diff options
Diffstat (limited to 'internal/admin/api_items.go')
| -rw-r--r-- | internal/admin/api_items.go | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/internal/admin/api_items.go b/internal/admin/api_items.go index 728997a..749e8ff 100644 --- a/internal/admin/api_items.go +++ b/internal/admin/api_items.go @@ -33,6 +33,10 @@ func (s *AdminServer) handleItemByID(w http.ResponseWriter, r *http.Request) { http.Error(w, `{"error":"missing item id"}`, http.StatusBadRequest) return } + if !validEntityID(id) { + http.Error(w, `{"error":"invalid item id"}`, http.StatusBadRequest) + return + } switch r.Method { case http.MethodGet: @@ -152,6 +156,10 @@ func (s *AdminServer) createItem(w http.ResponseWriter, r *http.Request) { http.Error(w, `{"error":"missing item id"}`, http.StatusBadRequest) return } + if !validEntityID(id) { + http.Error(w, `{"error":"invalid item id"}`, http.StatusBadRequest) + return + } if _, _, err := s.findItemFile(id); err == nil { http.Error(w, `{"error":"item already exists"}`, http.StatusConflict) |