From 7eab582d8a8ee2af1a6baae7baf0696c7005de2e Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 15:16:44 -0400
Subject: fix: harden triggers, economy, casino, world data, and admin/net
 paths

---
 internal/player/player.go | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'internal/player/player.go')

diff --git a/internal/player/player.go b/internal/player/player.go
index f8d9a68..efa906b 100644
--- a/internal/player/player.go
+++ b/internal/player/player.go
@@ -510,6 +510,12 @@ func (p *Player) CountItem(itemID string) int {
 }
 
 func (p *Player) RemoveItem(itemID string, qty int) bool {
+	// A non-positive quantity must never mutate a stack: with qty < 0 the
+	// subtraction below would increase it. Callers pass positive quantities;
+	// reject anything else instead of creating items from a data typo.
+	if qty <= 0 {
+		return false
+	}
 	remaining := qty
 	for i, slot := range p.Inventory {
 		if slot == nil || slot.ItemID != itemID {
-- 
cgit v1.2.3