Reject negative multipart burn_after_reads via parseBurnAfterReads

2026-10-16 16:59:41 -05:00
1 changed files with 6 additions and 0 deletions
@@ -197,6 +197,12 @@ func (a *apiServer) handleCreatePasteMultipart(w http.ResponseWriter, r *http.Re
 				writeErrCode(w, 400, "burn_invalid", "burn_after_reads must be a positive number")
 				return
 			}
 			// negative values are invalid too: same 400 burn_invalid shape
 			// as the JSON path (validate.go:92), identical message text.
 			if err := parseBurnAfterReads(n); err != nil {
 				writeErrCode(w, 400, "burn_invalid", err.Error())
 				return
 			}
 			p.BurnAfterReads = &n
 		}
 	}