Replace TinyMCE 4.2.8 with a small local editor.

TinyMCE 4.2.8 has known XSS bugs. publish/editor.js has the same toolbar and writes the same HTML. The textarea still posts the story.
2026-09-25 22:58:05 +02:00
parent aee8a830d7
commit a9daa6a792
116 changed files with 1371 additions and 5862 deletions
@@ -1,8 +1,8 @@
 <?php
 /*
- * Clean story HTML with HTML Purifier. Only the markup that the TinyMCE
- * toolbar can produce (plus a few tags that older stories use) is kept;
- * scripts, event handlers and unsafe URLs are removed.
+ * Clean story HTML with HTML Purifier. Only the markup that the story
+ * editor (publish/editor.js) can produce (plus a few tags that older
+ * stories use) is kept; scripts, event handlers and unsafe URLs are removed.
 */
 require_once(__DIR__ . '/htmlpurifier-4.19.1/library/HTMLPurifier.auto.php');