The ScriptLoader now supports configurable crossorigin attributes, allowing better control over script loading behavior and CORS policies. This improvement is particularly important for {productname} Cloud deployments where browsers or security software (such as Norton Antivirus) might interfere with Referer headers.
When upgrading to {productname} 8, you will need to review and possibly update how your integration handles cross-origin resource loading. {productname} 8 provides a new configuration option for controlling the `crossorigin` attribute on loaded resources.
Configure the crossorigin attribute in two ways:
**What to check:**
. If you're using {cloudname}:
+
* Ensure your script tag includes both required attributes:
. If your application loads resources (scripts or stylesheets) from different domains:
+
* Configure the new crossorigin function in your `tinymce.init`:
+
[source, javascript]
----
// Method 2: Global configuration
tinymce.init({
selector: 'textarea',
crossorigin: 'anonymous'
crossorigin: (url, resourceType) => {
// Add crossorigin="anonymous" for cross-origin resources
if (url.startsWith('https://your-cdn.com')) {
return 'anonymous';
}
// Omit crossorigin attribute for same-origin resources
return '';
}
});
----
+
. If you're using content_css from a different domain:
**Impact**: This change improves security and compatibility with various hosting configurations, particularly ensuring consistent loading behavior for both the main {productname} script and plugins when using {productname} Cloud.
* The `content_css_cors` option takes precedence for stylesheets.
* Review your content_css configuration if you use cross-origin stylesheets.
**Migration steps:**
**Migration checklist:**
* [ ] Verify script tag attributes for Cloud deployments.
* [ ] Configure crossorigin function if using cross-origin resources.
* [ ] Test resource loading in your deployment environment.
* [ ] Review content_css configuration if using cross-origin stylesheets.
* Review your script loading configurations and update as needed
* Add appropriate crossorigin attributes where required by your security policies
* For {productname} Cloud deployments, consider setting `crossorigin: 'anonymous'` to prevent potential loading issues caused by security software
For complete details on the new crossorigin function API, see: xref:tinymce-and-cors.adoc#crossorigin[crossorigin configuration option].
==== Removed Empty Files
// #TINY-11287, #TINY-12084
@ -291,10 +322,12 @@ Several empty files have been removed from the codebase to reduce clutter and im
**Impact**: These changes have no functional impact but may affect custom build processes that explicitly reference these files.
**Migration steps:**
**Migration checklist:**
* Remove any direct references to these files from your build processes
* Update any custom CSS/LESS imports that included these files
* [ ] Check build processes for references to Comments plugin CSS
* [ ] Check build processes for references to Mentions plugin LESS
* [ ] Remove any imports of these empty files
* [ ] Test Comments and Mentions plugins after removal
=== Content Handling Updates
@ -305,11 +338,12 @@ The handling of `<div>` elements during cut operations has been improved to prev
**Impact**: This change affects how div elements are handled during cut operations, particularly in complex document structures.
**Migration steps:**
**Migration checklist:**
* Test cut/paste operations in your specific use cases, especially with complex nested div structures
* Update any custom handling of div elements to align with the new behavior
* Review and update any custom cleanup functions that process div elements
* [ ] Verify content structure after cut operations
=== Service and Configuration Changes
@ -440,6 +474,15 @@ tinymce.init({
For complete details on license key manager setup and troubleshooting, see xref:license-key.adoc##setting-up-the-commercial-license-key-manager[Setting up the Commercial License Key Manager].
**License Migration checklist:**
* [ ] Contact account manager for new {productname} {release-version} license key
* [ ] Choose appropriate license type for your deployment
Karl Kemister-Sheppard
1 month ago