<script> tag is not filtered out

[Wiktor Walc]

Thanks to #9829 CKEditor now creates HTML content which contains only allowed HTML tags.

The problem is that the <script> tag can be still inserted in source mode and is not properly removed, even though there isn't any rule that would allow it (in editor.filter.allowedContent). So it looks like this tag has been somehow forgotten.

I believe we should:

a) remove the <script> tag completely by default, leaving it to the developer to specify it in config.extraAllowedContent

OR

b) eventually specify it in config.extraAllowedContent by default. However if config.extraAllowedContent is set to an empty string, the tag should be still removed.

Also in case of <script> tag we should simply remove the tag if its forbidden, without leaving the inner content in the editor.

[Piotrek Koszuliński]

Pushed ​t/10089 on dev and tests.

<(no)script> tags are by default removed, but may be passed if added to (extra)AllowedContent.

[Piotrek Koszuliński]

Merged to major with ​git:f35bd1f on dev and b9e9dd8 on tests.