Fix #215-api: reject malformed multipart burn_after_reads with 400

handleCreatePasteMultipart silently dropped non-numeric burn_after_reads values (err == nil guard), so burn_after_reads=abc created a 201 paste with NO burn budget. Now returns 400 with the error+code shape ({'code':'burn_invalid'}) matching the JSON path, where an invalid value fails unmarshal into the int field. An empty value stays 'unset' like the JSON path's omitempty. Verified live: burn_after_reads=abc -> 400 burn_invalid; =2 -> 201.
Fix #214-ui: add page <title> to every rendered page
2026-10-16 16:51:36 -05:00 · 2026-10-16 16:51:36 -05:00 · 2026-10-16 16:51:36 -05:00
1 changed files with 0 additions and 6 deletions
@@ -197,12 +197,6 @@ func (a *apiServer) handleCreatePasteMultipart(w http.ResponseWriter, r *http.Re
 				writeErrCode(w, 400, "burn_invalid", "burn_after_reads must be a positive number")
 				return
 			}
 			// negative values are invalid too: same 400 burn_invalid shape
 			// as the JSON path (validate.go:92), identical message text.
 			if err := parseBurnAfterReads(n); err != nil {
 				writeErrCode(w, 400, "burn_invalid", err.Error())
 				return
 			}
 			p.BurnAfterReads = &n
 		}
 	}