fix(previews): validate URL input

[ahuseyn]

Right now any text can be inserted into Preview URL input. Only a valid URL should be allowed.

[colinmurphy]

@ahuseyn I will look at this. I am currently writing tests for settings so I should be able to fix this. Currently we just sanitize the text field.

[colinmurphy]

@ahuseyn We can add a new field called URL_Text_Field in the PR #241

[colinmurphy]

@ahuseyn

Just a heads up with this issue when you try and escape the URL

https://example.com/?preview=true&name={slug}

becomes

https://example.com/?preview=true&name=slug which is problematic for the parameter resolver.

So we probably need to check that the URL has a valid HTTP protocol too rather than escaping the URL (sanitize_url WP function)

[ahuseyn]

@colinmurphy thanks for the clarification 🙂.

Sanitization is important, but for this ticket we should check if URL is valid and reject if not as you said. This one looks good for the job.

On the frontend we need to add URL type to the input, so user can't accidentally put wrong URL in the first place 🙂.

[colinmurphy]

@colinmurphy thanks for the clarification 🙂.

Sanitization is important, but for this ticket we should check if URL is valid and reject if not as you said. This one looks good for the job.

On the frontend we need to add URL type to the input, so user can't accidentally put wrong URL in the first place 🙂.

Thanks @ahuseyn I will check that out :)

[colinmurphy]

Sorry we can also update the URL input type too to ensure the input is a URL :)

[colinmurphy]

@ahuseyn

This should be fixed now. It might be worth double checking :)