diff options
Diffstat (limited to 'internal/admin/api_room_courses.go')
| -rw-r--r-- | internal/admin/api_room_courses.go | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/internal/admin/api_room_courses.go b/internal/admin/api_room_courses.go index 097b9e8..47e4d8c 100644 --- a/internal/admin/api_room_courses.go +++ b/internal/admin/api_room_courses.go @@ -153,6 +153,10 @@ func (s *AdminServer) handleCourses(w http.ResponseWriter, r *http.Request) { writeJSON(w, map[string]any{"error": "missing id"}) return } + if !validEntityID(id) { + writeJSON(w, map[string]any{"error": "invalid id"}) + return + } delete(body, "id") path := s.courseFilePath(id) if _, err := os.Stat(path); err == nil { @@ -186,6 +190,10 @@ func (s *AdminServer) handleCourseByID(w http.ResponseWriter, r *http.Request) { writeJSON(w, map[string]any{"error": "missing id"}) return } + if !validEntityID(id) { + writeJSON(w, map[string]any{"error": "invalid id"}) + return + } path := s.courseFilePath(id) switch r.Method { |