From 0a0aa64d8a3aa37b001cf7c40371a2005e0d0bed Mon Sep 17 00:00:00 2001
From: SkyratBot <59378654+SkyratBot@users.noreply.github.com>
Date: Thu, 18 Apr 2024 03:07:22 +0200
Subject: [PATCH] [MIRROR] Fixes netpod href exploit (#27365)

* Fixes netpod href exploit (#82698)

## About The Pull Request
Can't have fits in detroit
## Why It's Good For The Game
Fixes #81616
## Changelog
:cl:
fix: Netpods have had their security against exploits increased.
/:cl:

---------

Co-authored-by: Kapu1178 <75460809+Kapu1178@ users.noreply.github.com>

* Fixes netpod href exploit

---------

Co-authored-by: Jeremiah <42397676+jlsnow301@users.noreply.github.com>
Co-authored-by: Kapu1178 <75460809+Kapu1178@ users.noreply.github.com>
---
 code/modules/bitrunning/objects/netpod.dm | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/code/modules/bitrunning/objects/netpod.dm b/code/modules/bitrunning/objects/netpod.dm
index 2d4e995b19b..5c8e399292f 100644
--- a/code/modules/bitrunning/objects/netpod.dm
+++ b/code/modules/bitrunning/objects/netpod.dm
@@ -443,8 +443,16 @@
 /// Resolves a path to an outfit.
 /obj/machinery/netpod/proc/resolve_outfit(text)
 	var/path = text2path(text)
-	if(ispath(path, /datum/outfit))
-		return path
+	if(!ispath(path, /datum/outfit))
+		return
+
+	for(var/wardrobe in cached_outfits)
+		for(var/outfit in wardrobe["outfits"])
+			if(path == outfit["path"])
+				return path
+
+	message_admins("[usr]:[usr.ckey] attempted to select an unavailable outfit from a netpod")
+	return
 
 /// Severs the connection with the current avatar
 /obj/machinery/netpod/proc/sever_connection()