From 8fe9e3c3fef0049df82281a62afe35dda516dfe2 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 17:48:26 -0400
Subject: fix: close combat ghost, admin traversal, login throttle, journal
 double-pay, and quality/economy gaps

---
 internal/admin/api_modules.go | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'internal/admin/api_modules.go')

diff --git a/internal/admin/api_modules.go b/internal/admin/api_modules.go
index 1d8c25b..8356b2d 100644
--- a/internal/admin/api_modules.go
+++ b/internal/admin/api_modules.go
@@ -30,6 +30,10 @@ func (s *AdminServer) handleModules(w http.ResponseWriter, r *http.Request) {
 			failJSON(w, "missing id")
 			return
 		}
+		if !validEntityID(id) {
+			failJSON(w, "invalid id")
+			return
+		}
 		delete(m, "id")
 		path := filepath.Join(s.dataDir, "modules", id+".yaml")
 		if _, err := os.Stat(path); err == nil {
-- 
cgit v1.2.3