Laravel Ueditor Laravel Package

Getting Started

1. Install against a compatible Laravel version. This package targets Laravel 5.x–6.x era. On modern Laravel you will likely need composer require overtrue/laravel-ueditor --ignore-platform-reqs, or better, fork it and bump the illuminate/* constraints. Confirm the resolved version in composer.lock before relying on it.
2. Publish config and assets.

   php artisan vendor:publish --provider="Overtrue\LaravelUEditor\UEditorServiceProvider"
   

   Check config/ueditor.php (upload disk, path, URL prefix, allow-lists, max sizes) and whatever public assets tag gets published. Because the repo is gone, run php artisan vendor:publish with no args and inspect the tags — do not assume names.
3. Confirm the server route. The package registers a controller route (commonly /ueditor/server) that UEditor calls with an action query param (config, uploadimage, uploadfile, uploadscrawl, listimage, catchimage, …).

   php artisan route:list | grep -i ueditor
   

4. Wire the frontend. Copy the UEditor dist (or the package's published assets) to public/vendor/ueditor, set UEDITOR_HOME_URL, then instantiate:

   var ue = UE.getEditor('content', {
     serverUrl: '/ueditor/server',
     initialFrameHeight: 400
   });
   

5. First use case: an article create/edit form. Add a <textarea name="content" id="content"> to the Blade view, point serverUrl at the package route, submit, and confirm the uploaded image lands on your configured disk and returns a usable URL.

Because the repository is unknown/unavailable, treat the config keys and view helpers as discoverable: read vendor/overtrue/laravel-ueditor/config/ueditor.php and the controller first. That file is your source of truth for what actually works.

Implementation Patterns

• One endpoint, many actions. UEditor multiplexes everything through a single route via ?action=.... Handle config separately from uploads; the config action returns a JSON blob (allow-lists, max sizes, image URLs) that the editor uses client-side. Keep server-side validation authoritative regardless of what config says.
• Per-field editors. For pages with multiple rich-text fields, instantiate one editor per textarea and reuse a shared serverUrl. Use UE.getEditor(id, { toolbars: [...] }) with a trimmed toolbar per field (e.g., short summary vs. full article body).
• Sync before submit. UEditor renders into an iframe; the underlying <textarea> is not always current. Call ue.sync() on form submit (or bind to the editor's contentchange and mirror it into the textarea) so Laravel receives the HTML.
• Blade wrapper. Instead of repeating the JS init, make a small Blade partial/component that takes $name, $value, and optional toolbar config, and emits the textarea plus the editor bootstrap. This is more reliable than depending on a package directive whose API may have drifted.
• Customizing the upload handler. If you need tenancy, per-user folders, or S3, either:
  • extend/override the package's controller and re-point the route in routes/web.php, or
  • bypass it entirely and implement the action switch yourself (it is small: uploadimage, uploadfile, uploadscrawl, listimage, catchimage). The response contract is strict — see Gotchas.
• Storage abstraction. Return a public URL from the upload action, not a disk-relative path. For local public disk this is Storage::disk('public')->url($path). For S3, ensure url() is configured; UEditor will embed whatever string you return, so a signed/expiring URL will break once it expires.
• Content persistence. Store the HTML as-is (TEXT/LONGTEXT or JSON if you keep structured content). Sanitize on render, not only on save — UEditor can produce content from pasted HTML that your save-time rules miss.
• Form integration. In a FormRequest, validate content as nullable|string and, if you want a hard guarantee, run it through HTMLPurifier before persistence. For "required" semantics, remember <p><br></p> is UEditor's empty state — normalise it.

Gotchas and Tips

• Abandoned since 2019. No PHP 8 / Laravel 9–10 support out of the box. Expect illuminate/support constraint failures. Fork-and-bump, or replace with a maintained editor (TinyMCE, Tiptap, or a maintained UEditor bridge). This is the single biggest risk for day-to-day use.
• CSRF on uploads. UEditor's XHR uploads hit your Laravel route and will 419 if the route isn't in VerifyCsrfToken::$except or the token isn't sent. Excluding the route is common but means the upload endpoint needs its own auth check.
• Strict JSON response shape. UEditor expects a flat object, e.g. success {"state":"SUCCESS","url":"...","title":"...","original":"...","size":123,"type":".png"} and failure {"state":"error message"}. Returning a Laravel JsonResponse from a validation failure with different keys silently shows "unknown error" in the UI.
• Two configs. UEditor reads a client config.json and the server action=config response. Mismatched imageMaxSize / imageAllowFiles cause confusing client-side rejections or server-side rejections with no UI feedback. Keep them in sync or return the same config from the server action.
• listimage / listfile leak directory listings. These actions enumerate uploaded files. Disable them unless you actually use the "online images" tab; they can expose other users' uploads when a shared folder is used.
• catchimage is an SSRF vector. It fetches remote URLs server-side. Restrict schemes/hosts or disable it; a naive implementation will happily hit 169.254.169.254.
• Path/URL drift. url_prefix in config, the disk's url, and the physical public path must agree. The most common bug is "image uploads fine but shows a broken preview" — that's a URL-prefix or symlink (storage:link) problem, not an upload problem.
• Config cache. After editing config/ueditor.php, run php artisan config:clear. With config:cache active the changes silently don't apply, which looks like "the package ignores my config."
• Asset paths. UEDITOR_HOME_URL must end consistently (trailing slash matters). If the editor loads but the toolbar icons are broken, the base URL is wrong; if the editor doesn't load at all, it's a 404 on ueditor.all.min.js.
• Multi-instance naming. UEditor uses global objects keyed by container id; reusing ids across partials (especially in modals or repeated form rows) results in only one editor initialising. Generate unique ids.
• XSS. Stored HTML is rendered raw. Use {!! !!} only for sanitized content, and prefer a Purifier allow-list (no <script>, no on* attributes, restricted <a href> schemes).
• Extension points are thin. There's no event system worth relying on. The practical extension points are: swap the controller via the route, override the config file, or replace the package with a small custom controller implementing the action switch — which, given the package's age, is often the cleanest long-term move.