@richscripts/richtexteditor 2.11.1 → 2.12.1

package/richtexteditor/plugins/aitoolkit.js

@@ -2538,6 +2538,29 @@ function RTE_Plugin_AIToolkit() {
         };
     }
 
+    // HTML that arrives from a ledger or a persisted document came from someone else - another
+    // reviewer, a shared store, an AI endpoint that can be prompt-injected. It is written straight
+    // into the document on accept/reject, so clean it here, at the boundary, instead of relying on
+    // whatever runs against the live DOM later. Script vectors go through the content sanitizer when
+    // it is loaded; position:fixed/sticky is dropped either way, because a full-viewport overlay from
+    // remote content survived every other pass (UI redress, measured 2026-09-18).
+    function cleanRemoteHtml(html) {
+        if (!html) return "";
+        html = String(html);
+        if (typeof editor.sanitizeHtml === "function") html = editor.sanitizeHtml(html);
+        var doc = new DOMParser().parseFromString("<body>" + html + "</body>", "text/html");
+        var styled = doc.body.querySelectorAll("[style]");
+        for (var i = 0; i < styled.length; i++) {
+            var st = styled[i].style;
+            if (/^(fixed|sticky)$/i.test(st.position)) {
+                st.removeProperty("position");
+                st.removeProperty("z-index");
+                if (!styled[i].getAttribute("style")) styled[i].removeAttribute("style");
+            }
+        }
+        return doc.body.innerHTML;
+    }
+
     function normalizeLedgerEntry(raw) {
         if (!raw || !raw.id) return null;
         var changeType = raw.changeType || "ai-preview";
@@ -2555,10 +2578,10 @@ function RTE_Plugin_AIToolkit() {
                 name: author.name || author.id || "User",
                 color: author.color || "#2563eb"
             },
-            originalHtml: raw.originalHtml || "",
+            originalHtml: cleanRemoteHtml(raw.originalHtml),
             originalText: raw.originalText || "",
             resultText: raw.resultText || "",
-            resultHtml: raw.resultHtml || "",
+            resultHtml: cleanRemoteHtml(raw.resultHtml),
             reason: raw.reason || "",
             suggestionType: raw.suggestionType || "",
             language: raw.language || "",
@@ -2595,10 +2618,10 @@ function RTE_Plugin_AIToolkit() {
                 name: author.name || author.id || "User",
                 color: author.color || "#2563eb"
             },
-            originalHtml: raw.originalHtml || textToInlineHtml(raw.originalText || ""),
+            originalHtml: cleanRemoteHtml(raw.originalHtml) || textToInlineHtml(raw.originalText || ""),
             originalText: normalizeText(raw.originalText || ""),
             resultText: normalizeText(raw.resultText || ""),
-            resultHtml: raw.resultHtml || textToInlineHtml(raw.resultText || ""),
+            resultHtml: cleanRemoteHtml(raw.resultHtml) || textToInlineHtml(raw.resultText || ""),
             reason: normalizeText(raw.reason || ""),
             suggestionType: getSuggestionTypeValue(raw.suggestionType || ""),
             language: raw.language || "",

package/richtexteditor/plugins/all_plugins.js

@@ -3748,6 +3748,29 @@ function RTE_Plugin_AIToolkit() {
         };
     }
 
+    // HTML that arrives from a ledger or a persisted document came from someone else - another
+    // reviewer, a shared store, an AI endpoint that can be prompt-injected. It is written straight
+    // into the document on accept/reject, so clean it here, at the boundary, instead of relying on
+    // whatever runs against the live DOM later. Script vectors go through the content sanitizer when
+    // it is loaded; position:fixed/sticky is dropped either way, because a full-viewport overlay from
+    // remote content survived every other pass (UI redress, measured 2026-09-18).
+    function cleanRemoteHtml(html) {
+        if (!html) return "";
+        html = String(html);
+        if (typeof editor.sanitizeHtml === "function") html = editor.sanitizeHtml(html);
+        var doc = new DOMParser().parseFromString("<body>" + html + "</body>", "text/html");
+        var styled = doc.body.querySelectorAll("[style]");
+        for (var i = 0; i < styled.length; i++) {
+            var st = styled[i].style;
+            if (/^(fixed|sticky)$/i.test(st.position)) {
+                st.removeProperty("position");
+                st.removeProperty("z-index");
+                if (!styled[i].getAttribute("style")) styled[i].removeAttribute("style");
+            }
+        }
+        return doc.body.innerHTML;
+    }
+
     function normalizeLedgerEntry(raw) {
         if (!raw || !raw.id) return null;
         var changeType = raw.changeType || "ai-preview";
@@ -3765,10 +3788,10 @@ function RTE_Plugin_AIToolkit() {
                 name: author.name || author.id || "User",
                 color: author.color || "#2563eb"
             },
-            originalHtml: raw.originalHtml || "",
+            originalHtml: cleanRemoteHtml(raw.originalHtml),
             originalText: raw.originalText || "",
             resultText: raw.resultText || "",
-            resultHtml: raw.resultHtml || "",
+            resultHtml: cleanRemoteHtml(raw.resultHtml),
             reason: raw.reason || "",
             suggestionType: raw.suggestionType || "",
             language: raw.language || "",
@@ -3805,10 +3828,10 @@ function RTE_Plugin_AIToolkit() {
                 name: author.name || author.id || "User",
                 color: author.color || "#2563eb"
             },
-            originalHtml: raw.originalHtml || textToInlineHtml(raw.originalText || ""),
+            originalHtml: cleanRemoteHtml(raw.originalHtml) || textToInlineHtml(raw.originalText || ""),
             originalText: normalizeText(raw.originalText || ""),
             resultText: normalizeText(raw.resultText || ""),
-            resultHtml: raw.resultHtml || textToInlineHtml(raw.resultText || ""),
+            resultHtml: cleanRemoteHtml(raw.resultHtml) || textToInlineHtml(raw.resultText || ""),
             reason: normalizeText(raw.reason || ""),
             suggestionType: getSuggestionTypeValue(raw.suggestionType || ""),
             language: raw.language || "",
@@ -30812,10 +30835,12 @@ function RTE_Plugin_InsertEmoji() {
 //
 //   config.galleryEndpoint   URL returning { currentFolder, currentFolderDisplay,
 //                            parentFolder, folders: [{folder,name}],
-//                            images: [{url,name,folder,size,source}] }.
+//                            images: [{url,name,folder,size,source,alt}] }.
 //                            Absent -> local mode: presets only, no request.
 //   config.galleryImages     Preset images. String, [url, text], or an object
-//                            with url/src/href plus optional thumbnail/name/meta.
+//                            with url/src/href plus optional thumbnail/name/meta/alt.
+//                            alt (presets and server images) becomes the inserted
+//                            image's alt text; without it the attribute stays absent.
 //
 // Uploads use window.richTextBoxUploadFile when present (it accepts a target
 // folder), otherwise the generic window.rte_file_upload_handler.
@@ -30946,7 +30971,8 @@ function RTE_Plugin_InsertGallery() {
                 url: url,
                 thumbnail: item.thumbnail || item.thumb || item.preview || url,
                 name: item.name || item.text || item.title || getFileName(url),
-                meta: item.meta || item.description || item.alt || ""
+                meta: item.meta || item.description || item.alt || "",
+                alt: typeof item.alt === "string" ? item.alt : undefined
             };
         }
 
@@ -30986,6 +31012,7 @@ function RTE_Plugin_InsertGallery() {
             folder: item.folder || "",
             source: item.source || "upload",
             size: item.size || 0,
+            alt: typeof item.alt === "string" ? item.alt : undefined,
             searchText: (name + " " + item.url).toLowerCase()
         };
     }
@@ -31179,7 +31206,9 @@ function RTE_Plugin_InsertGallery() {
                 return;
             }
 
-            editor.insertImageByUrl(selected.url);
+            // Only an alt the host supplied (preset or server listing). The file name is
+            // not alt text; leaving it absent lets the accessibility checker flag it.
+            editor.insertImageByUrl(selected.url, selected.alt);
             closeDialog();
             editor.focus();
         }
@@ -31410,6 +31439,10 @@ function RTE_Plugin_InsertGallery() {
             render();
         }
 
+        // Upload failures to show once the folder has been re-listed (applyResponse
+        // clears the error, so it would otherwise vanish).
+        var pendingError = "";
+
         function loadFolder(folder, selectAfterLoad) {
             if (!serverMode) {
                 state.images = presetImages.slice(0);
@@ -31423,6 +31456,7 @@ function RTE_Plugin_InsertGallery() {
 
             requestJson("GET", withFolder(endpoint, folder), null, function (payload, errorCode) {
                 if (errorCode) {
+                    pendingError = "";
                     loadFallback(errorCode);
                     return;
                 }
@@ -31431,6 +31465,8 @@ function RTE_Plugin_InsertGallery() {
                 if (selectAfterLoad) {
                     state.selectedUrl = selectAfterLoad;
                 }
+                state.error = pendingError;
+                pendingError = "";
                 state.loading = false;
                 render();
             });
@@ -31465,67 +31501,120 @@ function RTE_Plugin_InsertGallery() {
             });
         }
 
+        // config.maxUploadFileSize is enforced by the core only on its own insert
+        // paths. The gallery calls the upload handler directly, so the limit a
+        // customer set to protect their database was skipped for every image
+        // uploaded through this dialog. The accept list is only a hint to the file
+        // picker ("All files" bypasses it), so the format is checked here too.
+        function rejectReason(file) {
+            var name = String(file.name || "").toLowerCase();
+            var dot = name.lastIndexOf(".");
+            if (dot < 0 || GALLERY_ACCEPT.indexOf(name.substring(dot)) < 0) {
+                return file.name + " is not an accepted image format.";
+            }
+            var max = parseInt(config.maxUploadFileSize, 10);
+            if (max > 0 && file.size > max) {
+                return file.name + " is " + humanSize(file.size) + ". The maximum allowed size is " + humanSize(max) + ".";
+            }
+            return "";
+        }
+
         function uploadFiles(fileList) {
             var files = [];
+            var problems = [];
             var index;
             for (index = 0; index < fileList.length; index++) {
-                files.push(fileList[index]);
+                var reason = rejectReason(fileList[index]);
+                if (reason) {
+                    problems.push(reason);
+                } else {
+                    files.push(fileList[index]);
+                }
             }
 
-            if (!files.length || !canUpload) {
+            if (!canUpload) {
+                return;
+            }
+            if (!files.length) {
+                if (problems.length) {
+                    state.error = problems.join(" ");
+                    render();
+                }
                 return;
             }
 
-            var lastUploadedUrl = "";
+            // One failed file used to stop the batch, and in local mode only the
+            // LAST success was added to the list - uploading three images showed
+            // one. Now every file is attempted, every success is kept, and the
+            // failures are reported together at the end.
+            var uploadedUrls = [];
 
-            function uploadNext(nextIndex) {
-                if (nextIndex >= files.length) {
-                    if (serverMode) {
-                        loadFolder(state.currentFolder, lastUploadedUrl);
-                        return;
-                    }
+            function finish() {
+                var lastUploadedUrl = uploadedUrls.length ? uploadedUrls[uploadedUrls.length - 1] : "";
 
-                    // No server to re-list from, so fold the upload into the
-                    // preset list directly and keep it selected.
-                    if (lastUploadedUrl) {
-                        var uploaded = normalizePreset(lastUploadedUrl);
-                        if (uploaded) {
-                            uploaded.source = "upload";
-                            presetImages.unshift(uploaded);
-                            config.galleryImages.unshift(lastUploadedUrl);
-                        }
-                        state.selectedUrl = lastUploadedUrl;
+                if (serverMode) {
+                    pendingError = problems.join(" ");
+                    loadFolder(state.currentFolder, lastUploadedUrl || state.selectedUrl);
+                    return;
+                }
+
+                // No server to re-list from, so fold the uploads into the preset
+                // list directly, newest first, and select the last one.
+                for (var u = 0; u < uploadedUrls.length; u++) {
+                    var uploaded = normalizePreset(uploadedUrls[u]);
+                    if (uploaded) {
+                        uploaded.source = "upload";
+                        presetImages.unshift(uploaded);
+                        config.galleryImages.unshift(uploadedUrls[u]);
                     }
-                    state.images = presetImages.slice(0);
-                    state.loading = false;
-                    render();
+                }
+                if (lastUploadedUrl) {
+                    state.selectedUrl = lastUploadedUrl;
+                }
+                state.images = presetImages.slice(0);
+                state.loading = false;
+                state.error = problems.join(" ");
+                render();
+            }
+
+            function uploadNext(nextIndex) {
+                if (nextIndex >= files.length) {
+                    finish();
                     return;
                 }
 
                 var file = files[nextIndex];
+                var settled = false;
 
-                function done(url, errorCode) {
-                    if (!url) {
-                        state.error = errorCode || ("Upload failed for " + file.name + ".");
-                        state.loading = false;
-                        render();
+                function done(url, errorText) {
+                    // a handler that calls back twice must not upload the rest twice
+                    if (settled) {
                         return;
                     }
-
-                    lastUploadedUrl = url;
+                    settled = true;
+                    if (url) {
+                        uploadedUrls.push(url);
+                    } else {
+                        problems.push(typeof errorText === "string" && errorText ? errorText : ("Upload failed for " + file.name + "."));
+                    }
                     uploadNext(nextIndex + 1);
                 }
 
-                if (uploadToFolder) {
-                    window.richTextBoxUploadFile(file, function (url, errorCode) {
-                        done(errorCode ? "" : url, errorCode ? ("Upload failed for " + file.name + ".") : "");
-                    }, { folder: state.currentFolder }, nextIndex, files);
-                    return;
-                }
+                try {
+                    if (uploadToFolder) {
+                        window.richTextBoxUploadFile(file, function (url, errorCode) {
+                            done(errorCode ? "" : url, errorCode ? ("Upload failed for " + file.name + ".") : "");
+                        }, { folder: state.currentFolder }, nextIndex, files);
+                        return;
+                    }
 
-                window.rte_file_upload_handler(file, function (url, error) {
-                    done(url, error);
-                }, nextIndex, files);
+                    window.rte_file_upload_handler(file, function (url, error) {
+                        done(url, error);
+                    }, nextIndex, files);
+                } catch (ex) {
+                    // a handler that throws must not leave the dialog stuck on "Loading"
+                    done("", "Upload failed for " + file.name + ".");
+                }
             }
 
             state.loading = true;
@@ -39806,13 +39895,35 @@ function RTE_Plugin_Sanitizer() {
     // sanitizerAllowedIframeHosts is still the stronger control.
     var DEFAULT_IFRAME_SANDBOX = "allow-scripts allow-same-origin allow-presentation";
 
+    // 2026-09-21 Two holes in the default sandbox, both closed here:
+    //  - it was only ADDED when the iframe had none, so injected markup that
+    //    brought its own sandbox="allow-top-navigation allow-popups allow-forms"
+    //    kept every permission the comment above says is withheld. An existing
+    //    sandbox is now narrowed to the default set, never trusted.
+    //  - allow-scripts + allow-same-origin isolates nothing when the frame is
+    //    served from the page's OWN origin: the framed page can reach the parent
+    //    and remove its own sandbox. Same-origin frames lose allow-same-origin.
+    function applyDefaultSandbox(el, src) {
+        var allowed = DEFAULT_IFRAME_SANDBOX.split(" ");
+        var sameOrigin = false;
+        try { sameOrigin = new URL(src, location.href).origin === location.origin; } catch (e) {}
+        if (sameOrigin) allowed = allowed.filter(function (t) { return t !== "allow-same-origin"; });
+        if (el.hasAttribute("sandbox")) {
+            // keep only what the frame asked for AND the default permits; an empty
+            // sandbox (the strictest) stays empty
+            var asked = (el.getAttribute("sandbox") || "").toLowerCase().split(/\s+/);
+            allowed = allowed.filter(function (t) { return asked.indexOf(t) >= 0; });
+        }
+        el.setAttribute("sandbox", allowed.join(" "));
+    }
+
     function iframeAllowed(el) {
         if (config.sanitizerAllowIframes === false) return false;
         var src = el.getAttribute("src") || "";
         if (!/^https?:/i.test(src)) return false;
         var hosts = config.sanitizerAllowedIframeHosts;
         if (!hosts || !hosts.length) {
-            if (!el.hasAttribute("sandbox")) el.setAttribute("sandbox", DEFAULT_IFRAME_SANDBOX);
+            applyDefaultSandbox(el, src);
             return true;
         }
         try {