Merge pull request #2404 from webzwo0i/sanity-in-atext

block changeset if it deletes more lines than exist in the whole pad

1 files changed, 10 insertions, 1 deletions

diff --git a/src/node/handler/PadMessageHandler.js b/src/node/handler/PadMessageHandler.js
index 7cdefc65..68686c9e 100644
--- a/src/node/handler/PadMessageHandler.js
+++ b/src/node/handler/PadMessageHandler.js
@@ -742,7 +742,16 @@ function handleUserChanges(data, cb)
         return callback(new Error("Can't apply USER_CHANGES "+changeset+" with oldLen " + Changeset.oldLen(changeset) + " to document of length " + prevText.length));
       }
 
-      pad.appendRevision(changeset, thisSession.author);
+      try
+      {
+        pad.appendRevision(changeset, thisSession.author);
+      }
+      catch(e)
+      {
+        client.json.send({disconnect:"badChangeset"});
+        stats.meter('failedChangesets').mark();
+        return callback(e)
+      }
 
       var correctionChangeset = _correctMarkersInPad(pad.atext, pad.pool);
       if (correctionChangeset) {