Ticket #3591: 3591_6.patch

_source/tests/plugins/htmldataprocessor/htmldataprocessor.html

@@ -242 +242 @@
                         assert.areSame( html , dataProcessor.toDataFormat( protectedHtml ) );
                 },
 
+                test_ticket_3591 : function()
+                {
+                        var editor = CKEDITOR.instances.editor1,
+                                dataProcessor = editor.dataProcessor;
+
+                        dataProcessor.writer = new CKEDITOR.htmlParser.basicWriter();
+                        var html = getTextAreaValue( '_TEXTAREA_3591' );
+                        var protectedHtml = dataProcessor.toHtml( html );
+
+                        assert.areSame( getTextAreaValue( '_TEXTAREA_3591_protected' ),
+                                protectedHtml );
+                        assert.areSame( getTextAreaValue( '_TEXTAREA_3591' ),
+                                dataProcessor.toDataFormat( protectedHtml ) );
+                },
+
+                test_ticket_3591_2_2 : function()
+                {
+                        var editor = CKEDITOR.instances.editor1,
+                                dataProcessor = editor.dataProcessor;
+
+                        dataProcessor.writer = new CKEDITOR.htmlParser.basicWriter();
+                        var html = getTextAreaValue( '_TEXTAREA_3591_2' );
+                        var protectedHtml = dataProcessor.toHtml( html );
+
+                        assert.areSame( getTextAreaValue( '_TEXTAREA_3591_2' ),
+                                dataProcessor.toDataFormat( protectedHtml ) );
+                },
+
                 name : document.title
         };
 })() );
 
-//window.onload = testCase.test_ticket_3407;
+//window.onload = testCase.test_ticket_3591;
         //]]>
         </script>
 </head>
@@ -258 +286 @@
 <![endif]>
 <![endif]--><td><%Response.Write(now())%></td><td><asp:control_name id="some_id" runat="server"/></td><td><?php
 include ("head.html"); ?></td></tr></tbody></table><noscript>Your browser doesn't support JavaScript</noscript></textarea>
+        <textarea id="_TEXTAREA_3591"><object><param /><param /><embed></embed></object></textarea>
+        <textarea id="_TEXTAREA_3591_protected"><cke:object><cke:param></cke:param><cke:param></cke:param><cke:embed></cke:embed></cke:object></textarea>
+        <textarea id="_TEXTAREA_3591_2"><object classid="clsid"><param name="movie" value="movie.swf" /><embed src="movie.swf" type="application/x-shockwave-flash"></embed></object></textarea>
 </body>
 </html>

_source/plugins/flash/plugin.js

@@ -19 +19 @@
         {
                 var attributes = element.attributes;
 
-                return ( attributes.type != 'application/x-shockwave-flash' || !flashFilenameRegex.test( attributes.src || '' ) );
+                return ( attributes.type == 'application/x-shockwave-flash' || flashFilenameRegex.test( attributes.src || '' ) );
         }
 
         function createFakeElement( editor, realElement )

_source/plugins/htmldataprocessor/plugin.js

@@ -72 +72 @@
         delete blockLikeTags.pre;
         var defaultDataFilterRules =
         {
-                elementNames :
-                [
-                        // Elements that cause problems in wysiwyg mode.
-                        [ ( /^(object|embed|param)$/ ), 'cke:$1' ]
-                ],
-
                 attributeNames :
                 [
                         // Event attributes (onXYZ) must not be directly set. They can become
@@ -132 +126 @@
                                         // and height attributes from it.
                                         if ( parent && parent.name == 'object' )
                                         {
-                                                element.attributes.width = parent.attributes.width;
-                                                element.attributes.height = parent.attributes.height;
+                                                var parentWidth = parent.attributes.width,
+                                                        parentHeight = parent.attributes.height;
+                                                parentWidth && ( element.attributes.width = parentWidth );
+                                                parentHeight && ( element.attributes.height = parentHeight );
                                         }
                                 },
 
+                                // Restore param elements into self-closing.
+                                param : function( param )
+                                {
+                                        param.children = [];
+                                        param.isEmpty = true;
+                                        return param;
+                                },
+
                                 img : function( element )
                                 {
                                         var attribs = element.attributes;
@@ -197 +201 @@
         }
 
         var protectAttributeRegex = /<(?:a|area|img|input).*?\s((?:href|src|name)\s*=\s*(?:(?:"[^"]*")|(?:'[^']*')|(?:[^ "'>]+)))/gi;
+        var protectStyleTagsRegex = /<(style)(?=[ >])[^>]*>[^<]*<\/\1>/gi;
+        var encodedTagsRegex = /<cke:encoded>([^<]*)<\/cke:encoded>/gi;
+        var protectElementNamesRegex = /(<[/]?)((?:object|embed|param).*?>)/gi;
+        var protectSelfClosingRegex = /<cke:param(.*?)\/>/gi;
 
         function protectAttributes( html )
         {
                 return html.replace( protectAttributeRegex, '$& _cke_saved_$1' );
         }
 
-        var protectStyleTagsRegex = /<(style)(?=[ >])[^>]*>[^<]*<\/\1>/gi;
-        var encodedTagsRegex = /<cke:encoded>([^<]*)<\/cke:encoded>/gi;
-
         function protectStyleTagsMatch( match )
         {
                 return '<cke:encoded>' + encodeURIComponent( match ) + '</cke:encoded>';
@@ -215 +220 @@
         {
                 return html.replace( protectStyleTagsRegex, protectStyleTagsMatch );
         }
+        function protectElementsNames( html )
+        {
+                return html.replace( protectElementNamesRegex, '$1cke:$2');
+        }
+        function protectSelfClosingElements( html )
+        {
+                return html.replace( protectSelfClosingRegex, '<cke:param$1></cke:param>' );
+        }
 
         function unprotectEncodedTagsMatch( match, encoded )
         {
@@ -298 +311 @@
                         if ( CKEDITOR.env.ie )
                                 data = protectStyleTags( data );
 
+                        // Certain elements has problem to go through DOM operation, protect
+                        // them by prefixing 'cke' namespace.(#3591)
+                        data = protectElementsNames( data );
+
+                        // All none-IE browsers ignore self-closed custom elements,
+                        // protecting them into open-close.(#3591)
+                        data = protectSelfClosingElements( data );
+
                         // Call the browser to help us fixing a possibly invalid HTML
                         // structure.
                         var div = document.createElement( 'div' );

CHANGES.html

@@ -62 +62 @@
                         </li>
                 <li><a href="http://dev.fckeditor.net/ticket/3821">#3821</a> : Fixed an issue with JAWS in which
                         toolbar items are read inconsistently between virtual cursor modes.</li>
+                <li><a href="http://dev.fckeditor.net/ticket/3591">#3591</a> : Protecting flash related elements
+                        including '&lt;object&gt;', '&lt;embed&gt;' and '&lt;param&gt;'.
+                        </li>
         </ul>
         <h3>
                 CKEditor 3.0 RC</h3>