Therefore, the investigation confidently concludes none are impacted by the Apache Log4j vulnerability. Idera has completed its review / investigation on all family of products.įor products supported in this portal, our investigation confirmed there are no exposed instances of the Apache Log4j library within the version range that contains this vulnerability. This is an update of Idera's internal review of the Log4J Issue (CVE-2021-44228). NOTE: This incident is no longer considered active, but is being maintained as Monitoring for short-term visibility. Take a look at the code example in the Custom Filebrowser article when it comes to returning values back to the editor to see a working example for this whole window.opener thingy.Security Bulletin Update - Log4J Issue (CVE-2021-44228) It is also mandatory to do things along the lines above because then your popup mechanism works the same way like all the other opening mechanisms and as such can be manipulated via a plugin like the inlinepopups plugin. The tinyMCEPopup object can make use of its getWindowArg() method to retrieve the parameters that your windowManager.open() method has transferred into the popup. Only then have you the necessary objects available which tinyMCEPopup needs to get the reference back to the 'opener' of the popup.

windowManager.open() (or your editor reference instead of 'tinyMCE.activeEditor', usually 'this' or 'ed' in many plugins' codes). It is mandatory that you open new windows by calling tinyMCE.activeEditor.

Do you use tinyMCEPopup in your popup window and have you opened this window by calling your editor's windowManager.open() method? If only one answer is 'no' then you have done something wrong.

Tinymce windowmanager full page window