From fea2cc6839ec3ee17940a2dea69622dc6f4deabf Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Wed, 16 Sep 2026 21:35:55 -0400
Subject: fix: unify crafting ingredient resolution; fix superheat
 alternatives, quantity gates, and dropped combine byproducts

---
 internal/admin/api_room_courses.go | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'internal/admin/api_room_courses.go')

diff --git a/internal/admin/api_room_courses.go b/internal/admin/api_room_courses.go
index bebacff..5a33e6a 100644
--- a/internal/admin/api_room_courses.go
+++ b/internal/admin/api_room_courses.go
@@ -321,6 +321,13 @@ func (s *AdminServer) handleRoomAttachCourse(w http.ResponseWriter, r *http.Requ
 		failJSON(w, "missing course_id")
 		return
 	}
+	// Course IDs join into file paths under data/courses, so an unchecked
+	// id ("../../x") could write course YAML outside the data directory.
+	// Same rule as every other entity route (see validEntityID).
+	if !validEntityID(body.CourseID) {
+		failJSON(w, "invalid course_id")
+		return
+	}
 	m, _, path, err := s.loadCourseMap(body.CourseID)
 	if err != nil {
 		failJSON(w, "course not found: "+body.CourseID)
-- 
cgit v1.2.3