From 573a912e4f1b481fca8f3c8146972e78f76278e2 Mon Sep 17 00:00:00 2001
From: Stefan <mu.stefan@googlemail.com>
Date: Sat, 8 Nov 2014 17:26:40 +0100
Subject: Add check for special url characters to createPad API function

---
 src/node/db/API.js | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

(limited to 'src/node/db/API.js')

diff --git a/src/node/db/API.js b/src/node/db/API.js
index 4a912368..79f5fbeb 100644
--- a/src/node/db/API.js
+++ b/src/node/db/API.js
@@ -544,12 +544,21 @@ Example returns:
 exports.createPad = function(padID, text, callback)
 {  
   //ensure there is no $ in the padID
-  if(padID && padID.indexOf("$") != -1)
+  if(padID)
   {
-    callback(new customError("createPad can't create group pads","apierror"));
-    return;
+    if(padID.indexOf("$") != -1)
+    {
+      callback(new customError("createPad can't create group pads","apierror"));
+      return;
+    }
+    //check for url special characters
+    else if(padID.match(/(\/|\?|&|#)/))
+    {
+      callback(new customError("malformed padID: Remove special characters","apierror"));
+      return;
+    }
   }
-  
+
   //create pad
   getPadSafe(padID, false, text, function(err)
   {
-- 
cgit v1.2.3