Merge pull request #2657 from weseek/add-validate-for-page-duplicate

Add validate for page duplicate

src/server/routes/apiv3/pages.js

@@ -132,14 +132,19 @@ module.exports = (crowi) => {
       body('pageTags').if(value => value != null).isArray().withMessage('pageTags must be array'),
     ],
     renamePage: [
-      body('pageId').exists().withMessage('pageId is required'),
-      body('revisionId').exists().withMessage('revisionId is required'),
-      body('newPagePath').exists().withMessage('newPagePath is required'),
+      body('pageId').isMongoId().withMessage('pageId is required'),
+      body('revisionId').isMongoId().withMessage('revisionId is required'),
+      body('newPagePath').isLength({ min: 1 }).withMessage('newPagePath is required'),
       body('isRenameRedirect').if(value => value != null).isBoolean().withMessage('isRenameRedirect must be boolean'),
       body('isRemainMetadata').if(value => value != null).isBoolean().withMessage('isRemainMetadata must be boolean'),
       body('isRecursively').if(value => value != null).isBoolean().withMessage('isRecursively must be boolean'),
       body('socketClientId').if(value => value != null).isInt().withMessage('socketClientId must be int'),
     ],
+
+    duplicatePage: [
+      body('pageId').isMongoId().withMessage('pageId is required'),
+      body('pageNameInput').trim().isLength({ min: 1 }).withMessage('pageNameInput is required'),
+    ],
   };
 
   async function createPageAction({
@@ -468,7 +473,7 @@ module.exports = (crowi) => {
    *          500:
    *            description: Internal server error.
    */
-  router.post('/duplicate', accessTokenParser, loginRequiredStrictly, csrf, async(req, res) => {
+  router.post('/duplicate', accessTokenParser, loginRequiredStrictly, csrf, validator.duplicatePage, apiV3FormValidator, async(req, res) => {
     const { pageId } = req.body;
 
     const newPagePath = pathUtils.normalizePath(req.body.pageNameInput);
@@ -497,6 +502,7 @@ module.exports = (crowi) => {
     options.grantUserGroupId = page.grantedGroup;
     options.grantedUsers = page.grantedUsers;
 
+
     const createdPage = await createPageAction({
       path: newPagePath, user: req.user, body: page.revision.body, options,
     });