add some client side validation to make sure org/course/run is URL sage

cms/static/js/base.js

@@ -653,6 +653,20 @@ function saveNewCourse(e) {
 
     bInErr = (display_name_errMsg || org_errMsg || number_errMsg || run_errMsg);
 
+    // check for suitable encoding
+    if (!bInErr) {
+        encoding_errMsg = gettext('Please do not use any spaces or special characters in this field.');
+
+        if (encodeURIComponent(org) != org)
+            org_errMsg = encoding_errMsg;
+        if (encodeURIComponent(number) != number)
+            number_errMsg = encoding_errMsg;
+        if (encodeURIComponent(run) != run)
+            run_errMsg = encoding_errMsg;
+
+        bInErr = (display_name_errMsg || org_errMsg || number_errMsg || run_errMsg);
+    }
+
     header_err_msg = (bInErr) ? gettext('Please correct the fields below.') : null;
 
     setNewCourseErrMsgs(header_err_msg, display_name_errMsg, org_errMsg, number_errMsg, run_errMsg);

cms/templates/index.html

@@ -67,7 +67,7 @@
               <li class="field field-inline text required" id="field-course-number">
                 <label for="new-course-number">${_("Course Number")}</label>
                 <input class="new-course-number" id="new-course-number" type="text" name="new-course-number" aria-required="true" placeholder="${_('e.g. CS101')}" />
-                <span class="tip tip-stacked">${_("The unique number that identifies your course within your organization")} - <strong>${_("Note: This cannot be changed")}</strong></span>
+                <span class="tip tip-stacked">${_("The unique number that identifies your course within your organization")} - <strong>${_("Note: No spaces or special characters are allowed. This cannot be changed")}</strong></span>
               </li>
 
               <li class="field field-inline text required" id="field-course-run">