From 88cfe18a6bb74057ee8275c2020c9489e7449b1b Mon Sep 17 00:00:00 2001
From: Benno Tielen <Benno@tielen.nl>
Date: Mon, 9 Mar 2026 15:25:34 +0100
Subject: [PATCH] feat: href validation

---
 src/globals/Footer.ts       |  2 ++
 src/globals/Menu.ts         |  7 +++++--
 src/globals/ValidateHref.ts | 16 ++++++++++++++++
 3 files changed, 23 insertions(+), 2 deletions(-)
 create mode 100644 src/globals/ValidateHref.ts

diff --git a/src/globals/Footer.ts b/src/globals/Footer.ts
index d377bb3..ff90d99 100644
--- a/src/globals/Footer.ts
+++ b/src/globals/Footer.ts
@@ -1,6 +1,7 @@
 import { GlobalConfig } from 'payload'
 import { isAdmin } from '@/collections/access/admin'
 import { revalidateTag } from 'next/cache'
+import { validateHref } from '@/globals/ValidateHref'
 
 export const FooterGlobal: GlobalConfig = {
   slug: 'footer',
@@ -50,6 +51,7 @@ export const FooterGlobal: GlobalConfig = {
               label: {
                 de: 'Zieladresse',
               },
+              validate: validateHref,
             },
           ],
         },
diff --git a/src/globals/Menu.ts b/src/globals/Menu.ts
index 4721eca..9112b56 100644
--- a/src/globals/Menu.ts
+++ b/src/globals/Menu.ts
@@ -1,6 +1,7 @@
 import { Block, GlobalConfig } from 'payload'
-import { hide, isAdmin } from '@/collections/access/admin'
+import { isAdmin } from '@/collections/access/admin'
 import { revalidateTag } from 'next/cache'
+import { validateHref } from '@/globals/ValidateHref'
 
 const SimpleItem: Block = {
   slug: 'simple-item',
@@ -18,7 +19,8 @@ const SimpleItem: Block = {
       name: 'href',
       type: 'text',
       label: 'Zieladresse',
-      required: true
+      required: true,
+      validate: validateHref,
     },
     {
       name: 'type',
@@ -93,6 +95,7 @@ const MegaMenuItem: Block = {
               label: 'Zieladresse',
               type: 'text',
               required: true,
+              validate: validateHref,
             }
           ],
           required: true,
diff --git a/src/globals/ValidateHref.ts b/src/globals/ValidateHref.ts
new file mode 100644
index 0000000..a14e5ea
--- /dev/null
+++ b/src/globals/ValidateHref.ts
@@ -0,0 +1,16 @@
+/**
+ * Payload field validator for href/link fields.
+ * Ensures values start with `/`, `http://`, or `https://`
+ * to prevent malformed or relative URLs.
+ */
+export const validateHref = (value: string | null | undefined) => {
+  if (
+    value &&
+    !value.startsWith('/') &&
+    !value.startsWith('http://') &&
+    !value.startsWith('https://')
+  ) {
+    return 'Zieladresse muss mit "/", "http://" oder "https://" beginnen'
+  }
+  return true
+}
\ No newline at end of file