fix: economy recovery double-refund/erased-liability/cap-drops, entity editor path traversal

1 files changed, 8 insertions, 0 deletions

diff --git a/internal/admin/api_objects.go b/internal/admin/api_objects.go
index 340c87c..8f9eac5 100644
--- a/internal/admin/api_objects.go
+++ b/internal/admin/api_objects.go
@@ -33,6 +33,10 @@ func (s *AdminServer) handleObjectByID(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, `{"error":"missing object id"}`, http.StatusBadRequest)
 		return
 	}
+	if !validEntityID(id) {
+		http.Error(w, `{"error":"invalid object id"}`, http.StatusBadRequest)
+		return
+	}
 
 	switch r.Method {
 	case http.MethodGet:
@@ -142,6 +146,10 @@ func (s *AdminServer) createObject(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, `{"error":"missing object id"}`, http.StatusBadRequest)
 		return
 	}
+	if !validEntityID(id) {
+		http.Error(w, `{"error":"invalid object id"}`, http.StatusBadRequest)
+		return
+	}
 
 	if _, _, err := s.findObjectFile(id); err == nil {
 		http.Error(w, `{"error":"object already exists"}`, http.StatusConflict)