camdendotlol / topstersorg

Book and music charts
https://topsters.org
GNU Affero General Public License v3.0
18 stars 9 forks source link

Don't attempt to fetch local paths from Custom item search #27

Closed camdendotlol closed 7 months ago

camdendotlol commented 1 year ago

If you select Custom and then type something that's not a URL, such as example, it will be treated as a URL anyway and will try to fetch topsters.org/example.

In the request logs, it seems to be common for users to get mixed up on which type of search they're on and try to search from the Custom URL box. For example, there were nearly 800 requests to topsters.org/pokemon in the past month, likely all caused by this user error. (Topsters 2 allows users to link an image by just pasting it into the search box, regardless of which data type is selected, so new users may be expecting that behavior here, but I'd rather keep things consistent with the type dropdown.)

  1. The Custom URL box should carry some regex validation to only fetch a URL if it's an actual link
  2. Users should be notified somehow if they seem to be trying to search from the Custom URL input, such as a popup or just a window.alert