diff --git a/forms.py b/forms.py
index b9616ebe4a..5a4141c27d 100644
--- a/forms.py
+++ b/forms.py
@@ -5,6 +5,9 @@ from django.utils.translation import ugettext_lazy as _
 from seaserv import ccnet_rpc, ccnet_threaded_rpc, is_valid_filename
 
 from seahub.base.accounts import User
+from pysearpc import SearpcError
+
+import settings
 
 class AddUserForm(forms.Form):
     """
@@ -95,4 +98,51 @@ class RepoCreateForm(forms.Form):
                 if passwd != passwd_again:
                     raise forms.ValidationError("两次输入的密码不一致")
         return self.cleaned_data
-    
+
+
+class RepoNewFileForm(forms.Form):
+    """
+    Form for create a new empty file
+    """
+    repo_id = forms.CharField(error_messages={'required': '参数错误'})
+    parent_dir = forms.CharField(error_messages={'required': '参数错误'})
+    new_file_name = forms.CharField(max_length=settings.MAX_UPLOAD_FILE_NAME_LEN,
+                                error_messages={
+                                    'max_length': '新文件名太长',
+                                    'required': '新文件名不能为空',
+                                })
+
+    def clean_new_file_name(self):
+        new_file_name = self.cleaned_data['new_file_name']
+        try:
+            if not is_valid_filename(new_file_name):
+                error_msg = u"您输入的文件名 %s 包含非法字符" % new_file_name
+                raise forms.ValidationError(error_msg)
+            else:
+                return new_file_name
+        except SearpcError, e:
+            raise forms.ValidationError(str(e))
+
+class RepoNewDirForm(forms.Form):
+    """
+    Form for create a new empty dir
+    """
+    repo_id = forms.CharField(error_messages={'required': '参数错误'})
+    parent_dir = forms.CharField(error_messages={'required': '参数错误'})
+    new_dir_name = forms.CharField(max_length=settings.MAX_UPLOAD_FILE_NAME_LEN,
+                                error_messages={
+                                    'max_length': '新目录名太长',
+                                    'required': '新目录名不能为空',
+                            })
+
+    def clean_new_dir_name(self):
+        new_dir_name = self.cleaned_data['new_dir_name']
+        try:
+            if not is_valid_filename(new_dir_name):
+                error_msg = u"您输入的目录名 %s 包含非法字符" % new_dir_name
+                raise forms.ValidationError(error_msg)
+            else:
+                return new_dir_name
+        except SearpcError, e:
+            raise forms.ValidationError(str(e))
+
diff --git a/templates/repo.html b/templates/repo.html
index 497c4dc41c..96bb4ea68e 100644
--- a/templates/repo.html
+++ b/templates/repo.html
@@ -196,12 +196,12 @@
     </div>
 
 {% if not view_history %}
-    <form id="add-new-dir-form" action="{{ SITE_ROOT}}repo/new_dir/" method="post" class="hide">
+    <form id="add-new-dir-form" action="{{ SITE_ROOT}}repo/new_dir/" method="post" class="hide">{% csrf_token %}
         <h4>新目录名称：</h4>
         <input type="hidden" name="repo_id" value="{{ repo.id }}" />
         <input type="hidden" name="parent_dir" value="{{ path }}" />
         <input type="text" name="new_dir_name" value="" /><br />
-        <p class="error hide">输入不能为空。</p>
+        <p class="error hide">输入不能为空</p>
         <input type="submit" value="提交" class="submit" />
         <button class="simplemodal-close">取消</button>
     </form>
@@ -211,7 +211,7 @@
         <input type="hidden" name="repo_id" value="{{ repo.id }}" />
         <input type="hidden" name="parent_dir" value="{{ path }}" />
         <input type="text" name="new_file_name" value="" /><br />
-        <p class="error hide">输入不能为空。</p>
+        <p class="error hide">输入不能为空</p>
         <input type="submit" value="提交" class="submit" />
         <button class="simplemodal-close">取消</button>
     </form>
diff --git a/views.py b/views.py
index 8fffec286b..99b2e6d7ce 100644
--- a/views.py
+++ b/views.py
@@ -42,7 +42,7 @@ from seahub.contacts.models import Contact
 from seahub.contacts.signals import mail_sended
 from seahub.notifications.models import UserNotification
 from seahub.organizations.utils import access_org_repo
-from forms import AddUserForm, FileLinkShareForm, RepoCreateForm
+from forms import AddUserForm, FileLinkShareForm, RepoCreateForm, RepoNewDirForm, RepoNewFileForm
 from utils import render_permission_error, render_error, list_to_string, \
     get_httpserver_root, get_ccnetapplet_root, gen_token, \
     calculate_repo_last_modify, valid_previewed_file, \
@@ -1484,28 +1484,15 @@ def file_upload_progress_page(request):
 
 @login_required        
 def repo_new_dir(request):        
-    repo_id         = request.POST.get("repo_id")
-    parent_dir      = request.POST.get("parent_dir")
-    new_dir_name    = request.POST.get("new_dir_name")
-    user            = request.user.username
 
-    if not new_dir_name:
-        error_msg = u"请输入新目录名"
-        return render_error(request, error_msg)
-
-    if not (repo_id and parent_dir and user):
-        return render_error(request)
-
-    if len(new_dir_name) > settings.MAX_UPLOAD_FILE_NAME_LEN:
-        error_msg = u"您输入的目录名称过长"
-        return render_error (request, error_msg)
-
-    try:
-        if not is_valid_filename(new_dir_name):
-            error_msg = (u"您输入的目录名称 %s 包含非法字符" % new_dir_name)
-            return render_error (request, error_msg)
-    except SearpcError,e:
-            return render_error (request, e.msg)
+    form = RepoNewDirForm(request.POST)
+    if form.is_valid():
+        repo_id       = form.cleaned_data["repo_id"]
+        parent_dir    = form.cleaned_data["parent_dir"]
+        new_dir_name = form.cleaned_data["new_dir_name"]
+        user          = request.user.username
+    else:
+        return render_error(request, form.errors.values()[0])
 
     new_dir_name = check_filename_with_rename(repo_id, parent_dir, new_dir_name)
 
@@ -1519,29 +1506,16 @@ def repo_new_dir(request):
     
 @login_required        
 def repo_new_file(request):        
-    repo_id         = request.POST.get("repo_id")
-    parent_dir      = request.POST.get("parent_dir")
-    new_file_name   = request.POST.get("new_file_name")
-    user            = request.user.username
-
-    if not new_file_name:
-        error_msg = u"请输入文件名"
-        return render_error(request, error_msg)
-
-    if not (repo_id and parent_dir and user):
-        return render_error(request)
-
-    if len(new_file_name) > settings.MAX_UPLOAD_FILE_NAME_LEN:
-        error_msg = u"您输入的文件名过长"
-        return render_error (request, error_msg)
-
-    try:
-        if not is_valid_filename(new_file_name):
-            error_msg = (u"您输入的文件 %s 包含非法字符" % new_file_name)
-            return render_error (request, error_msg)
-    except SearpcError,e:
-            return render_error (request, e.msg)
 
+    form = RepoNewFileForm(request.POST)
+    if form.is_valid():
+        repo_id       = form.cleaned_data["repo_id"]
+        parent_dir    = form.cleaned_data["parent_dir"]
+        new_file_name = form.cleaned_data["new_file_name"]
+        user          = request.user.username
+    else:
+        return render_error(request, form.errors.values()[0])
+        
     new_file_name = check_filename_with_rename(repo_id, parent_dir, new_file_name)
 
     try: