- awesome as always!
Thanks @enigmatic_user - quality step by step there.Thanks for linking to my little guide from the TinymceWrapper installation options!
I'll try to capture some error messages for you, but I have some tough deadlines, so I don't have that much time to occupy myself with that just now.
One little thing: I just updated one installation to version 2.3.2-pl. After that, the property sets for the system events of the plugin were set back to "Default". Is there a way to let these settings alone if there's already a property set assigned to the event?I am almost certain this would be a MODX-level feature request. I know, it is super annoying.
BUT, what I could do is allow the user to reattach existing pset as install option.That would be great!
As for the other issues, I can't respond properly without pertinent error reports to lead me.Yes, I expected this answer (and it's probably the one I would have given in such a case
). I just hoped you might have an idea.Console running...The Updater Extra is not the problem - the installation of TinymceWrapper failed on local sites where Updater wasn't installed.
Attempting to install package with signature: tinymcewrapper-2.3.2-pl
Package found...now preparing to install.
PHP warning: ZipArchive::extractTo() [ziparchive.extractto.html]: Full extraction path exceed MAXPATHLEN (260)
Could not unpack package F:/xampp/htdocs/projekte/_kunden/headstarters/modx/core/packages/tinymcewrapper-2.3.2-pl.transport.zip to F:/xampp/htdocs/projekte/_kunden/headstarters/modx/core/packages/. SIG: tinymcewrapper-2.3.2-pl
[Updater] packages have been changed, clearing updater cache.
[Updater] Successfully cleared updater cache after package change.
[Updater] There was an error clearing Updaters' internal caches.
Could not install package with signature: tinymcewrapper-2.3.2-pl
function tinyMessageInit(id){
tinymce.init({
selector: "#"+id,
[[$TinymceWrapperCommonCode]]
statusbar: false,
plugins: "imagetools,,paste,contextmenu,image,code,link",
toolbar: "link image bold italic"
})
}
function tinyMessageButton(thisButton,id){
if($(thisButton).hasClass("m_active")){
if($("#"+id).is(':visible') ){
$(thisButton).find("button").text("Remove TinyMCE");
$(thisButton).removeClass("m_active");
tinyMessageInit(id)
}
}
else{
$(thisButton).addClass("m_active");
$(thisButton).find("button").text("Edit With TinyMCE");
tinymce.get(id).destroy();
$("#"+id).fadeIn();
}
}
Ext.onReady(function(){
$(document).on("mouseenter", ".modx-window", function () {
if ($(this).has("input[name=sendemail]").length && $(this).has("textarea[name=message]").length){
var tinyContent = $(this).find("textarea[name=message]");
tinyMessageId = tinyContent.attr("id");
if ($(this).has(".tinyMessageButton").length){}
else{
$(this).find(".x-toolbar-left-row").prepend("<p onclick=tinyMessageButton(this,tinyMessageId) class='tinyMessageButton m_active x-btn x-btn-small x-btn-icon-small-left x-btn-noicon' unselectable='on'><em><button class='x-btn-text'>Edit with TinyMCE</button></em></p>");
}
}
});
});
☆ A M B ☆
TinyMCE in itself can not be insecure, it would be completly impossible for any exploit to exist in TinyMCE that would allow anyone to hack your blog/cms or similar by injecting XSS contents since it by it self can't modify the contents of the site. The server side scripts like PHP/.NET etc is what's updating your site.[ed. note: donshakespeare last edited this post 10 years, 1 month ago.]
It is important to understand that TinyMCE is PURE Javascript, and is only run in the context of the browser of the user who is using the page. Any exploit in the regards of XSS has to be plugged in the server side logic since that exploit would still be there if you disable javascript.
This also means you should not assume that TinyMCE is secure, if you implement TinyMCE on a public page where anyone has access and can public the content, you are bound to run into security issues. Most systems have TinyMCE behind some form of login but people within that system might still for example paste in code that has securty issues.
We would recommend that you use server side filtering of some sort, here is a few examples.
htmLawed
HTMLPurifier
Zend_Filter_Input
Using filtering you can achieve good security even for public content, such as a forum or wiki.