<commit_before>var errorResponses = require('./errors.js'),
  formatItem = require('./itemFormatter.js');

module.exports = exports = function (core, parameters, router) {
  router.post('/', function (request, response) {
    request.model[parameters.modelName].canCreate(request.user, function (error, canCreate, ownerFieldName) {
      if (error) {
        throw error;
      } else {
        if (canCreate) {
          var item = new request.model[parameters.modelName](request.body); //todo - not sure. setters are better?
          ownerFieldName = ownerFieldName || 'owner';
          item[ownerFieldName] = request.user._id;
          item.save(function (error, itemCreated) {
            if (error) {
              throw error;
            } else {
              response.status(201);
              response.set('Location', parameters.mountPoint + '/' + itemCreated.id);
              formatItem(itemCreated, core, request, response);
            }
          });
        } else {
          if (request.user) {
            errorResponses.error403(response);
          } else {
            errorResponses.error401(response);
          }
        }
      }
    });
  });
};<commit_msg>more secure way of creating items<commit_after>var errorResponses = require('./errors.js'),
  formatItem = require('./itemFormatter.js');

module.exports = exports = function (core, parameters, router) {
  router.post('/', function (request, response) {
    request.model[parameters.modelName].canCreate(request.user, function (error, canCreate, ownerFieldName) {
      if (error) {
        throw error;
      } else {
        if (canCreate) {
          var item = new request.model[parameters.modelName](); //todo - not sure. setters are better?
          ownerFieldName = ownerFieldName || 'owner';
          item[ownerFieldName] = request.user._id;
          item.canUpdate(request.user, function (error, updateAllowed, settersToUse) {
            if (error) {
              throw error;
            } else {
              if (updateAllowed) {
                settersToUse.map(function(setter){
                  item.set(''+setter, request.body[setter]);
                });
                item.save(function (error, itemCreated) {
                  if (error) {
                    throw error;
                  } else {
                    response.status(201);
                    response.set('Location', parameters.mountPoint + '/' + itemCreated.id);
                    formatItem(itemCreated, core, request, response);
                  }
                });
              } else {
                if (request.user) {
                  errorResponses.error403(response);
                } else {
                  errorResponses.error401(response);
                }
              }
            }
          });
        } else {
          if (request.user) {
            errorResponses.error403(response);
          } else {
            errorResponses.error401(response);
          }
        }
      }
    });
  });
};
{'fraction_non_alphanumeric': 0.121232196091421, 'fraction_numerical': 0.007949652202716132, 'mean_word_length': 1.6702033598585322, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7168566', 'n_tokens_mistral': 808, 'n_tokens_neox': 776, 'n_words': 154}