v2023 here, in the process of upgrading but that’s a massive job, so for now i need to fix this vulnerability.
My site for some reason has Tinymce in the 3 following locations:
/vendor/tinymce/tinymce
/tinymce
/node_modules/tinymce
I remember once adding the node_module to try to update way back, but even without that one I’m confused why PHPMaker has to make multiple tinymce folders. What’s the story there?
But most importantly, is it possible to manually install v7? do the hooks remain unchanged? can i do a drop-in replacement somehow?
PHPMaker uses Composer package of TinyMCE, not npm package, your /node_modules/tinymce is not installed by PHPMaker. After downloading the Composer package, PHPMaker will copy the required files from the "vendor" folder to the "tinymce" folder. (The "vendor" folder is internal PHP code that can change on updates, may expose sensitive files, and is not meant to be publicly served or optimized for browsers.)
To update to TinyMCE 6/7/8 (note that only v6 is available under free license), you can update the composer.json, run composer update and then copy the corresponding folders and files to the "tinymce" folder yourself.
In fact, you can use the latest version of v6 (i.e. v6.8.6) and add the following settings to your TinyMCE config: