Ticket #6791: 6791_4.patch

_source/core/editor_basic.js

@@ -98 +98 @@
                         // Look for the element by id. We accept any kind of element here.
                         element = document.getElementById( elementOrIdOrName );
 
+                        // Elements that should go into head are unacceptable (#6791).
+                        if ( element && element.tagName.toLowerCase() in {style:1,script:1,base:1,link:1,meta:1,title:1} )
+                                element = null;
+
                         // If not found, look for elements by name. In this case we accept only
                         // textareas.
                         if ( !element )