Bug 589291: validating user's homepage url by change the field to a URLField

apps/users/models.py

@@ -67,7 +67,11 @@ class UserProfile(amo.models.ModelBase):
     display_collections = models.BooleanField(default=False)
     display_collections_fav = models.BooleanField(default=False)
     emailhidden = models.BooleanField(default=False)
-    homepage = models.CharField(max_length=255, blank=True, default='')
+    homepage = models.URLField(max_length=255, blank=True, default='',
+                               verify_exists=False, error_messages={
+                               'invalid': _('This URL has an invalid format. '
+                                            'Valid URLs look like '
+                                            'http://example.com/my_page.')})
     location = models.CharField(max_length=255, blank=True, default='')
     notes = models.TextField(blank=True, null=True)
     notifycompat = models.BooleanField(default=True)

apps/users/tests/test_forms.py

@@ -263,6 +263,13 @@ class TestUserRegisterForm(UserFormBase):
         self.assertFormError(r, 'form', 'username',
                              'This username is invalid.')
 
+    def test_invalid_homepage(self):
+        data = {'homepage': 'example.com:alert(String.fromCharCode(88,83,83)'}
+        m = 'This URL has an invalid format. '
+        m += 'Valid URLs look like http://example.com/my_page.'
+        r = self.client.post('/en-US/firefox/users/register', data)
+        self.assertFormError(r, 'form', 'homepage', m)
+
     def test_already_logged_in(self):
         self.client.login(username='jbalogh@mozilla.com', password='foo')
         r = self.client.get('/users/register', follow=True)