Problem/Motivation

When loading a node edit page with a paragraph field, which includes am editor enabled text area using the Paragraphs Classic widget, it does not seem to detect that CKEditor is being used, and fails to take the measures add the unsafe-inline CSP option.

This can be mitigated by allowing "unsafe-inline" globally for the "script-src-attr" setting. Which is not ideal.

I'm not sure what this module's policy is for supporting other modules, but Paragraphs is pretty common.

Steps to reproduce

* Install CSP.
* Install Paragraphs.
* Add a Paragraph field to a node, use the "Classic widget" and set the edit mode to closed.
* Create a node. with a paragraph that includes a CKEditor enabled text field.

Proposed resolution

Install the patch of the third comment.

Remaining tasks

...

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
#3 paragraphs-Paragraphs_with_CSP_module_break_Ckeditor_in_closed_editing_mode-3279007-3.patch3.75 KBnono95230

Issue fork paragraphs-3279007

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

Nono95230 created an issue. See original summary.

nono95230’s picture

nono95230 commented
Title: Paragraph module content with edit mode closed break CKEditor » Paragraphs with CSP module, break Ckeditor in closed editing mode
Issue summary: View changes
nono95230’s picture

nono95230 commented
Issue summary: View changes
StatusFileSize
new paragraphs-Paragraphs_with_CSP_module_break_Ckeditor_in_closed_editing_mode-3279007-3.patch3.75 KB
pminf’s picture

pminf
Primary language German
Location Nuremburg (Germany), formerly Dresden
commented

I can confirm that this is still an issue with Drupal 10.4.8 and Paragraphs 1.19.0.

pcambra made their first commit to this issue’s fork.

pcambra opened merge request !249

pcambra’s picture

pcambra
he/him
Primary language Spanish
commented
Assigned: nono95230 » Unassigned
Status: Active » Needs review

I think this is simpler than what the patch is proposing but I might be missing something of course.

yashaswi18’s picture

yashaswi18 commented

The code change looks good to me, switching from type="submit" with onClick="return false;" to type="button" is cleaner and more correct approach. Using type="button" natively prevents form submission without needing the inline onClick handler.
Keeping this as Needs review for better confirmation that this fully resolves the original CKEditor/CSP issue.