Update tinymce

public/ext/tinymce-webcomponent.js

@@ -85,49 +85,6 @@
     };
     const ScriptLoader = CreateScriptLoader();
 
-    const toInt = str => parseInt(str, 10);
-    const cmp = (a, b) => {
-      const delta = a - b;
-      if (delta === 0) {
-        return 0;
-      }
-      return delta > 0 ? 1 : -1;
-    };
-    const nu = (major, minor, patch) => ({
-      major,
-      minor,
-      patch
-    });
-    const parse = versionString => {
-      const parts = /([0-9]+)\.([0-9]+)\.([0-9]+)(?:(\-.+)?)/.exec(versionString);
-      return parts ? nu(toInt(parts[1]), toInt(parts[2]), toInt(parts[3])) : nu(0, 0, 0);
-    };
-    const compare = (version1, version2) => {
-      const cmp1 = cmp(version1.major, version2.major);
-      if (cmp1 !== 0) {
-        return cmp1;
-      }
-      const cmp2 = cmp(version1.minor, version2.minor);
-      if (cmp2 !== 0) {
-        return cmp2;
-      }
-      const cmp3 = cmp(version1.patch, version2.patch);
-      if (cmp3 !== 0) {
-        return cmp3;
-      }
-      return 0;
-    };
-
-    const createSemVer = tinymce => {
-      const semver = [
-        tinymce.majorVersion,
-        tinymce.minorVersion
-      ].join('.');
-      return semver.split('.').slice(0, 3).join('.');
-    };
-    const getVersion = tinymce => parse(createSemVer(tinymce));
-    const isLessThan = (tinymce, version) => !tinymce ? false : compare(getVersion(tinymce), parse(version)) === -1;
-
     var Status;
     (function (Status) {
       Status[Status['Raw'] = 0] = 'Raw';
@@ -185,7 +142,10 @@
       promotion: parseBooleanOrString
     };
     const configRenames = {};
-    const isDisabledOptionSupported = tinymce => !isLessThan(tinymce, '7.6.0');
+    const isDisabledOptionSupported = editor => {
+      var _a;
+      return !!editor && typeof ((_a = editor.options) === null || _a === void 0 ? void 0 : _a.set) === 'function' && editor.options.isRegistered('disabled');
+    };
     class TinyMceEditor extends HTMLElement {
       static get formAssociated() {
         return true;
@@ -508,10 +468,7 @@
         return this._editor ? this._editor.options.get('disabled') : this.hasAttribute('disabled');
       }
       set disabled(value) {
-        var _a;
-        const tinymce = (_a = this._getTinymce) === null || _a === void 0 ? void 0 : _a.call(this);
-        const isVersionNewer = tinymce ? isDisabledOptionSupported(tinymce) : true;
-        if (this._editor && this._status === Status.Ready && isVersionNewer) {
+        if (this._editor && this._status === Status.Ready && isDisabledOptionSupported(this._editor)) {
           this._editor.options.set('disabled', value);
         }
         if (value && !this.hasAttribute('disabled')) {

public/ext/tinymce/CHANGELOG.md

@@ -5,6 +5,23 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
+## 7.9.3 - 2026-05-19
+
+### Security
+- Fixed media plugin `data-mce-object` injection leading to stored XSS. #TINY-14357
+- Fixed stored XSS vulnerability through `mce:protected` comments. #TINY-14353
+- Fixed stored XSS vulnerability through `data-mce-` prefixed `src`, `href`, `style` attributes. #TINY-14333
+
+## 7.9.2 - 2026-02-11
+
+### Deprecated
+- The default value of `allow_html_in_comments` will change from `true` to `false` in TinyMCE 8.x. #TINY-11900
+
+### Security
+- Updated dependencies and parsing logic for enhanced content sanitization. HTML-like content in comments and certain legacy patterns are now sanitized more strictly when `xss_sanitization` is enabled (default). The Introduced `allow_html_in_comments` option provides control over comment node sanitization behavior.
+ #TINY-11900
+- Introduced `allow_html_in_comments` option (boolean, default: `true`) to control handling of HTML-like syntax in comment nodes. This option will default to `false` in TinyMCE 8.x. #TINY-11900
+
 ## 7.9.1 - 2025-05-29
 
 ### Improved

public/ext/tinymce/composer.json

@@ -1,6 +1,6 @@
 {
 	"name": "tinymce/tinymce",
-	"version": "7.9.1",
+	"version": "7.9.3",
 	"description": "Web based JavaScript HTML WYSIWYG editor control.",
 	"license": [
 		"GPL-2.0-or-later"

public/ext/tinymce/models/dom/model.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/notices.txt

@@ -1,10 +1,10 @@
 Below is a list of third party libraries that this software uses:
 ----------------------------------------------------------------
 
-dompurify - Patched by Tiny
+dompurify
 owner: Mario Heiderich
 repo: https://github.com/cure53/DOMPurify
-version: 3.2.4
+version: 3.2.6
 license: MPL-2.0 OR Apache-2.0
 
 prismjs

public/ext/tinymce/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "tinymce",
-	"version": "7.9.1",
+	"version": "7.9.3",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/tinymce/tinymce.git",

public/ext/tinymce/plugins/accordion/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/advlist/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/anchor/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/autolink/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/autoresize/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/autosave/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/charmap/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/code/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/codesample/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/directionality/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/emoticons/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/fullscreen/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/help/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/image/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/importcss/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/insertdatetime/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/link/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/lists/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {

public/ext/tinymce/plugins/media/plugin.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.3 (2026-05-19)
  */
 
 (function () {
@@ -1294,13 +1294,75 @@
         }
     };
 
-    const parseAndSanitize = (editor, context, html) => {
+    const parseAndSanitize = (editor, html) => {
         const getEditorOption = editor.options.get;
         const sanitize = getEditorOption('xss_sanitization');
         const validate = shouldFilterHtml(editor);
-        return Parser(editor.schema, { sanitize, validate }).parse(html, { context });
+        return Parser(editor.schema, { sanitize, validate }).parse(html);
     };
 
+    const buildMediaElement = (editor, node) => {
+        var _a;
+        const realElmName = node.attr('data-mce-object');
+        const element = document.createElement(realElmName);
+        // Add width/height to everything but audio
+        if (realElmName !== 'audio') {
+            const className = node.attr('class');
+            const firstChild = node.firstChild;
+            if (className && className.indexOf('mce-preview-object') !== -1 && firstChild) {
+                const width = firstChild.attr('width');
+                const height = firstChild.attr('height');
+                if (isString(width)) {
+                    element.setAttribute('width', width);
+                }
+                if (isString(height)) {
+                    element.setAttribute('height', height);
+                }
+            }
+            else {
+                const width = node.attr('width');
+                const height = node.attr('height');
+                if (isString(width)) {
+                    element.setAttribute('width', width);
+                }
+                if (isString(height)) {
+                    element.setAttribute('height', height);
+                }
+            }
+        }
+        const style = node.attr('style');
+        if (isString(style)) {
+            element.setAttribute('style', style);
+        }
+        // Unprefix all placeholder attributes
+        const attribs = (_a = node.attributes) !== null && _a !== void 0 ? _a : [];
+        let ai = attribs.length;
+        while (ai--) {
+            const attrName = attribs[ai].name;
+            if (attrName.indexOf('data-mce-p-') === 0) {
+                element.setAttribute(attrName.substr(11), attribs[ai].value);
+            }
+        }
+        // Inject innerhtml
+        const innerHtml = node.attr('data-mce-html');
+        if (isString(innerHtml)) {
+            element.innerHTML = unescape(innerHtml);
+        }
+        else {
+            element.innerHTML = '\u00a0';
+        }
+        const fragment = parseAndSanitize(editor, element.outerHTML);
+        const newElement = fragment.getAll(realElmName)[0];
+        if (isNonNullable(newElement)) {
+            if (!isString(innerHtml)) {
+                newElement.empty();
+            }
+            return Optional.some(newElement);
+        }
+        else {
+            return Optional.none();
+        }
+    };
     const setup$1 = (editor) => {
         editor.on('PreInit', () => {
             const { schema, serializer, parser } = editor;
@@ -1324,51 +1386,14 @@
             // Converts iframe, video etc into placeholder images
             parser.addNodeFilter('iframe,video,audio,object,embed', placeHolderConverter(editor));
             // Replaces placeholder images with real elements for video, object, iframe etc
-            serializer.addAttributeFilter('data-mce-object', (nodes, name) => {
-                var _a;
+            serializer.addAttributeFilter('data-mce-object', (nodes) => {
                 let i = nodes.length;
                 while (i--) {
                     const node = nodes[i];
                     if (!node.parent) {
                         continue;
                     }
-                    const realElmName = node.attr(name);
-                    const realElm = new global$2(realElmName, 1);
-                    // Add width/height to everything but audio
-                    if (realElmName !== 'audio') {
-                        const className = node.attr('class');
-                        if (className && className.indexOf('mce-preview-object') !== -1 && node.firstChild) {
-                            realElm.attr({
-                                width: node.firstChild.attr('width'),
-                                height: node.firstChild.attr('height')
-                            });
-                        }
-                        else {
-                            realElm.attr({
-                                width: node.attr('width'),
-                                height: node.attr('height')
-                            });
-                        }
-                    }
-                    realElm.attr({
-                        style: node.attr('style')
-                    });
-                    // Unprefix all placeholder attributes
-                    const attribs = (_a = node.attributes) !== null && _a !== void 0 ? _a : [];
-                    let ai = attribs.length;
-                    while (ai--) {
-                        const attrName = attribs[ai].name;
-                        if (attrName.indexOf('data-mce-p-') === 0) {
-                            realElm.attr(attrName.substr(11), attribs[ai].value);
-                        }
-                    }
-                    // Inject innerhtml
-                    const innerHtml = node.attr('data-mce-html');
-                    if (innerHtml) {
-                        const fragment = parseAndSanitize(editor, realElmName, unescape(innerHtml));
-                        each$1(fragment.children(), (child) => realElm.append(child));
-                    }
-                    node.replace(realElm);
+                    buildMediaElement(editor, node).fold(() => node.remove(), (realElm) => node.replace(realElm));
                 }
             });
         });