Fixed issues:
- #4934: Fixed: Active focus in dialog tabs is not visible in the High Contrast mode.
- #547: Fixed: Dragging and dropping elements like images within a table is no longer available.
- #4875: Fixed: It is not possible to delete multiple selected lists.
- #4873: Fixed: Pasting content from MS Word and Outlook with horizontal lines prevents images from being uploaded.
- #4952: Fixed: Dragging and dropping images within a table cell appends additional elements.
- #4761: Fixed: Some CSS files are missing unique timestamp used to prevent browser to cache static resources between editor releases.
- #4987: Fixed: Find/Replace is not recognizing more than one space character.
- #5061: Fixed: Find/Replace plugin incorrectly handles multiple whitespace during replacing text.
-
#5004: Fixed:
MutationObserverused in IFrame Editing Area plugin causes memory leaks. - #4994: Fixed: Easy Image plugin caused content pasted from Word to turn into an image.
API changes:
-
#4918: Explicitly set the
config.useComputedStatedefault value totrue. Thanks to Shabab Karim! -
#4761: The
CKEDITOR.appendTimestamp()function was added. -
#4761:
CKEDITOR.dom.document#appendStyleSheet()andCKEDITOR.tools.buildStyleHtml()now use the newly addedCKEDITOR.appendTimestamp()function to correctly handle caching of CSS files.
Other changes:
Fixed issues:
Security Updates:
-
Fixed XSS vulnerability in the core module reported by William Bowling.
Issue summary: The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. See security advisory for more details.
-
Fixed XSS vulnerability in the core module reported by Maurice Dauer.
Issue summary: The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. See security advisory for more details.
You can read more details in the relevant security advisory and contact us if you have more questions.
An upgrade is highly recommended!
Highlights:
Adobe ended support of Flash Player on December 31, 2020 and blocked Flash content from running in Flash Player beginning January 12, 2021. We have decided to deprecate and remove the Flash plugin from CKEditor 4 to help protect users' systems and discourage using insecure software.
New Features:
-
#3433: Marked required fields in dialogs with asterisk (
*) symbol. - #4374: Integrated the Maximize plugin with browser's History API.
- #4461: Introduced the possibility to delay editor initialization while it is in a detached DOM element.
- #4462: Introduced support for reattaching editor container element to DOM.
- #4612: Allow pasting images as Base64 from clipboard in all browsers except IE.
- #4681: Allow drag and drop images as Base64.
- #4750: Added notification for pasting and dropping unsupported file types into the editor.
- #4807: [Chrome] Improved the performance of pasting large images. Thanks to FlowIT-JIT!
- #4850: Added support for loading content templates from HTML files. Thanks to Fynn96!
-
#4874: Added the
config.clipboard_handleImagesconfiguration option for enabling and disabling built-in support for pasting and dropping images in the Clipboard plugin. Thanks to FlowIT-JIT! -
#4026: Preview plugin now uses the
editor#titleproperty for the title of the preview window. Thanks to Ely! - #4467: Added support for inserting content next to a block widgets using keyboard navigation. Thanks to bunglegrind!
Fixed Issues:
- #3757: [Firefox] Fixed: images pasted from clipboard are not inserted as Base64-encoded images.
- #3876: Fixed: The Print plugin incorrectly prints links and images.
- #4444: [Firefox] Fixed: Print preview is incorrectly loaded from CDN.
-
#4596: Fixed: Incorrect handling of HSL/HSLA values in
CKEDITOR.tools.color. -
#4597: Fixed: Incorrect color conversion for HSL/HSLA values in
CKEDITOR.tools.color. -
#4604: Fixed:
CKEDITOR.plugins.clipboard.dataTransfer#getTypes()returns no types. - #4761: Fixed: Not all resources loaded by the editor respect the cache key.
- #4783: Fixed: The Accessibility Help dialog does not contain info about focus being moved back to the editing area upon activating a toolbar button.
- #4790: Fixed: Printing page is invoked before the printed page is fully loaded.
- #4874: Fixed: Built-in support for pasting and dropping images in the Clipboard plugin restricts third party plugins from handling image pasting. Thanks to FlowIT-JIT!
-
#4888: Fixed: The
CKEDITOR.dialog#setState()method throws error when there is no "OK" button in the dialog. -
#4858: Fixed: The Autolink plugin incorrectly escapes the
&characters when pasting links into the editor. - #4892: Fixed: Focus of buttons in dialogs is not visible enough in High Contrast mode.
-
#3858: Fixed: Pasting content in
ENTER_BRenter mode crashes the editor. - #4891: Fixed: The Autogrow plugin applies fixed width to the editor.
API Changes:
-
#4462:
CKEDITOR.editor#getSelection()now returnsnullif the editor is in recreating state. -
#4583: Added support for new, comma-less color syntax to
CKEDITOR.tools.color. -
#4604: Added the
CKEDITOR.plugins.clipboard.dataTransfer#isFileTransfer()method. -
#4761:
CKEDITOR.dom.document#appendStyleSheet()andCKEDITOR.tools.buildStyleHtml()now useCKEDITOR.getUrl()to correctly handle caching of CSS files. -
#4790: Added
callbackparameter toCKEDITOR.plugins.preview#createPreview()method.
Other Changes:
- #4866: The Flash plugin is now deprecated and has been removed from CKEditor 4.
- #4901: Redesigned buttons placement in the Content templates dialog to make it more UX friendly. Thanks to Fynn96!
Security Updates:
-
Fixed XSS vulnerability in the Clipboard plugin reported by Anton Subbotin.
Issue summary: The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. See security advisory for more details.
-
Fixed XSS vulnerability in the Widget plugin reported by Anton Subbotin.
Issue summary: The vulnerability allowed to abuse undo functionality using malformed Widget HTML, which could result in executing JavaScript code. See security advisory for more details.
-
Fixed XSS vulnerability in the Fake Objects plugin reported by Mika Kulmala.
Issue summary: The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. See security advisory for more details.
You can read more details in the relevant security advisory and contact us if you have more questions.
An upgrade is highly recommended!
Fixed Issues:
- #4777: Fixed: HTML comments in widgets not processed correctly.
- #4733: Fixed: Link prevent duplicate anchors in text with styles.
-
#3819: [Chrome] Fixed: After removing one of the two consecutive spaces, the
character appears in the editor instead of a space. - #4666: [IE] Introduce CSS.escape polyfill. Thanks to limingli0707!
- #3638: Fixed: Opening the same dialog twice causes it to become hidden under the dialog's page cover.
- #4247: Fixed: Color Button's incorrect rendering on the first opening.
- #4555: Fixed: Font styles with attributes are not applied correctly when used multiple times over the same selection.
-
#4782: [Firefox] Fixed:
TypeErroris thrown when switching to Source View and back while Autocomplete plugin is enabled.
Fixed Issues:
- #4617: Fixed: Autocomplete is not accessible in inline editors.
- #4493: Fixed: The drop-down label does not reflect the current value of the drop-down.
- #1572: Fixed: A paragraph before or after a widget cannot be removed. Thanks to bunglegrind!
-
#4301: Fixed: Pasted content is overwritten when pasted in an initially empty editor with the
divEnter mode. - #4351: Fixed: Incorrect values for RGBA/HSLA colors in Color Dialog.
- #4509: Fixed: Incorrect handling of drag & drop inside widgets and nested editables.
- #4611: [Android, iOS] Fixed: Incorrect hover styles for buttons in the toolbar on mobile devices.
-
#4652: Fixed: Event data set to
falseis treated as an event cancelation.