diff options
Diffstat (limited to 'internal/admin/api_hazards.go')
| -rw-r--r-- | internal/admin/api_hazards.go | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/internal/admin/api_hazards.go b/internal/admin/api_hazards.go index 405c9ab..fac68c4 100644 --- a/internal/admin/api_hazards.go +++ b/internal/admin/api_hazards.go @@ -35,6 +35,10 @@ func (s *AdminServer) handleHazardByID(w http.ResponseWriter, r *http.Request) { http.Error(w, `{"error":"missing hazard id"}`, http.StatusBadRequest) return } + if !validEntityID(id) { + http.Error(w, `{"error":"invalid hazard id"}`, http.StatusBadRequest) + return + } switch r.Method { case http.MethodGet: @@ -140,6 +144,10 @@ func (s *AdminServer) createHazard(w http.ResponseWriter, r *http.Request) { http.Error(w, `{"error":"missing hazard id"}`, http.StatusBadRequest) return } + if !validEntityID(id) { + http.Error(w, `{"error":"invalid hazard id"}`, http.StatusBadRequest) + return + } path := filepath.Join(s.dataDir, "hazards", id+".yaml") if _, err := os.Stat(path); err == nil { |