fix: harden triggers, economy, casino, world data, and admin/net paths

1 files changed, 6 insertions, 0 deletions

diff --git a/internal/player/player.go b/internal/player/player.go
index f8d9a68..efa906b 100644
--- a/internal/player/player.go
+++ b/internal/player/player.go
@@ -510,6 +510,12 @@ func (p *Player) CountItem(itemID string) int {
 }
 
 func (p *Player) RemoveItem(itemID string, qty int) bool {
+	// A non-positive quantity must never mutate a stack: with qty < 0 the
+	// subtraction below would increase it. Callers pass positive quantities;
+	// reject anything else instead of creating items from a data typo.
+	if qty <= 0 {
+		return false
+	}
 	remaining := qty
 	for i, slot := range p.Inventory {
 		if slot == nil || slot.ItemID != itemID {