Uploaded image for project: 'MusicBrainz Server'
  1. MusicBrainz Server
  2. MBS-5087

URL whitelisting code does not work correctly

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Normal
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: Bug fixes, 2012-08-20
    • Component/s: JavaScript
    • Labels:
      None

      Description

      We have several relationship types which have a URL whitelist. All other URLs are blocked. Sometimes, people manage to enter relationships they shouldn't be able to enter and up until now I'd never been able to figure out a way of doing it that seemed remotely plausible. Now I finally found one:

      Steps to reproduce:
      Open relate to URL page, e.g. for a release
      Paste invalid URL, e.g. http://www.example.com/
      Select a relationship type with a whitelist, e.g. "has cover art at"
      Press enter

      Expected result: Editor is prevented from entering the relationship
      Actual result: The text "This URL is not allowed for the selected link type, or is incorrectly formatted." is shown, but the edit is submitted anyway.

      I managed to reproduce it in Opera 10.10 and Safari 4.1.3 in OSX 10.4 and Opera Next 12.1 internal in OSX 10.7. I also managed to reproduce it in Firefox 7.0.1 in OSX 10.7 by clicking "Enter edit" rather than pressing enter.

        Attachments

          Activity

            People

            • Assignee:
              ianmcorvidae Ian McEwen
              Reporter:
              nikki nikki
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Packages

                Version Package
                Bug fixes, 2012-08-20