#5534 - No server-side field validation for field hooks (catalogues)
-
By PDStig
- Added
- 6 views
| Identifier | #5534 |
|---|---|
| Issue type | Major issue (breaks an entire feature) |
| Title | No server-side field validation for field hooks (catalogues) |
| Status | Completed |
| Handling member | PDStig |
| Version | 10.0.44 |
| Addon | catalogues |
| Description | There is no server-side validation when adding or editing catalogue entries. The only validation is JavaScript-side. But someone can modify or bypass the JS in their browser to force validation to pass, thereby resulting in the form getting submitted and the catalogue entry having invalid values.
This bug also exists in v11. |
| Steps to reproduce | |
| Funded? | No |
| Commits |
The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".
Comments
There is no server-side validation when adding or editing catalogue entries. The only validation is JavaScript-side. But someone can modify or bypass the JS in their browser to force validation to pass, thereby resulting in the form getting submitted and the catalogue entry having invalid values.
This fix adds required field validation on a high-level (wherever the hooks are called) and field-specific validation where it was missing in inputted_to_field_value.