From 7eab582d8a8ee2af1a6baae7baf0696c7005de2e Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 15:16:44 -0400
Subject: fix: harden triggers, economy, casino, world data, and admin/net
 paths

---
 internal/admin/api_map.go | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'internal/admin/api_map.go')

diff --git a/internal/admin/api_map.go b/internal/admin/api_map.go
index 5eac385..d0372df 100644
--- a/internal/admin/api_map.go
+++ b/internal/admin/api_map.go
@@ -24,6 +24,16 @@ func (s *AdminServer) handleMap(w http.ResponseWriter, r *http.Request) {
 	}
 
 	dir := r.URL.Query().Get("dir")
+	if dir != "" {
+		// Route the map's directory through the same guard every other room
+		// API uses, so ?dir=../../.. cannot read/walk outside data/rooms.
+		clean, err := s.resolveRoomSubdir(dir)
+		if err != nil {
+			failJSON(w, err.Error())
+			return
+		}
+		dir = clean
+	}
 	seed := s.cfg.StartingRoom
 	if dir != "" {
 		if low, ok := findLowestLoadableRoom(s, dir); ok {
-- 
cgit v1.2.3