Replace TinyMCE 4.2.8 with a small local editor.
TinyMCE 4.2.8 has known XSS bugs. publish/editor.js has the same toolbar and writes the same HTML. The textarea still posts the story.
This commit is contained in:
+1
-1
@@ -23,7 +23,7 @@ if (!isset($_SESSION['editor'])) {
|
||||
<link rel='stylesheet' type='text/css' href='../publish/style.css' />
|
||||
<script type="text/javascript" src="../utilities.js"></script>
|
||||
<link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
|
||||
<?php include_once('./tinymce_init.inc.php'); ?>
|
||||
<?php include_once('./editor.inc.php'); ?>
|
||||
</head>
|
||||
<?php
|
||||
flush();
|
||||
|
||||
Reference in New Issue
Block a user