closes #5262

src/groups.js

@@ -57,30 +57,24 @@ var utils = require('../public/src/utils');
 	};
 
 	Groups.getGroupsFromSet = function (set, uid, start, stop, callback) {
-		var method;
+		async.waterfall([
-		var args;
+			function (next) {
-		if (set === 'groups:visible:name') {
+				if (set === 'groups:visible:name') {
-			method = db.getSortedSetRangeByLex;
+					db.getSortedSetRangeByLex(set, '-', '+', start, stop - start + 1, next);
-			args = [set, '-', '+', start, stop - start + 1, done];
+				} else {
-		} else {
+					db.getSortedSetRevRange(set, start, stop, next);
-			method = db.getSortedSetRevRange;
+				}
-			args = [set, start, stop, done];
+			},
-		}
+			function (groupNames, next) {
-		method.apply(null, args);
+				if (set === 'groups:visible:name') {
-
+					groupNames = groupNames.map(function (name) {
-		function done(err, groupNames) {
+						return name.split(':')[1];
-			if (err) {
+					});
-				return callback(err);
+				}
-			}
 
-			if (set === 'groups:visible:name') {
+				Groups.getGroupsAndMembers(groupNames, next);
-				groupNames = groupNames.map(function (name) {
-					return name.split(':')[1];
-				});
 			}
-
+		], callback);
-			Groups.getGroupsAndMembers(groupNames, callback);
-		}
 	};
 
 	Groups.getGroups = function (set, start, stop, callback) {

src/groups/create.js

@@ -92,6 +92,10 @@ module.exports = function (Groups) {
 			return callback(new Error('[[error:group-name-too-long]]'));
 		}
 
+		if (!Groups.isPrivilegeGroup(name) && name.indexOf(':') !== -1) {
+			return callback(new Error('[[error:invalid-group-name]]'));
+		}
+
 		if (name.indexOf('/') !== -1 || !utils.slugify(name)) {
 			return callback(new Error('[[error:invalid-group-name]]'));
 		}

test/groups.js

@@ -255,6 +255,13 @@ describe('Groups', function () {
 				done();
 			});
 		});
+
+		it('should fail if group name is invalid', function (done) {
+			Groups.create({name: 'not:valid'}, function (err) {
+				assert.equal(err.message, '[[error:invalid-group-name]]');
+				done();
+			});
+		});
 	});
 
 	describe('.hide()', function () {