search

pretalx / pretalx-youtube

Embed YouTube videos in pretalx talk pages
Other
3 stars 0 forks source link

input fields do not have a length indicator #4

Open fkusei opened 5 months ago

fkusei commented 5 months ago

This allows users to input very long urls, which in turn leads to HTTP 500 with exception django.db.utils.DataError: value too long for type character varying(20).

pretalx-youtube should either limit the length of the URL or sanitize the url to strip it of all unwanted data before trying to input it into the database.

fkusei commented 5 months ago

After reading the code i see that pretalx-youtube should already sanitize the full youtube urls. I suspect that my users used something like https://youtu.be/foobar?utm_medium=share&whatever=foobar, which got sanitized to foobar?utm_medium=share&whatever=foobar. I'll submit a PR to fix this.