diff options
| author | historia <[not public]> | 2026-09-16 02:14:02 -0400 |
|---|---|---|
| committer | historia <[not public]> | 2026-09-16 02:14:02 -0400 |
| commit | ad60843fbf577eda80105e3916822d663aaefcb3 (patch) | |
| tree | 68092a6403fdb2992ef92cfe0e2dd62b479935aa /internal/admin/server.go | |
| parent | 61881fd0c1a7066293f552be1a747143f70d03ff (diff) | |
| download | thehouseoficarus-ad60843fbf577eda80105e3916822d663aaefcb3.tar.gz | |
fix: economy recovery double-refund/erased-liability/cap-drops, entity editor path traversal
Diffstat (limited to 'internal/admin/server.go')
| -rw-r--r-- | internal/admin/server.go | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/internal/admin/server.go b/internal/admin/server.go index 3dbe8ad..fb0c53b 100644 --- a/internal/admin/server.go +++ b/internal/admin/server.go @@ -622,7 +622,8 @@ func (s *AdminServer) handleEntityRename(entityType string) http.HandlerFunc { ID string `json:"id"` NewID string `json:"new_id"` } - if err := readJSON(r, &body); err != nil || body.ID == "" || body.NewID == "" { + if err := readJSON(r, &body); err != nil || body.ID == "" || body.NewID == "" || + !validEntityID(body.NewID) { writeJSON(w, map[string]any{"error": "invalid"}) return } |