Anyone else constantly being dinged on security sc...
# cfml-generals
Sid Wing
12/21/2023, 5:01 PMAnyone else constantly being dinged on security scans because ACF has a "bugged" version of CKEditor as part of its distro? No? Just me? If you are - I raised a bug tracker entry for it - please upvote here if you are amenable!
https://tracker.adobe.com/#/view/CF-4220142
p
Patrick
12/21/2023, 5:04 PMNot an active issue for myself (not an ACF fan) but gave you a vote.
🙌 1
r
Rodney
12/21/2023, 5:17 PMFor reasons such as what you posted, it is often highly recommended not to use any CF tag or function that generates client side JavaScript or uses client side libraries.
p
Patrick
12/21/2023, 5:19 PMPS- my vote failed because the Adobe tracker app sucks
âž• 1
s
sknowlton
12/21/2023, 5:36 PMyeah that's in the camp of 'shouldn't be using anymore' - is the relevant richtext tag/attribute deprecated or is it technically still supported? I thought it was dumped
s
Sid Wing
12/21/2023, 8:45 PMThat's the point - we don't use it... But it is THERE in the /cf_scripts/scripts/ajax path - so our scanner picks it up
s
sknowlton
12/21/2023, 8:46 PMoh, you can prolly just delete it
sknowlton
12/21/2023, 8:46 PMI know ACF likes to have the folder there but I don't think it checks to make sure all of its old cruft is there every time
s
Sid Wing
12/21/2023, 8:46 PMWe did - and then it mysteriously reappeared during the flurry of update (Update10/11/12)
s
sknowlton
12/21/2023, 8:47 PMyeah you'd have to do it after every acf update
s
Sid Wing
12/21/2023, 8:47 PMJust modified IIS to block access to that URL path instead
✅ 2
Sid Wing
12/21/2023, 8:48 PMSeeing as ADobe seemingly doesn't have plans to update that any time soon