tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Replace TinyMCE 4.2.8 with a small local editor.

Browse Source 
TinyMCE 4.2.8 has known XSS bugs. publish/editor.js has the same toolbar
and writes the same HTML. The textarea still posts the story.
This commit is contained in:
tim
2026-09-25 22:58:05 +02:00
parent aee8a830d7
commit a9daa6a792
116 changed files with 1371 additions and 5862 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/utilities.js
+16 -28
View File
@@ -1,6 +1,3 @@
// GLOBAL
var tinyMCEstate = true;
function showHide(show) {
if (show == 'text') {
var hide = 'upload';
@@ -14,18 +11,9 @@ function showHide(show) {
document.getElementById(hide+'parent').style.display = "none";
document.getElementById(show+'parent').style.display = "block";
document.getElementById('wordcounter').style.display = "block";
if (!tinyMCEstate && tinyMCE) {
// Toggling breaks getContent if the inital state is toggled off.
//tinyMCE.execCommand('mceToggleEditor',false,'text');
tinyMCEstate = true;
}
tinyMCE.execCommand('mceFocus',false,'text');
if (window.storyEditor)
storyEditor.focus();
} else if (show == 'upload') {
if (tinyMCEstate && tinyMCE) {
// Toggling breaks getContent if the inital state is toggled off.
//tinyMCE.execCommand('mceToggleEditor',false,'text');
tinyMCEstate = false;
}
document.getElementById('wordcounter').style.display = "none";
document.getElementById(hide+'parent').style.display = "none";
document.getElementById(show+'parent').style.display = "block";
@@ -52,7 +40,7 @@ function review() {
var upload = document.getElementById('upload');
var uploaded = document.getElementById('uploaded');
var remove_img = document.getElementById('remove_img');
var txtcnt = wc(tinyMCE.get('story').getContent());
var txtcnt = wc(document.getElementById('story').value);
if (is_delete) return true;
if (!title.value) {
alert("Please add a title to your submission; one makes everything much prettier.");
@@ -92,20 +80,20 @@ function toggle_remove() {
}
}
function mceWordCount (e) {
if (e && e.type != 'keyup')
return true;
var txt = tinyMCE.get('story').getContent();
// Show the number of words in the story (publish/editor.inc.php calls
// this when the story changes)
function updateWordCount() {
var story = document.getElementById("story");
var wordcounter = document.getElementById("wordcounter");
var cnt = wc(txt);
if (!story || !wordcounter)
return true;
var cnt = wc(story.value);
var words = (cnt == 1) ? " word" : " words";
if (wordcounter) {
wordcounter.innerHTML = cnt + words;
wordcounter.className = "counter";
if (cnt == 100) wordcounter.className += " yes";
if (cnt > 100) wordcounter.className += " no";
}
return true;
wordcounter.innerHTML = cnt + words;
wordcounter.className = "counter";
if (cnt == 100) wordcounter.className += " yes";
if (cnt > 100) wordcounter.className += " no";
return true;
}
function wc (txt) {
@@ -115,7 +103,7 @@ function wc (txt) {
txt = txt.replace(/\s[^a-zA-Z0-9]+\s/g," "); //strip punctuation
txt = txt.replace(/\s*((\S+\s*)*)/, "$1"); //ltrim
txt = txt.replace(/((\s*\S+)*)\s*/, "$1"); //rtrim
txt = txt.replace(/( )/g, " "); //TinyMCE newlines leave spaces behind
txt = txt.replace(/( )/g, " "); //empty paragraphs and non-breaking spaces
txt = txt.replace(/(^\s+|\s+$)/, " "); // Remove trailing spaces
if (txt.match(/^ *$/))
return 0;