From 2d91d8e185170e5059466a2cc97f1b250d0973f8 Mon Sep 17 00:00:00 2001
From: Josh Pruim <josh@josh-M11x-R2.(none)>
Date: Sat, 1 Dec 2012 18:08:14 -0800
Subject: [PATCH 01/10] Added Fading and stuff

---
 src/templates/index.html | 31 ++++++++++++++++++++++++++++---
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/src/templates/index.html b/src/templates/index.html
index 9fd33a26a..adfc35353 100644
--- a/src/templates/index.html
+++ b/src/templates/index.html
@@ -31,6 +31,7 @@
 
         <meta charset="utf-8"> 
         <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0">
+        <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js"></script>
         <link rel="resource" type="application/l10n" href="locales.ini" />
         <link rel="shortcut icon" href="<%=settings.favicon%>">
         
@@ -157,8 +158,8 @@
 
         <div id="wrapper">
             <div id="inner">
-                <div id="button" onclick="go2Random()" data-l10n-id="index.newPad"></div>
-                <div id="label" data-l10n-id="index.createOpenPad"></div> 
+                <div id="button" onclick="go2Random()" data-l10n-id="index.newPad"><div id="content-btn" data-possible="New Pad,নতুন প্যাড,Neues Pad,Nuevo Pad,Uusi muistio,Nouveau Pad,Nieuw pad"></div></div>
+                <div id="label" data-l10n-id="index.createOpenPad"><div id="newwithname" data-possible="or create/open a Pad with the name:,অথবা নাম লিখে প্যাড খুলুন/তৈরী করুন:,Pad mit folgendem Namen öffnen,o puedes crear/abrir un Pad con el nombre:,tai avaa muistio nimellä:,ou créer/ouvrir un Pad intitulé,Maak of open pad met de naam:"></div></div> 
                 <form action="#" onsubmit="go2Name();return false;"> 
                     <input type="text" id="padname" autofocus x-webkit-speech> 
                     <button type="submit">OK</button>
@@ -168,7 +169,6 @@
 
         <script src="static/custom/index.js"></script>
         <script> 
-      
             function go2Name() 
             {
                 var padname = document.getElementById("padname").value;
@@ -195,5 +195,30 @@
             
             // start the custom js
             if (typeof customStart == "function") customStart();
+
+            var type = $("#content-btn").attr("data-possible").split(",");
+            var type2 = $("#newwithname").attr("data-possible").split(",");
+            var go = 1;
+            var go2 = 1;
+            $("#content-btn").text(type[0]).fadeIn(300).delay(800).fadeOut(300).queue(namer);
+            $("#newwithname").text(type2[0]).fadeIn(300).delay(800).fadeOut(300).queue(namer2);
+            function namer(){
+              $(this).text(type[go]).fadeIn(300).delay(800).fadeOut(300).queue(namer);
+              if(go < type.length - 1){
+                go++;
+              }else{
+                go = 0;
+              }
+                $(this).dequeue();
+            }  
+            function namer2(){
+              $(this).text(type2[go2]).fadeIn(300).delay(800).fadeOut(300).queue(namer2);
+              if(go2 < type2.length - 1){
+                go2++;
+              }else{
+                go2 = 0;
+              }
+                $(this).dequeue();
+            }  
         </script>
 </html>

From 8204b52f55c4f563e645a4727ef72ae298e2dc3b Mon Sep 17 00:00:00 2001
From: Josh Pruim <josh@josh-M11x-R2.(none)>
Date: Sat, 1 Dec 2012 20:18:21 -0800
Subject: [PATCH 02/10] Added Sanitization logic for custom PadIDs

---
 src/templates/index.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/templates/index.html b/src/templates/index.html
index adfc35353..8d75c433c 100644
--- a/src/templates/index.html
+++ b/src/templates/index.html
@@ -171,7 +171,8 @@
         <script> 
             function go2Name() 
             {
-                var padname = document.getElementById("padname").value;
+              
+                var padname = document.getElementById("padname").value.replace(/[^a-z0-9_\-]/gi, '_');
                 padname.length > 0 ? window.location = "p/" + padname : alert("Please enter a name")
             }
  

From 4a43fd7ecb3bef314ac78a6235471926c820deeb Mon Sep 17 00:00:00 2001
From: Josh Pruim <josh@josh-M11x-R2.(none)>
Date: Sat, 1 Dec 2012 20:18:55 -0800
Subject: [PATCH 03/10] Added Sanitization logic for custom PadIDs

---
 src/templates/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/templates/index.html b/src/templates/index.html
index 8d75c433c..e676e8f11 100644
--- a/src/templates/index.html
+++ b/src/templates/index.html
@@ -173,7 +173,7 @@
             {
               
                 var padname = document.getElementById("padname").value.replace(/[^a-z0-9_\-]/gi, '_');
-                padname.length > 0 ? window.location = "p/" + padname : alert("Please enter a name")
+                padname.length > 0 ? window.location = "p/" + padname : alert("Please enter a name");
             }
  
             function go2Random() 

From c44b6eabdd3c729c3490bbce1263ced9135aa288 Mon Sep 17 00:00:00 2001
From: Josh Pruim <josh@josh-M11x-R2.(none)>
Date: Sat, 1 Dec 2012 21:48:47 -0800
Subject: [PATCH 04/10] Added sanitization to API logic

---
 src/node/db/API.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/node/db/API.js b/src/node/db/API.js
index 4979e8c65..8317cb915 100644
--- a/src/node/db/API.js
+++ b/src/node/db/API.js
@@ -331,12 +331,12 @@ exports.createPad = function(padID, text, callback)
     callback(new customError("createPad can't create group pads","apierror"));
     return;
   }
-  
+  padID = padID.replace(/[^a-z0-9_\-]/gi, '_'); 
   //create pad
   getPadSafe(padID, false, text, function(err)
   {
     if(ERR(err, callback)) return;
-    callback();
+    callback(null, {padID: padID});
   });
 }
 

From b81d79e60567d14607913ee04c86abb135b17436 Mon Sep 17 00:00:00 2001
From: Josh Pruim <josh@josh-M11x-R2.(none)>
Date: Sat, 1 Dec 2012 22:00:06 -0800
Subject: [PATCH 05/10] Pulled back to reflect branch titling.

---
 src/templates/index.html | 31 +++----------------------------
 1 file changed, 3 insertions(+), 28 deletions(-)

diff --git a/src/templates/index.html b/src/templates/index.html
index e676e8f11..2eb5fb0fe 100644
--- a/src/templates/index.html
+++ b/src/templates/index.html
@@ -42,7 +42,7 @@
               if(language) document.documentElement.lang = language[1];
             })(document)
         </script>
-        <script type="text/javascript" src="static/js/l10n.js" async></script>
+        <script type="text/javascript" src="static/js/l10n.js"></script>
 
         <style>
             html, body {
@@ -158,8 +158,8 @@
 
         <div id="wrapper">
             <div id="inner">
-                <div id="button" onclick="go2Random()" data-l10n-id="index.newPad"><div id="content-btn" data-possible="New Pad,নতুন প্যাড,Neues Pad,Nuevo Pad,Uusi muistio,Nouveau Pad,Nieuw pad"></div></div>
-                <div id="label" data-l10n-id="index.createOpenPad"><div id="newwithname" data-possible="or create/open a Pad with the name:,অথবা নাম লিখে প্যাড খুলুন/তৈরী করুন:,Pad mit folgendem Namen öffnen,o puedes crear/abrir un Pad con el nombre:,tai avaa muistio nimellä:,ou créer/ouvrir un Pad intitulé,Maak of open pad met de naam:"></div></div> 
+                <div id="button" onclick="go2Random()" data-l10n-id="index.newPad"></div>
+                <div id="label" data-l10n-id="index.createOpenPad"></div> 
                 <form action="#" onsubmit="go2Name();return false;"> 
                     <input type="text" id="padname" autofocus x-webkit-speech> 
                     <button type="submit">OK</button>
@@ -196,30 +196,5 @@
             
             // start the custom js
             if (typeof customStart == "function") customStart();
-
-            var type = $("#content-btn").attr("data-possible").split(",");
-            var type2 = $("#newwithname").attr("data-possible").split(",");
-            var go = 1;
-            var go2 = 1;
-            $("#content-btn").text(type[0]).fadeIn(300).delay(800).fadeOut(300).queue(namer);
-            $("#newwithname").text(type2[0]).fadeIn(300).delay(800).fadeOut(300).queue(namer2);
-            function namer(){
-              $(this).text(type[go]).fadeIn(300).delay(800).fadeOut(300).queue(namer);
-              if(go < type.length - 1){
-                go++;
-              }else{
-                go = 0;
-              }
-                $(this).dequeue();
-            }  
-            function namer2(){
-              $(this).text(type2[go2]).fadeIn(300).delay(800).fadeOut(300).queue(namer2);
-              if(go2 < type2.length - 1){
-                go2++;
-              }else{
-                go2 = 0;
-              }
-                $(this).dequeue();
-            }  
         </script>
 </html>

From 3d085f168a6addaddad3745cf6f0a3702731231c Mon Sep 17 00:00:00 2001
From: Josh Pruim <josh@josh-M11x-R2.(none)>
Date: Sat, 1 Dec 2012 22:09:09 -0800
Subject: [PATCH 06/10] Removed artifacts from accidental commits.

---
 src/templates/index.html | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/templates/index.html b/src/templates/index.html
index 2eb5fb0fe..368aa3a80 100644
--- a/src/templates/index.html
+++ b/src/templates/index.html
@@ -31,7 +31,6 @@
 
         <meta charset="utf-8"> 
         <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0">
-        <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js"></script>
         <link rel="resource" type="application/l10n" href="locales.ini" />
         <link rel="shortcut icon" href="<%=settings.favicon%>">
         

From 604b785ddeb019c4d339572d9909495666267cc2 Mon Sep 17 00:00:00 2001
From: Josh Pruim <josh@josh-M11x-R2.(none)>
Date: Sat, 1 Dec 2012 22:25:54 -0800
Subject: [PATCH 07/10] Added in better regex.

---
 src/node/db/API.js       | 2 +-
 src/templates/index.html | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/node/db/API.js b/src/node/db/API.js
index 8317cb915..900ca8025 100644
--- a/src/node/db/API.js
+++ b/src/node/db/API.js
@@ -331,7 +331,7 @@ exports.createPad = function(padID, text, callback)
     callback(new customError("createPad can't create group pads","apierror"));
     return;
   }
-  padID = padID.replace(/[^a-z0-9_\-]/gi, '_'); 
+  padID = padID.replace(/[;\/\?:@&=\+\$,{}\\\^\[\]\`\|]/gi, '_'); 
   //create pad
   getPadSafe(padID, false, text, function(err)
   {
diff --git a/src/templates/index.html b/src/templates/index.html
index 368aa3a80..62a590a87 100644
--- a/src/templates/index.html
+++ b/src/templates/index.html
@@ -171,7 +171,7 @@
             function go2Name() 
             {
               
-                var padname = document.getElementById("padname").value.replace(/[^a-z0-9_\-]/gi, '_');
+                var padname = document.getElementById("padname").value.replace(/[;\/\?:@&=\+\$,{}\\\^\[\]\`\|]/gi, '_');
                 padname.length > 0 ? window.location = "p/" + padname : alert("Please enter a name");
             }
  

From 6c3bcb33c0153a2ad35dcc10be6412847ee43c18 Mon Sep 17 00:00:00 2001
From: Josh Pruim <josh@josh-M11x-R2.(none)>
Date: Sat, 1 Dec 2012 22:29:48 -0800
Subject: [PATCH 08/10] Added in an even better regex.

---
 src/node/db/API.js       | 2 +-
 src/templates/index.html | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/node/db/API.js b/src/node/db/API.js
index 900ca8025..cd0835b4f 100644
--- a/src/node/db/API.js
+++ b/src/node/db/API.js
@@ -331,7 +331,7 @@ exports.createPad = function(padID, text, callback)
     callback(new customError("createPad can't create group pads","apierror"));
     return;
   }
-  padID = padID.replace(/[;\/\?:@&=\+\$,{}\\\^\[\]\`\|]/gi, '_'); 
+  padID = padID.replace(/[;\/\?:@&=\+\$,{}\\\^\[\]\`\|%<>\*#]/gi, '_'); 
   //create pad
   getPadSafe(padID, false, text, function(err)
   {
diff --git a/src/templates/index.html b/src/templates/index.html
index 62a590a87..950c28b64 100644
--- a/src/templates/index.html
+++ b/src/templates/index.html
@@ -171,7 +171,7 @@
             function go2Name() 
             {
               
-                var padname = document.getElementById("padname").value.replace(/[;\/\?:@&=\+\$,{}\\\^\[\]\`\|]/gi, '_');
+                var padname = document.getElementById("padname").value.replace(/[;\/\?:@&=\+\$,{}\\\^\[\]\`\|%<>\*#]/gi, '_');
                 padname.length > 0 ? window.location = "p/" + padname : alert("Please enter a name");
             }
  

From 322f652501e7a5dd20795596f702aa5fe78c176d Mon Sep 17 00:00:00 2001
From: Josh Pruim <josh@josh-M11x-R2.(none)>
Date: Sat, 1 Dec 2012 23:11:05 -0800
Subject: [PATCH 09/10] Updated APIDocs to reflect light API tweak

---
 doc/api/http_api.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/api/http_api.md b/doc/api/http_api.md
index 990d1b498..b10178fb7 100644
--- a/doc/api/http_api.md
+++ b/doc/api/http_api.md
@@ -295,10 +295,10 @@ Group pads are normal pads, but with the name schema GROUPID$PADNAME. A security
 #### createPad(padID [, text])
  * API >= 1
 
-creates a new (non-group) pad.  Note that if you need to create a group Pad, you should call **createGroupPad**.
+creates a new (non-group) pad.  Note that if you need to create a group Pad, you should call **createGroupPad**. Returns the actual PadID that was recorded (Checked against a regex so that nothing breaks when accessed.)
 
 *Example returns:*
-  * `{code: 0, message:"ok", data: null}`
+  * `{code: 0, message:"ok", data: {"padID":"asdf_as_d"}}`
   * `{code: 1, message:"pad does already exist", data: null}`
 
 #### getRevisionsCount(padID)

From e82924b4ebadca75c6db06c2bc475b6072f1c238 Mon Sep 17 00:00:00 2001
From: itguy51 <me@joshpruim.com>
Date: Sun, 2 Dec 2012 19:32:25 -0800
Subject: [PATCH 10/10] Made routing behave and disallow funky PadIDs.

---
 src/node/hooks/express/specialpages.js | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/node/hooks/express/specialpages.js b/src/node/hooks/express/specialpages.js
index 440024614..6deb8650d 100644
--- a/src/node/hooks/express/specialpages.js
+++ b/src/node/hooks/express/specialpages.js
@@ -27,7 +27,11 @@ exports.expressCreateServer = function (hook_name, args, cb) {
   //serve pad.html under /p
   args.app.get('/p/:pad', function(req, res, next)
   {    
-    res.send(eejs.require("ep_etherpad-lite/templates/pad.html", {req: req}));
+    /*if(!!(req.params.pad.match(/[;\/\?:@&=\+\$,{}\\\^\[\]\`\|%<>\*#]/gi))){
+      res.send(404, "Such a padname is forbidden");
+    }else{*/
+      res.send(eejs.require("ep_etherpad-lite/templates/pad.html", {req: req}));
+    //}
   });
 
   //serve timeslider.html under /p/$padname/timeslider
@@ -35,7 +39,16 @@ exports.expressCreateServer = function (hook_name, args, cb) {
   {
     res.send(eejs.require("ep_etherpad-lite/templates/timeslider.html", {req: req}));
   });
-
+  args.app.get('/p/:pad/*', function(req, res, next)
+  {
+    if(req.url.split("/")[3] == "timeslider"){
+      //Just a safeguard, sometimes these URLs get messed up and should be
+      //actually rerouted to the timeslider instead of an error page.
+      res.send(eejs.require("ep_etherpad-lite/templates/timeslider.html", {req: req}));
+    }else{
+      res.send(404, "Such a padname is forbidden");
+    }
+  });
   //serve favicon.ico from all path levels except as a pad name
   args.app.get( /\/favicon.ico$/, function(req, res)
   {