Merge pull request #8975 from MrStonedOne/patch-6

Fixes href exploit relating to admins without +fun being able to force events

code/modules/admin/topic.dm

@@ -81,6 +81,7 @@
 					usr << "<span class='danger'>Unfortunatly there were not enough candidates available.</span>"
 
 	else if(href_list["forceevent"])
+		if(!check_rights(R_FUN))	return
 		var/datum/round_event_control/E = locate(href_list["forceevent"]) in SSevent.control
 		if(E)
 			var/datum/round_event/event = E.runEvent()