scratchfoundation / scratch-www

Standalone web client for Scratch
https://scratch.mit.edu
BSD 3-Clause "New" or "Revised" License
1.6k stars 845 forks source link

Add project to studio box can add wrong project if text is used #5950

Open BryceLTaylor opened 3 years ago

BryceLTaylor commented 3 years ago

On the projects tab of a studio page, if you type a string with numbers into the add projects box, it will strip out all of the non-digit characters and add the numbers that are left as a project id to the studio.

This is so we can strip out the rest of the url, but in the event that someone tries to type in a project title, it could result in adding the wrong project to the studio.

Typing https://scratch.mit.edu/projects/1300002901/ will add project with id 1300002901 Typing 1300002901 adds that id

The problem is that typing pizza1300002901 will add the project with id 1300002901 pizza1300002901pizza will add project with id 1300002901 130000pizza2901 will add the project with the id 2901

We should validate that the text we are stripping out is a project url and throw an error if it is anything else.

Desired behavior

If the string provided is not (1) a Scratch project URL or (2) the ID by itself, we should show this new error to the user: Hmm, that’s not a link to a Scratch project. Get the URL by clicking “Copy Link” on the project page.

We should also make sure there are unit tests of this behavior, likely in studio-project-actions.test.js.

Steps to Reproduce

Navigate to a studio you own/are a curator for Type in the name of a project with a number in the title into the Add project bar Submit Note: you add the project with the id that has that number

Operating System and Browser

Mac Chrome

apple502j commented 3 years ago

See also #5928

BryceLTaylor commented 3 years ago

From #5928 @mxmou points out that copying a link from single comment view will cause the wrong project to get added.

LankyBox01 commented 3 years ago
if (str.startsWith("https://scratch.mit.edu/projects/") && parseInt(str) != "")
seotts commented 3 years ago

I just added some information about the desired behavior to the issue (including the intended error message.)