···102 }
103 };
104105- // Validate redirect URL when direct RSVP is disabled
106 let disable_direct_rsvp = form.disable_direct_rsvp.unwrap_or(false);
107 let rsvp_redirect_url = form.rsvp_redirect_url.as_deref().map(|s| s.trim());
1080109 if disable_direct_rsvp {
110 if let Some(url) = rsvp_redirect_url {
111 if url.is_empty() || !url.starts_with("https://") {
···129 );
130 }
131 }
00000000000000000132133 // Update the event in the database only (settings are not stored in AT Protocol)
134 let event_update_result = event_update_with_full_metadata(
···102 }
103 };
104105+ // Validate redirect URL settings
106 let disable_direct_rsvp = form.disable_direct_rsvp.unwrap_or(false);
107 let rsvp_redirect_url = form.rsvp_redirect_url.as_deref().map(|s| s.trim());
108109+ // When disable_direct_rsvp is true, URL is required
110 if disable_direct_rsvp {
111 if let Some(url) = rsvp_redirect_url {
112 if url.is_empty() || !url.starts_with("https://") {
···130 );
131 }
132 }
133+134+ // When URL is provided, validate it's HTTPS (even if disable_direct_rsvp=false)
135+ if let Some(url) = rsvp_redirect_url {
136+ if !url.is_empty() && !url.starts_with("https://") {
137+ return contextual_error!(
138+ ctx.web_context,
139+ ctx.language,
140+ error_template,
141+ default_context,
142+ CommonError::FieldRequired,
143+ StatusCode::BAD_REQUEST
144+ );
145+ }
146+ }
147+148+ // Convert empty string to None for database storage
149+ let rsvp_redirect_url = rsvp_redirect_url.filter(|url| !url.is_empty());
150151 // Update the event in the database only (settings are not stored in AT Protocol)
152 let event_update_result = event_update_with_full_metadata(