From d9a9ae135816d86f2e83dddf46731b39d2e1f737 Mon Sep 17 00:00:00 2001
From: MrStonedOne <kyleshome@gmail.com>
Date: Tue, 14 Apr 2015 10:48:24 -0700
Subject: [PATCH] adds a permission check to force event's topic

There existed a href exploit that allowed any admin to force an event.
---
 code/modules/admin/topic.dm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/code/modules/admin/topic.dm b/code/modules/admin/topic.dm
index 0f2fff1cc51..93ff19acc6b 100644
--- a/code/modules/admin/topic.dm
+++ b/code/modules/admin/topic.dm
@@ -81,6 +81,7 @@
 					usr << "<span class='danger'>Unfortunatly there were not enough candidates available.</span>"
 
 	else if(href_list["forceevent"])
+		if(!check_rights(R_FUN))	return
 		var/datum/round_event_control/E = locate(href_list["forceevent"]) in SSevent.control
 		if(E)
 			var/datum/round_event/event = E.runEvent()