Context menu items can be dragged into the editor

[Alfonso Martínez de Lizarrondo]

Open the context menu and try to drag one of the items: in Firefox and Chrome works and a link is inserted into the content.

v3 and IE9 work fine.

[Jakub Ś]

Problem can be reproduced in Firefox, IE10, Webkit and Opera from CKEditor 4.0 beta.

The worst part is that such behaviour generates error in FF and IE10 when cursor is over link :

ReferenceError: CKEDITOR is not defined
CKEDITOR.tools.callFunction(204,0);
onmouseover

UPDATE: I have checked latest CKEditor 4.5.11 and error in no longer being thrown.

[Justin Carlson]

I also can reproduce this, it causes some issues with students doing testing. Their specific browser version can crash out / loop when it serializes the data and restores it in a later session (FF10 which nobody should have to care about... but you know how it is).

In addition there doesn't seem to be an easy css fix (I tried a lot of no-select hackery).

Disabling the draggable plugin also does not prevent this interaction. You can still drag menu items into the editor even if you cannot drag the text around.

[Justin Carlson]

Patch and config option CKEDITOR.config.disableMenuDrag.

This is actually a little hard to do an a per menu item since the initial resize is all done in the focus and setTimeout methods of a floating panel.

​https://github.com/UberMeatShield/ckeditor-dev/commit/35fa2b882ac8a3c4e9fefde3cb752f1397fcb4b3

[Jakub Ś]

Thank you for submitting link to your patch however in order to get your proposed fix tested and applied (if it is correct) please get CKEditor 4 code from ​https://github.com/ckeditor/ckeditor-dev, prepare your fix and make a "pull request" (here is the example list of pull requests ​https://github.com/ckeditor/ckeditor-dev/pulls?direction=desc&page=1&sort=created&state=open). In comment please specify link to bug for which this fix was prepared.

NOTE: Dragging menu items into editor isn’t in any way desired so I don't think menu option should be used for it. IMHO it should be blocked permanently. Anyway if this was desired it would have been reported as feature and not a bug ;)

[Jay]

We've found users in production are accidentally using this and the dropped text includes an anchor that leads to unpredictable behavior when clicked such as navigating to about:blank. We've applied the resolution internally, does CKEditor have plans to formally resolve this in future releases?

[Jakub Ś]

You can also drag and drop items from dropdowns. Just like with menu elements, in CKEditor 4.5.11 errors are not thrown when hovering over such link.

This issue has been reported on our support channel.

[Tade0]

Added disabling draggability as an option active by default.

Changes pushed to ​branch:t/10373.

[Marek Lewandowski]

It's still possible to drag the link in ie9, but you're unable to drop it inside the editor, so we're not worried too much about that as since IE10 it works as expected.

For now there's no reason for making menu entries draggable, so let's keep it simple simply always disable dragging for menu options.

Fixed with ​git:644ba61.

[Tade0]

For some reason setting draggable=false in Firefox does not cut it.

Added a no-op drag start handler for Firefox.

Changes pushed to ​branch:t/10373.

[Marek Lewandowski]

Added some fixes on top of it in ​git:56157c6dd338c1ccea56766050466d5f0f8c8d2a - merged to master.