Issue Details (XML | Word | Printable)

Key: MBS-5087
Type: Bug Bug
Status: Closed Closed
Resolution: Fixed
Priority: Normal Normal
Assignee: Ian McEwen
Reporter: nikki
Votes: 0
Watchers: 0
Operations

If you were logged in you would be able to see more operations.
MusicBrainz Server

URL whitelisting code does not work correctly

Created: 04/Aug/12 04:59 PM   Updated: 20/Aug/12 09:51 AM   Resolved: 20/Aug/12 09:51 AM
Component/s: JavaScript
Affects Version/s: None
Fix Version/s: Bug fixes, 2012-08-20


 Description  « Hide

We have several relationship types which have a URL whitelist. All other URLs are blocked. Sometimes, people manage to enter relationships they shouldn't be able to enter and up until now I'd never been able to figure out a way of doing it that seemed remotely plausible. Now I finally found one:

Steps to reproduce:
Open relate to URL page, e.g. for a release
Paste invalid URL, e.g. http://www.example.com/
Select a relationship type with a whitelist, e.g. "has cover art at"
Press enter

Expected result: Editor is prevented from entering the relationship
Actual result: The text "This URL is not allowed for the selected link type, or is incorrectly formatted." is shown, but the edit is submitted anyway.

I managed to reproduce it in Opera 10.10 and Safari 4.1.3 in OSX 10.4 and Opera Next 12.1 internal in OSX 10.7. I also managed to reproduce it in Firefox 7.0.1 in OSX 10.7 by clicking "Enter edit" rather than pressing enter.



Sort Order: Ascending order - Click to sort in descending order
Ian McEwen added a comment - 04/Aug/12 05:54 PM

Looks like urlChanged gets fired but it doesn't have an event.preventDefault() call so the submit goes through anyway.