From 7b0f5f42f3dee7c828d703783ded7dce68cd3fe0 Mon Sep 17 00:00:00 2001
From: "Theodor S. Midtlien" <theodor@midtlien.com>
Date: Mon, 8 Jun 2026 16:15:07 +0200
Subject: [PATCH] Fix feedback

---
 client/android/profile_manager.go        |  7 +++++++
 client/cmd/profile.go                    |  2 +-
 client/internal/profilemanager/config.go | 10 ++++++++++
 client/server/server.go                  |  7 ++++++-
 4 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/client/android/profile_manager.go b/client/android/profile_manager.go
index 88de04b50..df4cf097c 100644
--- a/client/android/profile_manager.go
+++ b/client/android/profile_manager.go
@@ -204,6 +204,9 @@ func (pm *ProfileManager) RemoveProfile(id string) error {
 // This is needed for Android-specific path handling (netbird.cfg for default profile)
 func (pm *ProfileManager) getProfileConfigPath(id string) (string, error) {
 	if id == "" || id == profilemanager.DefaultProfileName {
+		if !profilemanager.IsValidProfileFilenameStem(profilemanager.ID(id)) {
+			return "", fmt.Errorf("id %q is not valid", id)
+		}
 		// Android uses netbird.cfg for default profile instead of default.json
 		// Default profile is stored in root configDir, not in profiles/
 		return filepath.Join(pm.configDir, defaultConfigFilename), nil
@@ -226,6 +229,10 @@ func (pm *ProfileManager) GetStateFilePath(id string) (string, error) {
 		return filepath.Join(pm.configDir, "state.json"), nil
 	}
 
+	if !profilemanager.IsValidProfileFilenameStem(profilemanager.ID(id)) {
+		return "", fmt.Errorf("id %q is not valid", id)
+	}
+
 	profilesDir := filepath.Join(pm.configDir, profilesSubdir)
 	return filepath.Join(profilesDir, id+".state.json"), nil
 }
diff --git a/client/cmd/profile.go b/client/cmd/profile.go
index c11ed57dd..e0c5fc8db 100644
--- a/client/cmd/profile.go
+++ b/client/cmd/profile.go
@@ -148,8 +148,8 @@ func addProfileFunc(cmd *cobra.Command, args []string) error {
 		ProfileName: profileName,
 		Username:    currUser.Username,
 	})
-	id := profilemanager.ID(resp.Id)
 	if err == nil {
+		id := profilemanager.ID(resp.Id)
 		cmd.Printf("Profile added: %s  %s\n", id.ShortID(), profilemanager.StripCtrlChars(profileName))
 		return nil
 	}
diff --git a/client/internal/profilemanager/config.go b/client/internal/profilemanager/config.go
index bfb4d17f8..2ec4fb50c 100644
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -252,6 +252,16 @@ func createNewConfig(input ConfigInput) (*Config, error) {
 }
 
 func (config *Config) apply(input ConfigInput) (updated bool, err error) {
+	if config.Name != "" {
+		sanitized, err := sanitizeDisplayName(config.Name)
+		if err != nil {
+			return false, fmt.Errorf("invalid profile name: %w", err)
+		}
+		if sanitized != config.Name {
+			config.Name = sanitized
+			updated = true
+		}
+	}
 	if config.ManagementURL == nil {
 		log.Infof("using default Management URL %s", DefaultManagementURL)
 		config.ManagementURL, err = parseURL("Management URL", DefaultManagementURL)
diff --git a/client/server/server.go b/client/server/server.go
index 03aa4b56a..e3aa253b6 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -1035,7 +1035,12 @@ func (s *Server) logoutFromProfile(ctx context.Context, profile *profilemanager.
 		return s.sendLogoutRequest(ctx)
 	}
 
-	config, err := profilemanager.GetConfig(profile.Path)
+	cfgPath := profile.Path
+	if cfgPath == "" {
+		cfgPath = profilemanager.DefaultConfigPath
+	}
+
+	config, err := profilemanager.GetConfig(cfgPath)
 	if err != nil {
 		return fmt.Errorf("profile '%s' not found", profile.ID)
 	}