Security Updates:

• Fixed XSS vulnerability in the HTML data processor reported by Michał Bentkowski of Securitum.

  Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode or (i) copy the specially crafted HTML code, prepared by the attacker and (ii) paste it into CKEditor in WYSIWYG mode.

• Fixed XSS vulnerability in the WebSpellChecker plugin reported by Pham Van Khanh from Viettel Cyber Security.

  Issue summary: It was possible to execute XSS using CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, then (iii) switch back to WYSIWYG mode, and (iv) preview CKEditor content outside CKEditor editable area.

An upgrade is highly recommended!

New features:

• #2374: Added support for pasting rich content from LibreOffice Writer with the Paste from LibreOffice plugin.
• #2583: Changed emoji suggestion box to show the matched emoji name instead of an ID.
• #3748: Improved the color button state to reflect the selected editor content colors.
• #3661: Improved the Print plugin to respect styling rendered by the Preview plugin.
• #3547: Active dialog tab now has the aria-selected="true" attribute.
• #3441: Improved widget.getClipboardHtml() support for dragging and dropping multiple widgets.

Fixed Issues:

• #3587: [Edge, IE] Fixed: Widget with form input elements loses focus during typing.
• #3705: [Safari] Fixed: Safari incorrectly removes blocks with the editor.extractSelectedHtml() method after selecting all content.
• #1306: Fixed: The Font plugin creates nested HTML <span> tags when reapplying the same font multiple times.
• #3498: Fixed: The editor throws an error during the copy operation when a widget is partially selected.
• #2517: [Chrome, Firefox, Safari] Fixed: Inserting a new image when the selection partially covers an existing enhanced image widget throws an error.
• #3007: [Chrome, Firefox, Safari] Fixed: Cannot modify the editor content once the selection is released over a widget.
• #3698: Fixed: Cutting the selected text when a widget is partially selected merges paragraphs.

API Changes:

• #3387: Added the CKEDITOR.ui.richCombo.select() method.
• #3727: Added new textColor and bgColor commands that apply the selected color chosen by the Color Button plugin.
• #3728: Added new font and fontSize commands that apply the selected font style chosen by the Font plugin.
• #3842: Added the editor.getSelectedRanges() alias.
• #3775: Widget mask and parts can now be refreshed dynamically via API calls.

Fixed Issues:

• #875: Fixed: Pasting inside the editor that contains a table with the Table Selection plugin after selecting all content replaces only the table element instead of the entire content.
• #3415: [Firefox] Fixed: Pasting individual list elements fails. Thanks to Jack Wickham!
• #3413: Fixed: Menu items with labels containing double quotes are rendered incorrectly.
• #3475: [Firefox] Fixed: Pasting plain text over existing content fails and throws an error.
• #2027: Fixed: Incorrect email display text after reopening the Link dialog for display names starting with @.
• #3544: Fixed: The Special Characters dialog read incorrectly by screen readers due to empty table cells at the end.
• #1653: Fixed: Balloon Toolbar is not repositioned when the editor is scrolled with the Div Editing Area feature enabled.
• #3559: Fixed: Color Dialog is incorrectly positioned when used with another dialog.
• #3593: Fixed: Cannot access a text or comment node when replacing an element node with them via CKEDITOR.htmlParser.filter.
• #3524: Fixed: The Easy Image plugin throws an error when any image with an unsupported data type is pasted into the editor.
• #3552: Fixed: Incorrect value of CKEDITOR.plugins.widget.repository#selected after selecting the whole editor content.
• #3586: Fixed: Content pasted from Microsoft Excel is not correctly recognised by the Paste from Word plugin.
• #3585: [Firefox] Fixed: Microsoft Excel content is pasted as an image.
• #3625: [Firefox] Fixed: Microsoft PowerPoint content is pasted as an image.
• #3474: Fixed: Incorrect focus order after any tab in a dialog was clicked.
• #3689: Fixed: Cannot change dialog tabs with keyboard arrow keys after focusing any tab with a mouse click.

API Changes:

• #3634: Added the CKEDITOR.plugins.clipboard.dataTransfer#getTypes() method.

New Features:

• #835: Extended support for pasting from external applications:
  • Added support for pasting rich content from Google Docs with the Paste from Google Docs plugin.
  • Added a new Paste Tools plugin for unified paste handling.
• #3315: Added support for strikethrough in the BBCode plugin. Thanks to Alexander Kahl!
• #3175: Introduced selection optimization mechanism for handling incorrect selection behaviors in various browsers:
  • #3256: Triple-clicking in the last table cell and deleting content no longer pulls the content below into the table.
  • #3118: Selecting a paragraph with a triple-click and applying a heading applies the heading only to the selected paragraph.
  • #3161: Double-clicking a <span> element containing just one word creates a correct selection including the clicked <span> only.
• #3359: Improved dialog positioning and behavior when the dialog is resized or moved, or the browser window is resized.
• #2227: Added the config.linkDefaultProtocol configuration option that allows setting the default URL protocol for the Link plugin dialog.
• #3240: Extended the CKEDITOR.plugins.widget#mask property to allow masking only the specified part of a widget.
• #3138: Added the possibility to use the widgetDefinition.getClipboardHtml() method to customize the widget HTML during copy, cut and drag operations.

Fixed Issues:

• #808: Fixed: Widgets and other content disappear on drag and drop in read-only mode.
• #3260: Fixed: Widget drag handler is visible in read-only mode.
• #3261: Fixed: A widget initialized using the dialog has an incorrect owner document.
• #3198: Fixed: Blurring and focusing the editor when a widget is focused creates an additional undo step.
• #2859: [IE, Edge] Fixed: Various editor UI elements react to right mouse button click:
  • #2845: Rich Combo.
  • #2857: List Block.
  • #2858: Menu.
• #3158: [Chrome, Safari] Fixed: Undo plugin breaks with the filling character.
• #504: [Edge] Fixed: The editor's selection is collapsed to the beginning of the content when focusing the editor for the first time.
• #3101: Fixed: CKEDITOR.dom.range#_getTableElement() returns null instead of a table element for edge cases.
• #3287: Fixed: CKEDITOR.tools.promise initializes incorrectly if an AMD loader is present.
• #3379: Fixed: Incorrect CKEDITOR.editor#getData() call when inserting content into the editor.
• #941: Fixed: An error is thrown after styling a table cell text selected using the native selection when the Table Selection plugin is enabled.
• #3136: [Firefox] Fixed: Clicking Balloon Toolbar items removes the native table selection.
• #3381: [IE8] Fixed: The CKEDITOR.tools.object.keys() method does not accept non-objects.
• #2395: [Android] Fixed: Focused input in a dialog is scrolled out of the viewport when the soft keyboard appears.
• #453: Fixed: Link dialog has an invalid width when the editor is maximized and the browser window is resized.
• #2138: Fixed: An email address containing a question mark is mishandled by the Link plugin.
• #14613: Fixed: Race condition when loading plugins for an already destroyed editor instance throws an error.
• #2257: Fixed: The editor throws an exception when destroyed shortly after it was created.
• #3115: Fixed: Destroying the editor during the initialization throws an error.
• #3354: [iOS] Fixed: Pasting no longer works on iOS version 13.
• #3423 Fixed: Bookmarks can be created inside temporary elements.

API Changes:

• #3154: Added the CKEDITOR.tools.array.some() method.
• #3245: Added the CKEDITOR.plugins.undo.UndoManager.addFilterRule() method that allows filtering undo snapshot contents.
• #2845: Added the CKEDITOR.tools.normalizeMouseButton() method.
• #2975: Added the CKEDITOR.dom.element#fireEventHandler() method.
• #3247: Extended the CKEDITOR.tools.bind() method to accept arguments for bound functions.
• #3326: Added the CKEDITOR.dom.text#isEmpty() method.
• #2423: Added the CKEDITOR.plugins.dialog.getModel() and CKEDITOR.plugins.dialog.getMode() methods with their CKEDITOR.plugin.definition counterparts, allowing to get the dialog subject of a change.
• #3124: Added the CKEDITOR.dom.element#isDetached() method.

Fixed Issues:

• #3220: Fixed: Prevent Paste from Word filter from deleting Page Break elements on paste.

New Features:

• #2598: Added the Page Break feature support for the Paste from Word plugin.
• #1490: Improved the Paste from Word plugin to retain table cell borders.
• #2870: Improved support for preserving the indentation of list items for nested lists pasted with the Paste from Wordplugin.
• #2048: New CKEDITOR.config.image2_maxSize configuration option for the Enhanced Image plugin that allows setting a maximum size that an image can be resized to with the resizer.
• #2639: The Color Dialog plugin now shows the current selection's color when opened.
• #2084: The Table Tools plugin now allows to change the cell height unit type to either pixels or percent.
• #3164: The Table Tools plugin now accepts floating point values as the table cell width and height.

Fixed Issues:

• #2672: Fixed: When resizing an Enhanced Image to a minimum size with the resizer, the image dialog does not show actual values.
• #1478: Fixed: Custom colors added to Color Button with the config.colorButton_colors configuration option in the form of a label or code do not work correctly.
• #1469: Fixed: Trying to get data from a nested editable inside a freshly pasted widget throws an error.
• #2235: Fixed: An Image in a table cell has an empty URL field when edited from the context menu opened by right-click when the Table Selection plugin is in use.
• #3098: Fixed: Unit pickers for table cell width and height in the Table Tools plugin have a different width.
• #2923: Fixed: The CSS windowtext color is not correctly recognized by the CKEDITOR.tools.style.parse methods.
• #3120: [IE8] Fixed: The CKEDITOR.tools.extend() method does not work with the DontEnum object property attribute.
• #2813: Fixed: Editor HTML insertion methods (editor.insertHtml(), editor.insertHtmlIntoRange(), editor.insertElement() and editor.insertElementIntoRange()) pollute the editable with empty <span>elements.
• #2751: Fixed: An editor with config.enterMode set to ENTER_DIV alters pasted content.

API Changes:

• #1496: The Balloon Toolbar plugin exposes the CKEDITOR.ui.balloonToolbar.reposition() and CKEDITOR.ui.balloonToolbarView.reposition() methods.
• #2021: Added new CKEDITOR.dom.documentFragment.find() and CKEDITOR.dom.documentFragment.findOne()methods.
• #2700: Added the CKEDITOR.tools.array.find() method.
• #3123: Added the CKEDITOR.tools.object.keys() method.
• #3123: Added the CKEDITOR.tools.object.entries() method.
• #3123: Added the CKEDITOR.tools.object.values() method.
• #2821: The CKEDITOR.template#source property can now be a function, so it can return the changed template values during the runtime. Thanks to Jacek Pulit!
• #2598: Added the CKEDITOR.plugins.pagebreak.createElement() method allowing to create a Page Break plugin CKEDITOR.dom.element instance.
• #2748: Enhanced error messages thrown when creating an editor on a non-existent element or when trying to instantiate the second editor on the same element. Thanks to Byran Zaugg!
• #2698: Added the CKEDITOR.htmlParser.element.findOne() method.
• #2935: Introduced the CKEDITOR.config.pasteFromWord_keepZeroMargins configuration option that allows for keeping any margin-*: 0 style that would be otherwise removed when pasting content with the Paste from Wordplugin.
• #2962: Added the CKEDITOR.tools.promise class.
• #2924: Added the CKEDITOR.tools.style.border object wrapping CSS border style helpers under a single type.
• #2495: The Table Selection plugin can now be disabled for the given table with the data-cke-tableselection-ignored attribute.
• #2692: Plugins can now expose information about the supported environment by implementing the pluginDefinition.isSupportedEnvironment() method.

Other Changes:

• #2741: Replaced deprecated arguments.callee calls with named function expressions to allow the editor to work in strict mode.
• #2924: Marked CKEDITOR.tools.style.parse.border() as deprecated in favor of the CKEDITOR.tools.style.border.fromCssRule() method.
• #3132: Marked CKEDITOR.tools.objectKeys() as deprecated in favor of the CKEDITOR.tools.object.keys()method.

Fixed Issues:

• #589: Fixed: The editor causes memory leaks in create and destroy cycles.
• #1397: Fixed: Using the dialog to remove headers from a table with one header row only throws an error.
• #1479: Fixed: Justification for styled content in BR mode is disabled.
• #2816: Fixed: Enhanced Image resize handler is visible in read-only mode.
• #2874: Fixed: Enhanced Image resize handler is not created when the editor is initialized in read-only mode.
• #2775: Fixed: Clipboard paste buttons have wrong state when read-only mode is set by the mouse event listener with the Div Editing Area plugin.
• #1901: Fixed: Cannot open the context menu over a Widget with the Shift+F10 keyboard shortcut.

Other Changes:

• Updated WebSpellChecker (WSC) and SpellCheckAsYouType (SCAYT) plugins:
  • Language dictionary update: German language was extended with over 600k new words.
  • Language dictionary update: Swedish language was extended with over 300k new words.
  • Grammar support added for Australian and New Zealand English, Polish, Slovak, Slovenian and Austrian languages.
  • Changed wavy red and green lines that underline spelling and grammar errors to straight ones.
  • #55: Fixed: WSC does not use CKEDITOR.getUrl() when referencing style sheets.
  • #166: Fixed: SCAYT does not use CKEDITOR.getUrl() when referencing style sheets.
  • #56: [Chrome] Fixed: SCAYT/WSC throws errors when running inside a Chrome extension.
  • Fixed: After removing a dictionary, the words are not underlined and considered as incorrect.
  • Fixed: The Slovenian (sl_SL) language does not work.
  • Fixed: Quotes with code U+2019 (Right single quotation mark) are considered separators.
  • Fixed: Wrong error message formatting when the service ID is invalid.
  • Fixed: Absent languages in the Languages tab when using SCAYT with the Shared Spaces plugin.

Fixed Issues:

• #2721, #487: Fixed: The order of sublist items is reversed when a higher level list item is removed.
• #2527: Fixed: Emoji autocomplete order does not prioritize emojis with the name starting from the used string.
• #2572: Fixed: Icons in the Emoji dropdown navigation groups are not centered.
• #1191: Fixed: Items in the elements path are draggable.
• #2292: Fixed: Dropping a list with a link on the editor's margin causes a console error and removes the dragged text from editor.
• #2756: Fixed: The Auto Link plugin causes an error when typing in the source editing mode.
• #1986: Fixed: The Cell Properties dialog from the Table Tools plugin shows styles that are not allowed through config.allowedContent.
• #2565: [IE, Edge] Fixed: Buttons in the editor toolbar are activated by clicking them with the right mouse button.
• #2792: Fixed: A bug in the Copy Formatting plugin that caused the following issues:
  • #2780: Fixed: Undo steps disappear after multiple changes of selection.
  • #2470: [Firefox] Fixed: Widget's nested editable gets blurred upon focus.
  • #2655: [Chrome, Safari] Fixed: Widget's nested editable cannot be focused under certain circumstances.

Fixed Issues:

• #2403: Fixed: Styling inline editor initialized inside a table with the Table Selection plugin is causing style leaks.
• #2514: Fixed: Pasting table data into inline editor initialized inside a table with the Table Selection plugin inserts pasted content into the wrapping table.
• #2451: Fixed: The Remove Format plugin changes selection.
• #2546: Fixed: The separator in the toolbar moves when buttons are focused.
• #2506: Fixed: Enhanced Image throws a type error when an empty <figure> tag with an image class is upcasted.
• #2650: Fixed: Table dialog validator fails when the getValue()function is defined in the global scope.
• #2690: Fixed: Decimal characters are removed from the inside of numbered lists when pasting content using the Paste from Word plugin.
• #2205: Fixed: It is not possible to add new list items under an item containing a block element.
• #2411, #2438 Fixed: Apply numbered list option throws a console error for a specific markup.
• #2430 Fixed: Color Button and List Block items are draggable.

Other Changes:

• Updated the WebSpellChecker (WSC) plugin:
  • #52 Fixed: Clicking "Finish Checking" without a prior action would hang the Spell Checking dialog.
• #2603: Corrected the GPL license entry in the package.json file.

Fixed Issues:

• #2571: Fixed: Clicking the categories in the Emoji dropdown panel scrolls the entire page.

Security Updates:

• Fixed XSS vulnerability in the HTML parser reported by maxarr.

  Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode.

An upgrade is highly recommended!

New Features:

• #2062: Added the emoji dropdown that allows the user to choose the emoji from the toolbar and search for them using keywords.
• #2154: The Link plugin now supports phone number links.
• #1815: The Auto Link plugin supports typing link completion.
• #2478: Link can be inserted using the Ctrl/Cmd + K keystroke.
• #651: Text pasted using the Paste from Word plugin preserves indentation in paragraphs.
• #2248: Added support for justification in the BBCode plugin. Thanks to Matěj Kmínek!
• #706: Added a different cursor style when selecting cells for the Table Selection plugin.
• #2072: The UI Button plugin supports custom aria-haspopup property values. The Menu Button aria-haspopupvalue is now menu, the Panel Button and Rich Combo aria-haspopup value is now listbox.
• #1176: The Balloon Panel can now be attached to a selection instead of an element.
• #2202: Added the contextmenu_contentsCss configuration option to allow adding custom CSS to the Context Menu.

Fixed Issues:

• #1477: Fixed: On destroy, Balloon Toolbar does not destroy its content.
• #2394: Fixed: Emoji dropdown does not show up with repeated symbols in a single line.
• #1181: [Chrome] Fixed: Opening the context menu in a read-only editor results in an error.
• #2276: [iOS] Fixed: Button state does not refresh properly.
• #1489: Fixed: Table contents can be removed in read-only mode when the Table Selection plugin is used.
• #1264 Fixed: Right-click does not clear the selection created with the Table Selection plugin.
• #586 Fixed: The required attribute is not correctly recognized by the Form Elements plugin dialog. Thanks to Roli Züger!
• #2380 Fixed: Styling HTML comments in a top-level element results in extra paragraphs.
• #2294 Fixed: Pasting content from Microsoft Outlook and then bolding it results in an error.
• #2035 [Edge] Fixed: Permission denied is thrown when opening a Panel instance.
• #965 Fixed: The config.forceSimpleAmpersand option does not work. Thanks to Alex Maris!
• #2448: Fixed: The [Escape HTML Entities] plugin with custom additional entities configuration breaks HTML escaping.
• #898: Fixed: Enhanced Image long alternative text protrudes into the editor when the image is selected.
• #1113: [Firefox] Fixed: Nested contenteditable elements path is not updated on focus with the Div Editing Area plugin.
• #1682 Fixed: Hovering the Balloon Toolbar panel changes its size, causing flickering.
• #421 Fixed: Expandable Button puts the (Selected) text at the end of the label when clicked.
• #1454: Fixed: The onAbort method of the Upload Widget is not called when the loader is aborted.
• #1451: Fixed: The context menu is incorrectly positioned when opened with Shift+F10.
• #1722: CKEDITOR.filter.instances is causing memory leaks.
• #2491: Fixed: The Mentions plugin is not matching diacritic characters.
• #2519: Fixed: The Accessibility Help dialog should display all available keystrokes for a single command.

API Changes:

• #2453: The CKEDITOR.ui.panel.block.getItems method now also returns input elements in addition to links.
• #2224: The CKEDITOR.tools.convertToPx function now converts negative values.
• #2253: The widget definition insert method now passes editor and commandData. Thanks to marcparmet!
• #2045: Extracted tools.eventsBuffer and tools.throttle functions logic into a separate namespace.
  • tools.eventsBuffer was extracted into tools.buffers.event,
  • tools.throttle was extracted into tools.buffers.throttle.
• #2466: The CKEDITOR.filter constructor accepts an additional rules parameter allowing to bind the editor and filter together.
• #2493: The editor.getCommandKeystroke method accepts an additional all parameter allowing to retrieve an array of all command keystrokes.
• #2483: Button's DOM element created with the hasArrow definition option can by identified by the .cke_button_expandable CSS class.

Other Changes:

• #1713: Removed the redundant lang.title entry from the Clipboard plugin.