fix: economy recovery double-refund/erased-liability/cap-drops, entity editor path traversal

1 files changed, 8 insertions, 0 deletions

diff --git a/internal/admin/api_room_courses.go b/internal/admin/api_room_courses.go
index 097b9e8..47e4d8c 100644
--- a/internal/admin/api_room_courses.go
+++ b/internal/admin/api_room_courses.go
@@ -153,6 +153,10 @@ func (s *AdminServer) handleCourses(w http.ResponseWriter, r *http.Request) {
 			writeJSON(w, map[string]any{"error": "missing id"})
 			return
 		}
+		if !validEntityID(id) {
+			writeJSON(w, map[string]any{"error": "invalid id"})
+			return
+		}
 		delete(body, "id")
 		path := s.courseFilePath(id)
 		if _, err := os.Stat(path); err == nil {
@@ -186,6 +190,10 @@ func (s *AdminServer) handleCourseByID(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, map[string]any{"error": "missing id"})
 		return
 	}
+	if !validEntityID(id) {
+		writeJSON(w, map[string]any{"error": "invalid id"})
+		return
+	}
 	path := s.courseFilePath(id)
 
 	switch r.Method {