diff options
Diffstat (limited to 'internal/admin/api_rooms.go')
| -rw-r--r-- | internal/admin/api_rooms.go | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/internal/admin/api_rooms.go b/internal/admin/api_rooms.go index 586bfff..76db231 100644 --- a/internal/admin/api_rooms.go +++ b/internal/admin/api_rooms.go @@ -1315,6 +1315,25 @@ func (s *AdminServer) handleResolveDuplicate(w http.ResponseWriter, r *http.Requ failJSON(w, "invalid path") return } + // Only a real duplicate-ID file may be resolved here. Trusting the client + // path would let this endpoint delete a live indexed room with none of the + // normal delete semantics (exit cleanup, casino eviction, undo). + stem := strings.TrimSuffix(filepath.Base(absPath), ".yaml") + isDuplicate := false + for _, d := range behavior.CheckDuplicateIDs(roomsDir) { + if d.ID != stem { + continue + } + for _, p := range d.Paths { + if pa, err := filepath.Abs(p); err == nil && pa == absPath { + isDuplicate = true + } + } + } + if !isDuplicate { + failJSON(w, "path is not a duplicate-ID room file") + return + } switch body.Action { case "delete": |