Embedding widgets possible even widget editable allowedContent filter does not allow this.

[tomkdgun]

I was able to reproduce this on latest ​http://ckeditor.com/demo#widgets and "Simple Sample Box", but this apply also when I'm trying to write my custom widget.

Widget editable content is defined like this: content: {

selector: '.simplebox-content', allowedContent: 'p br ul ol li strong em'

}

When cursor is inside this editable, "Create a Simple Box" button is not active, which is correct, according to allowedContent filter.

Unfortunately, I'm able to select "Sample Box" widget, copy it, put the cursor inside the content editable of this widget, and paste all widget there. This causes that widgets are embedded, even this should be not allowed. Same situation happen when I have two widgets, I will select and cut one of them. I'm able to paste just cut widget, into second widget's content editable.

Looks like widget's editable filter is not applied during paste for widgets.

Steps to reproduce

1. Click "Create a Simple Box" button, to add widget
2. Select and copy widget "Simple Box" widget
3. Place cursor in "Simple Box" widget content editable
4. Paste (Ctrl+V)

Expected result

AllowedContent filter for content editable is applied, not allowed HTML elements (e.g. <div>) are removed before insert. As a result, there is no possibility to embed "Simple Box" widgets, one inside another.

Actual result

"Simple Box" widget is embed inside another.

Other details (browser, OS, CKEditor version, installed plugins)

FF 38.6.1 Windows 7 CKEditor (latest): ​http://ckeditor.com/demo#widgets

[Jakub Ś]

DUP of #11115

Please also see #11503