diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..0d6952b4
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+# Vendored third-party library: collapse in diffs and exclude from language stats
+enferno/static/js/tinymce/** -diff linguist-vendored
diff --git a/.retireignore b/.retireignore
new file mode 100644
index 00000000..f1ba3240
--- /dev/null
+++ b/.retireignore
@@ -0,0 +1 @@
+enferno/static/js/tinymce
\ No newline at end of file
diff --git a/enferno/admin/templates/admin/actors.html b/enferno/admin/templates/admin/actors.html
index 5ed81667..50d75b80 100644
--- a/enferno/admin/templates/admin/actors.html
+++ b/enferno/admin/templates/admin/actors.html
@@ -338,7 +338,7 @@
{% endblock %} {% block js %}
diff --git a/enferno/admin/templates/admin/bulletins.html b/enferno/admin/templates/admin/bulletins.html
index fc76c6fe..290bdbcf 100644
--- a/enferno/admin/templates/admin/bulletins.html
+++ b/enferno/admin/templates/admin/bulletins.html
@@ -370,7 +370,7 @@
{% block js %}
diff --git a/enferno/admin/templates/admin/incidents.html b/enferno/admin/templates/admin/incidents.html
index 3d66f26c..b092f2ad 100644
--- a/enferno/admin/templates/admin/incidents.html
+++ b/enferno/admin/templates/admin/incidents.html
@@ -301,7 +301,7 @@
{% block js %}
diff --git a/enferno/admin/templates/admin/locations.html b/enferno/admin/templates/admin/locations.html
index c357a4f6..16f5dca4 100644
--- a/enferno/admin/templates/admin/locations.html
+++ b/enferno/admin/templates/admin/locations.html
@@ -147,7 +147,7 @@
{% endblock %} {% block js %}
diff --git a/enferno/admin/views/media.py b/enferno/admin/views/media.py
index 22c5554b..e50f69e4 100644
--- a/enferno/admin/views/media.py
+++ b/enferno/admin/views/media.py
@@ -513,9 +513,9 @@ def api_inline_medias_upload() -> Response:
filename = Media.generate_file_name(f.filename)
filepath = (Media.inline_dir / filename).as_posix()
f.save(filepath)
- response = {"location": filename}
- return HTTPResponse.success(data=response)
+ # TinyMCE requires a flat {"location": "..."} response, not wrapped in {"data": ...}
+ return jsonify({"location": filename})
except Exception as e:
logger.error(e, exc_info=True)
return HTTPResponse.error("Request Failed", status=500)
diff --git a/enferno/static/js/tinymce/CHANGELOG.md b/enferno/static/js/tinymce/CHANGELOG.md
deleted file mode 100644
index d7c9d521..00000000
--- a/enferno/static/js/tinymce/CHANGELOG.md
+++ /dev/null
@@ -1,3622 +0,0 @@
-# Changelog
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
-and is generated by [Changie](https://github.com/miniscruff/changie).
-
-## 7.3.0 - 2024-08-07
-
-### Added
-- Colorpicker number input fields now show an error tooltip and error icon when invalid text has been entered. #TINY-10799
-- New `format-code` icon. #TINY-11018
-
-### Improved
-- When a full document was loaded as editor content the head elements were added to the body. #TINY-11053
-
-### Fixed
-- Unnecessary nbsp entities were inserted when typing at the edges of inline elements. #TINY-10854
-- Fixed JavaScript error when inserting a table using the context menu by adjusting the event order in `renderInsertTableMenuItem`. #TINY-6887
-- Notifications didn't position and resize properly when resizing the editor or toggling views. #TINY-10894
-- The pattern commands would execute even if the command was not enabled. #TINY-10994
-- Split button popups were incorrectly positioned when switching to fullscreen mode if the editor was inside a scrollable container. #TINY-10973
-- Sequential html comments would in some cases generate unwanted elements. #TINY-10955
-- The listbox component had a fixed width and was not a responsive ui element. #TINY-10884
-- Prevent default mousedown on toolbar buttons was causing misplaced focus bugs. #TINY-10638
-- Attempting to use focus commands on an editor where the cursor had last been in certain contentEditable="true" elements would fail. #TINY-11085
-- Colorpicker's hex-based input field showed the wrong validation error message. #TINY-11115
-
-## 7.2.1 - 2024-07-03
-
-### Fixed
-- Text content could move unexpectedly when deleting a paragraph. #TINY-10590
-- Cursor would shift to the start of the editor body when focus was shifted to a noneditable cell of a table. #TINY-10127
-- Long translations of the bottom help text would cause minor graphical issues. #TINY-10961
-- Open Link button was disabled when selection partially covered a link or when multiple links were selected. #TINY-11009
-
-## 7.2.0 - 2024-06-19
-
-### Added
-- Added `options.debug` API that logs the initial raw editor options to console. #TINY-10605
-- Added `referrerpolicy` as a valid attribute for an iframe element. #TINY-10374
-- New `onInit` and `stretched` properties to the `HtmlPanel` dialog component. #TINY-10900
-- Added support for querying the state of the `mceTogglePlainTextPaste` command. #TINY-10938
-- Added `for` option to dialog label components to improve accessibility. The value must be another component on the same dialog. #TINY-10971
-
-### Improved
-- Dialog slider components now emit an onChange event when using arrow keys. #TINY-10428
-- Accessibility for element path buttons, added tooltip to describe the button and removed incorrect `aria-level` attribute. #TINY-10891
-- Improve merging of inserted inline elements by removing nodes with redundant inheritable styles. #TINY-10869
-- Improved Find & Replace dialog accessibility by changing placeholders to labels. #TINY-10871
-
-### Changed
-- Replaced tiny branding logo with `Build with TinyMCE` text and logo. #TINY-11001
-
-### Fixed
-- Deleting in a `div` with preceeding `br` elements would sometimes throw errors. #TINY-10840
-- `autoresize_bottom_margin` was not reliably applied in some situations. #TINY-10793
-- Fixed cases where adding a newline around a br, table or img would not move the cursor to a new line. #TINY-10384
-- Focusing on `contenteditable="true"` element when using `editable_root: false` and inline mode causing selection to be shifted. #TINY-10820
-- Corrected the `role` attribute on listbox dialog components to `combobox` when there are no nested menu items. #TINY-10807
-- HTML entities that were double decoded in `noscript` elements caused an XSS vulnerability. #TINY-11019
-- It was possible to inject XSS HTML that was not matching the regexp when using the `noneditable_regexp` option. #TINY-11022
-
-## 7.1.2 - 2024-06-05
-
-### Fixed
-- CSS color values set to `transparent` were incorrectly converted to '#000000`. #TINY-10916
-
-## 7.1.1 - 2024-05-22
-
-### Fixed
-- Insert/Edit image dialog lost focus after the image upload completed. #TINY-10885
-- Deleting into a list from a paragraph that has an `img` tag could cause extra inline styles to be added. #TINY-10892
-- Resolved an issue where emojis configured with the `emojiimages` database were not loading correctly due to a broken CDN. #TINY-10878
-- Iframes in dialogs were not rendering rounded borders correctly. #TINY-10901
-- Autocompleter possible values are no longer capped at a length of 10. #TINY-10942
-
-## 7.1.0 - 2024-05-08
-
-### Added
-- Parser support for math elements. #TINY-10809
-- New `math-equation` icon. #TINY-10804
-
-### Improved
-- Included `itemprop`, `itemscope` and `itemtype` as valid HTML5 attributes in the core schema. #TINY-9932
-- Notification accessibility improvements: added tooltips, keyboard navigation and shortcut to focus on notifications. #TINY-6925
-- Removed `aria-pressed` from the `More` button in sliding toolbar mode and replaced it with `aria-expanded`. #TINY-10795
-- The editor UI now renders correctly in Windows High Contrast Mode. #TINY-10781
-
-### Fixed
-- Backspacing in certain html setups resulted in data moving around unexpectedly. #TINY-10590
-- Dialog title markup changed to use an `h1` element instead of `div`. #TINY-10800
-- Dialog title was not announced in macOS VoiceOver, dialogs now use `aria-label` instead of `aria-labelledby` on macOS. #TINY-10808
-- Theme loader did not respect the suffix when it was loading skin CSS files. #TINY-10602
-- Custom block elements with colon characters would throw errors. #TINY-10813
-- Tab navigation in views didn't work. #TINY-10780
-- Video and audio elements could not be played on Safari. #TINY-10774
-- `ToggleToolbarDrawer` command did not toggle the toolbar in `sliding` mode when `{skipFocus: true}` parameter was passed. #TINY-10726
-- The buttons in the custom view header were clipped on when overflowing. #TINY-10741
-- In the custom view, the scrollbar of the container was not visible if its height was greater than the editor. #TINY-10741
-- Fixed accessibility issue by removing duplicate `role="menu"` attribute from color swatches. #TINY-10806
-- Fullscreen mode now prevents focus from leaving the editor. #TINY-10597
-- Open link context menu action did not work with selection surrounding a link. #TINY-10391
-- Styles were not retained when toggling a list on and off. #TINY-10837
-- Caret and placeholder text were invisible in Windows High Contrast Mode. #TINY-9811
-- Firefox did not announce the iframe title when `iframe_aria_text` was set. #TINY-10718
-- Notification width was not constrained to the width of the editor. #TINY-10886
-- Open link context menu action was not enabled for links on images. #TINY-10391
-
-## 7.0.1 - 2024-04-10
-
-### Fixed
-- Toggle list behavior generated wrong html when the `forced_root_block` option was set to `div`. #TINY-10488
-- Tapping inside a composed text on Firefox Android would not close the autocompleter. #TINY-10715
-- An inline editor toolbar now behaves correctly in horizontally scrolled containers. #TINY-10684
-- Tooltips unintended shrinking and incorrectly positioned when shown in horizontally scrollable container. #TINY-10797
-- The status bar was invisible when the editor's height is short. #TINY-10705
-
-## 7.0.0 - 2024-03-20
-
-### Added
-- New `license_key` option that must be set to `gpl` or a valid license key. #TINY-10681
-- New custom tooltip functionality, tooltip will be shown when hovering with a mouse or with keyboard focus. #TINY-9275
-- New `sandbox_iframes_exclusions` option that holds a list of URL host names to be excluded from iframe sandboxing when `sandbox_iframes` is set to `true`. #TINY-10350
-- Added 'getAllEmojis' api function to the emoticons plugin. #TINY-10572
-- Element preset support for the `valid_children` option and Schema.addValidChildren API. #TINY-9979
-- A new `trigger` property for block text pattern configurations, allowing pattern activation with either Space or Enter keys. #TINY-10324
-- onFocus callback for CustomEditor dialog component. #TINY-10596
-- icons for the import from Word, export to Word and export to PDF premium plugins. #TINY-10612
-- `data` is now a valid element in the Schema. #TINY-10611
-- More advanced schema config for custom elements. #TINY-9980
-- Custom tooltip for autocompleter, now visible on both mouse hover and keyboard focus, except single column cases. #TINY-9638
-
-### Improved
-- Included keyboard shortcut in custom tooltip for `ToolbarButton` and `ToolbarToggleButton`. #TINY-10487
-- Improved showing which element has focus for keyboard navigation. #TINY-9176
-- Custom tooltips will now show for items in `collection` which is rendered inside a dialog, on mouse hover and keyboard focus. #TINY-9637
-- Autocompleter will now work with IMEs. #TINY-10637
-- Make table ghost element better reflect height changes when resizing. #TINY-10658
-
-### Changed
-- TinyMCE is now licensed GPL Version 2 or later. #TINY-10578
-- `convert_unsafe_embeds` editor option is now defaulted to `true`. #TINY-10351
-- `sandbox_iframes` editor option is now defaulted to `true`. #TINY-10350
-- The DOMUtils.isEmpty API function has been modified to consider nodes containing only comments as empty. #TINY-10459
-- The `highlight_on_focus` option now defaults to true, adding a focus outline to every editor. #TINY-10574
-- Delay before the tooltip to show up, from 800ms to 300ms. #TINY-10475
-- Now `tox-view__pane` has `position: relative` instead of `static`. #TINY-10561
-- Update outbound link for statusbar Tiny logo #TINY-10494
-- Remove the height field from the `table` plugin cell dialog. The `table` plugin row dialog now controls the row height by setting the height on the `tr` element, not the `td` elements. #TINY-10617
-- Change table height resizing handling to remove heights from `td`/`th` elements and only apply to `tr` elements. #TINY-10589
-- Removed incorrect `aria-placeholder` attribute from editor body when `placeholder` option is set. #TINY-10452
-- The `tooltip` property for dialog's footer `togglebutton` is now optional. #TINY-10672
-- Changed the `media_url_resolver` option to use promises. #TINY-9154
-- `Styles` bespoke toolbar button fallback changed to `Formats` if `Paragraph` is not configured in `style_formats` option. #TINY-10603
-- Updated deprecation/removed console message. #TINY-10694
-
-### Removed
-- Deprecated `force_hex_color` option, with the default now being all colors are forced to hex format as lower case. #TINY-10436
-- Deprecated `remove_trailing_brs` option from DomParser. #TINY-10454
-- `title` attribute on buttons with visible label. #TINY-10453
-- `InsertOrderedList` and `InsertUnorderedList` commands from core, these now only exist in the `lists` plugin. #TINY-10644
-- `closeButton` from the notification API, close buttons in notifications are now required. #TINY-10646
-- The autocompleter `ch` configuration property has been removed. Use the `trigger` property instead. #TINY-8929
-- Deprecated `template` plugin. #TINY-10654
-
-### Fixed
-- When deleting the last row in a table, the cursor would jump to the first cell (top left), instead of moving to the next adjacent cell in some cases. #TINY-6309
-- Heading formatting would be partially applied to the content within the `summary` element when the caret was positioned between words. #TINY-10312
-- Moving focus to the outside of the editor after having clicked a menu would not fire a `blur` event as expected. #TINY-10310
-- Autocomplete would sometimes cause corrupt data when starting during text composition. #TINY-10317
-- Inline mode with persisted toolbar would show regardless of the skin being loaded, causing css issues. #TINY-10482
-- Table classes couldn't be removed via setting an empty value in `table_class_list`. Also fixed being forced to pick the first class option. #TINY-6653
-- Directly right clicking on a ol's li in FireFox didn't enable the button `List Properties...` in the context menu. #TINY-10490
-- The `link_default_target` option wasn't considered when inserting a link via `quicklink` toolbar. #TINY-10439
-- When inline editor toolbar wrapped to multiple lines the top wasn't always calculated correctly. #TINY-10580
-- Removed manually dispatching dragend event on drop in Firefox. #TINY-10389
-- Slovenian help dialog content had a dot in the wrong place. #TINY-10601
-- Pressing Backspace at the start of an empty `summary` element within a `details` element nested in a list item no longer removes the `summary` element. #TINY-10303
-- The toolbar width was miscalculated for the inline editor positioned inside a scrollable container. #TINY-10581
-- Fixed incorrect object processor for `event_root` option. #TINY-10433
-- Adding newline after using `selection.setContent` to insert a block element would throw an unhandled exception. #TINY-10560
-- Floating toolbar buttons in inline editor incorrectly wrapped into multiple rows on window resizing or zooming. #TINY-10570
-- When setting table border width and `table_style_by_css` is true, only the border attribute is set to 0 and border-width styling is no longer used. #TINY-10308
-- Clicking to the left or right of a non-editable div in Firefox would show two cursors. #TINY-10314
-
-## 6.8.3 - 2024-02-08
-
-### Changed
-- Update outbound TinyMCE website links. #TINY-10491
-
-### Fixed
-- The floating toolbar would not be fully visible when the editor was placed inside a scrollable container. #TINY-10335
-- ShadowDOM skin was not loaded properly when used with js bundling feature. #TINY-10451
-
-## 6.8.2 - 2023-12-11
-
-### Fixed
-- Bespoke select toolbar buttons including `fontfamily`, `fontsize`, `blocks`, and `styles` incorrectly used plural words in their accessible names. #TINY-10426
-- The `align` bespoke select toolbar button had an accessible name that was misleading and grammatically incorrect in certain cases. #TINY-10435
-- Accessible names of bespoke select toolbar buttons including `align`, `fontfamily`, `fontsize`, `blocks`, and `styles` were incorrectly translated. #TINY-10426 #TINY-10435
-- Clicking inside table cells with heavily nested content could cause the browser to hang. #TINY-10380
-- Toggling a list that contains an LI element having another list as its first child would remove the remaining content within that LI element. #TINY-10414
-
-## 6.8.1 - 2023-11-29
-
-### Improved
-- Colorpicker now includes the Brightness/Saturation selector and hue slider in the keyboard navigable items. #TINY-9287
-
-### Fixed
-- Translation syntax for announcement text in the table grid was incorrectly formatted. #TINY-10141
-- The functions `schema.isWrapper` and `schema.isInline` did not exclude node names that started with `#` which should not be considered as elements. #TINY-10385
-
-## 6.8.0 - 2023-11-22
-
-### Added
-- CSS files are now also generated as separate JS files to improve bundling of all resources. #TINY-10352
-- Added new `StylesheetLoader.loadRawCss` API that can be used to load CSS into a style element. #TINY-10352
-- Added new `StylesheetLoader.unloadRawCss` API that can be used to unload CSS that was loaded into a style element. #TINY-10352
-- Added `force_hex_color` editor option. Option `'always'` converts all RGB & RGBA colours to hex, `'rgb_only'` will only convert RGB and *not* RGBA colours to hex, `'off'` won't convert any colours to hex. #TINY-9819
-- Added `default_font_stack` editor option that makes it possible to define what is considered a system font stack. #TINY-10290
-- New `sandbox_iframes` option that controls whether iframe elements will be added a `sandbox=""` attribute to mitigate malicious intent. #TINY-10348
-- New `convert_unsafe_embeds` option that controls whether `