From 516fd29da423432ef6dfded21a984f1d15dcab1a Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Mon, 5 Oct 2026 17:31:50 -0400
Subject: fix: slop casino and economy fixes

---
 internal/admin/api_helpers.go | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'internal/admin/api_helpers.go')

diff --git a/internal/admin/api_helpers.go b/internal/admin/api_helpers.go
index 37cc4ae..d5e23c3 100644
--- a/internal/admin/api_helpers.go
+++ b/internal/admin/api_helpers.go
@@ -17,12 +17,17 @@ import (
 // JSON bodies, so an unchecked join could otherwise escape the data
 // directory ("../") or touch dot files.
 func validEntityID(id string) bool {
-	if id == "" || id == "." || id == ".." {
+	if id == "" || id == "." || id == ".." || strings.HasPrefix(id, ".") {
 		return false
 	}
 	if strings.ContainsAny(id, `/\`) || strings.ContainsRune(id, 0) {
 		return false
 	}
+	for _, r := range id {
+		if r < 32 || r == 127 {
+			return false
+		}
+	}
 	return true
 }
 
-- 
cgit v1.2.3