jodit 4.15.3 → 4.15.5

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.15.3
+ * Version: v4.15.5
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.15.3
+ * Version: v4.15.5
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.15.3
+ * Version: v4.15.5
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.15.3
+ * Version: v4.15.5
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.15.3
+ * Version: v4.15.5
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.15.3
+ * Version: v4.15.5
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.15.3
+ * Version: v4.15.5
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.15.3
+ * Version: v4.15.5
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.15.3
+ * Version: v4.15.5
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/config.d.ts

@@ -1033,6 +1033,15 @@ interface Config {
          * it to `''` for form submission.
          */
         collapseEmptyValueToEmptyString: boolean;
+        /**
+         * Browsers serialise quoted font names in a `style` attribute with
+         * double quotes, which end up as `"` in the editor value
+         * (`font-family: "Open Sans", sans-serif`). Some back ends
+         * HTML-decode the value before storing it and turn that into invalid
+         * markup. With this option (default) the value getter rewrites such
+         * names with single quotes: `font-family: 'Open Sans', sans-serif`.
+         */
+        singleQuotesInFontFamily: boolean;
         /**
          * Replace old tags to new eg. <i> to <em>, <b> to <strong>
          */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.15.3";
+export const APP_VERSION = "4.15.5";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/modules/file-browser/data-provider.d.ts

@@ -8,6 +8,15 @@
  */
 import type { IFileBrowserAnswer, IFileBrowserDataProvider, IFileBrowserDataProviderItemsMods, IFileBrowserItem, IFileBrowserOptions, ImageBox, IPermissions, ISourcesFiles, IViewBased, Nullable } from "../../types/index";
 export declare const DEFAULT_SOURCE_NAME = "default";
+/**
+ * Validate the connector answer for the `files` / `folders` actions and
+ * normalise it. A hand-written backend that returns the wrong shape used to
+ * crash deep inside the UI with a bare `TypeError: ... reading 'forEach'`;
+ * now it fails right here with a message that names the action, the option
+ * and the missing field. Missing `files` / `folders` lists are treated as
+ * empty instead of throwing.
+ */
+export declare function assertSourcesAnswer(resp: unknown, action: 'files' | 'folders', option: 'items' | 'folder'): IFileBrowserAnswer;
 export default class DataProvider implements IFileBrowserDataProvider {
     readonly parent: IViewBased;
     readonly options: IFileBrowserOptions;

package/esm/modules/file-browser/data-provider.js

@@ -15,7 +15,9 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 import { IS_PROD } from "../../core/constants.js";
 import { autobind } from "../../core/decorators/autobind/autobind.js";
+import { isArray } from "../../core/helpers/checker/is-array.js";
 import { isFunction } from "../../core/helpers/checker/is-function.js";
+import { isPlainObject } from "../../core/helpers/checker/is-plain-object.js";
 import { normalizeRelativePath } from "../../core/helpers/normalize/normalize-relative-path.js";
 import { ConfigProto } from "../../core/helpers/utils/config-proto.js";
 import { abort, error } from "../../core/helpers/utils/error/index.js";
@@ -38,6 +40,43 @@ const possibleRules = new Set([
     'allowImageResize',
     'allowImageCrop'
 ]);
+const DOCS_URL = 'https://xdsoft.net/jodit/docs/modules/file_browser.html';
+/**
+ * Validate the connector answer for the `files` / `folders` actions and
+ * normalise it. A hand-written backend that returns the wrong shape used to
+ * crash deep inside the UI with a bare `TypeError: ... reading 'forEach'`;
+ * now it fails right here with a message that names the action, the option
+ * and the missing field. Missing `files` / `folders` lists are treated as
+ * empty instead of throwing.
+ */
+export function assertSourcesAnswer(resp, action, option) {
+    const fail = (what) => {
+        throw new Error(`File browser: the connector answer for action "${action}" (option "filebrowser.${option}") ${what}. See ${DOCS_URL}`);
+    };
+    if (!isPlainObject(resp) || !isPlainObject(resp.data)) {
+        return fail('has no "data" object');
+    }
+    const { sources } = resp.data;
+    if (!isArray(sources)) {
+        return fail(sources === undefined
+            ? 'has no "data.sources" array'
+            : `must contain "data.sources" as an array of sources, got ${isPlainObject(sources)
+                ? 'an object keyed by source name'
+                : typeof sources}`);
+    }
+    sources.forEach((source, index) => {
+        if (!isPlainObject(source)) {
+            return fail(`has a non-object entry at "data.sources[${index}]"`);
+        }
+        if (!isArray(source.files)) {
+            source.files = [];
+        }
+        if (!isArray(source.folders)) {
+            source.folders = [];
+        }
+    });
+    return resp;
+}
 export default class DataProvider {
     constructor(parent, options) {
         this.parent = parent;
@@ -100,6 +139,7 @@ export default class DataProvider {
         this.o.permissions.data.source = source;
         if (this.o.permissions.url) {
             return this.get('permissions').then(resp => {
+                var _a;
                 if (this.parent.isInDestruct) {
                     throw abort();
                 }
@@ -109,7 +149,9 @@ export default class DataProvider {
                 }
                 if (process) {
                     const respData = process.call(self, resp);
-                    if (respData.data.permissions) {
+                    // The permissions answer is optional and may come back without
+                    // a `data` object at all from a minimal backend.
+                    if ((_a = respData === null || respData === void 0 ? void 0 : respData.data) === null || _a === void 0 ? void 0 : _a.permissions) {
                         this.parent.events.fire(this, 'changePermissions', this.__currentPermissions, respData.data.permissions);
                         this.__currentPermissions = respData.data.permissions;
                     }
@@ -150,7 +192,7 @@ export default class DataProvider {
             if (process) {
                 resp = process.call(self, resp);
             }
-            return onResult(resp);
+            return onResult(assertSourcesAnswer(resp, 'files', 'items'));
         });
     }
     /**
@@ -216,7 +258,7 @@ export default class DataProvider {
             if (process) {
                 resp = process.call(self, resp);
             }
-            return resp.data.sources;
+            return assertSourcesAnswer(resp, 'folders', 'folder').data.sources;
         });
     }
     /**

package/esm/plugins/clean-html/clean-html.d.ts

@@ -42,6 +42,15 @@ export declare class cleanHtml extends Plugin {
     protected onAfterGetValueFromEditor(data: {
         value: string;
     }): void;
+    /**
+     * Rewrite double-quoted font names inside `style` attributes with single
+     * quotes. The DOM always serialises them as `"…"`, and back ends
+     * that HTML-decode the value before storing it then produce
+     * `style="font-family: "Open Sans", …"` — broken markup. Single quotes
+     * survive that round trip. Names that already contain an apostrophe are
+     * left alone.
+     */
+    private __singleQuotesInFontFamily;
     protected onSafeHTML(sandBox: HTMLElement): void;
     /** @override */
     protected beforeDestruct(): void;

package/esm/plugins/clean-html/clean-html.js

@@ -106,6 +106,7 @@ export class cleanHtml extends Plugin {
      * opt-in via `cleanHTML.collapseEmptyValueToEmptyString`. See #1149
      */
     onAfterGetValueFromEditor(data) {
+        this.__singleQuotesInFontFamily(data);
         if (!this.j.o.cleanHTML.collapseEmptyValueToEmptyString) {
             return;
         }
@@ -113,6 +114,32 @@ export class cleanHtml extends Plugin {
             data.value = '';
         }
     }
+    /**
+     * Rewrite double-quoted font names inside `style` attributes with single
+     * quotes. The DOM always serialises them as `"…"`, and back ends
+     * that HTML-decode the value before storing it then produce
+     * `style="font-family: "Open Sans", …"` — broken markup. Single quotes
+     * survive that round trip. Names that already contain an apostrophe are
+     * left alone.
+     */
+    __singleQuotesInFontFamily(data) {
+        if (!this.j.o.cleanHTML.singleQuotesInFontFamily ||
+            !data.value.includes('"')) {
+            return;
+        }
+        data.value = data.value.replace(/\sstyle="([^"]*)"/gi, (attribute, css) => {
+            if (!css.includes('"') || !/font-family/i.test(css)) {
+                return attribute;
+            }
+            const normalized = css.replace(
+            // `"` itself ends with `;`, so the entity has to be
+            // consumed as a unit or the declaration stops inside it.
+            /font-family\s*:(?:"|[^;])*/gi, (declaration) => declaration.includes("'")
+                ? declaration
+                : declaration.replace(/"/g, "'"));
+            return attribute.replace(css, normalized);
+        });
+    }
     onSafeHTML(sandBox) {
         const sanitizer = this.j.o.cleanHTML.sanitizer;
         if (sanitizer) {

package/esm/plugins/clean-html/config.d.ts

@@ -32,6 +32,15 @@ declare module 'jodit/config' {
              * it to `''` for form submission.
              */
             collapseEmptyValueToEmptyString: boolean;
+            /**
+             * Browsers serialise quoted font names in a `style` attribute with
+             * double quotes, which end up as `"` in the editor value
+             * (`font-family: "Open Sans", sans-serif`). Some back ends
+             * HTML-decode the value before storing it and turn that into invalid
+             * markup. With this option (default) the value getter rewrites such
+             * names with single quotes: `font-family: 'Open Sans', sans-serif`.
+             */
+            singleQuotesInFontFamily: boolean;
             /**
              * Replace old tags to new eg. <i> to <em>, <b> to <strong>
              */

package/esm/plugins/clean-html/config.js

@@ -11,6 +11,7 @@ Config.prototype.cleanHTML = {
     removeEmptyElements: true,
     fillEmptyParagraph: true,
     collapseEmptyValueToEmptyString: false,
+    singleQuotesInFontFamily: true,
     replaceNBSP: true,
     replaceOldTags: {
         i: 'em',

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.15.3",
+	"version": "4.15.5",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",

package/types/config.d.ts

@@ -1033,6 +1033,15 @@ interface Config {
          * it to `''` for form submission.
          */
         collapseEmptyValueToEmptyString: boolean;
+        /**
+         * Browsers serialise quoted font names in a `style` attribute with
+         * double quotes, which end up as `"` in the editor value
+         * (`font-family: "Open Sans", sans-serif`). Some back ends
+         * HTML-decode the value before storing it and turn that into invalid
+         * markup. With this option (default) the value getter rewrites such
+         * names with single quotes: `font-family: 'Open Sans', sans-serif`.
+         */
+        singleQuotesInFontFamily: boolean;
         /**
          * Replace old tags to new eg. <i> to <em>, <b> to <strong>
          */

package/types/modules/file-browser/data-provider.d.ts

@@ -8,6 +8,15 @@
  */
 import type { IFileBrowserAnswer, IFileBrowserDataProvider, IFileBrowserDataProviderItemsMods, IFileBrowserItem, IFileBrowserOptions, ImageBox, IPermissions, ISourcesFiles, IViewBased, Nullable } from "../../types/index";
 export declare const DEFAULT_SOURCE_NAME = "default";
+/**
+ * Validate the connector answer for the `files` / `folders` actions and
+ * normalise it. A hand-written backend that returns the wrong shape used to
+ * crash deep inside the UI with a bare `TypeError: ... reading 'forEach'`;
+ * now it fails right here with a message that names the action, the option
+ * and the missing field. Missing `files` / `folders` lists are treated as
+ * empty instead of throwing.
+ */
+export declare function assertSourcesAnswer(resp: unknown, action: 'files' | 'folders', option: 'items' | 'folder'): IFileBrowserAnswer;
 export default class DataProvider implements IFileBrowserDataProvider {
     readonly parent: IViewBased;
     readonly options: IFileBrowserOptions;

package/types/plugins/clean-html/clean-html.d.ts

@@ -42,6 +42,15 @@ export declare class cleanHtml extends Plugin {
     protected onAfterGetValueFromEditor(data: {
         value: string;
     }): void;
+    /**
+     * Rewrite double-quoted font names inside `style` attributes with single
+     * quotes. The DOM always serialises them as `"…"`, and back ends
+     * that HTML-decode the value before storing it then produce
+     * `style="font-family: "Open Sans", …"` — broken markup. Single quotes
+     * survive that round trip. Names that already contain an apostrophe are
+     * left alone.
+     */
+    private __singleQuotesInFontFamily;
     protected onSafeHTML(sandBox: HTMLElement): void;
     /** @override */
     protected beforeDestruct(): void;

package/types/plugins/clean-html/config.d.ts

@@ -32,6 +32,15 @@ declare module 'jodit/config' {
              * it to `''` for form submission.
              */
             collapseEmptyValueToEmptyString: boolean;
+            /**
+             * Browsers serialise quoted font names in a `style` attribute with
+             * double quotes, which end up as `"` in the editor value
+             * (`font-family: "Open Sans", sans-serif`). Some back ends
+             * HTML-decode the value before storing it and turn that into invalid
+             * markup. With this option (default) the value getter rewrites such
+             * names with single quotes: `font-family: 'Open Sans', sans-serif`.
+             */
+            singleQuotesInFontFamily: boolean;
             /**
              * Replace old tags to new eg. <i> to <em>, <b> to <strong>
              */