Hi Team,

We recently ran security scan on our web application which using "https://kendo.cdn.telerik.com/2020.2.513" Version.

and we encountered one scenario where Cross Site script executed even though we implemented encode and decode.

Scenari: User opens editor -> Clicks Insert Link Option.

We filled URL, Text inputs and for Tooltip fields we input Cross Site Script i.e (">">">"><script>alert(document.cookie);</script>)

and we clicked INSERT.

Basically the Tooltip field will break the anchor tag title parameter and script will execute.

Though we have implemented HTML encode and Decode we still experiencing this alert popup with cookie data while encode and Save and also Decode and Show.

OR
Please let us know.

How to restrict user to input only Alphanumeric Values into the fields "Text", and "ToolTip" when user clicks "Insert Link" option on Kendo tool Editor (CK Editor).

Bug report

When an image is placed inside an <a> tag resizing the image does not work as expected

Reproduction of the problem

1. Open the Dojo example
2. Resize the image in order to decrease the size
3. Try to resize and increase the size of the image

Current behavior

The image can not be resized back to the original size (screencast). Its width can not be changed.

In case the image is set to float on the right after resizing its width becomes about 10px and is almost hidden - Dojo

Expected/desired behavior

It should be possible to resize the image by increasing/decreasing the size and keeping the width/height ratio.

Environment

• Kendo UI version: 2021.2.616
• Browser: [all ]

Bug report

When the content pasted in the Editor contains the 'MsoNormal' class the new lines are not preserved.

Reproduction of the problem

1. Open the Dojo.
2. Copy the text that is above the Editor and paste it in the Editor.

Current behavior

The text after the 'MsoNormal' class is pasted on a single line.

Expected/desired behavior

The new lines should be preserved.

Environment

• Kendo UI version: 2021.3.1109
• Browser: [all ]

Currently, when Chrome Translate is activated and the user presses 'Enter' key in the Editor, the text is translated.

Also, when Translate is enabled and the user types fast, some characters disappear, as Chrome rewrites the inner text of elements. I know that this can be controlled by adding a translate attribute.

However, I would like to have the option to control this by the built-in Editor configuration options (for example, translate: false).

Hi,

Bullets are not removed when content is deleted.

1. Create text editor on a div
2. Input some text
3. Make it bold and underline
4. Make it bulleted
5. Add few more bullets
6. Select all bullets
7. Press backspace

Observe that two bullet points remain

Hi,

We are facing an issue as follows.

1. We type some ordered or unordered list and we move cursor one left or right.

2. We do select all and backspace to delete entire list.

Issue: First index or bullet never gets deleted does not matter how many times backspace is clicked. On inspecting dom we can see list structure is retained and does not get deleted.

Please find attached video.

Thanks

Bug report

In an Editor that has a visible scrollbar, the selection event fires if you click on the scrollbar.

Reproduction of the problem

1. Open the Editor events demo - https://demos.telerik.com/kendo-ui/editor/events
2. Type some content until the scrollbar appears
3. Click on the scrollbar

Current behavior

The selection event triggers when you click the scrollbar

Expected/desired behavior

The selection event shouldn't trigger when you click the scrollbar

Environment

• Kendo UI version: 2023.2.718
• Browser: [all]

Bug report

Then you open the color/background color tools in an Inline Editor, closing the tools by clicking randomly on the page doesn't close the Editor popup.

Reproduction of the problem

1. Open this Dojo example - https://dojo.telerik.com/VMVasaJO/5
2. Open the color or the background color tool
3. Click outside of the popups or the Editor
4. You can compare the behaviour with other tools that have a popup, e.g. the formatting tool

Current behavior

The inline Editor remains open when closing the color/background tool popups

Expected behavior

The inline Editor should close when the popups and the Editor lose focus

Environment

• Kendo UI version: 2024.4.1112
• Browser: [all]

I can use the Print-Dialog (Print-Icon in the Editor)  only once.

If I try to use it again nothing happens. If I do a page reload everything works fine for one time again.

Description of the occurring behavior

the styling of links is handled inconsistently:

• When you set the cursor inside a link and then change the text-color the color is changed.
• When you select a block of text containing a link and style the entire block of text (e.g. change the color) and then you try to change the color of the link this has no effect.

The issue seems to be that in the first case a span is inserted inside the a-tag, while in the second case a span is created around the a-tag and the styling for the a-tag is then used.

Reproduction of the problem

This can be reproduced in the All Tools demo as shown in the following video.

NOTE: if only the link is selected, or the selection starts or ends with the link, then the link color is changed. The issue is reproducible only when there is selected text before and after the link.

Expected/desired behavior

The color should be applied to the link text too.

Environment

• Kendo UI version: 2025.1.227
• Browser: [All]

Bug report

Reproduction of the problem

Dojo example.

1. Click the cell with name John
2. Open the table wizard and select the Cell tab (Select All Cells is NOT checked)
3. Chang the border color of the cell and hit OK

Current behavior

The border color of all cells is changed. If you re-open the table wizard and follow the same steps only the selected cell border color is set (expected). This behavior is not reproducible with tables added through the createTable tool.

Expected/desired behavior

The border color of the selected cell is changed.

Environment

• Kendo UI version: 2020.2.513
• jQuery version: x.y
• Browser: [all]

Bug report

When uploading a file through the Editor's FileBrowser, the file's name is not updated with the name coming generated on the server. The file's name is updated in the ImageBrowser using the same server code.

Editor configuration:

$("#editor").kendoEditor({               
                fileBrowser: {
                    schema: {
                        model: {
                            id: "name",
                            fields: {
                                name: { field: "name" },
                                type: { field: "type" },
                                size: { field: "size" }
                            }
                        }
                    },
                    transport: {
                        read: "@Url.HttpRouteUrl("ActionApi", new {controller = "MessageTemplates", action = "Read"})",
                        destroy: "",
                        create: "",
                        uploadUrl: "@Url.HttpRouteUrl("ActionApi", new {action = "UploadMp3", controller = "MessageTemplates" })",
                        fileUrl: function (name) {
                            var url = "/files/" + name + "/";
                            return url;
                        }
                    },

                    fileTypes: "*.mp3, *.pdf"
                },
                tools: ['insertImage', 'insertFile']
});

Controller:

[HttpPost]
        [ActionName("Read")]
        public object Read()
        {
            try
            {
                string path = HttpContext.Current.Request.Params["path"];

                var fullPath = System.Web.Hosting.HostingEnvironment.MapPath(@"~/Files/" + path);

                DirectoryInfo dir = new DirectoryInfo(fullPath);
                var result = dir.GetFiles("*.*").Select(f => new
                {
                    name = f.Name,
                    type = "f",
                    size = (long)0,
                }).ToList();

                return result;
            }
            catch (Exception e)
            {
                return null;
                //throw new HttpException(404, "File Not Found");
            }
        }

        [HttpPost]
        [ActionName("UploadMp3")]
        public HttpResponseMessage UploadMp3()
        {
            var file = HttpContext.Current.Request.Files[0];
            try
            {
                return Request.CreateResponse(HttpStatusCode.Created, new
                {
                    size = file.ContentLength,
                    name = Guid.NewGuid().ToString(),
                    type = "f"
                });
            }
            catch (Exception e)
            {
                return new HttpResponseMessage(HttpStatusCode.BadRequest);
            }
        }

Reproduction of the problem

1. Open the Editor's FileBrowser.
2. Upload a file.

Current behavior

The file name is not updated whereas it is being updated in the ImageBrowser.

Expected/desired behavior

The file name should be updated as in the ImageBrowser.

Environment

• Kendo UI version: 2021.1.119
• Browser: [all]
  editorimagevsfileuploadzip.zip

Bug report

When there are bookmarks in a Word file and the text from the Word is pasted in Editor the indention of the text and space of the alignment is changed.

Reproduction of the problem

1. Open the Dojo
2. Copy the list from the attached file and paste it in the Editor:

TestFile1.docx

Current behavior

The indention of the list is changed.

Expected/desired behavior

The pasted list should look like in the Word document

Environment

• Kendo UI version: 2020.3.1118
• jQuery version: x.y
• Browser: [all ]

Bug report

Reproduction of the problem

Dojo example.

1. In the Editor's content click the line above the "Climate" word
2. Press and hold down Space key, while holding it down click the left mouse button and hold it down as well, then hover the table and move the mouse cursor over it.

For more details see Ticket ID: 1478828

Current behavior

A js exception is thrown:
kendo.all.js:78925 Uncaught DOMException: Failed to execute 'setStart' on 'Range': There is no child at offset 3.

Expected/desired behavior

No exceptions.

Environment

• Kendo UI version: 2020.2.617
• jQuery version: x.y
• Browser: [ Chrome XX ]

Bug report

The last row of a table in the Editor cannot be resized.

Reproduction of the problem

1. Open this demo - https://demos.telerik.com/kendo-ui/editor/table-editing.
2. Try resizing the last row.

Current behavior

The upper row will be resized instead.

Expected/desired behavior

The last row should be resized.

Environment

• Kendo UI version: 2020.2.617
• Browser: [all]

Bug report

When text is hihlighet in Rwad-Only Editor and the user tries to paste a text, the highlighted text dissapears.

Reproduction of the problem

1. Open the Dojo
2. Copy some text
3. Highlight part of the text in the Editor and try to paste using Ctrl + V

Current behavior

Currently, the highlighted text dissapers

Expected/desired behavior

The highlighted text should not dissapear and the content of the Editor should remain unchanged.

Workaround

kendo.ui.editor.Clipboard.fn.onpaste = function(){
        if (this.editor.body.contentEditable === "false" || this.editor.body.contentEditable === "inherit" ) {
          return;
        }
      }

Dojo

Environment

• Kendo UI version: 2022.1.412
• Browser: [all ]

### Bug report

A non-breaking space is added at the beginning of each new row when typing in the Editor.  As a result, the method "getRange" returns a wrong "startOffset" index.

### Reproduction of the problem

    1. Subscribe to the "select" event of the Editor;

    2. Log the property "startOffset" of the "getRange" method in the browser console;

    3. Click on any line in the empty Editor and check the logged index. It is "1" instead of "0".

    4. Type in any text in the Editor and click at the beginning of the text - the logged index is "1" instead of "0".

A Dojo sample for reproduction: https://dojo.telerik.com/UqUNoBaM/8

### Expected/desired behavior

The non-breaking space should be removed when typing.

### Environment

* **Kendo UI version:** 2021.2.616
* **jQuery version:** 1.12.4
* **Browser:** [all]

Bug report

If you select a text in the Editor, the ForeColor value is not updated to match the color of the selected text.

Reproduction of the problem

1. Open this Dojo example - https://dojo.telerik.com/IHAGOfom/6
2. Select the first line
3. Select a color from the tool
4. Select the second line

Current behavior

The value of the ForeColor tool is not updated to match the second line

Expected/desired behavior

The ForeColor value should change based on the selected text

Environment

• Kendo UI version: 2022.3.913
• Browser: [all]

Bug report

Reproduction of the problem

When the Editor is rendered in a long page with a scroller and the user paste a content replacing the entire content, the entire page scrolls, not only the Editor content.

1. Open the Dojo - https://dojo.telerik.com/wKDfkpEW
2. Copy long content for example from above the Editor
3. Mark the entire content in the Editor and paste the previously copied content

Current behavior

The entire page scrolls and in some cases the Editor is not visible.

screencast - https://go.screenpal.com/watch/cOQTlxnxqVk

Expected/desired behavior

Pasting in the Editor should not affect the page scroller.

Environment

• Kendo/Telerik version: 2026.3.811
• Browser: [all ]

When trying to navigate the toolbar of the editor with a keyboard, the focus is stuck/not working for color pickers.

When using Tab(or RightArrow) from the left the focus is stuck on the first colorpicker.

When using Shift+Tab(or LeftArrow) from the right the focus is stuck on the last tool before the colorpicker.

See DOJO: https://dojo.telerik.com/aKOKOwiP