@richscripts/richtexteditor 2.4.1 → 2.5.0

package/richtexteditor/plugins/insertgallery.js

@@ -231,6 +231,15 @@ function RTE_Plugin_InsertGallery() {
 
         var browser = append(dialoginner, "div", "", "rte-gallery-browser");
 
+        // Exactly what the upload endpoint accepts, and nothing more. The file
+        // picker used to advertise "image/*,...,.svg", so it offered files the
+        // server then rejected with "Invalid file extension" and the user had no
+        // way to know the real list until after the failure. Declared here
+        // because both the header hint and the file input read it.
+        // SVG is excluded on purpose: it can carry script, so it is not a safe
+        // thing to store and serve back from our own origin.
+        var GALLERY_ACCEPT = [".jpg", ".jpeg", ".jfif", ".png", ".gif", ".webp", ".bmp", ".avif"];
+
         // The dialog frame already draws a title bar and close button, so this is
         // a one-line subtitle, not a second heading.
         var header = append(browser, "div", "", "rte-dialog-browser-header");
@@ -239,6 +248,12 @@ function RTE_Plugin_InsertGallery() {
             ? "Browse folders, upload new files, and insert the selected image into the editor."
             : "Browse the available images, filter by name, and insert the selected image into the editor.";
 
+        // State the accepted formats up front. Previously the only way to learn
+        // them was to pick an unsupported file and read "Invalid file extension".
+        var acceptHint = append(header, "div", "", "rte-dialog-browser-accept");
+        acceptHint.innerText = "Accepted formats: " +
+            GALLERY_ACCEPT.map(function (ext) { return ext.replace(".", "").toUpperCase(); }).join(", ");
+
         var toolbar = append(browser, "div", "", "rte-gallery-browser-toolbar");
         var toolbarLeft = append(toolbar, "div", "", "rte-gallery-browser-toolbar-group");
         var toolbarRight = append(toolbar, "div", "", "rte-gallery-browser-toolbar-group rte-gallery-browser-toolbar-group-right");
@@ -273,7 +288,7 @@ function RTE_Plugin_InsertGallery() {
 
         var fileInput = append(toolbarRight, "input", "display:none;");
         fileInput.type = "file";
-        fileInput.accept = "image/*,.jpg,.jpeg,.png,.gif,.bmp,.webp,.svg";
+        fileInput.accept = GALLERY_ACCEPT.join(",");
         fileInput.multiple = true;
 
         // Without a server there is no folder tree to walk and nothing to create
@@ -299,6 +314,12 @@ function RTE_Plugin_InsertGallery() {
         grid.setAttribute("role", "listbox");
         grid.setAttribute("aria-label", "Available images");
 
+        // Non-blocking failure notice. Sits above the grid instead of replacing
+        // it, so a rejected upload never hides the images you can still pick.
+        var errorBar = append(surface, "div", "", "rte-gallery-browser-error");
+        errorBar.setAttribute("role", "status");
+        show(errorBar, false);
+
         var empty = append(surface, "div", "", "rte-gallery-browser-empty");
 
         var footer = append(browser, "div", "", "rte-gallery-browser-footer");
@@ -341,6 +362,9 @@ function RTE_Plugin_InsertGallery() {
 
         function setSelected(url) {
             state.selectedUrl = url || "";
+            // Picking an image is a fresh action, so a stale failure notice from
+            // an earlier upload must not linger next to it.
+            state.error = "";
             render();
         }
 
@@ -494,12 +518,16 @@ function RTE_Plugin_InsertGallery() {
                 return;
             }
 
+            // An upload failure must not wipe the browser. It used to replace the
+            // whole grid, so one rejected file left the dialog reading "0 items"
+            // with an error where the images should be - while the footer still
+            // said the previously selected image was ready to insert. Two panels
+            // contradicting each other. Show it as a banner and keep browsing.
             if (state.error) {
-                empty.innerText = state.error;
-                show(empty, true);
-                show(grid, false);
-                updateStatus(0, 0);
-                return;
+                errorBar.innerText = state.error;
+                show(errorBar, true);
+            } else {
+                show(errorBar, false);
             }
 
             for (var folderIndex = 0; folderIndex < visibleFolders.length; folderIndex++) {

package/richtexteditor/plugins/keyboarda11y.js

@@ -227,7 +227,33 @@ function RTE_Plugin_KeyboardA11y() {
     // The editor already tracks active state — it just keeps it in a class.
     // Mirroring rather than recomputing means the announced state can never
     // disagree with the highlighted button.
-    var TOGGLE_CMD = /^(bold|italic|underline|strikethrough|subscript|superscript|justifyleft|justifycenter|justifyright|justifyfull|insertorderedlist|insertunorderedlist|outdent|indent|blockquote|inlinecode|trackchanges|typewriter|focusmode|pagination|formattingmarks|linenumbers|permanentpen|rtlui)$/;
+    // Command names here must match the TOOLBAR command exactly — the regex is
+    // anchored, so a near-miss is a silent no-op that looks like coverage.
+    // "blockquote" is one: the command is `insertblockquote`, so the entry
+    // written specifically for it never matched and that button ships with no
+    // aria-pressed. Found by checking every genuine toggle on the full toolbar
+    // rather than the three the published verify page samples.
+    //
+    // This mirror only copies the editor's own active state, so a command may
+    // only be listed here once core actually tracks it. Emitting the attribute
+    // for an untracked command yields a permanent aria-pressed="false" —
+    // confidently announcing "not pressed" while the formatting IS applied,
+    // which makes announced state DISAGREE with the highlight. That is the exact
+    // failure this mirror exists to prevent, so silence beats a wrong answer.
+    //   - `toggleborder` was already tracked (core checks the editable's
+    //     rte-toggleborder class); it reads inactive simply when borders are off.
+    //   - `insertblockquote` was NOT tracked and now is, via a core case added
+    //     alongside `indent`, which resolves the same way.
+    // Both verified on the running editor rather than inferred.
+    //
+    // `inlinecode`, `pagination`, `typewriter` and `focusmode` match nothing in
+    // this build, and now the reason is known rather than assumed: pagination.js
+    // and typewriter.js are API-only (togglePageView / toggleTypewriterMode …)
+    // and register no toolbar command, and insertcode.js registers `insertcode`,
+    // which inserts a block rather than toggling the selection. They are kept —
+    // harmless, and correct the moment a toolbar button is added — but they
+    // cover nothing today, so do not read this list as evidence of coverage.
+    var TOGGLE_CMD = /^(bold|italic|underline|strikethrough|subscript|superscript|justifyleft|justifycenter|justifyright|justifyfull|insertorderedlist|insertunorderedlist|outdent|indent|insertblockquote|toggleborder|inlinecode|trackchanges|typewriter|focusmode|pagination|formattingmarks|linenumbers|permanentpen|rtlui)$/;
 
     function syncToggleStates(root) {
         var btns = [].slice.call(root.querySelectorAll('[role="button"][rte-cmd-name]'));

package/richtexteditor/plugins/multiroot.js

@@ -0,0 +1,269 @@
+if (!window.RTE_DefaultConfig) window.RTE_DefaultConfig = {};
+
+// 2026-08-15 Multi-root editing — one toolbar, several editable regions.
+//
+// The CMS / page-builder case: a page has a title, a summary and a body, and the
+// author wants one toolbar that acts on whichever region they are in, not three
+// stacked toolbars eating the viewport.
+//
+// SCOPE — read this before assuming parity with CKEditor's multi-root:
+//   This editor edits <body> inside an IFRAME and has no div/inline mode. One
+//   instance therefore owns exactly one editable document, and every plugin,
+//   the selection model and the CRDT binding are written against that
+//   assumption. Making a single instance own N editables is a core rewrite, not
+//   a plugin.
+//   What this does instead is COORDINATE several ordinary instances: they share
+//   one visible toolbar and one group-level API. That covers the layout and the
+//   workflow, which is what the feature is actually for.
+//   What it does NOT do, and cannot without core work:
+//     - a shared undo stack (Ctrl+Z undoes within the focused region only),
+//     - a selection spanning two regions,
+//     - one collaboration session across regions (each root syncs separately).
+//   Those are stated in getCapabilities() as well as here, so an integrator
+//   finds out from the API rather than from a bug report.
+//
+// Design notes:
+//   - Toolbars are SHOWN/HIDDEN, not rebuilt or re-pointed. Each instance's
+//     toolbar already drives its own editor correctly; re-routing commands
+//     across instances would mean reimplementing every command's notion of
+//     "current editor" and would break the moment a plugin cached one.
+//   - Moving the active toolbar into a shared host is optional. DOM moves
+//     preserve listeners, so the toolbar keeps working, but a host that is
+//     positioned or scrolled differently can change the float-panel anchoring —
+//     hence opt-in rather than default.
+//   - Registration is by GROUP NAME in a module-level registry, because plugins
+//     are constructed per instance and have no other way to see each other.
+RTE_DefaultConfig.plugin_multiroot = RTE_Plugin_MultiRoot;
+
+// Instances sharing a group name act as one multi-root editor. null = off.
+if (typeof RTE_DefaultConfig.multiRootGroup === "undefined") RTE_DefaultConfig.multiRootGroup = null;
+// A name for this root in the group API. Defaults to the container's id.
+if (typeof RTE_DefaultConfig.multiRootName === "undefined") RTE_DefaultConfig.multiRootName = null;
+// Element (or its id) to move the active toolbar into. null = leave in place.
+if (typeof RTE_DefaultConfig.multiRootToolbarHost === "undefined") RTE_DefaultConfig.multiRootToolbarHost = null;
+
+// group name -> { roots: [entry], active: entry }
+if (!window.__RTE_MultiRootGroups) window.__RTE_MultiRootGroups = {};
+
+function RTE_Plugin_MultiRoot() {
+    var obj = this;
+    var config, editor;
+    var entry = null;
+
+    obj.PluginName = "MultiRoot";
+
+    obj.InitConfig = function (argconfig) { config = argconfig; };
+
+    obj.InitEditor = function (argeditor) {
+        editor = argeditor;
+
+        var group = config.multiRootGroup;
+        if (!group) return;                       // opt-in
+
+        entry = {
+            name: config.multiRootName || containerId() || ("root" + (groupOf(group).roots.length + 1)),
+            editor: editor,
+            container: container(),
+            group: group
+        };
+        groupOf(group).roots.push(entry);
+
+        editor.multiRoot = api(group);
+
+        // Wait for the toolbar to exist before hiding anything.
+        setTimeout(function () { bindFocus(); settle(group); }, 0);
+        try { editor.attachEvent("ready", function () { bindFocus(); settle(group); }); } catch (e) {}
+    };
+
+    function groupOf(name) {
+        // `listeners` lives on the GROUP, not in this closure. Every root builds
+        // its own copy of this plugin, so an instance-local list means a callback
+        // registered through one root's API never hears an activation fired by a
+        // different root — the subscriber silently lags by one event, or misses
+        // everything, depending on which root the user clicks.
+        if (!window.__RTE_MultiRootGroups[name]) {
+            window.__RTE_MultiRootGroups[name] = { roots: [], active: null, listeners: [] };
+        }
+        var g = window.__RTE_MultiRootGroups[name];
+        if (!g.listeners) g.listeners = [];
+        return g;
+    }
+
+    // The editor exposes its host element as `container` (a property, not a
+    // getter — there is no getContainer()). Falling back through the iframe
+    // covers any build where that property is absent, rather than silently
+    // returning null and leaving every toolbar visible.
+    function container() {
+        try {
+            if (editor.container) return editor.container;
+            if (editor.iframe) {
+                var n = editor.iframe.parentNode;
+                while (n && !(n.classList && n.classList.contains("richtexteditor"))) n = n.parentNode;
+                return n || null;
+            }
+        } catch (e) {}
+        return null;
+    }
+
+    function containerId() {
+        var c = container();
+        return c && c.id ? c.id : null;
+    }
+
+    // ---- toolbar visibility ----------------------------------------------
+
+    function toolbarsOf(root) {
+        var c = root.container;
+        if (!c) return [];
+        return [].slice.call(c.querySelectorAll("rte-toolbar"));
+    }
+
+    function setVisible(root, visible) {
+        var bars = toolbarsOf(root);
+        for (var i = 0; i < bars.length; i++) {
+            var bar = bars[i];
+            if (visible) {
+                // Restore whatever the editor's own responsive logic had chosen
+                // (desktop vs mobile bar), rather than forcing display:flex on
+                // both and showing two toolbars at once.
+                if (bar.__rteMultiRootPrevDisplay !== undefined) {
+                    bar.style.display = bar.__rteMultiRootPrevDisplay;
+                    delete bar.__rteMultiRootPrevDisplay;
+                }
+            } else {
+                if (bar.__rteMultiRootPrevDisplay === undefined) {
+                    bar.__rteMultiRootPrevDisplay = bar.style.display;
+                }
+                bar.style.display = "none";
+            }
+        }
+    }
+
+    function settle(groupName) {
+        var g = groupOf(groupName);
+        if (!g.roots.length) return;
+        if (!g.active) g.active = g.roots[0];
+        for (var i = 0; i < g.roots.length; i++) {
+            setVisible(g.roots[i], g.roots[i] === g.active);
+        }
+        hostToolbar(g.active);
+    }
+
+    function hostToolbar(root) {
+        var hostRef = config.multiRootToolbarHost;
+        if (!hostRef || !root) return;
+        var host = (typeof hostRef === "string") ? document.getElementById(hostRef) : hostRef;
+        if (!host) return;
+        var bars = toolbarsOf(root);
+        for (var i = 0; i < bars.length; i++) {
+            // Moving a node keeps its listeners, so the toolbar stays live.
+            if (bars[i].parentNode !== host) host.appendChild(bars[i]);
+        }
+    }
+
+    // ---- focus tracking ---------------------------------------------------
+
+    function bindFocus() {
+        var doc;
+        try { doc = editor.getDocument(); } catch (e) { return; }
+        if (!doc || doc.__rteMultiRootBound) return;
+        doc.__rteMultiRootBound = true;
+
+        var activate = function () {
+            if (!entry) return;
+            var g = groupOf(entry.group);
+            if (g.active === entry) return;
+            g.active = entry;
+            settle(entry.group);
+            fire(entry.group, entry);
+        };
+
+        // focusin bubbles; focus does not.
+        doc.addEventListener("focusin", activate, true);
+        doc.addEventListener("mousedown", activate, true);
+    }
+
+    function fire(groupName, root) {
+        var list = groupOf(groupName).listeners;
+        for (var i = 0; i < list.length; i++) {
+            try { list[i]({ active: root.name, editor: root.editor }); } catch (e) {}
+        }
+    }
+
+    // ---- group API --------------------------------------------------------
+
+    function api(groupName) {
+        var g = groupOf(groupName);
+        return {
+            group: groupName,
+
+            getRoots: function () {
+                return g.roots.map(function (r) { return r.name; });
+            },
+
+            getActive: function () {
+                return g.active ? g.active.name : null;
+            },
+
+            getEditor: function (name) {
+                for (var i = 0; i < g.roots.length; i++) if (g.roots[i].name === name) return g.roots[i].editor;
+                return null;
+            },
+
+            focusRoot: function (name) {
+                var target = null;
+                for (var i = 0; i < g.roots.length; i++) if (g.roots[i].name === name) target = g.roots[i];
+                if (!target) return false;
+                g.active = target;
+                settle(groupName);
+                try { target.editor.focus(); } catch (e) {}
+                fire(groupName, target);
+                return true;
+            },
+
+            // The whole document, one entry per root — what a CMS saves.
+            getHTML: function () {
+                var out = {};
+                for (var i = 0; i < g.roots.length; i++) {
+                    try { out[g.roots[i].name] = g.roots[i].editor.getHTMLCode(); } catch (e) { out[g.roots[i].name] = null; }
+                }
+                return out;
+            },
+
+            setHTML: function (map) {
+                if (!map) return false;
+                for (var i = 0; i < g.roots.length; i++) {
+                    var r = g.roots[i];
+                    if (!(r.name in map)) continue;
+                    try { r.editor.setHTMLCode(map[r.name]); } catch (e) {}
+                }
+                return true;
+            },
+
+            onActiveChange: function (fn) {
+                if (typeof fn !== "function") return function () {};
+                g.listeners.push(fn);
+                return function () {
+                    var at = g.listeners.indexOf(fn);
+                    if (at >= 0) g.listeners.splice(at, 1);
+                };
+            },
+
+            // Say plainly what this does and does not do, so an integrator does
+            // not discover the limits from a support ticket.
+            getCapabilities: function () {
+                return {
+                    sharedToolbar: true,
+                    sharedGroupApi: true,
+                    perRootUndo: true,
+                    sharedUndoStack: false,
+                    selectionAcrossRoots: false,
+                    sharedCollaborationSession: false,
+                    note: "Each root is a separate editor instance sharing one visible toolbar. " +
+                          "Undo, selection and collaboration are per-root; the editor edits an " +
+                          "iframe body, so a single instance cannot own several editables without core changes."
+                };
+            }
+        };
+    }
+}

package/richtexteditor/plugins/revisionhistory.js

@@ -270,6 +270,11 @@ function RTE_Plugin_RevisionHistory() {
     }
 
     function restore(id, opts) {
+        // The dialog's own Restore button calls restore(id) with no options, so
+        // reading opts.skipConfirm threw and the button did nothing at all. The
+        // public API wrapper defaulted this, the internal caller did not - so
+        // default it here, where every caller is covered.
+        opts = opts || {};
         var entry = findById(id);
         if (!entry) return false;
         if (!opts.skipConfirm) {

package/richtexteditor/plugins/sanitizer.js

@@ -141,6 +141,17 @@ function RTE_Plugin_Sanitizer() {
         var v = String(value == null ? "" : value).replace(/[\u0000-\u0020\u007F-\u00A0]+/g, "").trim();
         if (!v) return false;
 
+        // <use> resolves its reference by FETCHING it. The only legitimate form
+        // in editor content is a same-document fragment (#icon-id) pointing at a
+        // <symbol>/<defs> in the same markup — nobody authoring a document means
+        // to reference a remote SVG. Left unrestricted it is a beacon that fires
+        // in every reader's browser for content one author saved, which is the
+        // same class of problem as an embedded remote logo or analytics pixel
+        // (see the no-external-calls hardening). Browsers additionally refuse
+        // cross-origin <use>, but relying on that is relying on someone else's
+        // policy to enforce ours.
+        if (tag === "use") return v.charAt(0) === "#";
+
         // Fragments, absolute paths and query-only URLs carry no scheme.
         if (/^[#?/]/.test(v)) return true;
 
@@ -243,6 +254,19 @@ function RTE_Plugin_Sanitizer() {
                 // This is the construct that actually executed downstream.
                 if (el.hasAttribute("srcdoc")) { note(report.removedAttributes, "iframe[srcdoc]"); el.removeAttribute("srcdoc"); }
                 if (!iframeAllowed(el)) { note(report.removedTags, "iframe"); el.parentNode.removeChild(el); continue; }
+            } else if (tag === "title" || tag === "desc") {
+                // Legal inside <svg> (they supply its accessible name), which is
+                // why they are in ALLOWED_TAGS. But the allowance was
+                // unqualified, so a document-level <title> from a pasted or
+                // set full HTML document survived into SAVED content while
+                // <style>/<meta>/<link> beside it were stripped. Head-level
+                // markup has no business in body content; keep these only where
+                // they are actually valid.
+                if (!el.closest || !el.closest("svg")) {
+                    note(report.removedTags, tag);
+                    el.parentNode.removeChild(el);
+                    continue;
+                }
             } else if (DROP_WHOLE[tag]) {
                 note(report.removedTags, tag);
                 el.parentNode.removeChild(el);