When managing an Article in the administrator/backend, it is possible to insert a non-url into the "Intro Image" field (located in the "Images and Links" tab).
Upon clicking "Select" a modal window containing a text input field labeled "Image URL" (among other options) appears. This field expects a url string like images/abc.jpg
, but there is no validation on the text in the field so a non-url value can be submitted. I want to eliminate the possibility of a non-url value like html, javascript, etc. from being stored. e.g. <img src="xxx/yy/zbx.jpg" onmouseover="alert(xxxx)" />
Ideally, I wish to deny the submission from the modal, so that the parent form can not receive the non-url value and generate the following:
Ultimately I'd like to validate the url field when saving the Article.