fix: harden triggers, economy, casino, world data, and admin/net paths

1 files changed, 10 insertions, 0 deletions

diff --git a/internal/admin/api_map.go b/internal/admin/api_map.go
index 5eac385..d0372df 100644
--- a/internal/admin/api_map.go
+++ b/internal/admin/api_map.go
@@ -24,6 +24,16 @@ func (s *AdminServer) handleMap(w http.ResponseWriter, r *http.Request) {
 	}
 
 	dir := r.URL.Query().Get("dir")
+	if dir != "" {
+		// Route the map's directory through the same guard every other room
+		// API uses, so ?dir=../../.. cannot read/walk outside data/rooms.
+		clean, err := s.resolveRoomSubdir(dir)
+		if err != nil {
+			failJSON(w, err.Error())
+			return
+		}
+		dir = clean
+	}
 	seed := s.cfg.StartingRoom
 	if dir != "" {
 		if low, ok := findLowestLoadableRoom(s, dir); ok {