alaveteli
alaveteli copied to clipboard
Don't accept invalid URLs
See the history of https://www.whatdotheyknow.com/admin/bodies/1001
An invalid URL (banana
) for disclosure log was accepted, and led to https://www.whatdotheyknow.com/body/banana
.
I perhaps should not have tested it on a live, body, but it has now been reverted.
+1 I've accidentally pasted tags into the homepage field before, which this would've prevented.
This would tackle the case of accidentally putting an email address into these fields.
It leads me to wonder about further validation eg. rejecting a notes or tags field containing just a URL or email address.
Also consider if we want validation on the CSV upload or just the admin create/edit form.
I'd say ideally on CSV too, but I imagine that would increase timeouts on WDTK, which is a separate issue.