Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-142077

CKEditor add image don't work when apply security patch

    Details

    • Type: Feature Request
    • Status: Under Review
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 7.2.X
    • Fix Version/s: None
    • Component/s: CKEditor
    • Labels:
      None

      Description

       Step to reproduce:

      1. Download from Github latest 7.2.x branch
      2. Apply cumulative security patch ( https://github.com/community-security-team/liferay-portal/compare/7.2.1-ga2...7.2.1-cumulative.patch )
      3. Set ckeditor default at portal-ext.properties
      4.     editor.wysiwyg.default=ckeditor
            editor.wysiwyg.portal-impl.portlet.ddm.text_html.ftl=ckeditor
            editor.wysiwyg.portal-web.docroot.html.portlet.announcements.edit_entry.jsp=ckeditor
            editor.wysiwyg.portal-web.docroot.html.portlet.blogs.edit_entry.jsp=ckeditor
            editor.wysiwyg.portal-web.docroot.html.portlet.mail.edit.jsp=ckeditor
            editor.wysiwyg.portal-web.docroot.html.portlet.mail.edit_message.jsp=ckeditor
            editor.wysiwyg.portal-web.docroot.html.portlet.message_boards.edit_message.bb_code.jsp=ckeditor
            editor.wysiwyg.portal-web.docroot.html.portlet.message_boards.edit_message.html.jsp=ckeditor
            editor.wysiwyg.portal-web.docroot.html.taglib.ui.discussion.jsp=ckeditor
            editor.wysiwyg.portal-web.docroot.html.taglib.ui.email_notification_settings.jsp=ckeditor
      1. Launch portal
      2. Add a new web content with a Image
      3. Click on 'source' => you can view html code
      4. Click again on 'source'

      Note: It's possible dowload patched directly https://github.com/liferay/liferay-portal/tree/82f4ccea1523ac97c62d5b22ebd900baa5d7c321

       Expected Results:
      The image is shown and everything is ok to publish the content.

       Actual Results:
      All ckeditor buttons are disabled and you can't do anything with the web content. No publish are allowed.

       

      Notes:

      Wrong code is generated when you add the image. Something like this:

      <p><span tabindex="-1" contenteditable="false"><img data-widget="image" src="/documents/20124/0/liferay_image.png/109cf42f-e45d-8d71-7e72-31d3dc629501?t=1636025586129" /><span style="background: url(&quot;http://localhost:8080/o/frontend-editor-ckeditor-web/ckeditor/plugins/widget/images/handle.png&quot;) rgba(220, 220, 220, 0.5); top: -15px; left: 0px;"><img src="data:image/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==" width="15" title="Click and drag to move" height="15" role="presentation" draggable="true" /></span><span title="Click and drag to resize">​</span></span></p>

      <span> tag with contenteditable="false" may be the problem. In 7.3.7 GA8 don't reproduce because <span> is not generate, only <p> wrap.

       

       Reproduced on:
      Tomcat 9.0.17 + MySQL 5.7. Portal master GIT ID: 82f4ccea1523ac97c62d5b22ebd900baa5d7c321.

        Attachments

          Activity

            People

            Assignee:
            rose.becerra Rose Becerra
            Reporter:
            javieras@um.es Javier Alpañez
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated:

                Packages

                Version Package