- How do I install webard/nova-suneditor in a Laravel Nova application?
- Install it with composer require webard/nova-suneditor, then use the field class inside your Nova resource's fields method with SunEditor::make('content'). It behaves like any other Nova field, so no service provider juggling or custom build step is required. A first working field realistically takes under a day; production-grade effort is closer to three to six days once sanitization, uploads, and CSP checks are handled.
- Which Laravel, Nova, PHP, and Vue versions does webard/nova-suneditor support?
- The package is a thin Vue component that mounts SunEditor inside the Nova form lifecycle, so Laravel Nova is a hard requirement and it is inert outside a Nova admin panel. It does not ship a standalone Blade component or CDN build, so there is no path to reuse it for a public-facing editor or a Filament admin. Exact version constraints should be verified against the package's composer.json rather than assumed, since Nova major upgrades are the primary compatibility event for a field like this.
- Does webard/nova-suneditor sanitize HTML to prevent XSS?
- No. The field stores whatever HTML the editor emits, and codeView allows arbitrary pasted markup, so there is no built-in sanitization. Before this reaches any public-facing template you must add server-side sanitization, typically mews/purifier or an equivalent, on save or on resolve. Treat the sanitizer as a first-class line item, not a hardening pass.
- How do I handle image uploads with SunEditor in Laravel Nova?
- The package does not ship an upload endpoint, so if you enable the image button you own the controller, storage disk, MIME validation, and access control. Wire the upload URL through the options() pass-through so SunEditor posts to your own route. Plan for authorization checks on that route, since editor uploads are an easy place to leak files.
- Can I customize the SunEditor toolbar and editor options in Nova?
- Yes, the toolbar is configurable and options are passed through to SunEditor's configuration via the field's options() method. The tradeoff is that this pass-through is powerful but untyped, so an upstream SunEditor option rename can break your configuration silently. Pin the SunEditor version and re-check options after upgrades.
- What happens if the saved HTML is larger than the database column?
- Oversized payloads against a TEXT column cause silent truncation, which surfaces as 'saved but the content disappeared' rather than a clear error. Add a max:65535 validation rule on the field and use a TEXT or MEDIUMTEXT column so the limit fails loudly. Size the column for the largest realistic pasted content, not for typical content.
- Does SunEditor break under a strict Content Security Policy?
- It can. SunEditor injects inline styles, so a strict style-src policy will break the editor UI in production even though it works fine locally. Test the field against your production CSP headers before rollout, and adjust the policy or self-host assets accordingly.
- Is webard/nova-suneditor actively maintained and safe for production?
- It is a small, single-maintainer package with very few stars and no known dependents, so the main risk is bus factor rather than complexity. The mitigating factor is that it is MIT licensed and roughly 200 lines, making it trivial to fork and pin, which converts dependency risk into a scheduled maintenance line item. Assign an internal owner and a review trigger tied to your Nova upgrade cadence, or evaluate heavier alternatives if that ownership is not realistic.
- Is a WYSIWYG HTML field the right choice for structured or block-based content?
- No. This field stores a formatted HTML blob, which makes it a content-model decision rather than just a UI choice, and it propagates into templating, search indexing, localization, and API output. It is a poor fit if your roadmap points toward structured or JSON block composition, or Markdown-first authoring. Adopt it for quick formatted content in a Nova admin panel, and be explicit about the model tradeoff.
- How does the field render in index, detail, and read-only views?
- Raw HTML is stored in the model column, so rendering fidelity depends on how each Nova view is configured. Verify behavior across all five modes: create, edit, detail, index, and read-only. Testing these explicitly is cheap and catches the rendering surprises that otherwise show up after launch.