diff options
| author | historia <[not public]> | 2026-09-16 21:35:55 -0400 |
|---|---|---|
| committer | historia <[not public]> | 2026-09-16 21:35:55 -0400 |
| commit | fea2cc6839ec3ee17940a2dea69622dc6f4deabf (patch) | |
| tree | 9d893525ca20d2cc920e9e866f84f71b605d8ae9 /internal/admin/api_room_courses.go | |
| parent | 35ddd0ad2215760bb1d3dc7724480f179ea33fa6 (diff) | |
| download | thehouseoficarus-fea2cc6839ec3ee17940a2dea69622dc6f4deabf.tar.gz | |
fix: unify crafting ingredient resolution; fix superheat alternatives, quantity gates, and dropped combine byproducts
Diffstat (limited to 'internal/admin/api_room_courses.go')
| -rw-r--r-- | internal/admin/api_room_courses.go | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/internal/admin/api_room_courses.go b/internal/admin/api_room_courses.go index bebacff..5a33e6a 100644 --- a/internal/admin/api_room_courses.go +++ b/internal/admin/api_room_courses.go @@ -321,6 +321,13 @@ func (s *AdminServer) handleRoomAttachCourse(w http.ResponseWriter, r *http.Requ failJSON(w, "missing course_id") return } + // Course IDs join into file paths under data/courses, so an unchecked + // id ("../../x") could write course YAML outside the data directory. + // Same rule as every other entity route (see validEntityID). + if !validEntityID(body.CourseID) { + failJSON(w, "invalid course_id") + return + } m, _, path, err := s.loadCourseMap(body.CourseID) if err != nil { failJSON(w, "course not found: "+body.CourseID) |