The online editor on TinyMCE 8 (opt-in, next to TinyMCE 3) #

This page is for editors who want a modern rich text editor, and for administrators who decide which editor a site uses. Exponential 6.0.15 ships TinyMCE 8.9.2 as a second engine of the eZ Online Editor. TinyMCE 3.5.12 stays the default, and nothing changes for existing installations. The new engine writes the same XHTML that the ezoe input handler reads, so stored XML is identical with both engines and editors can switch back and forth. Added 2026-10-02. Reference: ezoe and TinyMCE 8.

Try it in one minute #

For yourself, without touching settings:

1. Open /user/preferences/set/ezoe_engine/tinymce8.
2. Edit any article. The editor is TinyMCE 8.
3. To go back, open /user/preferences/set/ezoe_engine/tinymce3.

Editors can also choose on the page /ezoe/engine.

For a whole siteaccess, in settings/siteaccess/<name>/ezoe.ini.append.php:

[EditorSettings]
EditorEngine=tinymce8
EngineSwitch=enabled

EngineSwitch=enabled shows the engine switch below the editor: one group named "Editor" with every available engine in the order of Engines[] (for example "TinyMCE 3 | TinyMCE 8") as toggle buttons, the engine in use pressed (aria-pressed), each other one a button. A click stores the draft with the text typed so far and switches; the choice is stored as the user preference ezoe_engine. admin4 draws the group as a segmented control at the control height; other designs show the label, the name of the engine in use and the buttons. The template is content/datatype/edit/ezxmltext_ezoe_engine_switch.tpl, its list the input handler's engine_switch_options (expOEEditor::switchOptions(); engine_switch_choices, the other engines only, stays for overrides).

What the TinyMCE 8 engine does #

Settings #

All keys are in extension/ezoe/settings/ezoe.ini, block EditorSettings. Scope: user preference, siteaccess or global. Resolution order: user preference ezoe_engine, siteaccess, global, then tinymce3.

Check the shipped values:

grep -n 'EditorEngine\|EngineSwitch\|Engines\[' extension/ezoe/settings/ezoe.ini

The registry classes are extension/ezoe/classes/expoeeditorengine.php, expoetinymce3engine.php and expoetinymce8engine.php; the engine page is the view engine of the ezoe module.

Link checks when the text is saved #

Both engines send HTML that eZOEInputParser turns into the stored XML. Each link is checked there, and what it finds goes to the validation log shown above the edit form ("The draft was only partially stored"):

The trash is looked up only for a link whose target is gone, so a link to a live target costs no query. The messages are plain text; every design prints them with |wash, once (expOEValidationMessagesEscapedOnceTest). A design of your own that overrides content/edit_validation.tpl does the same. Tests: expOEDeadLinkMessageTest, expOEInputValidFlagTest, expOELinkAddressCheckTest.

Security #

ezoe/upload refuses a file whose last extension is not in UploadFileExtensions[], and any name with an executable extension anywhere in it (shell.php.jpg), because a request can skip the dialog. An engine change is recorded in the audit trail as content.ezoe.engine.change.

Upload from a URL #

The Upload tab of the embed dialog (TinyMCE 8 and TinyMCE 3) offers "From your computer" or "From a URL". The server fetches the address and creates the object like a browser upload: same class choice (upload.ini), location, name and description fields, same embed afterwards, same permission checks and form token. The fetch is a server-side request for a user, so:

• only http and https; no credentials in the URL; the host is resolved once, every address must be public (no loopback, private, link-local, multicast, reserved, carrier-grade NAT, IPv4-mapped or NAT64 IPv6 variants) and the connection is made to the checked address, so DNS rebinding cannot swap it;
• redirects are followed by hand, at most 3, every target checked again;
• connect timeout 5 s, total timeout UploadFromUrlTimeout; the size limit is enforced while the body streams to a temporary file under var/tmp/ezoe_url/ (never held in memory) and the file is deleted after the request;
• the name comes from Content-Disposition or the URL path and is sanitized; the extension must pass UploadFileExtensions[] (whatever UploadExtensionCheck says), executable names are refused, and the content (finfo) must agree with the extension, executables and web pages are refused whatever the name;
• a successful fetch is recorded as content.ezoe.upload.url in the audit trail.

Tests #

• extension/ezoe/tests/tinymce8 holds browser tests (puppeteer-core with Firefox or Chrome, real mouse clicks) that can be run against an installation at any time.
• PHPUnit tests in tests/tests/extension/ezoe/ cover the registry, engine configuration, upload rules, JSON answers, views and the XHTML round trip. The count was 267 when written (not re-counted for this page). Run them with php vendor/bin/phpunit tests/tests/extension/ezoe/.

The bundled TinyMCE 8.9.2 is used under the GPL (version 2 or later); its README states the licences and where the corresponding source is.

Related pages #

• ezoe and TinyMCE 8 (bc guide)
• Remote services expeditor and the expservices specification
• ezoe, ezautosave
• Upgrade checklist of 1-2 October 2026
• 6.0.15 changelog
• October 2026 chronicle