Problem/Motivation

Ckeditor has introduced a very strict validations or element filtering process where attribute like style are not allowed due to security concerns.
Because of that modules like colorbutton has lost their compatibility.

Steps to reproduce

  1. - Enable colorbutton module
  2. - Enable the colorbutton in the editor formats
  3. - Add a new content and add text and use colorbutton to highlight.
  4. - Enable and switch to CKE5 and see the results.

Expected :
- All the inline styles added by color-button should work

Actual:
- All the inline styling are gone

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

CommentFileSizeAuthor
#2 ckeditor5-allow-style-attribute.patch1.33 KBvakulrai

Comments

vakulrai created an issue. See original summary.

vakulrai’s picture

vakulrai commented
StatusFileSize
new ckeditor5-allow-style-attribute.patch1.33 KB

I am adding a patch to support the feature , i know this is not the very prominent or reliable solution but just for other projects having the some problem:

cilefen’s picture

cilefen commented
Version: 9.5.x-dev » 11.x-dev
Status: Active » Needs review

Status: Needs review » Needs work

The last submitted patch, 2: ckeditor5-allow-style-attribute.patch, failed testing. View results

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Title: Ckeditor5: Restricting the style attribute in <span> tag has restricted some modules to work as expected. » CKEditor 5: Restricting the style attribute in <span> tag has restricted some modules to work as expected.
Status: Needs work » Postponed (maintainer needs more info)
Related issues: +#3182292: <span style> didn't take effect even if it has been added to Allowed HTML tags, +#2910028: How to change span tag from style to class

If a module uses style, it will only work for text formats that do not use the filter_html filter. Even if you commit this patch, the presence of filter_html would still remove the style attribute anyway upon viewing!

This patch is not committable, it introduces a security regression.

The module maintainers are aware of this: #3182292: <span style> didn't take effect even if it has been added to Allowed HTML tags. The proper solution is #2910028: How to change span tag from style to class.

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)