Ticket #4196: 4196.patch

_source/plugins/list/plugin.js

@@ -356 +356 @@
                 compensateBrs( true );
                 compensateBrs();
 
-                var rootParent = groupObj.root.getParent();
                 docFragment.replace( groupObj.root );
         }
 
@@ -445 +444 @@
                                 while ( ( block = iterator.getNextParagraph() ) )
                                 {
                                         var path = new CKEDITOR.dom.elementPath( block ),
+                                                pathElements = path.elements,
+                                                pathElementsCount = pathElements.length,
                                                 listNode = null,
                                                 processedFlag = false,
                                                 blockLimit = path.blockLimit,
                                                 element;
 
                                         // First, try to group by a list ancestor.
-                                        for ( var i = 0 ; i < path.elements.length &&
-                                                  ( element = path.elements[ i ] ) && !element.equals( blockLimit ); i++ )
+                                        for ( var i = pathElementsCount - 1; i >= 0 && ( element = pathElements[ i ] ); i-- )
                                         {
-                                                if ( listNodeNames[ element.getName() ] )
+                                                if ( listNodeNames[ element.getName() ]
+                                                         && blockLimit.contains( element ) )     // Don't leak outside block limit (#3940).
                                                 {
                                                         // If we've encountered a list inside a block limit
                                                         // The last group object of the block limit element should

_source/core/htmlparser/element.js

@@ -35 +35 @@
         this.children = [];
 
         var dtd                 = CKEDITOR.dtd,
-                isBlockLike     = !!( dtd.$block[ name ] || dtd.$listItem[ name ] || dtd.$tableContent[ name ] || dtd.$nonEditable[ name ] ),
+                isBlockLike     = !!( dtd.$block[ name ] || dtd.$listItem[ name ] || dtd.$tableContent[ name ] || dtd.$nonEditable[ name ] || name == 'br' ),
                 isEmpty         = !!dtd.$empty[ name ];
 
         this.isEmpty    = isEmpty;