Whitelist Plugin for CKEditor

Introduction

This is a plugin that restricts the allowed elements and attributes in CKEditor.

Author:

Alfonso Martínez de Lizarrondo

Version history:

  1. 1.0: 20-May-2012. First version.

Installation

1. Copying the files

Extract the contents of the zip in you plugins directory, so it ends up like this

ckeditor\
	...
	images\
	lang\
	plugins\
		...
		whitelist
			plugin.js
			docs\
				install.html
		...
	skins\
	themes\

2. Adding it to CKEditor

Now add the plugin in your config.js or custom js configuration file: config.extraPlugins='whitelist';

3. Configuration

You can modify the list of allowed elements or attributes with the whitelist_elements and whitelist_globalAttributes entries.

4. Notes

This is not a full security solution. It must be coupled with a proper filter at the server like HTML Purifier for PHP. Previously it was possible to use the Microsoft AntiXSS for .Net, but the latest version seems horrible broken, anyone knows of a good alternative?.
If anyone suggests other such filters I can add them here so people can find them.

The aim of this plugin is to try to avoid showing to the user elements that will be filtered out later by the server script, not to provide a full security over the code (an attacker won't use CKEditor, he will POST the HTML directly to your page bypassing javascript "security").

Disclaimers

CKEditor is © CKSource.com