Created: Wednesday, 14 September 2022 12:44

This is a maintenance update to fix a few bugs and issues reported or discovered since the last update, including fixing some issues in Joomla 4.2 and PHP 8.1.

Joomla 4 and PHP 8

With the fixes included in this release, JCE Pro now appears to be fully compatible with Joomla 4.2 and PHP 8.1 (please continue to report version specific issues where you encounter them). With this in mind, and with PHP 7.4 and Joomla 3.10.x both due to reach end-of-life status soon, we have decided to move our development platform to Joomla 4.2 and PHP 8, with routine testing on Joomla 3.10.x and PHP 7.4 to maintain compatability in the short term.

File Browser file download

A small but perhaps useful optional feature has been added to the File Browser, with the ability to download any listed file by pressing the ALT key on the keyboard and clicking on the file name. This feature is disabled by default and can be enabled in Editor Profiles -> Plugin Parameters -> File Browser.

Created: Tuesday, 09 August 2022 14:32

This is a maintenance update to fix a few bugs and issues reported or discovered since the last update.

Users of SP PageBuilder Pro 3.8.7 who are seeing issues when creating content with JCE Pro that were not present in SP Page Builder Pro 3.8.6 should download and install SP Page Builder Pro 3.8.7 again. It appears that the bug has been fixed, but not released in a new version, but rather in a re-release of SP PageBuilder Pro 3.8.7

Created: Thursday, 14 July 2022 12:11

This is a maintenance update to fix a few issues reported the last release, including a few bugs affecting content creation in SP PageBuilder.

Note: A bug in SP PageBuilder 3.8.7 appears to affect editing and saving content in Text Addons with JCE Pro. Joomshaper appear to be aware of the issue, which is not present in SP PageBuilder 3.8.6

Created: Thursday, 23 June 2022 17:02

This update fixes an issue where changes to content were not saved if the editor was configured without the Editor, Code and Preview tabs.

Previously, JCE Pro 2.9.25 included some security related changes to the Editor Toggle options and Code Tab in JCE Core.

Toggle Editor Changes

The Toggle Editor button, located on the left above the editor toolbar and usually displayed as a "switch" or "power" icon, turns the editor off and on when clicked. When the editor is off, the textarea field is exposed, displaying the raw HTML content that is submitted when saving. In this state, this HTML content is no longer processed, validated or filtered by the editor anymore in any way when submitted, as if the editor had not been loaded at all. Any further processing of the content is usually done on the server by the Joomla Text Filter, or some other filtering mechanism used by the extension the user is creating the content in.

This highlights the importance of server-side filtering, as with the editor turned off, the potential exists for the content creator to accidentally or maliciously submit content that could create a security or reputational risk for the site. For this reason, the Toggle Editor options are now available in JCE Pro only, and the Toggle Editor switch is disabled and unavailable by default.

It should be noted however that even with content filtering and validation performed by the editor, it is still relatively easy for a malicious user to intercept and alter content while it is being submitted from the browser to the server. 

Server-side filtering, such as that performed by the Joomla Text Filter, should never be disabled or weakened for anonymous or untrusted users. Where server-side filtering affects media embedding, such as with Youtube, Viemo, Spotify, etc. which require iframes (no allowed for the Default Blacklist Text Filter setting), alternative embedding solutions provided by other extensions should be used for anonymous or untrusted users.

JCE Core Code Editor

JCE Core lacks the sophisticated, full featured Code Editor included with JCE Pro, and instead exposes the content textarea for HTML editing when the Code tab is clicked. This update adds validation and filtering to the textarea content when switching tabs, or when the content is submitted for saving.

Created: Wednesday, 22 June 2022 20:52

JCE Pro 2.9.26 has been released to fix issues loading languages, and asset files (scripts and stylesheets) when using the Compression options.

An error when accessing the Code tab in JCE Pro is also fixed.