Hello Louis, I love your posts about the CKEditor 5 with Oracle Apex... I am currently working on a migration fix from CKEditor 4 to CKEditor 5 because APEX 22.2 completely disables the use of CKEditor 4, the problem is that in CKEditor 4 it was possible to use an attribute configObject.filebrowserImageBrowseUrl in which it was possible to add your own APEX page to search images in the database, however, CKEditor 5 does not have this implementation. My idea is to modify the behavior of the uploadImage button (toolbar) through the methods without modifying the Drop Image (pasting images from clipboard)... do you have any idea how to simulate the configObject.filebrowserImageBrowseUrl functionality or how to modify only the behavior of the imageUpload button from clipboard? Sorry if I ask you these questions, literally reading your posts I could understand much better the use of the ckeditor 5 in oracle apex, thank you very much.

Hi Louis, Thank you for this amazing blog. It is very helpful.

ORDS Security

Concerning the ORDS First Party Authentication (Apex-Session), do we need to setup something on ORDS for that to work ?

I've spent a lot of time trying to make it working but for some reason ORDS always return 401 Unauthorized error. (I can see in the POST request of my browser the http header "apex-session" with the correct value but ORDS reject the request ).

I've tried using a ORDS OAUTH2 Token and it works properly.

Image Store

Concerning the image storage, I'm not a big fan of storing blob inside the database.

And I also think that there is a better approach to send the images to the storage location without using ORDS and overloading the database with blob handling.

The idea is to send the image directly from the client browser to Google Cloud Storage (or another cloud storage).

GCS provide JSON API to "Initiate a resumable upload session" which return a secure upload URL. We only need to define a PL/SQL Function to initiate an upload session on GCS using OAUTH2 to return an "upload url" to the client. That way, the GCS oauth token is not visible by the client, which is something we want to avoid to secure the bucket content.

The challenge here is to be able to dynamically set the upload url of the "CKEditor Simple upload adaptor" by executing an AJAX Call to execute that PL/SQL function when the user pick an image... + Another challenge is the successful response that the "CKEditor Simple upload adapter" is waiting for : { "url":"....." } Maybe we would have to define a "Custom upload adapter"

Best Regards

• Nicolas

Thanks Louis again for the blog post! Great job!

If I may add just 2 suggestions:

• apex.jQuery("#pFlowId").val() can be written as apex.env.APP_ID and apex.jQuery("#pInstance").val() as apex.env.APP_SESSION
• There is no need to pollute the "Execute when Page Loads" attribute. That bit can more elegantly be done directly in the item's JS Init Code:

  function(options){
    options.executeOnInitialization = editor => {
        editor.conversion.for...
    }
    return options;
  }
  

And a couple more things that you may still have to think about:

• The content probably won't only be viewed from within the editor. Chances are you'll wish to just render the HTML in a static or dynamic content region somewhere. How would you go about appending that session token then?
• You will most likely encounter the concept of "posts" as you won't only be editing the same content each time. In that case, how will you link a post to its images? That is, if a post is deleted, how will you also delete its images?
• Similarly, say a user uploads an image, but never actually submits the page. What happens to these "unsaved" images?

I still don't have an elegant solution for these problems, but they're worth thinking about.

- Stefan

      withCredentials: true,
      headers: {Authorization: 'Bearer &P10_OAUTH_TOKEN.'}

{
    "url": "example.com/ords/get_ck_image/file/10
}

select content_type, image
from ckeditor_images 
where id = :id
and image_token = :image_token