CKEditor unsafe-inline should be triggered by core/ckeditor

Created on 31 December 2021, over 2 years ago
Updated 5 December 2023, 7 months ago

There are currently 2 different triggers for the inclusion of unsafe-inline for CKEditor. The script-src variant is added when the core/ckeditor library is included and the style-src variant is added when the ckeditor/drupal.ckeditor library is loaded. This works fine in most cases, as the ckeditor/drupal.ckeditor library has a dependency on the core/ckeditor library, which means that both variants are loaded. However, when the core/ckeditor is loaded directly or is directly included by another library, the CKEditor will break, because it's missing the style-src unsafe-inline.

An example of this issue can be displayed by enabling the Webform β†’ module and opening the /admin/structure/webform/config page. In Webforms case this happens because it has its own html editor library implementation, which directly implements the core/ckeditor library.

πŸ› Bug report
Status

Closed: outdated

Version

1.0

Component

Code

Created by

πŸ‡³πŸ‡±Netherlands Arkener

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡¨πŸ‡¦Canada gapple

    Since Drupal 9 / CKEditor 4 are no longer supported, I'm closing this as outdated.

    Please reopen with any relevant Drupal 10 / CKE5 info if this is still an issue.

Production build 0.69.0 2024