CKEditor break quotes: Why? On the forum I made a quote using the Quote module. It works fine for the administrator, but it doesn't work for the anonymous users.

The module defines a function, called via an ajax request, which filters the text before passing it to the editor, to prevent certain XSS attacks on content edits (that the JavaScript library might not handle). Because the function did not check a CSRF token for anonymous users, it was possible to perform reflected XSS against anonymous users via CSRF.

Quotes breaks the function module (line 229 in "ckeditor\includes\ckeditor.page.inc").

function ckeditor_filter_xss() {
  header('Content-Type: text/plain; charset=utf-8');
  $GLOBALS['devel_shutdown'] = FALSE;
  if (!isset(
$_POST['text']) || !is_string($_POST['text']) || !isset($_POST['input_format']) || !is_string($_POST['input_format']) || !isset($_POST['token']) || !drupal_valid_token($_POST['token'], 'ckeditorAjaxCall', false)) {
    exit;
  }


I need to fix it.

Can I delete ckeditor_filter_xss()?
If deleting any function from a contributed module works for you without giving any issues, then it's totally ok except that the next module update will override your change and you will have to delete the offending lines again. So the best course is to report this to the contributed module's developers, so they fix and commit necessary changes.

By the way, this seems to have already been reported on https://www.drupal.org/project/ckeditor/issues/2957580.