closes #5262

src/groups.js

@@ -57,30 +57,24 @@ var utils = require('../public/src/utils');
 	};
 
 	Groups.getGroupsFromSet = function (set, uid, start, stop, callback) {
-		var method;
-		var args;
+		async.waterfall([
+			function (next) {
 				if (set === 'groups:visible:name') {
-			method = db.getSortedSetRangeByLex;
-			args = [set, '-', '+', start, stop - start + 1, done];
+					db.getSortedSetRangeByLex(set, '-', '+', start, stop - start + 1, next);
 				} else {
-			method = db.getSortedSetRevRange;
-			args = [set, start, stop, done];
-		}
-		method.apply(null, args);
-
-		function done(err, groupNames) {
-			if (err) {
-				return callback(err);
+					db.getSortedSetRevRange(set, start, stop, next);
 				}
-
+			},
+			function (groupNames, next) {
 				if (set === 'groups:visible:name') {
 					groupNames = groupNames.map(function (name) {
 						return name.split(':')[1];
 					});
 				}
 
-			Groups.getGroupsAndMembers(groupNames, callback);
+				Groups.getGroupsAndMembers(groupNames, next);
 			}
+		], callback);
 	};
 
 	Groups.getGroups = function (set, start, stop, callback) {

src/groups/create.js

@@ -92,6 +92,10 @@ module.exports = function (Groups) {
 			return callback(new Error('[[error:group-name-too-long]]'));
 		}
 
+		if (!Groups.isPrivilegeGroup(name) && name.indexOf(':') !== -1) {
+			return callback(new Error('[[error:invalid-group-name]]'));
+		}
+
 		if (name.indexOf('/') !== -1 || !utils.slugify(name)) {
 			return callback(new Error('[[error:invalid-group-name]]'));
 		}

test/groups.js

@@ -255,6 +255,13 @@ describe('Groups', function () {
 				done();
 			});
 		});
+
+		it('should fail if group name is invalid', function (done) {
+			Groups.create({name: 'not:valid'}, function (err) {
+				assert.equal(err.message, '[[error:invalid-group-name]]');
+				done();
+			});
+		});
 	});
 
 	describe('.hide()', function () {