Fix multiple href exploits from incorrectly scoped locates

Also adds a helper to flatten a keyed list to it's contents as it
turns out that byond cannot locate in a keyed list
This commit is contained in:
oranges
2016-09-28 06:55:45 +00:00
parent e3ce14d8fc
commit 8b7eb11df9
10 changed files with 70 additions and 129 deletions
+3 -1
View File
@@ -76,7 +76,9 @@
/obj/structure/guncase/Topic(href, href_list)
if(href_list["retrieve"])
var/obj/item/O = locate(href_list["retrieve"])
var/obj/item/O = locate(href_list["retrieve"]) in contents
if(!O || !istype(O))
return
if(!usr.canUseTopic(src))
return
if(ishuman(usr))