Article::test_urlname implemented.

1 files changed, 22 insertions, 1 deletions

diff --git a/ratatoeskr/sys/models.php b/ratatoeskr/sys/models.php
index 3cda168..5d6ee66 100644
--- a/ratatoeskr/sys/models.php
+++ b/ratatoeskr/sys/models.php
@@ -74,6 +74,13 @@ class AlreadyExistsError extends Exception { }
  */
 class NotAllowedError extends Exception { }
 
+/*
+ * Class: InvalidDataError
+ * Exception that will be thrown, if a object with invalid data (e.g. urlname in this form not allowed) should have been saved / created.
+ * Unless something else is said at a function, the exception message is a translation key.
+ */
+class InvalidDataError extends Exception { }
+
 abstract class BySQLRowEnabled
 {
 	protected function __construct() {  }
@@ -2329,6 +2336,11 @@ class Article extends BySQLRowEnabled
 	 */
 	public function get_id() { return $this->id; }
 	
+	private static function test_urlname($urlname)
+	{
+		return (bool) preg_match('/^[a-zA-Z0-9-_]+$/', $urlname);
+	}
+	
 	/*
 	 * Constructor: create
 	 * Create a new Article object.
@@ -2337,12 +2349,15 @@ class Article extends BySQLRowEnabled
 	 * 	urlname - A unique URL name
 	 * 
 	 * Throws:
-	 * 	<AlreadyExistsError>
+	 * 	<AlreadyExistsError>, <InvalidDataError>
 	 */
 	public static function create($urlname)
 	{
 		global $ratatoeskr_settings;
 		
+		if(!self::test_urlname($urlname))
+			throw new InvalidDataError("invalid_urlname");
+		
 		try
 		{
 			self::by_urlname($urlname);
@@ -2622,9 +2637,15 @@ WHERE " . implode(" AND ", $subqueries) . " $sorting");
 	
 	/*
 	 * Function: save
+	 * 
+	 * Throws:
+	 * 	<AlreadyExistsError>, <InvalidDataError>
 	 */
 	public function save()
 	{
+		if(!self::test_urlname($this->urlname))
+			throw new DoesNotExistError("invalid_urlname");
+			
 		$result = qdb("SELECT COUNT(*) AS `n` FROM `PREFIX_articles` WHERE `urlname` = '%s' AND `id` != %d", $this->urlname, $this->id);
 		$sqlrow = mysql_fetch_assoc($result);
 		if($sqlrow["n"] > 0)