diff options
Diffstat (limited to 'internal/admin/api_room_courses.go')
| -rw-r--r-- | internal/admin/api_room_courses.go | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/internal/admin/api_room_courses.go b/internal/admin/api_room_courses.go index bebacff..5a33e6a 100644 --- a/internal/admin/api_room_courses.go +++ b/internal/admin/api_room_courses.go @@ -321,6 +321,13 @@ func (s *AdminServer) handleRoomAttachCourse(w http.ResponseWriter, r *http.Requ failJSON(w, "missing course_id") return } + // Course IDs join into file paths under data/courses, so an unchecked + // id ("../../x") could write course YAML outside the data directory. + // Same rule as every other entity route (see validEntityID). + if !validEntityID(body.CourseID) { + failJSON(w, "invalid course_id") + return + } m, _, path, err := s.loadCourseMap(body.CourseID) if err != nil { failJSON(w, "course not found: "+body.CourseID) |