Add CKEditor official plugins to the whitelist

I think the request is to add all of the plugins authored by CKSource http://ckeditor.com/users/CKSource, but I'm not sure. That would be difficult to do as a blanket expression, since the download links don't include the author in the URL...

http://download.ckeditor.com/panel/releases/panel_4.1.2.zip
http://download.ckeditor.com/smiley/releases/smiley_4.1.2.zip

Each one of these is going to have be whitelisted separately, but they'd also all be reject due to licensing. I don't know if this changed since this issue was created, but the license linked on http://ckeditor.com/addon/autogrow is "dual" licensed as GPLv3, LGPLv3, and MPLv1.1... none of which qualify as compatible with GPLv2.

If there is some evidence that I'm missing that the license is actually "BSD/GNU/MIT", please provide it.

What about allowing things built on the ckeditor packager to pass?

http://ckeditor.com/builder allows for assembly of the package to include plugins. This wouldn't require authors to be white-listed ... although sounds like this won't solve the (stupid) licensing issue that will require people to click additional buttons to satisfy the same net gain (venting, I know the policy and why).

http://ckeditor.com/online-builder/ would be the folder that generates the zips that have custom builds of ckeditor with plugins

http://ckeditor.com/online-builder/releases/minified/4.2/moono/4.2/ckedi... is an example of one that I assembled with code mirror and another plugin for use with textbook module/feature.

This is very confusing. While the license included with ckeditor is clearly multi licensed as...

- GNU General Public License Version 2 or later (the "GPL")
- GNU Lesser General Public License Version 2.1 or later (the "LGPL")
- Mozilla Public License Version 1.1 or later (the "MPL")

... making it GPLv2 compatible, each individual plugin has its own license options. When I downloaded @btopro's package, the plugins simply include code referencing...

/*
 Copyright (c) 2003-2013, CKSource - Frederico Knabben. All rights reserved.
 For licensing, see LICENSE.md or http://ckeditor.com/license
*/

http://ckeditor.com/license redirects to http://ckeditor.com/about/license which clearly indicates that the license is GPLv3 with both the graphic and the link. To make this even more confusing, if I look up a specific plugin like http://ckeditor.com/addon/codemirror, it also links to GPLv3. CodeMirror is also licensed as MIT so it could be approved, but not every plugin includes both MIT and GPLv3.

Now this is where my head starts hurting. If I look up http://ckeditor.com/addon/scayt, it links to GPLv3 and doesn't include MIT.... but when I download it, it includes a LICENSE.md file which says...

Licensed under the terms of any of the following licenses at your choice:

*   GNU General Public License Version 2 or later (the "GPL"):
*   GNU Lesser General Public License Version 2.1 or later (the "LGPL"):
*   Mozilla Public License Version 1.1 or later (the "MPL"):

Assuming that links to the builds are static and don't update or expire and someone could verify all of the plugins in the build are GPLv2 compatible, then technically the specific build could be whitelisted... but how anyone could verify these licenses are GPLv2 compatible is beyond me when every link on http://ckeditor.com/ points to GPLv3.

Of course, #1449452: Give installation profiles/distributions GPLv3+ license as option for packaged downloads would make this much easier.

Does anyone know what this is or understand it?

http://cksource.com/license/ckeditor-for-drupal

There are a number of clauses in this that are really troubling.

@kreynen: Looks like that only relates to http://cksource.com/ckeditor-for-drupal which is a separate product they maintain and host themselves.

With the 4.3 stable release, the Widget API was also moved into a separate plugin. The API is used by Drupal Commons and some Media-related modules.

If you need access to the Widget API, I'd suggest sticking with the 4.3 beta until this issue is fixed.

Hmm, it looks live they've retroactively removed the plugins from the 4.3 beta tarballs on ckeditor.com but they are still included in the 4.3 beta tag on github. :S

• 4.3 beta basic
• 4.3 beta standard
• 4.3 beta full

I'm running into this issue as well for Open Enterprise as I need the widget plugin for ckeditor 4.3.

Looks like the widget plugin is GPL v3, LGPL v3 and MPL licensed. That means it probably can't be included without a change in licensing policy.

Frustrating...

I'm curious how ckeditor is compatible when it has the same GPL v3, LGPL v3 and MPL licenses. See: http://ckeditor.com/about/license

Not only that but it will be included in Drupal 8. How exactly does that work? If we can include ckeditor with those licenses, how can we not include its plugins with the exact same licenses?

Ah, a little searching and I found this: https://drupal.org/node/1449452

CKEditor is licensed as GPLv2. See https://drupal.org/comment/7737161#comment-7737161

#1449452: Give installation profiles/distributions GPLv3+ license as option for packaged downloads would give distributions a lot more flexibility when packaging code, but as it is written now wouldn't change the policy on what is committed to git as part of core or conrtib. Everything committed would still need to be licensed as GPLv2 or a compatible license. While CKEditor is displaying the GPLv3 icons on http://ckeditor.com/about/license, the license text that's included still indicates it is GPLv2.

If CKEditor actually changed its license to GPLv3 in future releases, Drupal wouldn't be able to include that version without changing the licensing policy.

So CKEditor widgets were specifically designed at the request of Drupal (see: http://dev.ckeditor.com/ticket/9764 and https://drupal.org/node/1260052#comment-6836034) but we aren't going to be able to actually use them in core or distributions?

This is going to become a pretty big issue for a lot of people if we can't get it figured out.

Is anyone working on this from the CKEditor side?

Created a ticket (https://dev.ckeditor.com/ticket/11292) to see if ckeditor folks have any feedback.

According to the ticket in #12, the plugins are GPL2+ which makes them compatible with the whitelisting requirements. This should be doable now.

that's very exciting! Now how best to white-list all plugins as well as packaged builds of CKEditor (if possible). Or would the correct method be to grab CKEditor 4.x, then use Drush make to place the individual CKEditor plugins in the right directories inside the library. Never done that before but assuming it's possible to include a library inside another library

It's not ALL plugins :(

CKEditor and all plugins, included in the ​ckeditor-dev repository

But it's safe to add https://github.com/ckeditor/ckeditor-dev/ to the whitelist to solve the specific issue w/ the widget plugin. I don't really understand why widget is in the repo https://github.com/ckeditor/ckeditor-dev/tree/master/plugins/widget, but not in the build... but regardless.

Adding ckeditor-dev should resolve this issue.

https://drupal.org/node/1403548

While it would be nice to include all the plugins in the repository, the minimum for me would be the widget plugin and lineutils (requirement for widgets).

http://download.ckeditor.com/widget/releases/*
http://download.ckeditor.com/lineutils/releases/*

@btopro

I was able to do that like this (doesn't work on d.o till whitelisted)

libraries[ckeditor][download][type] = file
libraries[ckeditor][download][url] = http://download.cksource.com/CKEditor/CKEditor/CKEditor%204.3.1/ckeditor...
libraries[ckeditor][directory_name] = ckeditor
libraries[ckeditor][destination] = libraries

libraries[ckeditor_widget][download][type] = file
libraries[ckeditor_widget][download][url] = http://download.ckeditor.com/widget/releases/widget_4.3.1.zip
libraries[ckeditor_widget][directory_name] = widget
libraries[ckeditor_widget][destination] = libraries/ckeditor/plugins

libraries[ckeditor_lineutils][download][type] = file
libraries[ckeditor_lineutils][download][url] = http://download.ckeditor.com/lineutils/releases/lineutils_4.3.1.zip
libraries[ckeditor_lineutils][directory_name] = lineutils
libraries[ckeditor_lineutils][destination] = libraries/ckeditor/plugins

@randallknutson

thank you, that's very helpful. I'll have to add them in that way to the package I build off of w/ the textbook module so that the plugins that aren't white-listed like codemirror

@kreynen - The widget plugin is not (yet) included in default builds of CKEditor, because we wanted to polish the image2 plugin first (which requires widget plugin), before we offer it as a default solution in CKEditor packages.

Anyway, nice to see that the issue is really close to be solved, thanks to all of you!

I updated https://drupal.org/node/1403548 with the github patterns. That addresses the original request. I did NOT add patterns for http://download.ckeditor.com/widget/releases/* or http://download.ckeditor.com/lineutils/releases/*.

This issue has become something of a catch all for everything related to CKEditor. Can someone add new issues for each plugin they want whitelisted as a .zip from https://github.com/ckeditor/ckeditor-dev/ and reference https://dev.ckeditor.com/ticket/11292 for the licensing info.

@btopro If you are going to take care of these, go ahead and consider any plugins in the ckeditor-dev repo already RTBC... but PLEASE also take a look at the other whitelist requests that are already RBTC so we aren't just cherry picking the requests that scratch are own itches.