diff --git a/r2/r2/controllers/validator/wiki.py b/r2/r2/controllers/validator/wiki.py index 9a9bf932e..459531124 100644 --- a/r2/r2/controllers/validator/wiki.py +++ b/r2/r2/controllers/validator/wiki.py @@ -165,11 +165,15 @@ def may_view(sr, user, page): return False def normalize_page(page): + # Ensure there is no side effect if page is None + page = page or "" + # Case insensitive page names page = page.lower() - # Normalize path - page = normpath(page) + # Normalize path (And avoid normalizing empty to ".") + if page: + page = normpath(page) # Chop off initial "/", just in case it exists page = page.lstrip('/') @@ -192,23 +196,23 @@ class VWikiPageName(Validator): def run(self, page): original_page = page - if not page: - # If no page is specified, give the index page - page = "index" try: - page = str(page) + page = str(page) if page else "" except UnicodeEncodeError: return self.set_error('INVALID_PAGE_NAME', code=400) if ' ' in page: page = page.replace(' ', '_') - if not page_match_regex.match(page): + if page and not page_match_regex.match(page): return self.set_error('INVALID_PAGE_NAME', code=400) page = normalize_page(page) + # If no page is specified, give the index page + page = page or "index" + if WikiPage.is_impossible(page): return self.set_error('INVALID_PAGE_NAME', code=400) @@ -298,6 +302,10 @@ class VWikiPageRevise(VWikiPage): VWikiPage.__init__(self, param, required=required, *k, **kw) def may_not_create(self, page): + if not page: + # Should not happen, but just in case + self.set_error('EMPTY_PAGE_NAME', 403) + return if c.is_wiki_mod and WikiPage.is_special(page): return {'reason': 'PAGE_CREATED_ELSEWHERE'} elif (not c.user_is_admin) and WikiPage.is_restricted(page): diff --git a/r2/r2/models/wiki.py b/r2/r2/models/wiki.py index 7dac1862e..c1edf9561 100644 --- a/r2/r2/models/wiki.py +++ b/r2/r2/models/wiki.py @@ -195,6 +195,9 @@ class WikiPage(tdb_cassandra.Thing): @classmethod def create(cls, sr, name): + # Sanity check for a page name and subreddit + if not name or not sr: + raise ValueError name = name.lower() kw = dict(sr=sr._id36, name=name, permlevel=0, content='', listed_=False) page = cls(**kw)