The New Territory: FCKeditor

Showing posts with label FCKeditor. Show all posts

2011/04/13

Migrating from FCKeditor is a little easier now

There are tons of site out there that are still using FCKeditor despite the fact that it has been replaced by CKEditor and no work is being done to improve it since long ago.

There are several reasons about that, and one of them is the time cost of upgrading things like the configuration and now there's a little plugin that helps avoid at least one of those problems.

In FCKeditor the definition for Templates (HTML snippets) that the user could insert into the content was available in XML files, but as CKEditor was designed so it could be used in a cross-server environment that meant that the format was changed to JSON in order to load .js files from the server instead of trying to do a XHR that it's quite complex or impossible to do on a foreign server.

But the fact is that most of the people doesn't use CKEditor in such environments and also there are lots of people that have their templates specified in XML files and migrating them to JSON isn't obvious as no tool has been published to carry out that goal. Besides that, I personally find much easier to deal with XML files for the templates instead of the JSON version.

Example of a template in JSON:

   {
    title: 'Image and Title',
    image: 'template1.gif',
    description: 'One main image with a title and text that surround the image.',
    html:
     '<h3>' +
      '<img style="margin-right: 10px" height="100" width="100" align="left"/>' +
      'Type the title here'+
     '</h3>' +
     '<p>' +
      'Type the text here' +
     '</p>'
   },

The same template in XML:

 <Template title="Image and Title" image="template1.gif">
  <Description>One main image with a title and text that surround the image.</Description>
  <Html>
   <![CDATA[
    <img style="MARGIN-RIGHT: 10px" height="100" alt="" width="100" align="left"/>
    <h3>Type the title here</h3>
    Type the text here
   ]]>
  </Html>
 </Template>

In the JSON version you have to use single quotes on each line of the "html" and remember to concatenate everything. In the XML version you just paste whatever you want inside the CDATA comment.

Ok, that's fine. You might like one version or another, but if you want to easily use the XML templates in CKEditor, then upgrade to CKEditor 3.5.3 and add the XmlTemplates plugin.

2011/01/15

Security attack from IP 92.243.90.103

I've noticed recently that the IP 92.243.90.103 is testing several servers, requesting for files related to FCKeditor and then checking for the availability of the connectors to perform operations on the server (usually I think that it's more common requests related to tinymce filemanager, but it doesn't really matter too much).

I don't think that the requests are related to an unknown problem with the server connectors in FCKeditor as it seems to search both the asp and aspx versions (maybe it acts depending on the server software), but there are a few points that everybody should remember in order to avoid problems.

As every other time that I've written about this issues, let me remember you that I'm not a security expert and these are just some basic guidelines, the basis is that you should try to create an onion around the security of your server, different layers so that an attacker has to go through all of them, and hopefully he should be stopped at the very first steps.

Keep only the needed files

Whenever you use a third party software (or even your own software), don't upload to the server everything that comes in the shipped distribution. You won't need at the server source files, samples, documentation, or integration files for other server languages.

By removing those extra files you are avoiding a larger vulnerable surface and you can focus on the important files.

Security by obscurity can be useful

Yes, security by obscurity isn't really secure, but this kind of automated attacks that just search any number of domains for some files at specific locations like "/FCKeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=File&CurrentFolder=/" can be avoided if you place this 3rd party components in a non-standard location, so something as easy as putting the FCKeditor in another subfolder can avoid that an automated attack finds your files.

It's also important that the files that the users upload to your server with scripts like the FCKeditor server upload, don't end up in a folder that gives any hint about how they have been placed there, if your files are under /scripts/CKFinder/userfiles I'll know that you are using CKFinder somewhere in your server and more important, you are stating the path for CKFinder so you are weakening a little the security that you got in the first place by using /scripts/CKFinder instead of just /CKFinder

Expose the upload script only to users that can upload files

If a user doesn't have permissions to upload anything, then he shouldn't be able to see any hint about what are you using to manage the files in your server.

Secure the upload folder

The folder where the users are able to upload files shouldn't have permissions to execute any script, so even if they are able to upload a script, it won't do anything. Using the IIS control panel or .htaccess files in Apache it's easy to perform this task.

Keep your code updated

This can be a pain, but you once you start using a script at your server, you should check from that moment any new release about that project, paying special attention to warnings about security problems in new releases. I think that every project has some kind of RSS feed, so it shouldn't really be that hard to at least notice the new versions.

Enable file management wisely

In FCKeditor and CKFinder the server connectors include a config file where you can adjust some parameters (location of uploaded files, allowed or disallowed extensions, types of files, etc...) but the most important one is the ability to state if the script is enabled or disabled.

By default the server connectors are disabled in FCKeditor and CKFinder as that's the safe default, but people the complain that when they try to use them they get a message stating that the connector is disabled. Of course, that kind of people are showing that they didn't bother to read the minimum about how to configure these scripts, so they might end up using other ones that are enabled by default and they won't ever notice that now everyone can manage the files of their servers.

The correct step is to use the login credentials of your CMS to enable the file management only for the correct users, you don't really want an anonymous user being able to upload a file to your server.

Finally: be careful

As you can see, I'm not revealing anything extraordinary, these are just some basic rules that can provide some basic protection, but there are more that you should be aware of and that's part of the task of managing a web server.

When you pick a file manager for your server, don't think only about a few buck that you can save by using a free manager instead of a paid one, check how the security is implemented in each one, if an attacker is able to get control of your server you can lose many times that money trying to getting it back to normality.

2009/12/09

Plugin localization in CKEditor (vs FCKeditor)

If you work in the web you should have already realized that there are tons of people from every where and that not all of them speak English, and even if they are able to understand it they might to work with their native tonge, so providing the ability to translate your plugins it's important if you want them to be used anywhere.

Adding the plugin

In FCKeditor the registration call of the plugin did specify the available languages:

FCKConfig.Plugins.Add( 'easyupload', 'de,en') ;

In CKEditor there's no call to add a plugin, just a list of plugins and two other lists to add extra plugins or remove existing ones (each list is just a comma separated string with the names of the plugins). So that call would be something along the lines:

config.extraPlugins = 'easyupload';

But that doesn't specify the languages available for the plugin, now instead is the plugin itself the one that specifies what are its available languages:

CKEDITOR.plugins.add( 'easyupload',
{
    // translations
    lang : ['en'],
...

The translation file

The available translations must be placed as previously under the pluginfolder/lang/languagecode.js being pluginfolder the name of your plugin and languagecode the code of the language ('en' in the above case), so we would end with a file under plugins/easyupload/lang/en.js for example.

The structure of this file is quite different from the previous one. In FCKeditor the file was a simple list of properties added to the FCKLang object:

FCKLang['EuImgDialogTitle']  = 'Insert / Edit Image' ;

Now the file is made of one (or several depending on how you have defined your data) call to the CKEDITOR.plugins.setLang method that gets as parameters the name of the plugin, the language code and an object that contains the definitions of the strings:

CKEDITOR.plugins.setLang( 'easyupload', 'en',
    {
        easyimage :
        {
            toolbar: 'Insert/Edit an image',
...
        }
    }
)

Usage

And so the way to use it now is also slightly different, the "lang" object of the current editor instance has been augmented with your definitions:

        editor.ui.addButton( 'EasyImage',
            {
                label : editor.lang.easyimage.toolbar,
                command : 'easyimage',
                icon : this.path + 'images/image.gif'
            } );

Dialogs

Now all the dialogs are created from javascript objects, there are no html parts to load so there is no need for the "fcklang" attribute and the call to FCKLanguageManager.TranslatePage(document)

2009/08/06

SWFObject plugin Update

Almost two months ago the fine folks at SWFObject did release the 2.2 version, so finally I've modified the FCKeditor plugin to make it use that version by default.

What does it means to you?

-If you don't use my plugin, not too much. Maybe you can take a look at it anyway if you are a FCKeditor user and don't like embeds.

-If you use the plugin, but are using a version of SWFObject hosted in your server, then you don't need to upgrade my plugin. Anyway, you might want to upgrade your copy of SWFObject, and if you place it with a different filename, then the upgrade of my plugin might be useful or you might end up including in the pages a link to the old library and another to the new one. Sorry, I didn't thought about it.

-If you are using the plugin and are relying on the externally hosted library, then it would be good to upgrade the plugin. The caveat is that you need to open and save again any page with a reference to the plugin to get it updated (unless your CMS has some option to do a search&replace in all the content). The good part is that even if you don't touch the existing content, the new files will use the new version.

Enjoy it

2009/08/02

Imgmap plugin update

Adam has been working on the imgmap code, and recently has released a new version to improve compatibility as well as fix some issues.

So finally I've upgraded the demo and the download link. If I ever forget again, just remember that the imgmap project is hosted at Google code.

I'll try to review these days all the mails that I have in the queue.

Edit

Now the CKEditor version of this imagemap plugin is available.

2009/06/01

Google Maps v3

Just last week Google announced the third version of the Google Maps API.

It's a full rewrite, so for the moment it can't be used to replace the current maps in most of the sites (features like polylines and polygons are missing at the moment), but it can be tested and I might start porting the current plugin for FCKeditor to use the new API.

Why should I care about it if it isn't ready?

One of the first claims that you see is the compatibility with mobile browsers, that's nice. Improved speed is also welcome. Modularization means that less code is loaded and everything will work better, but....

NO KEYS REQUIRED!!!

(Sorry for the caps)

So when the new version of the plugin is released, you'll be able to use it in any site without worrying about getting and storing those stupid keys. If you have a site that it's served under different names it will work without any extra magic. OK, one problem might remain: the static maps do still require the key, but if it isn't available the rest of the functionality should work.

Things might go like this:
A version 2.3 for use in FCKeditor 2.x with the Maps Api 3
A version 3.0 for use in CKeditor 3.x with the Maps Api 3. This one will be easy to remember :-)

Of course, that 3.0 version might take a while, the v3 maps must get back enough of the functionality from the current version so it can be used without problems, and CKEditor v3 must be released and then I have to rewrite all the code so it can work with the new CKEditor API.

As you can imagine, rewriting all the code is not a pleasant task, and due to the work with new versions some unexpected bugs might arise that needs to be fixed at the other side.

2009/02/15

GoogleMaps 1.98

This release fixes a little problem using the GoogleMaps_PublicKey setting and adds Chinese and Norwegian translation.

Of course, no new work is expected in the 1.x versions.

2009/02/01

Releases

I wanted to post something about several releases of different products, but I didn't have the time until now.

Let's start from oldest to the most recent.

CKFinder 1.3

This release fixes all the problems (at least for asp) known in previous versions, it's the work of several months trying to debug each and every report from the users.

Adding over that, it also includes some enhancements like ability to select the thumbnails themselves and remember the last selected folder.

ImageMap 2.1

I still need some time to update the demo page (and zip) in my server. This is update is just the job of Adam, and the parts related to the FCKeditor plugin are the ability to use Zoom and general bug-fixes and memory leaks. I'll try to really test it asap but I'm a little busy :-(

Internet Explorer 8 RC1

It seems that this release can be really tested, they have fixed lots of bug (included the two that I reported related to FCKeditor), improved performance, and I guess that we all really should test it to avoid finding two months after release that we didn't test it and it did include some regression that makes us suffer again. I don't expect any other releases shortly, just like IE7 I guess that we will have to wait a lot for something new, so this is the time for us to test it and check that it's really getting closer to the rest of the browsers. Let's hope that hopefully IE8 along the release of Windows 7 (I guess that it will be released much sooner than most of the people expects it) makes IE6 fade away.

FCKeditor 2.64

This is one of the last releases of the 2.x series of FCKeditor. It includes lots of bug fixes, I would had included even more little fixes but time is finite and it isn't possible to do everything that one would like to. This release isn't just bug fixes, it also includes support for table headers and a zero-configuration online spellchecker. If you are using any 2.6x version it's a no-brainer to update, your users will be pleased if they ever faced any of the bugs and you shouldn't have any problem to use it.

Let's remember also, that the 3.x versions are called CKEditor and you can start taking a look at it right now with the first beta that has been released, the online demo of the nightlies is available here. Almost everything is being rewritten, it isn't an easy task but the results so far are looking great.

2009/01/24

GoogleMaps v2.1 finished (including user docs and bug fixes)

Finally I've updated the documentation for the end user regarding the new features available in the Google Maps plugin version 2.1, but I've fixed also some little details that did appear after the initial testing period.

All the current customers of the v2 will receive shortly a mail with the new zip.

Some clarifications regarding the plugin:

If you want to use the plugin for free, then you must use the v1 code. It's free to use wherever you want, you can test it in that page and then download it and install it in your server to use with FCKeditor.

If you appreciate the work involved to make that version work, or if you want to use all the new features and want to use the v2 plugin, then you must contact me (until I setup an automatic system), the license for a single site is 15€, if you are any kind of OEM or company that want to use it for several sites, you can get a general license for 50€.

Of course, you should really test the free version before trying to use the v2, as the requirements and setup procedure are just the same. If you have the v1 working, to upgrade to the v2 you just need to replace the plugin folder and that's all, no extra job. There's no online demo or download trial of the v2 plugin, this is all javascript, so it's not worth for me trying to implement any kind of security to avoid the people that want to get everything for free.

2009/01/06

Text markers and static maps with GoogleMaps plugin

I've finished the coding of the new 2.1 version of the GoogleMaps plugin, the main highlights for this new version are:

Text markers.

You can add your text on the map, aimed at providing an always visible caption for the details that you want to remark.

The title field of normal markers now it's shown as a text besides the marker, and you can add any other text in the map using the Text tool.

This feature is based on the ELabels script provided by Mike Williams, I have simplify it a little to remove unwanted features and decrease its size.

Static images generation.

Ok, the previous version did generate a static image and then loaded the map, but this version does provide an option to not generate any script at all, and most important: it's able to edit again those images.

In the previous versions you were able to copy the image around or manually remove the script from source code, but if you tried to edit it again, it didn't recognize any of its data, so it wasn't very useful. Now it can generate the image without any scripts and then recover all the data that it's used on that image (I mean: data as text labels, areas, kml overlays... won't be recovered because they aren't used in the static maps).

This can be useful if you want to provide the option in a kind of forum where anybody can create data, but you don't want them to use any script due to obvious security reasons.

The scripts now are precompressed using YUICompressor in order to improve loading time, if you want to use the original files in order to make any adjustment or debug anything you just have to rename the files.

Now I need to update the docs and then it will be send to the current users. If you want the script and until I set up an automated system you can mail me at amla70 at gmail dot com and I'll provide you the PayPal info.

2008/12/27

Write Area 0.7.5 available as experimental download

I've uploaded the xpi with the new version of Write Area. Until it's approved you need to go to the "all versions" page in order to see it, by default the AMO it's showing only the 0.7 version even if it's incompatible with the 3.1 betas due to the previoulsy mentioned bug 469203.

At the same time I upgraded the FCKeditor core, so now it includes all the new features and fixes since the 2.6.1 SVN that I grabbed months ago. That means this list for the officially released versions and this list for the current changes in SVN since 2.6.3

I'll leave a few days and if no one reports any special problem I'll request the approval to make it the official version.

2008/12/20

The magic line

Thanks to Robert O'Callahan for providing an easy workaround, now I can start testing WriteArea in Firefox 3.1. All that was needed was a background-color:#FFF for the <html> and now it's working again :-)

Of course, using FCKeditor 2.6.1 is boring, so I've updated to the current SVN, and now some of the modifications aren't even needed anymore because the problem has been fixed directly in the FCKeditor main line. Anyway, working with SVN makes very easy the upgrade process and I had a script ready so it takes care of the packaging and removal of unnecessary files in order to re-package it as an extension for Firefox.

So very soon a new version will be ready, just some testing that nothing is too broken and I'll release it.

PD: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20081211 Minefield/3.2a1pre

2008/11/30

The GoogleMaps 2 plugin is finally ready

It has taken quite longer than I expected in order to get the new functionality ready, but there was lot of internal changes, some small ones, other big ones that required testing, adjusting, fixing bugs, then a new idea to add a little detail and all the testing was needed again.

I have already explained the main ideas behind the new version: removing some limitations, and giving more power to the user. Of course there are lots of other things that can be done with the Google Maps API, but it would requiere someone a lot of dedicated time in order to put everything in a single interface, and also make it usable by plain users (the ones that ask "the installer now says 'Next', should I press it?)

Unfortunately as this is just javascript and this version is not open source I can't provide a demo so you can test it because then it would be trivial to copy it. I don't think it's worth my time to write/use any kind of obfuscation so you'll have to judge based on the 1.97 demo and checking the new manual. (an advice to any 'smart guy': don't bother trying to guess filenames, there's no zip uploaded and if I upload the data, it will be available only under a password protection), only the install guide is available.

2008/11/26

One month later...

It's funny how sometimes the events can make it look like something is pulling the strings, but it happens that version 1.3 of the SwfObject plugin was released on 26th of September. Just one month later I released the 1.4 version that made it possible to use it with any site offering the typical <object> or <embed> code.

And now, exactly one month later another version is ready.

This one is even easier to install, now you only have to install this plugin and add the line to load it in your fckconfig.js file. The swfobject libreary will be loaded by default from the Google hosted servers. You can read about it in the SwfObject wiki: http://code.google.com/p/swfobject/wiki/hosted_library

Of course, you can keep on using your own hosted version, nothing has changed about that.

The other changes are related to people trying to paste videos. Well it turns out that even easy is not enough for some of them, and instead of trying to paste the code marked as "copy this video to embed this video" they want to paste the url of the page.

Ok, no problem, now some of those servers are automatically detected (YouTube, GoogleVideo, MetaCafe and the new MTV music). It's very easy to add new urls, but I don't wanna waste the time with it, there are too many sites around, and that people should learn to copy the correct code ;-)

Lastly a CDATA wrapper has been added to make those ones using XHTML pass validation.

The demo and download page are still the same: http://martinezdelizarrondo.com/swfobject/

2008/10/26

SWFObject, even easier to use

The new 1.4 release of the SWFObject plugin for FCKeditor does add automatic detection of typical flash embedding code:

<object width="425" height="344"> <param name="movie" value="http://www.youtube.com/v/nj2hewPBQh0&hl=es&fs=1"></param> <param name="allowFullScreen" value="true"></param> <embed src="http://www.youtube.com/v/nj2hewPBQh0&hl=es&fs=1" type="application/x-shockwave-flash" allowfullscreen="true" width="425" height="344"></embed> </object>

So pasting that line in the Url field of the flash dialog will parse it and the movie will be properly embeded in your page.

It also adds two configuration options to specify the minimum flash version for your movies and the path to the Express Install movie if you want to use it. Check the documentation of the SWFObject project to use those features.

2008/10/09

What's new for GoogleMaps v2

Some people might want to hear about this.

Lately I've been working on the new version of the Google Maps plugin, there are several parts that I've wanted to improve for a long time, and finally I've decided that it's the time to start coding it.

New loading system.

The maps won't stop the rest of the page, the google js files are loaded only after the rest of the page has been loaded or it can be delayed until the user really wants to use the map.

Static preview

While the full map isn't ready a static preview will be shown. This means also that the map will be visible for thos with javascript disabled.

Colors.

Yes, different markers should have different colors. Ditto for the lines or areas. Also width, opacity...

Areas

Ups, did I said that?, yes, multiple lines and multiple areas. Note: the static preview doesn't show the areas, it's a limitation of the static API.

Html comments

Embedding an instance of FCKeditor in a dialog used inside FCKeditor? are you crazy? maybe, but it works.

Selection of features.

Select the controls that you want to show: zoom standard/small, area overview, scrolling...

Loading KML files

That way you can import external data or create a complex map in Google Earth and display it online.

Over 60% of that is already coded, at least the most complex features, so I am optimistic that it will be ready "soon", but testing and then writing the new documentation might be a stop point, it's boring and sucks, mostly because the people doesn't read it and ask basic questions over and over again.

I guess that it sound very good, maybe too good to be true, but there is one caveat: Surely it won't be free. It will be cheap, but it will require buying a license as coding all of that means a lot of work, and you might have heard that there is some economic crisis around there. The current version will be available for free and you can use it, but if you want the advanced features you'll need to spend a little money on it.

2008/10/01

EasyUpload update and integration for Rails

You can find in the demo the download for the latest version of EasyUpload.

Meanwhile, Gastón Ramos has created a plugin for Ruby on Rails that integrates FCKeditor and the EasyUpload plugin (previous version)

2008/09/26

Updated swfobject plugin

IE, what to say about it. The browser you love to hate.

If you want the SWFObject to run in it you'll need to get the updated plugin, hopefully there are no more bad surprises hidden there.

2008/09/21

Goodbye embed, Hello SWFObject

When I first released the GoogleMaps plugin, I did mention that it included some code that could make "easy" the task to integrate things like SWFObject in FCKeditor, and it was just a matter of someone willing to code it or sponsor such development.

Recently I've been asked to carry that task for InControl Solutions, I've included also some extra code to allow editing of Flashvars and everything is available in the demo for the new swfobject plugin for FCKeditor.

What could be improved?

The ability to edit the alternative content
Using the static publishing method
Development of additional plugins for specific Flash usage based on this one (I mean, reusing most of the code)

But for the moment I don't have plans to do any of those tasks, so just check that it works for you and use it.

2008/09/20

Maps plugin with a nice preview

As I mentioned in my last entry, the recent update to the Google Maps static API menas that finally it was time to release the new version. As you can see in the version log the feature to use a preview inside the editor was added some months ago, but it only worked for hybrid maps, it was slightly confusing, so in order to avoid wasting the time replying over and over again (yes, there is people that doesn't read the docs and even ask how to install this plugin) I decided to not release it except for the people that had cooperated in its development.

There's still a difference between the final map and the preview: the static api doesn't allow to use encoded (compressed) paths, so until they fix this issue the path won't be shown. Yes, I could get the points and generate the path, but I think that it's more work that it is worth, after all this is just a preview inside the editor

Check it in the demo and upgrade your version, it's a drop in replacement.

Pages