- How do I install marshmallow/nova-tinymce in a Laravel Nova app?
- Install the field with Composer using composer require marshmallow/nova-tinymce, then publish the package config and front-end assets so Nova can load the compiled Vue component. After that you register the field in your resource form, for example TinyMCE::make('body'), and it renders a TinyMCE editor over the underlying text column. Installation is only possible in an application that already has a licensed Laravel Nova installation.
- Which Laravel and Nova versions does nova-tinymce support?
- Compatibility is governed primarily by the Nova major version rather than Laravel alone, because the package ships a compiled Vue field component built against Nova's front-end stack. Check the composer.json constraints in the repository and confirm they are satisfied by your exact Nova, Laravel, and PHP versions before committing. Nova's field assets are the most common breakage point across Nova majors, so a short spike on your real versions is worth the time.
- How do I add the TinyMCE field to a Nova resource?
- Add the field to the fields method of your Nova resource, typically as TinyMCE::make('body') or with a custom label and attribute. It behaves like a normal Nova field, so it persists to the same text or longText column that a Textarea or Trix field would use. No domain model changes are required beyond that existing column.
- Can I customize the TinyMCE editor options in nova-tinymce?
- Yes, the package is designed to let you customize the editor options, typically by publishing and editing the package configuration or by passing options through the field. You can adjust toolbars, plugins, and allowed content rules to match your editorial requirements. Restricting valid_elements and paste behavior is strongly recommended if you store and later render the HTML on a public site.
- How do image uploads work with the nova-tinymce field?
- The package exposes an image-upload endpoint and wires TinyMCE's image handling to it so editors can insert images without leaving the form. That introduces a write path you should treat seriously: validate MIME types and extensions, enforce size limits, randomize filenames, and ensure the route is authorized. You also need a plan for per-tenant or per-disk isolation and cleanup of orphaned files, since a thin wrapper is unlikely to cover every case.
- Is TinyMCE self-hosted or loaded from TinyMCE Cloud in this package?
- It depends on how the package is configured and how you publish assets; the editor can be served from published local assets or pulled from a CDN such as TinyMCE Cloud. The self-hosted community editor is permissively licensed, but Cloud features and some premium plugins require an API key and carry separate terms. Your choice also affects Content Security Policy, so confirm which delivery mode your CSP allows.
- Is the HTML saved by nova-tinymce safe from stored XSS?
- Not by default. Rich-text HTML is stored raw and re-rendered in Nova and often on the public site, so without server-side sanitization it becomes a stored-XSS vector, particularly for lower-trust admin roles. Add sanitization on save via a model mutator or observer using a library such as HTMLPurifier, and pair it with a strict TinyMCE valid_elements and paste policy.
- Does nova-tinymce work with Laravel Nova 4 or Nova 5?
- That must be verified against the package's composer constraints for the specific release you install, because the field's compiled assets are tied to Nova's front-end stack. The package has very low public adoption, so there is little downstream evidence of it surviving Nova major upgrades. Test rendering, persistence, and image upload on your exact Nova version before rolling it out broadly.
- What are alternatives to nova-tinymce for rich text editing in Nova?
- Nova ships its own Trix-based field, which is the lowest-risk option because it is first-party and maintained alongside Nova. Maintained third-party CKEditor or TinyMCE fields are also worth comparing if you need specific editor features, plugins, or upload behavior. Only choose a low-adoption package like nova-tinymce if you are prepared to own a fork when it breaks.
- Is marshmallow/nova-tinymce maintained and safe to use in production?
- Adoption is near zero, with roughly three stars and no dependent packages, which means there is effectively no public validation of upgrade paths or edge cases. A recent release date is mildly reassuring but is not evidence of a maintained roadmap. For production, pin an exact version, vendor or fork it under your own namespace if possible, add server-side sanitization and upload hardening, and name an owner responsible for keeping it working.