1 files changed, 6 insertions, 1 deletions
diff --git a/internal/admin/api_helpers.go b/internal/admin/api_helpers.go
index 37cc4ae..d5e23c3 100644
--- a/internal/admin/api_helpers.go
+++ b/internal/admin/api_helpers.go
@@ -17,12 +17,17 @@ import (
 // JSON bodies, so an unchecked join could otherwise escape the data
 // directory ("../") or touch dot files.
 func validEntityID(id string) bool {
-	if id == "" || id == "." || id == ".." {
+	if id == "" || id == "." || id == ".." || strings.HasPrefix(id, ".") {
 		return false
 	}
 	if strings.ContainsAny(id, `/\`) || strings.ContainsRune(id, 0) {
 		return false
 	}
+	for _, r := range id {
+		if r < 32 || r == 127 {
+			return false
+		}
+	}
 	return true
 }