accept only avatar_url beginning with //

Signed-off-by: Benoît Sibaud <oumph@linuxfr.org>
linuxfrorg · Sep 2, 2012 · 04c8198 · 04c8198
1 parent 5fe67a3
commit 04c8198
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/app/models/user.rb b/app/models/user.rb
@@ -58,6 +58,13 @@ def custom_avatar_url=(url)
     url
   end
 
+  before_validation :validate_url
+  def validate_url
+    return if custom_avatar_url.blank?
+    return if custom_avatar_url.starts_with?("//")
+    errors.add(:url, "Adresse de téléchargement d'avatar non valide")
+  end
+
   def avatar_url
     if avatar.present?
       url = avatar.url