The Bug

Assume two users, A and B, are collaborating.

User A uses their Google Chrome browser to copy an image (right clicks on an image > Copy Image) and pastes it into Trix. The source of the image is a private application that only A has access to (i.e. the image path is protected by authentication).

User A can see their image is successfully rendered in Trix, and happily saves their changes.

User B logs in to contribute to the content. They fire up Trix.

The image pasted by User A cannot be displayed (since User B does not have access to the path).

Why is this a bug?

When User A pasted into Trix, the clipboard data contains both the image URL/markup + actual file.

Seehttps://input-inspector.javan.us/profiles/r1s8c7DqbOQXXjz76mj0 for an example.

So, there are two items in the clipboard, however, Trix doesn't treat the paste as a file, but rather markup. This is because of existing code that tries to work around a Microsoft Office quirk, that includes an image of the copied text when content is copied from Word etc.

The Proposed Fix

Without inspecting the content to deal with the MS Word issue (we could search forMsoNormal), we simply invoke the existing logic if there are 3 (or more) types, i.e.text/html,text/plain and a file. If there are only two types, i.e.text/html and file, we should be good (hopefully!).