From aab8fc1e6b03714a1ffff0918d340405953caa56 Mon Sep 17 00:00:00 2001 From: Karl Kemister-Sheppard Date: Thu, 16 Nov 2023 10:49:58 +1000 Subject: [PATCH 1/6] DOC-2213: add CVE ref to 6.7.3 release notes. (#2983) --- modules/ROOT/pages/6.7.3-release-notes.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/6.7.3-release-notes.adoc b/modules/ROOT/pages/6.7.3-release-notes.adoc index 07bae913ef..2f5f0d098b 100644 --- a/modules/ROOT/pages/6.7.3-release-notes.adoc +++ b/modules/ROOT/pages/6.7.3-release-notes.adoc @@ -32,7 +32,7 @@ This vulnerability has been patched in {productname} 6.7.3 by: * ensuring that any unescaped text nodes which contain the special internal marker are emptied before removing the marker from the rest of the HTML, and; * removing the special internal marker from content strings passed to `Editor.setContent`, `Editor.insertContent`, and `Editor.resetContent` APIs to prevent them from being loaded into the editor as user-provided content. -CVE: pending. +CVE: https://www.cve.org/CVERecord?id=CVE-2023-48219[CVE-2023-48219]. GHSA: https://github.com/tinymce/tinymce/security/advisories/GHSA-v626-r774-j7f8[GitHub Advisory]. From d8c983897efe85ead30a5ff64dc4541d481a1cf6 Mon Sep 17 00:00:00 2001 From: Karl Kemister-Sheppard Date: Wed, 22 Nov 2023 21:35:31 +1000 Subject: [PATCH 2/6] DOC-2180: TinyMCE 6.8 Community docs release. (#2954) * DOC-2180: added initial outline for 6.8-specific entrys to . * DOC-2180: update changelog.adoc for 6.8 release notes. * DOC-2180: updates to changelog.adoc for 6.8 community release. * DOC-2180: updates to the changelog.adoc before community release. * Update modules/ROOT/pages/changelog.adoc * DOC-2180: api-version bump for tinymce community release 6.8. --- .api-version | 2 +- changelog.md | 1 + .../apis/tinymce.dom.stylesheetloader.adoc | 33 ++++++++++++++- .../apis/tinymce.editor.ui.registry.adoc | 8 ++-- modules/ROOT/pages/changelog.adoc | 42 +++++++++++++++++++ 5 files changed, 80 insertions(+), 6 deletions(-) diff --git a/.api-version b/.api-version index 8d81486efa..8a1c5c7e99 100644 --- a/.api-version +++ b/.api-version @@ -1 +1 @@ -6.7.3 \ No newline at end of file +6.8.0 \ No newline at end of file diff --git a/changelog.md b/changelog.md index 578ce074af..62898c6619 100644 --- a/changelog.md +++ b/changelog.md @@ -6,6 +6,7 @@ The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/ ### Unreleased +- DOC-2180: Added 6.8-specific entry to `changelog.adoc`. ### 2023-11-15 diff --git a/modules/ROOT/pages/apis/tinymce.dom.stylesheetloader.adoc b/modules/ROOT/pages/apis/tinymce.dom.stylesheetloader.adoc index add03c43dd..ece37a8086 100644 --- a/modules/ROOT/pages/apis/tinymce.dom.stylesheetloader.adoc +++ b/modules/ROOT/pages/apis/tinymce.dom.stylesheetloader.adoc @@ -1,7 +1,7 @@ = tinymce.dom.StyleSheetLoader :navtitle: tinymce.dom.StyleSheetLoader :description: This class handles loading of external stylesheets and fires events when these are loaded. -:keywords: load, loadAll, unload, unloadAll +:keywords: load, loadAll, loadRawCss, unload, unloadAll, unloadRawCss :moxie-type: api This class handles loading of external stylesheets and fires events when these are loaded. @@ -16,8 +16,10 @@ This class handles loading of external stylesheets and fires events when these a |Name|Summary|Defined by |xref:#load[load()]|Loads the specified CSS file and returns a Promise that will resolve when the stylesheet is loaded successfully or reject if it failed to load.|`xref:apis/tinymce.dom.stylesheetloader.adoc[StyleSheetLoader]` |xref:#loadAll[loadAll()]|Loads the specified CSS files and returns a Promise that is resolved when all stylesheets are loaded or rejected if any failed to load.|`xref:apis/tinymce.dom.stylesheetloader.adoc[StyleSheetLoader]` +|xref:#loadRawCss[loadRawCss()]|Loads the specified css string in as a style element with an unique key.|`xref:apis/tinymce.dom.stylesheetloader.adoc[StyleSheetLoader]` |xref:#unload[unload()]|Unloads the specified CSS file if no resources currently depend on it.|`xref:apis/tinymce.dom.stylesheetloader.adoc[StyleSheetLoader]` |xref:#unloadAll[unloadAll()]|Unloads each specified CSS file if no resources currently depend on it.|`xref:apis/tinymce.dom.stylesheetloader.adoc[StyleSheetLoader]` +|xref:#unloadRawCss[unloadRawCss()]|Unloads the specified CSS style element by key.|`xref:apis/tinymce.dom.stylesheetloader.adoc[StyleSheetLoader]` |=== [[methods]] @@ -59,6 +61,21 @@ Loads the specified CSS files and returns a Promise that is resolved when all st ''' +[[loadRawCss]] +=== loadRawCss() +[source, javascript] +---- +loadRawCss(key: String, css: String) +---- +Loads the specified css string in as a style element with an unique key. + +==== Parameters + +* `key (String)` - Unique key for the style element. +* `css (String)` - Css style content to add. + +''' + [[unload]] === unload() [source, javascript] @@ -86,3 +103,17 @@ Unloads each specified CSS file if no resources currently depend on it. * `urls (Array)` - URLs to unload or remove. ''' + +[[unloadRawCss]] +=== unloadRawCss() +[source, javascript] +---- +unloadRawCss(key: String) +---- +Unloads the specified CSS style element by key. + +==== Parameters + +* `key (String)` - Key of CSS style resource to unload. + +''' diff --git a/modules/ROOT/pages/apis/tinymce.editor.ui.registry.adoc b/modules/ROOT/pages/apis/tinymce.editor.ui.registry.adoc index b7e82e33fc..5f6f0299e8 100644 --- a/modules/ROOT/pages/apis/tinymce.editor.ui.registry.adoc +++ b/modules/ROOT/pages/apis/tinymce.editor.ui.registry.adoc @@ -50,8 +50,8 @@ clicked. For information on creating a group toolbar button, see: link:https://www.tiny.cloud/docs/tinymce/6/custom-group-toolbar-button/[ UI Components - Types of toolbar buttons: Group toolbar button].|`xref:apis/tinymce.editor.ui.registry.adoc[Registry]` -|xref:#addIcon[addIcon()]|Registers a new SVG icon, the icon name reference can be configured by any -TinyMCE 5 Ui components that can display an icon. The icon is only available +|xref:#addIcon[addIcon()]|Registers a new SVG icon. The icon name reference can be configured by any +TinyMCE UI components that can display an icon. The icon is only available to the editor instance it was configured for.|`xref:apis/tinymce.editor.ui.registry.adoc[Registry]` |xref:#addMenuButton[addMenuButton()]|Registers a new menu button. Adds a toolbar button that opens a menu when clicked. The menu can be populated by items created by addMenuItem, @@ -234,8 +234,8 @@ UI Components - Types of toolbar buttons: Group toolbar button]. ---- addIcon(name: String, svgData: String) ---- -Registers a new SVG icon, the icon name reference can be configured by any -TinyMCE 5 Ui components that can display an icon. The icon is only available +Registers a new SVG icon. The icon name reference can be configured by any +TinyMCE UI components that can display an icon. The icon is only available to the editor instance it was configured for. ==== Examples diff --git a/modules/ROOT/pages/changelog.adoc b/modules/ROOT/pages/changelog.adoc index 6b216bf085..0d7af24169 100644 --- a/modules/ROOT/pages/changelog.adoc +++ b/modules/ROOT/pages/changelog.adoc @@ -4,6 +4,48 @@ NOTE: This is the {productname} Community version changelog. For information about the latest {cloudname} or {enterpriseversion} Release, see: xref:release-notes.adoc[{productname} Release Notes]. +== 6.8 - 2023-11-22 + +== Added +* CSS files are now also generated as separate JS files to improve bundling of all resources. +* Added new StylesheetLoader.loadRawCss API that can be used to load CSS into a style element. +* Added new StylesheetLoader.unloadRawCss API that can be used to unload CSS that was loaded into a style element. +* Added force_hex_color editor option. Option 'always' converts all RGB & RGBA colours to hex, 'rgb_only' will only convert RGB and not RGBA colours to hex, 'off' won't convert any colours to hex. +* Added default_font_stack editor option that makes it possible to define what is considered a system font stack. +* New `sandbox_iframes` option that controls whether iframe elements will be added a `sandbox=""` attribute to mitigate malicious intent. +* New `convert_unsafe_embeds` option that controls whether `` and `` elements will be converted to more restrictive alternatives, namely `` for image MIME types, `