Fixed Issues:
- #5333: Fixed: The original name of the uploaded image is not preserved by the Upload Image plugin if the Clipboard plugin has enabled image handling.
- #2881: Fixed: Changing table headers from "Both" to "First column" in the Table dialog does not change the first column cell correctly.
- #2996: Fixed: Table header "scope" attribute is incorrect for the "Headers: both" option in the Table dialog.
- #4802: Fixed: Tableselection caret moves to the previous cell after tabbing into the next cell and then removing its content.
-
#5365: Fixed: The value of the
config.baseFloatZIndexconfig variable is incorrectly applied to parent dialog when the child dialog is closed resulting in the dialog overlay covering up the dialog. Thanks to JenoDK! - #5305: Fixed: Anchor name can invalidly include spaces.
New Features:
-
#5084: Added the
config.tabletools_scopedHeadersconfiguration option controlling the behaviour of table headers with and without the[scope]attribute. -
#5219: Added the
config.image2_defaultLockRatioconfiguration option allowing to set the default value of the "Lock ratio" option in the Enhanced Image dialog. -
#2008: Extended the Mentions and Emoji plugins with a feature option that adds a space after an accepted autocompletion match. See:
-
configDefinition.followingSpaceoption for the mentions plugin, and -
config.emoji_followingSpaceoption for the emoji plugin.
-
-
#5215: Added the
config.coreStyles_toggleSubSupconfiguration option which disallows setting the subscript and superscript on the same element simultaneously using UI buttons. This option is turned off by default.
Fixed Issues:
- #4889: Fixed: Incorrect position of the Table Resize cursor after scrolling the editor horizontally.
-
#5319: Fixed: Autolink
config.autolink_urlRegexoption produced invalid links when configured directly using the editor instance config. Thanks to Aigars Zeiza! -
#4941: Fixed: Some entities got wrongly encoded when using
entities_processNumerical = trueconfiguration option. - #4931: Fixed: Selecting the whole editor content when there is only a list with an empty element at the end inside and deleting it did not delete all list items.
API changes:
-
#5122: Added the ability to provide a list of buttons as an array to the
config.removeButtonsconfig variable. -
#2008: Added Autocomplete
followingSpaceoption that finishes an accepted match with a space.
Fixed Issues:
-
#5125: Fixed: Deleting a widget with disabled autoParagraph by the keyboard
backspacekey removes the editor editable area and crashes the editor. -
#5135: Fixed: The
checkbox.setValueandradio.setValuemethods are not chainable as stated in the documentation. Thanks to Jordan Bradford! - #5085: Fixed: The Language plugin removes the element marking the text in foreign language if said element does not have an information about the text direction.
- #4284: Fixed: Tableselection Merging cells with a rowspan throws an unexpected error and does not create an undo step.
- #5184: Fixed: The Editor Placeholder plugin degrades typing performance.
-
#5158: Fixed:
CKEDITOR.tools#convertToPx()gives invalid results if the helper calculator element was deleted from the DOM. - #5234: Fixed: Easy Image doesn't allow to upload images files using toolbar button.
- #438: Fixed: It is impossible to navigate to the elementspath from the toolbar by keyboard and vice versa.
-
#4449: Fixed:
dialog.validate#functionsincorrectly composes functions that return an optional error message, like e.g.dialog.validate.numberdue to unnecessary return type coercion. - #4473: Fixed: The dialog.validate method does not accept parameter value. The issue originated in dialog.validate.functions method that did not properly propagate parameter value to validator. Affected validators:
- #5147: Fixed: The Accessibility Help dialog does not contain info about focus being moved back to the editing area upon leaving dialogs.
- #5144: Fixed: Menu buttons and panel buttons incorrectly indicate the open status of their associated pop-up menus in the browser's accessibility tree.
-
#5022: Fixed: Find and Replace does not respond to the
Enterkey.
API changes:
-
#5184: Added the
config.editorplaceholder_delayconfiguration option allowing to delay placeholder before it is toggled when changing editor content. -
#5184: Added the
CKEDITOR.tools#debounce()function allowing to postpone a passed function execution until the given milliseconds have elapsed since the last time it was invoked.
New features:
- #2444: Togglable toolbar buttons are now exposed as toggle buttons in the browser's accessibility tree.
-
#4641: Added an option allowing to cancel the Delayed Editor Creation feature as a function handle for editor creators (
CKEDITOR.replace,CKEDITOR.inline,CKEDITOR.appendTo). -
#4986: Added
config.shiftLineBreaksallowing to preserve inline elements formatting when theshift+enterkeystroke is used. -
#2445: Added
config.applicationTitleconfiguration option allowing to customize or disable the editor's application region label. This option, combined withconfig.title, gives much better control over the editor's labels read by screen readers.
Fixed Issues:
- #4543: Fixed: Toolbar buttons toggle state is not correctly announced by screen readers lacking the information whether the feature is on or off.
- #4052: Fixed: Editor labels are read incorrectly by screen readers due to invalid editor control type for the Iframe Editing Area editors.
- #1904: Fixed: Screen readers are not announcing the read-only editor state.
-
#4904: Fixed: Table cell selection and navigation with the
tabkey behavior is inconsistent after adding a new row. - #3394: Fixed: Enhanced image plugin dialog is not supporting URL with query string parameters. Thanks to Simon Urli!
-
#5049: Fixed: The editor fails in strict mode due to not following the
use strictdirectives in a core editor module. -
#5095: Fixed: The clipboard plugin shows notification about unsupported file format when the file type is different than
jpg,gif,png, not respecting supported types by the Upload Widget plugin. - #4855: [iOS] Fixed: Focusing toolbar buttons with an enabled VoiceOver screen reader moves the browser focus into an editable area and interrupts button functionality.
API changes:
-
#4641: The
CKEDITOR.replace,CKEDITOR.inline,CKEDITOR.appendTofunctions are now returning a handle function allowing to cancel the Delayed Editor Creation feature. - #5095: Added the CKEDITOR.plugins.clipboard.addFileMatcher function allowing to define file formats supported by the clipboard plugin. Trying to paste unsupported files will result in a notification that a file cannot be dropped or pasted into the editor.
-
#2445: Added
config.applicationTitlealongsideCKEDITOR.editor#applicationTitleto allow customizing editor's application region label.
Security Updates:
-
Fixed an XSS vulnerability in the core module reported by GitHub Security Lab team member Kevin Backhouse.
Issue summary: The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing a JavaScript code. See CVE-2022-24728 for more details.
-
Fixed a Regular expression Denial of Service (ReDoS) vulnerability in dialog plugin discovered by the CKEditor 4 team during our regular security audit.
Issue summary: The vulnerability allowed to abuse a dialog input validator regular expression, which could cause a significant performance drop resulting in a browser tab freeze. See CVE-2022-24729 for more details.
You can read more details in the relevant security advisory and contact us if you have more questions.
An upgrade is highly recommended!
Highlights:
Web Spell Checker ended support for WebSpellChecker Dialog on December 31st, 2021. This means the plugin is not supported any longer. Therefore, we decided to deprecate and remove the WebSpellChecker Dialog plugin from CKEditor 4 presets.
We strongly encourage everyone to choose one of the other available spellchecking solutions - Spell Check As You Type (SCAYT) or WProofreader.
Fixed issues:
-
#5097: [Chrome] Fixed: Incorrect conversion of points to pixels while using
CKEDITOR.tools.convertToPx(). -
#5044: Fixed:
selectelements withmultipleattribute had incorrect styling. Thanks to John R. D'Orazio!
Other changes:
- #5093: Deprecated and removed WebSpellChecker Dialog from presets.
-
#5127: Deprecated the
CKEDITOR.rndproperty to discourage using it in a security-sensitive context. - #5087: Improved the jQuery adapter by replacing a deprecated jQuery API with existing counterparts. Thanks to Fran Boon!
-
#5128: Improved the Emoji definitions encoding set by the
config.emoji_emojiListUrlconfiguration option.