Avoid slash in role name (#4442)

OrchardCMS · Oct 10, 2019 · 6ad22b3 · 6ad22b3
1 parent 52cbccc
commit 6ad22b3
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/OrchardCore.Modules/OrchardCore.Roles/Controllers/AdminController.cs b/src/OrchardCore.Modules/OrchardCore.Roles/Controllers/AdminController.cs
@@ -98,6 +98,11 @@ public async Task<IActionResult> Create(CreateRoleViewModel model)
             {
                 model.RoleName = model.RoleName.Trim();
 
+                if (model.RoleName.Contains("/"))
+                {
+                    ModelState.AddModelError(string.Empty, T["Invalid role name."]);
+                }
+
                 if (await _roleManager.FindByNameAsync(_roleManager.NormalizeKey(model.RoleName)) != null)
                 {
                     ModelState.AddModelError(string.Empty, T["The role is already used."]);