Harden CMS security and theme contrast

src/actions/admin-ads.ts

@@ -5,6 +5,7 @@ import { redirect } from "next/navigation";
 import { requireStaff } from "@/lib/admin/guard";
 import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";
+import { formPositiveBigInt } from "@/lib/form-data";
 
 // CRUD for website advertisements (website_ads). Emulator does not own this
 // table; it only stores an image URL rendered in the site layout/widgets.
@@ -68,9 +69,8 @@ export async function updateAd(formData: FormData): Promise<void> {
 
 export async function deleteAd(formData: FormData): Promise<void> {
   const staff = await requireStaff();
-  const raw = String(formData.get("id") ?? "");
-  if (!/^\d+$/.test(raw)) return;
-  const id = BigInt(raw);
+  const id = formPositiveBigInt(formData, "id");
+  if (!id) return;
 
   try {
     await prisma.websiteAds.delete({ where: { id } });