Vulnerability in EPiServer.Forms
Hi, it seems that TinyMCE has bug related to selecting the class for image since EPi 6 R2 (continuing in EPi 7).Once we select a class (float-right, for example), when we select float-left, the class is not replaced - it's added to the exising class! So, we end up with
<img class="float-right float-left" ...
The page looks OK, as the second class rewrites the first one. However, if the editor changes his/her mind, they can't get it back to float-right, without opening the image edit modal.
This works just fine, if we delete all EditMenuTitle-s and EditMenuName-s from editor.css. Than, we have the default epi classes, but the classes for images gets toggled instead of concatenated.
Is there a workaround?
"Once we select a class (float-right, for example), when we select float-left, the class is not replaced - it's added to the exising class!": If you select first select"
- If you select float-left, then float-left again it should dissepear, than you can add float-right. You should then end up with:
<img class="float-right" ...
Works on my machine :)
According to the Tiny MCE forum this seems to be the correct behaviour for our setup:
Not sure why anybody would mark this sort of behaviour as correct, but I just wanted to note that if you don't use episerver specifics (EditMenuName, EditMenuTitle) in your css for editor, than there is no problem with double classes on elements. Only one class is added and in case you select another one - old one is replaced with new one. But then again if you don't have "EditMenuName" how would you add custom css classes?
Also, it feels very strange that in above example for image, if image has two css classes - only one is marked as selected in dropdown. Further more if you want to remove one css class from image which already has two classes, first you must remove the class that is added first. Not sure how would I explain that to average user...
Not sure if this helps you guys, just wanted to share some toughts...
I think this behaviour is logical. What if I want a class float-left and a class frame-red or something like that. Then this behaviour is nessesary.