Merge pull request #2302 from Gared/create_pad_special_characters

Add check for special url characters to createPad API function

1 files changed, 13 insertions, 4 deletions

diff --git a/src/node/db/API.js b/src/node/db/API.js
index edd130e2..97d5162d 100644
--- a/src/node/db/API.js
+++ b/src/node/db/API.js
@@ -687,12 +687,21 @@ Example returns:
 exports.createPad = function(padID, text, callback)
 {  
   //ensure there is no $ in the padID
-  if(padID && padID.indexOf("$") != -1)
+  if(padID)
   {
-    callback(new customError("createPad can't create group pads","apierror"));
-    return;
+    if(padID.indexOf("$") != -1)
+    {
+      callback(new customError("createPad can't create group pads","apierror"));
+      return;
+    }
+    //check for url special characters
+    else if(padID.match(/(\/|\?|&|#)/))
+    {
+      callback(new customError("malformed padID: Remove special characters","apierror"));
+      return;
+    }
   }
-  
+
   //create pad
   getPadSafe(padID, false, text, function(err)
   {