Dependency Graph

Dependency Graph
related to related to child of child of duplicate of duplicate of

View Issue Details

IDProjectCategoryView StatusLast Update
0005920SOGoWeb Mailpublic2024-04-08 08:45
Reportermj_antipode Assigned Tosebastien  
PriorityurgentSeverityfeatureReproducibilityalways
Status resolvedResolutionfixed 
Product Version5.9.1 
Fixed in Version5.11.0 
Summary0005920: [EDIT] Update CKEditor version CKEditor version check warning message
Description

The CKEditor team released a new update and the integrated version (4.22.1) is being considered as insecure. This produces a red floating box with this message being pretty alarming.

Additional Information

The alinto team has already created a quick/dirty patch (THANKS) :
https://github.com/Alinto/sogo/commit/5081de1639162be9d259a3c921fb05084f879ce4

TagsNo tags attached.

Relationships

related to 0005937 resolvedsebastien The "Font Definitions" within the <style>-tag show up in content when answering/forwarding messages from Outlook 

Activities

mj_antipode

mj_antipode

2024-02-07 17:06

reporter  

qhivert

qhivert

2024-02-07 18:53

administrator   ~0017566

Last edited: 2024-02-07 18:54

Hello!
Quentin from Alinto.

We can't simply get the next ckeditor4 LTS version as it is no more free. We're looking for a solution asap.
Meanwhile, there is this dirty workaround available in next nightly to prevent ckeditor to make the request and show this message.
Or you can do it in your current version by adding this:

config.versionCheck = false;

to your ckeditor config file
in ubuntu/debian -> /usr/lib/GNUstep/SOGo/WebServerResources/js/vendor/ckeditor/config.js
in rhel -> /usr/lib64/GNUstep/SOGo/WebServerResources/js/vendor/ckeditor/config.js

You'll need to empty the data and cache of your browser to not see the message again

sebastien

sebastien

2024-02-07 21:25

administrator   ~0017570

Just to clarify, there is no known weakness for now, this is just an informative message generated by ckeditor.
When sending the mail, the string goes into stringWithoutHTMLInjection and check for common XSS.

=> We're currently looking on how to update ckeditor, because the Open Source version of ckeditor4 is not maintained.
=> The config.versionCheck will finally stay as the webmail should not call external url (unlike my comment in the code :/).

Sebastien

sebastien

sebastien

2024-02-27 13:33

administrator   ~0017603

Dear SOGo users,

CKEditor has been upgraded to version 5 in the nightly 20240228.
Commit : https://github.com/Alinto/sogo/commit/e92fb8f52d615b72a6945760aecdf95039e1cbf2

Note : The SCAYT plugin is now a premium feature in CKEditor 5, so it has been removed from SOGo.

Please update this ticket if you have some issues regarding the new CKEditor version.

Sebastien

Christian Mack

Christian Mack

2024-03-01 09:18

developer   ~0017610

Having no spell checking at all is a problem.
As an replacement for SCAYT, could you add the CKEditor option for enabling the browser spell checking?

WebServerResources/js/vendor/ckeditor/config.js:

config.disableNativeSpellChecker = false;

Browser context menu is usually reachable with <CTRL>+right mouse click in the edit area.
Perhaps this should be documeted in the "Installation and Configuration Guide"?

sebastien

sebastien

2024-03-01 13:54

administrator   ~0017615

That's a good suggestion Christian. I will add it.

In addition, comments in Gihub : https://github.com/Alinto/sogo/commit/e92fb8f52d615b72a6945760aecdf95039e1cbf2#commitcomment-139254610

nemphys

nemphys

2024-03-01 14:05

reporter   ~0017616

Since the new CKEditor version (5) seems to mess with raw HTML inserted using the <Source> button (leading to messed-up HTML signature tables and embedded images), it would be nice if the HTML Embed plugin (https://ckeditor.com/docs/ckeditor5/latest/features/html/html-embed.html) was included, which seems to allow inserting (untouched) raw HTML.

Attached is the (redacted) original signature and how it now looks in the editor after v5.

nemphys

nemphys

2024-03-01 14:09

reporter   ~0017617

The only drawback would of course be that users would now see raw html as their signature while editing messages :-)

sebastien

sebastien

2024-03-04 14:13

administrator   ~0017620

Last edited: 2024-03-04 14:13

This has been fixed in commit : https://github.com/Alinto/sogo/commit/2b23ff3eb8dac6acc570b1aaa6e0baff72dd17ea :

  • Added config.disableNativeSpellChecker = false;
  • Added htmlEmbed button - CKEditor reformat tables. I have also added the table style contextual actions

@Christian Mack : The ctrl + right click action works for me (tested on mac and windows Chrome / Firefox). Can you provide more details on this (browser, os) ?

The commit will be included in nightly 20240305

Sebastien

nemphys

nemphys

2024-03-04 14:15

reporter   ~0017622

Great!
Will test and confirm that it solves the signature issue as soon as the nightly build is available.
The only problem is that, even if it works, everybody will have to re-add their signatures using the html embed add-on, I suppose this will cause a lot of whining...

sebastien

sebastien

2024-03-04 14:51

administrator   ~0017623

@nemphys I totally agree. I have added a commit : https://github.com/Alinto/sogo/commit/b7a71140f2b3eefb494a3acc151fe556ce1d3ce4 (NB 20240305) it seems to work on my tests, but your feedback will be welcome

Sebastien

nemphys

nemphys

2024-03-05 11:08

reporter   ~0017628

I just tried with the 2024-03-05 nightly and I confirm that re-adding the HTML signature using the HTML embed plugin fixes the issue (though the signature now appears as raw HTML during message editing, which is not optimal UX-wise).
Before boing through the re-addition procedure, the old HTML signature looked a little better than before (at least all embedded images were visible), but the table layout was still messed up.

sebastien

sebastien

2024-03-05 13:44

administrator   ~0017629

Last edited: 2024-03-05 14:33

Thank you for your feedback, I have tested several signatures with no problems, can you send me your HTML signature to xxxxx ?

Sebastien

nemphys

nemphys

2024-03-05 13:54

reporter   ~0017630

Sent, please check.

sebastien

sebastien

2024-03-05 21:07

administrator   ~0017633

Hi all,

Same problem than https://github.com/ckeditor/ckeditor5/issues/8869
From what I can gather, there is no easy way to fix this.

So I have implemented the following behavior in the commit https://github.com/Alinto/sogo/commit/dd965baae110176c6144ccd64cbade3ef757966a (NB 20240306) :

  • Embbeded html block now display preview
  • Disabled centering for embbeded html blocks preview
  • When a signature contains a &lt;table> without &lt;figure class=&quot;table&quot;> (tags inserted by ckeditor), the signature is encapsulated with the &lt;div class=&quot;raw-html-embed&quot;> to avoid modifications by ckeditor

The consequence of this will be the HTML Code frame when writing a mail (check screenshot).

What is the community feedback on this ?

Sebastien

nemphys

nemphys

2024-03-05 21:10

reporter   ~0017634

Looks good in the screenshot, will confirm as soon as I get the chance to test it.
Not sure if it covers all possible cases, though, others will have to test it with their signature to see if something else breaks.

nemphys

nemphys

2024-03-06 11:51

reporter   ~0017636

I confirm that the HTML embed preview looks fine (at least with my signature).

sebastien

sebastien

2024-03-06 13:26

administrator   ~0017637

Thank you @nemphys for the feedback.
Any other is welcome

Sebastien

sebastien

sebastien

2024-03-11 10:14

administrator   ~0017650

Last edited: 2024-03-11 10:17

Sebastien

sebastien

sebastien

2024-04-08 08:45

administrator   ~0017687

Hi there,

Some changes regarding the raw-html-embed tag in commit https://github.com/Alinto/sogo/commit/98e00d09a3e31b388592e2d1068d89bc57ff1d99 (NB 20240409)

  • The box style for signature has been removed to avoid end user's confusion
  • A new domain parameter has been introduced SOGoForceRawHtmlSignature to avoid adding the raw-html-embed - this parameter is set to YES by default, but you can set it to NO if you don't want to have the signature in the box and let CKEditor managing this
  • Fix : Removed adding raw-html-embed in database when saving the signature

Sebastien

Issue History

Date Modified Username Field Change
2024-02-07 17:06 mj_antipode New Issue
2024-02-07 17:06 mj_antipode File Added: Capture d’écran du 2024-02-07 17-19-44.png
2024-02-07 18:53 qhivert Note Added: 0017566
2024-02-07 18:54 qhivert Note Edited: 0017566
2024-02-07 21:25 sebastien Note Added: 0017570
2024-02-07 21:26 sebastien Severity minor => feature
2024-02-07 21:26 sebastien Summary CKEditor version check warning message => [EDIT] Update CKEditor version CKEditor version check warning message
2024-02-07 21:27 sebastien Assigned To => sebastien
2024-02-07 21:27 sebastien Status new => assigned
2024-02-13 09:40 sebastien Priority normal => urgent
2024-02-27 13:33 sebastien Note Added: 0017603
2024-02-27 13:33 sebastien Status assigned => feedback
2024-03-01 09:18 Christian Mack Note Added: 0017610
2024-03-01 13:54 sebastien Note Added: 0017615
2024-03-01 14:05 nemphys Note Added: 0017616
2024-03-01 14:05 nemphys File Added: Screenshot-2024-03-01-at-4.01.51 PM.jpg
2024-03-01 14:05 nemphys File Added: Screenshot-2024-03-01-at-4.02.06 PM.jpg
2024-03-01 14:09 nemphys Note Added: 0017617
2024-03-04 14:13 sebastien Note Added: 0017620
2024-03-04 14:13 sebastien Note Edited: 0017620
2024-03-04 14:15 nemphys Note Added: 0017622
2024-03-04 14:51 sebastien Note Added: 0017623
2024-03-05 11:08 nemphys Note Added: 0017628
2024-03-05 13:44 sebastien Note Added: 0017629
2024-03-05 13:54 nemphys Note Added: 0017630
2024-03-05 14:33 sebastien Note Edited: 0017629
2024-03-05 21:07 sebastien Note Added: 0017633
2024-03-05 21:07 sebastien File Added: Capture d’écran 2024-03-05 à 21.59.27.png
2024-03-05 21:10 nemphys Note Added: 0017634
2024-03-06 11:51 nemphys Note Added: 0017636
2024-03-06 13:26 sebastien Note Added: 0017637
2024-03-08 07:45 sebastien Relationship added related to 0005937
2024-03-11 10:14 sebastien Note Added: 0017650
2024-03-11 10:17 sebastien Note Edited: 0017650
2024-03-13 08:48 sebastien Status feedback => resolved
2024-03-13 08:48 sebastien Resolution open => fixed
2024-03-13 08:48 sebastien Fixed in Version => 5.11.0
2024-04-08 08:45 sebastien Note Added: 0017687