From 194164a77eb4f2479b94c19e6f0e1278ab608781 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 16:13:49 -0400
Subject: fix: more casino, economy, gameplay, security, and world data
 hardening gaps

---
 internal/admin/server.go | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'internal/admin')

diff --git a/internal/admin/server.go b/internal/admin/server.go
index c13fe96..98400c2 100644
--- a/internal/admin/server.go
+++ b/internal/admin/server.go
@@ -740,6 +740,11 @@ func (s *AdminServer) accountFromCookie(r *http.Request) string {
 }
 
 func loadOrGenerateCert(cfg *config.Config) (tls.Certificate, error) {
+	// A half-configured cert pair must fail loudly instead of silently serving
+	// a self-signed certificate (see the game-server equivalent).
+	if (cfg.TLS.CertFile == "") != (cfg.TLS.KeyFile == "") {
+		return tls.Certificate{}, fmt.Errorf("admin_https: tls.cert_file and tls.key_file must be set together")
+	}
 	if cfg.TLS.CertFile != "" && cfg.TLS.KeyFile != "" {
 		return tls.LoadX509KeyPair(cfg.TLS.CertFile, cfg.TLS.KeyFile)
 	}
-- 
cgit v1.2.3