diff options
| author | historia <[not public]> | 2026-09-18 17:48:26 -0400 |
|---|---|---|
| committer | historia <[not public]> | 2026-09-18 17:48:26 -0400 |
| commit | 8fe9e3c3fef0049df82281a62afe35dda516dfe2 (patch) | |
| tree | dd269f2c0710f334e19f00a191260ebc46284a90 /internal/admin/api_modules.go | |
| parent | 194164a77eb4f2479b94c19e6f0e1278ab608781 (diff) | |
| download | thehouseoficarus-8fe9e3c3fef0049df82281a62afe35dda516dfe2.tar.gz | |
fix: close combat ghost, admin traversal, login throttle, journal double-pay, and quality/economy gaps
Diffstat (limited to 'internal/admin/api_modules.go')
| -rw-r--r-- | internal/admin/api_modules.go | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/internal/admin/api_modules.go b/internal/admin/api_modules.go index 1d8c25b..8356b2d 100644 --- a/internal/admin/api_modules.go +++ b/internal/admin/api_modules.go @@ -30,6 +30,10 @@ func (s *AdminServer) handleModules(w http.ResponseWriter, r *http.Request) { failJSON(w, "missing id") return } + if !validEntityID(id) { + failJSON(w, "invalid id") + return + } delete(m, "id") path := filepath.Join(s.dataDir, "modules", id+".yaml") if _, err := os.Stat(path); err == nil { |