diff options
| author | historia <[not public]> | 2026-09-18 17:48:26 -0400 |
|---|---|---|
| committer | historia <[not public]> | 2026-09-18 17:48:26 -0400 |
| commit | 8fe9e3c3fef0049df82281a62afe35dda516dfe2 (patch) | |
| tree | dd269f2c0710f334e19f00a191260ebc46284a90 /internal/admin/api_techs.go | |
| parent | 194164a77eb4f2479b94c19e6f0e1278ab608781 (diff) | |
| download | thehouseoficarus-8fe9e3c3fef0049df82281a62afe35dda516dfe2.tar.gz | |
fix: close combat ghost, admin traversal, login throttle, journal double-pay, and quality/economy gaps
Diffstat (limited to 'internal/admin/api_techs.go')
| -rw-r--r-- | internal/admin/api_techs.go | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/internal/admin/api_techs.go b/internal/admin/api_techs.go index 91eb929..9e742e1 100644 --- a/internal/admin/api_techs.go +++ b/internal/admin/api_techs.go @@ -38,6 +38,10 @@ func (s *AdminServer) handleTechs(w http.ResponseWriter, r *http.Request) { failJSON(w, "missing id") return } + if !validEntityID(id) { + failJSON(w, "invalid id") + return + } delete(m, "id") if _, _, err := s.findTechFile(id); err == nil { failJSON(w, "tech already exists") |