Reject negative multipart burn_after_reads via parseBurnAfterReads

Reject malformed multipart burn_after_reads with 400
handleCreatePasteMultipart silently dropped non-numeric burn_after_reads values (err == nil guard), so burn_after_reads=abc created a 201 paste with NO burn budget. Now returns 400 with the error+code shape ({'code':'burn_invalid'}) matching the JSON path, where an invalid value fails unmarshal into the int field. An empty value stays 'unset' like the JSON path's omitempty. Verified live: burn_after_reads=abc -> 400 burn_invalid; =2 -> 201.
2026-10-16 16:59:41 -05:00 · 2026-10-16 16:52:29 -05:00 · 2026-10-16 16:52:29 -05:00 · 2026-10-16 16:52:29 -05:00
1 changed files with 6 additions and 0 deletions
@@ -197,6 +197,12 @@ func (a *apiServer) handleCreatePasteMultipart(w http.ResponseWriter, r *http.Re
 				writeErrCode(w, 400, "burn_invalid", "burn_after_reads must be a positive number")
 				return
 			}
+			// negative values are invalid too: same 400 burn_invalid shape
+			// as the JSON path (validate.go:92), identical message text.
+			if err := parseBurnAfterReads(n); err != nil {
+				writeErrCode(w, 400, "burn_invalid", err.Error())
+				return
+			}
 			p.BurnAfterReads = &n
 		}
 	}
Author	SHA1	Message	Date
fen	6e68889b35	Reject negative multipart burn_after_reads via parseBurnAfterReads CI / test (pull_request) Successful in 22s Details CI / docker (pull_request) Skipped Details	2026-10-16 16:59:41 -05:00
fen	135e0d2dc7	Reject malformed multipart burn_after_reads with 400 CI / test (pull_request) Successful in 21s Details CI / docker (pull_request) Skipped Details handleCreatePasteMultipart silently dropped non-numeric burn_after_reads values (err == nil guard), so burn_after_reads=abc created a 201 paste with NO burn budget. Now returns 400 with the error+code shape ({'code':'burn_invalid'}) matching the JSON path, where an invalid value fails unmarshal into the int field. An empty value stays 'unset' like the JSON path's omitempty. Verified live: burn_after_reads=abc -> 400 burn_invalid; =2 -> 201.	2026-10-16 16:52:29 -05:00
fen	b4c23a09bf	Add page <title> to every rendered page layout.html now emits <title>{{ pageTitle . }} · Palette</title>; the pageTitle template func maps the Page field to a label (New paste, Public pastes, Saved, Settings, paste title or 'Paste <id>', Unlock, Can, Not found).	2026-10-16 16:52:29 -05:00
fen	1c08647742	Fix /new horizontal overflow at ~800px viewports The .deck grid used '1fr 300px'; the 1fr editor column could not shrink below its min-content, expanding the grid to ~1000px at 800px viewports and pushing .pane-r to right=980 (document.scrollWidth 980 vs innerWidth 800). Use minmax(0, 1fr) so the editor column can shrink; the editor itself already clips/scrolls its own content. Verified with a CDP overflow probe at 800x600, 375x812, 1400x900 and 700x600: scrollWidth == innerWidth at all four.	2026-10-16 16:52:29 -05:00