From ad60843fbf577eda80105e3916822d663aaefcb3 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Wed, 16 Sep 2026 02:14:02 -0400
Subject: fix: economy recovery double-refund/erased-liability/cap-drops,
 entity editor path traversal

---
 internal/admin/api_mobs.go | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'internal/admin/api_mobs.go')

diff --git a/internal/admin/api_mobs.go b/internal/admin/api_mobs.go
index 0646753..8531e40 100644
--- a/internal/admin/api_mobs.go
+++ b/internal/admin/api_mobs.go
@@ -35,6 +35,10 @@ func (s *AdminServer) handleMobByID(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, `{"error":"missing mob id"}`, http.StatusBadRequest)
 		return
 	}
+	if !validEntityID(id) {
+		http.Error(w, `{"error":"invalid mob id"}`, http.StatusBadRequest)
+		return
+	}
 
 	switch r.Method {
 	case http.MethodGet:
@@ -143,6 +147,10 @@ func (s *AdminServer) createMob(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, `{"error":"missing mob id"}`, http.StatusBadRequest)
 		return
 	}
+	if !validEntityID(id) {
+		http.Error(w, `{"error":"invalid mob id"}`, http.StatusBadRequest)
+		return
+	}
 	if _, _, err := s.findMobFile(id); err == nil {
 		http.Error(w, `{"error":"mob already exists"}`, http.StatusConflict)
 		return
-- 
cgit v1.2.3