This is a plugin that restricts the allowed elements and attributes in CKEditor.
Alfonso Martínez de Lizarrondo
Extract the contents of the zip in you plugins directory, so it ends up like
this
ckeditor\ ... images\ lang\ plugins\ ... whitelist plugin.js docs\ install.html ... skins\ themes\
Now add the plugin in your config.js or custom js configuration
file:
config.extraPlugins='whitelist';
You can modify the list of allowed elements or attributes with the whitelist_elements and whitelist_globalAttributes entries.
This is not a full security solution. It must be coupled with a proper filter at the server like HTML Purifier for PHP.
Previously it was possible to use the Microsoft AntiXSS for .Net, but the latest version seems horrible broken, anyone knows of a good alternative?.
If anyone suggests other such filters I can add them here so people can find them.
The aim of this plugin is to try to avoid showing to the user elements that will be filtered out later by the server script, not to provide a full security over the code (an attacker won't use CKEditor, he will POST the HTML directly to your page bypassing javascript "security").
CKEditor is © CKSource.com