gistfile.diff

diff --git a/app.rb b/app.rb
index ae74307..75f43f2 100644
--- a/app.rb
+++ b/app.rb
@@ -505,6 +505,21 @@ class Razor::App < Sinatra::Base
 
   command :create_repo do |data|
     check_permissions! "commands:create-repo:#{data['name']}"
+    
+    unless data['name'].is_a? String
+      error 400, :error => I18n::t("create_repo.name.must_be_string", :class => friendly_class(data['name']))
+    end
+
+    unless data['name'] ~= HORRENDOUS_REGEXP
+      error 400, :error => I18n::t("create_repo.name.invalid_chars", :value => data['name'])
+    end
 
     # Create our shiny new repo.  This will implicitly, thanks to saving
     # changes, trigger our loading saga to begin.  (Which takes place in the

The actual calls to 'error' should probably make sure machine-readable info winds up in the error, too; i.e. more something like

error 400, :message => I18N::t(...), :param => 'name', :error => 'invalid_chars'