From ad60843fbf577eda80105e3916822d663aaefcb3 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Wed, 16 Sep 2026 02:14:02 -0400
Subject: fix: economy recovery double-refund/erased-liability/cap-drops,
 entity editor path traversal

---
 internal/admin/server.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'internal/admin/server.go')

diff --git a/internal/admin/server.go b/internal/admin/server.go
index 3dbe8ad..fb0c53b 100644
--- a/internal/admin/server.go
+++ b/internal/admin/server.go
@@ -622,7 +622,8 @@ func (s *AdminServer) handleEntityRename(entityType string) http.HandlerFunc {
 			ID    string `json:"id"`
 			NewID string `json:"new_id"`
 		}
-		if err := readJSON(r, &body); err != nil || body.ID == "" || body.NewID == "" {
+		if err := readJSON(r, &body); err != nil || body.ID == "" || body.NewID == "" ||
+			!validEntityID(body.NewID) {
 			writeJSON(w, map[string]any{"error": "invalid"})
 			return
 		}
-- 
cgit v1.2.3