"+f+""):d.push('');return d.join("")}, -htmlEncode:function(a){return(""+a).replace(b,"&").replace(c,">").replace(f,"<")},htmlDecode:function(a){return a.replace(g,"&").replace(j,">").replace(l,"<")},htmlEncodeAttr:function(a){return a.replace(d,""").replace(f,"<").replace(c,">")},htmlDecodeAttr:function(a){return a.replace(h,'"').replace(l,"<").replace(j,">")},getNextNumber:function(){var a=0;return function(){return++a}}(),getNextId:function(){return"cke_"+this.getNextNumber()},override:function(a,f){var d=f(a);d.prototype= +f=f-2}for(var c=1;c"+f+""):d.push('');return d.join("")}, +htmlEncode:function(a){return(""+a).replace(b,"&").replace(c,">").replace(f,"<")},htmlDecode:function(a){return a.replace(h,"&").replace(l,">").replace(i,"<")},htmlEncodeAttr:function(a){return a.replace(d,""").replace(f,"<").replace(c,">")},htmlDecodeAttr:function(a){return a.replace(g,'"').replace(i,"<").replace(l,">")},getNextNumber:function(){var a=0;return function(){return++a}}(),getNextId:function(){return"cke_"+this.getNextNumber()},override:function(a,f){var d=f(a);d.prototype= a.prototype;return d},setTimeout:function(a,f,d,b,c){c||(c=window);d||(d=c);return c.setTimeout(function(){b?a.apply(d,[].concat(b)):a.apply(d)},f||0)},trim:function(){var a=/(?:^[ \t\n\r]+)|(?:[ \t\n\r]+$)/g;return function(f){return f.replace(a,"")}}(),ltrim:function(){var a=/^[ \t\n\r]+/g;return function(f){return f.replace(a,"")}}(),rtrim:function(){var a=/[ \t\n\r]+$/g;return function(f){return f.replace(a,"")}}(),indexOf:function(a,f){if(typeof f=="function")for(var d=0,b=a.length;d=0?a[d]:null},bind:function(a,f){return function(){return a.apply(f,arguments)}},createClass:function(a){var f=a.$,d=a.base,b=a.privates||a._,c=a.proto,a=a.statics;!f&&(f=function(){d&&this.base.apply(this,arguments)});if(b)var e=f,f=function(){var a=this._||(this._={}),f;for(f in b){var d=b[f];a[f]=typeof d=="function"?CKEDITOR.tools.bind(d,this):d}e.apply(this,arguments)};if(d){f.prototype= this.prototypedCopy(d.prototype);f.prototype.constructor=f;f.base=d;f.baseProto=d.prototype;f.prototype.base=function(){this.base=d.prototype.base;d.apply(this,arguments);this.base=arguments.callee}}c&&this.extend(f.prototype,c,true);a&&this.extend(f,a,true);return f},addFunction:function(f,d){return a.push(function(){return f.apply(d||this,arguments)})-1},removeFunction:function(f){a[f]=null},callFunction:function(f){var d=a[f];return d&&d.apply(window,Array.prototype.slice.call(arguments,1))},cssLength:function(){var a= /^-?\d+\.?\d*px$/,f;return function(d){f=CKEDITOR.tools.trim(d+"")+"px";return a.test(f)?f:d||""}}(),convertToPx:function(){var a;return function(f){if(!a){a=CKEDITOR.dom.element.createFromHtml('
',CKEDITOR.document);CKEDITOR.document.getBody().append(a)}if(!/%$/.test(f)){a.setStyle("width",f);return a.$.clientWidth}return f}}(),repeat:function(a,f){return Array(f+1).join(a)},tryThese:function(){for(var a, f=0,d=arguments.length;f8)&&e)a=e+":"+a;return new CKEDITOR.dom.nodeList(this.$.getElementsByTagName(a))},getHead:function(){var a=this.$.getElementsByTagName("head")[0]; +this.$.documentElement,c=0;b&&c]*?>)|^/i,'$&\n