diff options
Diffstat (limited to 'internal/admin/api_map.go')
| -rw-r--r-- | internal/admin/api_map.go | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/internal/admin/api_map.go b/internal/admin/api_map.go index 5eac385..d0372df 100644 --- a/internal/admin/api_map.go +++ b/internal/admin/api_map.go @@ -24,6 +24,16 @@ func (s *AdminServer) handleMap(w http.ResponseWriter, r *http.Request) { } dir := r.URL.Query().Get("dir") + if dir != "" { + // Route the map's directory through the same guard every other room + // API uses, so ?dir=../../.. cannot read/walk outside data/rooms. + clean, err := s.resolveRoomSubdir(dir) + if err != nil { + failJSON(w, err.Error()) + return + } + dir = clean + } seed := s.cfg.StartingRoom if dir != "" { if low, ok := findLowestLoadableRoom(s, dir); ok { |