Version 3.2.3 released

This release is mostly to fix an XSS issue triggered when malicious HTML is passed to toBBCode(). The editor itself is not vulnerable and applications that do not use the toBBCode() method, or only pass trusted HTML to it, are unaffected.

Thanks to David Vieira Kurz (hisolutions.com) for reporting.

This release also fixes a potential XSS issue with the drag drop plugin if malicious HTML is passed to insert().

Full Changelog

• Fixed XSS bug with toBBCode() if passed malicious HTML.
  – Thanks to David Vieira Kurz (hisolutions.com) for reporting.
• Fixed bug with shortcuts not matching colons.
• Fixed bug with readOnly() not making source editor read only.
• Fixed XSS bug with drag drop plugin if malicious HTML passed to insert().