Restricted the creation of pages with 'not creatable' paths via the API

apps/app/src/server/routes/apiv3/pages.js

@@ -303,6 +303,10 @@ module.exports = (crowi) => {
     // check whether path starts slash
     path = addHeadingSlash(path);
 
+    if (!isCreatablePage(path)) {
+      return res.apiv3Err(`Could not use the path '${path}'`);
+    }
+
     if (isUserPage(path)) {
       const isExistUser = await User.isExistUserByUserPagePath(path);
       if (!isExistUser) {

apps/app/src/server/routes/attachment.js

@@ -1,4 +1,4 @@
-import { isUserPage } from '@growi/core/dist/utils/page-path-utils';
+import { isCreatablePage, isUserPage } from '@growi/core/dist/utils/page-path-utils';
 
 import { SupportedAction } from '~/interfaces/activity';
 import { AttachmentType } from '~/server/interfaces/attachment';
@@ -471,6 +471,10 @@ module.exports = function(crowi, app) {
     if (pageId == null) {
       logger.debug('Create page before file upload');
 
+      if (!isCreatablePage(pagePath)) {
+        return res.json(ApiResponse.error(`Could not use the path '${pagePath}'`));
+      }
+
       if (isUserPage(pagePath)) {
         const isExistUser = await User.isExistUserByUserPagePath(pagePath);
         if (!isExistUser) {