Changelog

A cross-site scripting (XSS) vulnerability in TinyMCE alerts which allowed arbitrary JavaScript execution was found and fixed.

New expand function added to tinymce.selection which expands the selection around the nearest word.

New expand function added to tinymce.dom.RangeUtils to return a new range expanded around the nearest word.

New color_map_background and color_map_foreground options which set the base colors used in the backcolor and forecolor toolbar buttons and menu items.

Added optional storageKey property to colorinput component and colorswatch fancy menu item.

New addView function added to editor.ui.registry which makes it possible to register custom editor views.

New ToggleView command which makes it possible to hide or show registered custom views.

New color_default_foreground and color_default_background options to set the initial default color for the forecolor and backcolor toolbar buttons and menu items.

New getTransparentElements function added to tinymce.html.Schema to return a map object of transparent HTML elements.

Added ToggleToolbarDrawer event to subscribe to toolbar’s opening and closing.

Transparent elements, like anchors, can now contain block elements.

Colorswatch now displays a checkmark for selected color.

Color picker dialog now starts on the appropriate color for the cursor position.

Transparent elements, like anchors, are now allowed in the root of the editor body if they contain blocks.

Colorswatch keyboard navigation now starts on currently selected color if present in the colorswatch.

setContent is now allowed to accept any custom keys and values as a second options argument.

Parsing media content would cause a memory leak, which for example occurred when using the getContent API.

Dragging a noneditable element toward the bottom edge would cause the page to scroll up.

Range expanding capabilities would behave inconsistently depending on where the cursor was placed.

Compilation errors were thrown when using TypeScript 4.8.

Line separator scrolling in floating toolbars.

A double bottom border appeared on inline mode editor for the tinymce-5 skin.

The editor header showed up even with no menubar and toolbar configured.

Inline text pattern no longer triggers if it matches only the end but not the start.

Matches of inline text patterns that are similar are now managed correctly.

Using editor.selection.getContent({ format: 'text' }) or editor.getContent({ format: 'text' }) would sometimes deselect selected radio buttons.

The context toolbar prevented the user from placing the cursor at the edges of the editor.

The Quick Insert context toolbar provided by the quickbars plugin showed when the cursor was in a fake block caret.

The editor.selection.getRng() API was not returning a proper range on hidden editors in Firefox.

The editor.selection.getBookmark() API was not returning a proper bookmark on hidden editors in Firefox.

Dragging a noneditable element before or after another noneditable element now works correctly.

The restored selection after a redo or undo action was not scrolled into view.

A newline could not be inserted when the selection was restored from a bookmark after an inline element with a contenteditable="false" attribute.

The global tinymce.dom.styleSheetLoader was not affected by the content_css_cors option.

The caret was moved to the previous line when a text pattern executed a mceInsertContent command on Enter key when running on Firefox.

New text_patterns_lookup option to provide additional text patterns dynamically.

New promotion element has been added to the default UI. It can be disabled using the new promotion option.

New format_noneditable_selector option to specify the contenteditable="false" elements that can be wrapped in a format.

Added allow as a valid attribute for the iframe element in the editor schema.

New search field in the MenuButton that shows a search field at the top of the menu, and refetches items when the search field updates.

The formatter can now apply a format to a contenteditable="false" element by wrapping it. Configurable using the format_noneditable_selector option.

The autocompleter now supports a multiple character trigger using the new trigger configuration.

The formatter now applies some inline formats, such as color and font size, to list item elements when the entire item content is selected.

The installed and available plugin lists in the Help dialog are now sorted alphabetically.

Alignment can now be applied to more types of embedded media elements.

The @menubar-row-separator-color oxide variable no longer affects the divider between the Menubar and Toolbar. It only controls the color of the separator lines drawn in multiline Menubars.

The @toolbar-separator-color oxide variable now affects the color of the separator between the Menubar and Toolbar only.

Available Premium plugins, which are listed by name in the Help dialog, are no longer translated.

The Autolink plugin did not work when text nodes in the content were fragmented.

Fixed multiple incorrect types on public APIs found while enabling TypeScript strict mode.

The number of blank lines returned from editor.getContent({format: 'text'}) differed between browsers.

The editor focused via the auto_focus option was not scrolled into the viewport.

Adding spaces immediately after a contenteditable="false" block did not work properly in some circumstances.

Elements with only data-* custom attributes were sometimes removed when they should not be removed.

Selecting a figure with class="image" incorrectly highlighted the link toolbar button.

Specifying a single, non-default list style for the advlist_bullet_styles and advlist_number_styles options was not respected.

Fixed multiple issues that occurred when formatting contenteditable elements.

Spaces could be incorrectly added to urlinput dialog components (commonly but not exclusively presented in the Insert/Edit Link dialog) in certain cases.

The text patterns logic threw an error when there were fragmented text nodes in a paragraph.

Dragging a contentEditable=false element towards a document’s edge did not cause scrolling.

Parsing large documents no longer throws a Maximum call stack size exceeded exception.

DomParser filter matching was not checked between filters, which could lead to an exception in the parser.

contenteditable="false" lists can no longer be toggled; and contenteditable="true" list elements within these lists can no longer be indented, split into another list element, or appended to the previous list element by deletion.

Removed extra bottom padding in the context toolbar of the tinymce-5 skin.

Fixed a regression where pressing Enter added or deleted content outside the selection.

Fixed a bug where pressing Enter deleted selected contenteditable="false" <pre> elements.

The editor.insertContent() API did not respect the no_events argument.

The autocompleter configuration property, ch, has been deprecated. It will be removed in the next major release. Use the trigger property instead.

Reverted the undo level fix in the autolink plugin as it caused duplicated content in some edge cases.

Invalid special elements were not cleaned up correctly during sanitization.

An exception was thrown when deleting all content if the start or end of the document had a contenteditable="false" element.

When a sidebar was opened using the sidebar_show option, its associated toolbar button was not highlighted.

When converting a URL to a link, the autolink plugin did not fire an ExecCommand event, nor did it create an undo level.

Worked around a Firefox bug which resulted in cookies not being available inside the editor content.

<pre> content pasted into a <pre> block that had inline styles or was noneditable now merges correctly with the surrounding content.

After a codesample was pasted, the insertion point was placed incorrectly.

New sidebar_show option to show the specified sidebar on initialization.

New newline_behavior option controls what happens when the Return or Enter key is pressed or the mceInsertNewLine command is used.

New iframe_template_callback option in the Media plugin. Patch provided by Namstel.

New transparent property for iframe dialog component.

New removeAttributeFilter and removeNodeFilter functions added to the DomParser and DOM Serializer APIs.

New dispatchChange function added to the UndoManager API to fire the change with current editor status as level and current undoManager layer as lastLevel.

Clearer focus states for buttons while navigating with a keyboard.

Support annotating certain block elements directly when using the editor’s Annotation API.

The mceLink command can now take the value { dialog: true } to always open the link dialog.

All help dialog links to https://www.tiny.cloud now include rel="noopener" to avoid potential security issues.

The end_container_on_empty_block option can now take a string of blocks, allowing the exiting of a blockquote element by pressing Enter or Return twice.

The default value for end_container_on_empty_block option has been changed to 'blockquote'.

Link menu and toolbar buttons now always execute the mceLink command.

Toggling fullscreen mode when using the Fullscreen plugin now also fires the ResizeEditor event.

Getting the editor’s text content now returns newlines instead of an empty string if more than one empty paragraph exists.

Custom elements are now treated as non-empty elements by the schema.

The autocompleter’s menu HTML element is now positioned instead of the wrapper.

Choice menu items will now use the 'menuitemradio' aria role to better reflect that only a single item can be active.

Some Template plugin option values were not escaped properly when doing replacement lookups with Regular Expressions.

Copy events were not dispatched in readonly mode.

<pre> tags were not preserved when copying and pasting.

The URL detection used for autolink and smart paste did not work if a path segment contained valid characters such as ! and :.

In some cases pressing the Backspace or Delete key would incorrectly step into tables rather than remain outside.

Links opened when Alt+Enter or Option+Return was typed even when preventDefault() was called on the keydown event.

Inconsistent visual behavior between choosing Edit → Select All and typing Ctrl+A or Cmd+A when a document contained an image.

Ctrl+Shift+Home/End or Cmd+Shift+Up-arrow/Down-arrow did not expand the selection to a contenteditable="false" element if the element was at the beginning or end of a document.

Triple-clicking did not select a paragraph in Google Chrome in some circumstances.

Images were not showing as selected when selected along with other content.

Selection direction was not stored or restored when getting or setting selection bookmarks.

When text within an inline boundary element was selected and the right-arrow key was pressed, the insertion point incorrectly moved to the left.

In some versions of Safari, the editor.selection.isForward() API could throw an exception due to an invalid selection.

The selection is no longer incorrectly moved inside a comment by the editor.selection.normalize() API.

The InsertParagraph or mceInsertNewLine commands did not delete the current selection like the native command does.

The InsertLineBreak command did not replace selected content.

If selected content straddled a parent and nested list, cutting the selection did not always set the list style to 'none' on the parent list.

Delete operations could behave incorrectly if the selection contains a contenteditable="false" element located at the edge of content.

Spaces were not added correctly on some browsers when the insertion point was immediately before or after a contenteditable="false" block element.

Images that used a Data URI were corrupted when the data wasn’t base64 encoded.

uploadImages no longer triggers two change events if there is a removal of images on upload.

Preview and Insert Template dialogs now display the correct content background color when using dark skins.

Dialogs no longer exceed window height on smaller screens.

UI components, such as dialogs, would in some cases cause the Esc keyup event to incorrectly trigger inside the editor.

Fixed incorrect word breaks in menus when the menu presented with a scrollbar.

Notifications did not properly reposition when toggling fullscreen mode.

Text alignments, such as flush left and centered, could not be applied to <pre> elements.

Indenting or outdenting list items inside a block element that was inside another list item did not work.

Changing the list type of a list within another block element altered the parent element that contained that list.

Pasting columns in tables could, in some circumstances, result in an invalid table.

Copying columns in tables could sometimes result in an invalid copy.

Changing table properties with the table_style_by_css option set to false would sometimes reset the table width.

Custom elements added to otherwise blank lines were removed during serialization.

The editor’s autocompleter was not triggered at the start of nested list items.

Some function types in the TreeWalker API missed that it could return undefined.

Nuget packages for .NET and .NET Core are now configured to copy TinyMCE into /wwwroot/lib/ when TinyMCE is installed into a project.

Could not remove values when multiple cells were selected with the cell properties dialog.

Could not remove values when multiple rows were selected with the row properties dialog.

Empty lines that were formatted in a ranged selection using the format_empty_lines option were not kept in the serialized content.

The s element was missing from the default schema text inline elements.

Some text inline elements specified via the schema were not removed when empty by default.

Some media elements wouldn’t update when changing the source URL.

Inline toolbars flickered when switching between editors.

Multiple inline toolbars were shown if focused too quickly.

Added background and additional spacing for the text labeled buttons in the toolbar to improve visual clarity.

Toolbar split buttons with text used an incorrect width on touch devices.

Fixed the dev ZIP missing the required bin scripts to build from the source.

Fixed a regression whereby text patterns couldn’t be updated at runtime.

Fixed an issue where tables with colgroups could be copied incorrectly in some cases.

Naked buttons better adapt to various background colors, improved text contrast in notifications.

The autocompleter would not fire the AutocompleterStart event nor close the menu in some cases.

It wasn’t possible to select text right after an inline noneditable element.

Fixed a double border showing for the tinymce-5 skin when using toolbar_location: 'bottom'.

Clipboard content was not generated correctly when cutting and copying contenteditable="false" elements.

Fixed the box-shadow getting clipped in autocompletor popups.

The buttonType property did not work for dialog footer buttons.

Fix contrast ratio for error messages.

New editor.options API to replace the old editor.settings and editor.getParam APIs.

New editor.annotator.removeAll API to remove all annotations by name.

New Resource.unload API to make it possible to unload resources.

New FakeClipboard API on the tinymce global.

New dispatch() function to replace the now deprecated fire() function in various APIs.

New AutocompleterStart, AutocompleterUpdate and AutocompleterEnd events.

New mceAutocompleterClose, mceAutocompleterReload commands.

New mceInsertTableDialog command to open the insert table dialog.

New slider dialog component.

New imagepreview dialog component, allowing preview and zoom of any image URL.

New buttonType property on dialog button components, supporting toolbar style in addition to primary and secondary.

The tabindex attribute is now copied from the target element to the iframe.

New default theme styling for TinyMCE 6 facelift with old skin available as tinymce-5 and tinymce-5-dark.

The default height of editor has been increased from 200px to 400px to improve the usability of the editor.

The upload results returned from the editor.uploadImages() API now includes a removed flag, reflecting if the image was removed after a failed upload.

The ScriptLoader, StyleSheetLoader, AddOnManager, PluginManager and ThemeManager APIs will now return a Promise when loading resources instead of using callbacks.

A ThemeLoadError event is now fired if the theme fails to load.

The BeforeSetContent event will now include the actual serialized content when passing in an AstNode to the editor.setContent API.

Improved support for placing the caret before or after noneditable elements within the editor.

Calls to editor.selection.setRng now update the caret position bookmark used when focus is returned to the editor.

The emoticon plugin dialog, toolbar and menu item has been updated to use the more accurate Emojis term.

The dialog redial API will now only rerender the changed components instead of the whole dialog.

The dialog API setData method now uses a deep merge algorithm to support partial nested objects.

The dialog spec initialData type is now Partial<T> to match the underlying implementation details.

Notifications no longer require a timeout to disable the close button.

The editor theme is now fetched in parallel with the icons, language pack and plugins.

TinyMCE is now MIT licensed.

Moved the paste plugin’s functionality to TinyMCE core.

The paste_data_images option now defaults to true.

Moved the noneditable plugin to TinyMCE core.

Renamed the noneditable_noneditable_class option to noneditable_class.

Renamed the noneditable_editable_class option to editable_class.

Moved the textpattern plugin to TinyMCE core.

Renamed the textpattern_patterns option to text_patterns.

Moved the hr plugin’s functionality to TinyMCE core.

Moved the print plugin’s functionality to TinyMCE core.

Moved non-UI table functionality to core.

The DomParser API no longer uses a custom parser internally and instead uses the native DOMParser API.

The editor.getContent() API can provide custom content by preventing and overriding content in the BeforeGetContent event. This makes it consistent with the editor.selection.getContent() API.

The editor.setContent() API can now be prevented using the BeforeSetContent event. This makes it consistent with the editor.selection.setContent() API.

Add-ons such as plugins and themes are no longer constructed using the new operator.

A number of APIs that were not proper classes, are no longer constructed using the new operator.

The Editor commands APIs will no longer fallback to executing the browsers native command functionality.

The Editor query command APIs will now return false or an empty string on removed editors.

The mceAddEditor and mceToggleEditor commands now take an object as their value to specify the id and editor options.

The mceInsertTable command can no longer open the insert table dialog. Use the mceInsertTableDialog command instead.

The plugins option now returns a string array instead of a space separated string.

The media plugin no longer treats iframe, video, audio or object elements as "special" and will validate the contents against the schema.

The images_upload_handler option is no longer passed a success or failure callback and instead requires a Promise to be returned with the upload result.

The tinymce.settings global property is no longer set upon initialization.

The change event is no longer fired on first modification.

The GetContent event will now always pass a string for the content property.

Changed the default tag for the strikethrough format to the s tag when using a html 5 schema.

The strike tag is automatically converted to the s tag when using a html 5 schema.

Aligning a table to the left or right will now use margin styling instead of float styling.

The : control character has been changed to ~ for the schema valid_elements and extended_valid_elements options.

The primary property on dialog buttons has been deprecated. Use the new buttonType property instead.

Changed the default statusbar element path delimiter from » to ›.

Replaced the Powered by Tiny branding text with the Tiny logo.

The default minimum height of editor has been changed to 100px to prevent the UI disappearing while resizing.

RGB colors are no longer converted to hex values when parsing or serializing content.

Replaced the isDisabled() function with an isEnabled() function for various APIs.

Replaced the enable() and disable() functions with a setEnabled(state) function in various APIs.

Replaced the disabled property with an enabled property in various APIs.

Replaced the disable(name) and enable(name) functions with a setEnabled(name, state) function in the Dialog APIs.

Renamed the tinymce.Env.os.isOSX API to tinymce.Env.os.isMacOS.

Renamed the tinymce.Env.browser.isChrome API to tinymce.Env.browser.isChromium to better reflect its functionality.

Renamed the getShortEndedElements Schema API to getVoidElements.

Renamed the font_formats option to font_family_formats.

Renamed the fontselect toolbar button and fontformats menu item to fontfamily.

Renamed the fontsize_formats option to font_size_formats.

Renamed the fontsizeselect toolbar button and fontsizes menu item to fontsize.

Renamed the formatselect toolbar button and blockformats menu item to blocks.

Renamed the styleselect toolbar button and formats menu item to styles.

Renamed the lineheight_formats option to line_height_formats.

Renamed the getWhiteSpaceElements() function to getWhitespaceElements() in the Schema API.

Renamed the mceInsertClipboardContent command content property to html to better reflect what data is passed.

Renamed the default_link_target option to link_default_target for both link and autolink plugins.

Renamed the rel_list option to link_rel_list for the link plugin.

Renamed the target_list option to link_target_list for the link plugin.

The default value for the link_default_protocol option has been changed to https instead of http.

The default value for the element_format option has been changed to html.

The default value for the schema option has been changed to html5.

The default value for the table_style_by_css option has been changed to true.

The default value for the table_use_colgroups option has been changed to true.

The object returned from the editor.fire() API was incorrect if the editor had been removed.

The editor.selection.getContent() API did not respect the no_events argument.

The editor.annotator.remove API did not keep selection when removing the annotation.

The GetContent event was not fired when getting tree or text formats using the editor.selection.getContent() API.

The beforeinput and input events would sometimes not fire as expected when deleting content.

The table plugin would sometimes not correctly handle headers in the tfoot section.

The silver theme UI was incorrectly rendered before plugins had initialized.

The aria labels for the color picker dialog were not translated.

Fixed sub-menu items not read by screen readers. Patch contributed by westonkd.

Dialog labels and other text-based UI properties did not escape HTML markup.

Anchor elements would render incorrectly when using the allow_html_in_named_anchor option.

The AstNode HTML serializer did not serialize pre or textarea elements correctly when they contained newlines.

The Home or End keys would move out of a editable element contained within a noneditable element.

Dialogs could not be opened in inline mode before the editor had been rendered.

Clicking on menu items could cause an unexpected console warning if the onAction function caused the menu to close.

Fixed various color and contrast issues for the dark skins.

The dialog button component’s primary property has been deprecated and will be removed in the next major release. Use the new buttonType property instead.

The fire() function of tinymce.Editor, tinymce.dom.EventUtils, tinymce.dom.DOMUtils, tinymce.util.Observable and tinymce.util.EventDispatcher has been deprecated and will be removed in the next major release. Use the dispatch() function instead.

The content property on the SetContent event has been deprecated and will be removed in the next major release.

The return value of the editor.setContent API has been deprecated and will be removed in the next major release.

Removed support for Microsoft Internet Explorer 11.

Removed support for Microsoft Word from the opensource paste functionality.

Removed support for the plugins option allowing a mixture of a string array and of space separated strings.

Removed support for the deprecated false value for the forced_root_block option.

Removed the jQuery integration.

Removed the imagetools plugin, which is now classified as a Premium plugin.

Removed the imagetools dialog component.

Removed the toc plugin, which is now classified as a Premium plugin.

Removed the tabfocus plugin.

Removed the textpattern plugin’s API as part of moving it to core.

Removed the table plugin’s API.

Removed the callback for the EditorUpload API.

Removed the legacy browser detection properties from the Env API.

Removed the filterNode method from the DomParser API.

Removed the SaxParser API.

Removed the tinymce.utils.Promise API.

Removed the toHex function for the DOMUtils and Styles APIs.

Removed the execCommand handler function from the plugin and theme interfaces.

Removed the editor.settings property as it has been replaced by the new Options API.

Removed the shortEnded and fixed properties on tinymce.html.Node class.

Removed the mceInsertRawHTML command.

Removed the style field from the image plugin dialog advanced tab.

Removed the paste_filter_drop option as native drag and drop handling is no longer supported.

Removed the legacy mobile theme.

Removed the deprecated $, Class, DomQuery and Sizzle APIs.

Removed the deprecated Color, JSON, JSONP and JSONRequest.

Removed the deprecated XHR API.

Removed the deprecated setIconStroke Split Toolbar Button API.

Removed the deprecated editors property from EditorManager.

Removed the deprecated execCallback and setMode APIs from Editor.

Removed the deprecated addComponents and dependencies APIs from AddOnManager.

Removed the deprecated clearInterval, clearTimeout, debounce, requestAnimationFrame, setInterval, setTimeout and throttle APIs from Delay.

Removed the deprecated Schema options.

Removed the deprecated file_browser_callback_types, force_hex_style_colors and images_dataimg_filter options.

Removed the deprecated filepicker_validator_handler, force_p_newlines, gecko_spellcheck, tab_focus, table_responsive_width and toolbar_drawer options.

Removed the deprecated media_scripts option in the media plugin.

Removed the deprecated editor_deselector, editor_selector, elements, mode and types legacy TinyMCE init options.

Removed the deprecated content_editable_state and padd_empty_with_br options.

Removed the deprecated autoresize_on_init option from the autoresize plugin.

Removed the deprecated fullpage, spellchecker, bbcode, legacyoutput, colorpicker, contextmenu and textcolor plugins.

Removed the undocumented editor.editorCommands.hasCustomCommand API.

Removed the undocumented mceResetDesignMode, mceRepaint and mceBeginUndoLevel commands.