Fix malicious/bad JS exploits

code/datums/server_greeting.dm

@@ -175,6 +175,21 @@
 
 	user << browse('html/templates/welcome_screen.html', "window=greeting;size=640x500")
 
+/*
+ * A proc used to close the server greeting window for a user.
+ * Args:
+ * - var/user client
+ * - var/reason text
+ */
+/datum/server_greeting/proc/close_window(var/client/user, var/reason)
+	if (!user)
+		return
+
+	if (reason)
+		user << span("notice", reason)
+
+	user << browse(null, "window=greeting")
+
 /*
  * Sends data to the JS controllers used in the server greeting.
  * Also updates the user's preferences, if any of the hashes were out of date.

code/modules/admin/DB ban/ban_mirroring.dm

@@ -139,6 +139,10 @@
 
 	if (!conn_info || !conn_info.len)
 		return
+	else if (conn_info.len > 100)
+		log_debug("MIRROR BANS: [C.ckey] has [conn_info.len] unique sets. They were dropped and not processed.")
+		update_connection_data(C)
+		return
 
 	var/ding_bannu = 0
 	var/new_info = BAD_CKEY|BAD_IP|BAD_CID

code/modules/client/client defines.dm

@@ -36,6 +36,7 @@
 		//SECURITY//
 		////////////
 	var/next_allowed_topic_time = 10
+	var/info_sent = 0
 	// comment out the line below when debugging locally to enable the options & messages menu
 	//control_freak = 1
 

code/modules/client/client procs.dm

@@ -25,7 +25,12 @@
 		return
 
 	if (href_list["EMERG"] && href_list["EMERG"] == "action")
-		handle_connection_info(src, href_list["data"])
+		if (!info_sent)
+			handle_connection_info(src, href_list["data"])
+			info_sent = 1
+		else
+			server_greeting.close_window(src, "Your greeting window has malfunctioned and has been shut down.")
+
 		return
 
 	//Reduces spamming of links by dropping calls that happen during the delay period