Fixed
- Pasting an HTML embed code (e.g. from Vimeo or YouTube) instead of a URL no longer breaks the entry edit page (fixes #181). Thanks @tomfischerNL
- HTML embed codes are now rejected in
normalizeValue()andOembedService::embed()— including any bad data already stored in the database — so they are never saved or rendered - The CP field input value is now properly HTML-escaped, preventing HTML injection from malformed stored values
- A clear validation error ("Please enter a URL, not an HTML embed code.") is now surfaced inline in the Control Panel when an embed code is submitted
Added
- Unit tests for HTML embed code rejection in
OembedFieldTestandOembedServiceTest