-
Bug
-
Resolution: Fixed
-
Normal
-
None
-
None
We have several relationship types which have a URL whitelist. All other URLs are blocked. Sometimes, people manage to enter relationships they shouldn't be able to enter and up until now I'd never been able to figure out a way of doing it that seemed remotely plausible. Now I finally found one:
Steps to reproduce:
Open relate to URL page, e.g. for a release
Paste invalid URL, e.g. http://www.example.com/
Select a relationship type with a whitelist, e.g. "has cover art at"
Press enter
Expected result: Editor is prevented from entering the relationship
Actual result: The text "This URL is not allowed for the selected link type, or is incorrectly formatted." is shown, but the edit is submitted anyway.
I managed to reproduce it in Opera 10.10 and Safari 4.1.3 in OSX 10.4 and Opera Next 12.1 internal in OSX 10.7. I also managed to reproduce it in Firefox 7.0.1 in OSX 10.7 by clicking "Enter edit" rather than pressing enter.