Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 299143

HTML included in CKEditor title attribute with field label

$
0
0

On a required field with CKEditor, the title attribute of iframe.cke_wysiwyg_frame can contain HTML code, for example:

title='Rich Text Editor, My Label<span aria-hidden="true" class="hidden"> (required)</span> field'

This appear to be caused by this part of ckeditor.es6.js, which sets the title attribute to the label without filtering out the markup:

      // Set a title on the CKEditor instance that includes the text field's
      // label so that screen readers say something that is understandable
      // for end users.
      const label = $(`label[for=${element.getAttribute('id')}]`).html();
      format.editorSettings.title = Drupal.t('Rich Text Editor, !label field', {
        '!label': label,
      });

This problem appears to have been introduced in #2292035: CKEditor uses the automatically generated ID attribute for the body field in the ARIA label.


Viewing all articles
Browse latest Browse all 299143

Latest Images

Trending Articles



Latest Images

<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>