fix: more casino, economy, gameplay, security, and world data hardening gaps

1 files changed, 5 insertions, 0 deletions

diff --git a/internal/admin/server.go b/internal/admin/server.go
index c13fe96..98400c2 100644
--- a/internal/admin/server.go
+++ b/internal/admin/server.go
@@ -740,6 +740,11 @@ func (s *AdminServer) accountFromCookie(r *http.Request) string {
 }
 
 func loadOrGenerateCert(cfg *config.Config) (tls.Certificate, error) {
+	// A half-configured cert pair must fail loudly instead of silently serving
+	// a self-signed certificate (see the game-server equivalent).
+	if (cfg.TLS.CertFile == "") != (cfg.TLS.KeyFile == "") {
+		return tls.Certificate{}, fmt.Errorf("admin_https: tls.cert_file and tls.key_file must be set together")
+	}
 	if cfg.TLS.CertFile != "" && cfg.TLS.KeyFile != "" {
 		return tls.LoadX509KeyPair(cfg.TLS.CertFile, cfg.TLS.KeyFile)
 	}