Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CKEditor 4 security issues #55

Closed
KevinHamonApp opened this issue Mar 4, 2024 · 3 comments
Closed

CKEditor 4 security issues #55

KevinHamonApp opened this issue Mar 4, 2024 · 3 comments

Comments

@KevinHamonApp
Copy link

First, thanks for the work on that package. Seems amazing !

Describe the bug
After installing the package, we can observe a warning :

?: (ckeditor.W001) django-ckeditor bundles CKEditor 4.22.1 which isn't supported anmyore and which does have unfixed security issues, see for example https://ckeditor.com/cke4/release/CKEditor-4.24.0-LTS . You should consider strongly switching to a different editor (maybe CKEditor 5 respectively django-ckeditor-5 after checking whether the CKEditor 5 license terms work for you) or switch to the non-free CKEditor 4 LTS package. See https://ckeditor.com/ckeditor-4-support/ for more on this. (Note! This notice has been added by the django-ckeditor developers and we are not affiliated with CKSource and were not involved in the licensing change, so please refrain from complaining to us. Thanks.)

After some readings, we can see that ckeditor-4 reached end of life and support in June 2023.

Do you know the impacts using your package ? Do you plan some solutions to avoid security issues or this warning ?

To Reproduce
Steps to reproduce the behavior:

  1. Install the package as described in documentation
  2. Check logs

Expected behavior
A stable and secure package. Or at least an explanation in the package description of why it would be secure / insecure in the context of the app.

Additional context
Django django==5.0.3

@Salaah01
Copy link
Owner

Salaah01 commented Mar 4, 2024

Hey Kevin,
Thanks for the kind words.
Replacing ckeditor-4 with 5 might just need a bit of tweaking to the config, I don't imagine it being overly difficult.
I'll set aside some time later this evening to upgrade it.

@Salaah01
Copy link
Owner

Salaah01 commented Mar 5, 2024

Fixed by #57
Note - As django-ckeditor is no longer supported, it's been replaced by django-tinymce which has much better support.
This however meant that we had to remove support for <Python 3.8.
Let me know if this is an issue for you, and if so we can figure out a workaround.

@Salaah01
Copy link
Owner

Salaah01 commented Mar 5, 2024

Version 2 has been released.
Released as a major version as Python 3.6 and 3.7 are no longer supported.

@Salaah01 Salaah01 closed this as completed Mar 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants