From 4386ab122581b49f74503b851400db4b5ed2eafd Mon Sep 17 00:00:00 2001
From: James Allen <james@sharelatex.com>
Date: Wed, 21 Sep 2016 16:31:02 +0100
Subject: [PATCH] Don't allow files to be created with / or * characters

Requires the following translations:

  "files_cannot_include_invalid_characters": "Files cannot include '*' or '/' characters",
  "invalid_file_name": "Invalid File Name"
---
 .../app/views/project/editor/file-tree.jade   | 22 +++++++++++++++++--
 services/web/public/coffee/ide.coffee         |  2 ++
 .../controllers/FileTreeController.coffee     |  4 ++++
 .../FileTreeEntityController.coffee           | 16 +++++++++++++-
 4 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/services/web/app/views/project/editor/file-tree.jade b/services/web/app/views/project/editor/file-tree.jade
index 77cbd10da9..b32bdbed23 100644
--- a/services/web/app/views/project/editor/file-tree.jade
+++ b/services/web/app/views/project/editor/file-tree.jade
@@ -315,8 +315,12 @@ script(type='text/ng-template', id='newDocModalTemplate')
 				required,
 				ng-model="inputs.name",
 				on-enter="create()",
-				select-name-on="open"
+				select-name-on="open",
+				ng-pattern="validFileRegex",
+				name="name"
 			)
+			.text-danger.row-spaced-small(ng-show="newDocForm.name.$error.pattern")
+				| #{translate('files_cannot_include_invalid_characters')}
 	.modal-footer
 		button.btn.btn-default(
 			ng-disabled="state.inflight"
@@ -341,8 +345,12 @@ script(type='text/ng-template', id='newFolderModalTemplate')
 				required,
 				ng-model="inputs.name",
 				on-enter="create()",
-				select-name-on="open"
+				select-name-on="open",
+				ng-pattern="validFileRegex",
+				name="name"
 			)
+			.text-danger.row-spaced-small(ng-show="newFolderForm.name.$error.pattern")
+				| #{translate('files_cannot_include_invalid_characters')}
 	.modal-footer
 		button.btn.btn-default(
 			ng-disabled="state.inflight"
@@ -414,3 +422,13 @@ script(type='text/ng-template', id='deleteEntityModalTemplate')
 		)
 			span(ng-hide="state.inflight") #{translate("delete")}
 			span(ng-show="state.inflight") #{translate("deleting")}...
+
+script(type='text/ng-template', id='invalidFileNameModalTemplate')
+	.modal-header
+		h3 #{translate('invalid_file_name')}
+	.modal-body
+		p #{translate('files_cannot_include_invalid_characters')}
+	.modal-footer
+		button.btn.btn-default(
+			ng-click="$close()"
+		) #{translate('ok')}
\ No newline at end of file
diff --git a/services/web/public/coffee/ide.coffee b/services/web/public/coffee/ide.coffee
index be82aa72a8..2553bf9c42 100644
--- a/services/web/public/coffee/ide.coffee
+++ b/services/web/public/coffee/ide.coffee
@@ -87,6 +87,8 @@ define [
 		# End of tracking code.
 
 		window._ide = ide
+		
+		ide.validFileRegex = '^[^\*\/]*$' # Don't allow * and /
 
 		ide.project_id = $scope.project_id = window.project_id
 		ide.$scope = $scope
diff --git a/services/web/public/coffee/ide/file-tree/controllers/FileTreeController.coffee b/services/web/public/coffee/ide/file-tree/controllers/FileTreeController.coffee
index a0dcaa1367..5c8b82e5ed 100644
--- a/services/web/public/coffee/ide/file-tree/controllers/FileTreeController.coffee
+++ b/services/web/public/coffee/ide/file-tree/controllers/FileTreeController.coffee
@@ -44,6 +44,8 @@ define [
 	App.controller "NewDocModalController", [
 		"$scope", "ide", "$modalInstance", "$timeout", "parent_folder",
 		($scope,   ide,   $modalInstance,   $timeout,   parent_folder) ->
+			$scope.validFileRegex = ide.validFileRegex
+			
 			$scope.inputs = 
 				name: "name.tex"
 			$scope.state =
@@ -74,6 +76,8 @@ define [
 	App.controller "NewFolderModalController", [
 		"$scope", "ide", "$modalInstance", "$timeout", "parent_folder",
 		($scope,   ide,   $modalInstance,   $timeout,   parent_folder) ->
+			$scope.validFileRegex = ide.validFileRegex
+
 			$scope.inputs = 
 				name: "name"
 			$scope.state =
diff --git a/services/web/public/coffee/ide/file-tree/controllers/FileTreeEntityController.coffee b/services/web/public/coffee/ide/file-tree/controllers/FileTreeEntityController.coffee
index f0813cf03b..5f627f9121 100644
--- a/services/web/public/coffee/ide/file-tree/controllers/FileTreeEntityController.coffee
+++ b/services/web/public/coffee/ide/file-tree/controllers/FileTreeEntityController.coffee
@@ -26,9 +26,23 @@ define [
 		$scope.startRenaming = () ->
 			$scope.entity.renaming = true
 
+		invalidModalShowing = false
 		$scope.finishRenaming = () ->
-			delete $scope.entity.renaming
 			name = $scope.inputs.name
+			
+			if !name.match(/^[^\*\/]*$/)
+				# Showing the modal blurs the rename box which calls us again
+				# so track this with the invalidModalShowing flag
+				return if invalidModalShowing
+				invalidModalShowing = true
+				modal = $modal.open(
+					templateUrl: "invalidFileNameModalTemplate"
+				)
+				modal.result.then () ->
+					invalidModalShowing = false
+				return
+				
+			delete $scope.entity.renaming
 			if !name? or name.length == 0
 				$scope.inputs.name = $scope.entity.name
 				return