[MIRROR] Fixes negative payment in NTpay & Encodes name param sent to admins in fax [MDB IGNORE] (#17729)

* Fixes negative payment in NTpay & Encodes name param sent to admins in fax (#71491)

## About The Pull Request
NTpay wasn't validating negative input serverside, allowing for negative
payment to users(Negative - Negative = Positive, so it adds money to the
senders account.) Also encodes a parameter that was sent unsanitized to
admins.
## Why It's Good For The Game
## Changelog
🆑
fix: Fixes a NTPay exploit.
/🆑

* Fixes negative payment in NTpay & Encodes name param sent to admins in fax

Co-authored-by: CocaColaTastesGood <47264839+CocaColaTastesGood@users.noreply.github.com>

code/modules/economy/account.dm

@@ -133,11 +133,11 @@
 		if(istype(from, /datum/bank_account/department))
 			reason_to = "Nanotrasen: Salary"
 			reason_from = ""
-		
+
 		if(transfer_reason)
 			reason_to = istype(src, /datum/bank_account/department) ? "" : transfer_reason
 			reason_from = transfer_reason
-		
+
 		adjust_money(amount, reason_to)
 		from.adjust_money(-amount, reason_from)
 		SSblackbox.record_feedback("amount", "credits_transferred", amount)
@@ -180,7 +180,7 @@
  * This sends a local chat message to the owner of a bank account, on all ID cards registered to the bank_account.
  * If not held, sends out a message to all nearby players.
  * Arguments:
- * * message - text that will be sent to listeners after the id card icon 
+ * * message - text that will be sent to listeners after the id card icon
  * * force - if TRUE ignore checks on client and client prefernces.
  */
 /datum/bank_account/proc/bank_card_talk(message, force)
@@ -281,7 +281,7 @@
 /datum/bank_account/proc/add_log_to_history(adjusted_money, reason)
 	if(transaction_history.len >= 20)
 		transaction_history.Cut(1,2)
-	
+
 	transaction_history += list(list(
 		"adjusted_money" = adjusted_money,
 		"reason" = reason,

code/modules/modular_computers/file_system/programs/nt_pay.dm

@@ -42,7 +42,7 @@
 
 			if(!recipient)
 				return to_chat(usr, span_notice("The app can't find who you're trying to pay. Did you enter the pay token right?"))
-			if(!current_user.has_money(money_to_send))
+			if(!current_user.has_money(money_to_send) || money_to_send < 1)
 				return current_user.bank_card_talk("You cannot afford it.")
 
 			recipient.bank_card_talk("You received [money_to_send] credit(s). Reason: transfer from [current_user.account_holder]")

code/modules/paperwork/fax.dm

@@ -253,7 +253,7 @@
 			playsound(src, 'sound/machines/eject.ogg', 50, FALSE)
 			update_appearance()
 			return TRUE
-		
+
 		if("send")
 			var/obj/item/loaded = loaded_item_ref?.resolve()
 			if (!loaded)
@@ -264,13 +264,13 @@
 				loaded_item_ref = null
 				update_appearance()
 				return TRUE
-		
+
 		if("send_special")
 			var/obj/item/paper/fax_paper = loaded_item_ref?.resolve()
 			if(!istype(fax_paper))
 				to_chat(usr, icon2html(src.icon, usr) + span_warning("Fax cannot send all above paper on this protected network, sorry."))
-				return 
-			
+				return
+
 			fax_paper.request_state = TRUE
 			fax_paper.loc = null
 
@@ -278,13 +278,13 @@
 			playsound(src, 'sound/machines/high_tech_confirm.ogg', 50, vary = FALSE)
 
 			history_add("Send", params["name"])
-			
+
 			GLOB.requests.fax_request(usr.client, "sent a fax message from [fax_name]/[fax_id] to [params["name"]]", fax_paper)
-			to_chat(GLOB.admins, span_adminnotice("[icon2html(src.icon, GLOB.admins)]<b><font color=green>FAX REQUEST: </font>[ADMIN_FULLMONTY(usr)]:</b> [span_linkify("sent a fax message from [fax_name]/[fax_id][ADMIN_FLW(src)] to [params["name"]]")] [ADMIN_SHOW_PAPER(fax_paper)]"), confidential = TRUE)
+			to_chat(GLOB.admins, span_adminnotice("[icon2html(src.icon, GLOB.admins)]<b><font color=green>FAX REQUEST: </font>[ADMIN_FULLMONTY(usr)]:</b> [span_linkify("sent a fax message from [fax_name]/[fax_id][ADMIN_FLW(src)] to [html_encode(params["name"])]")] [ADMIN_SHOW_PAPER(fax_paper)]"), confidential = TRUE)
 			log_fax(fax_paper, params["id"], params["name"])
 			loaded_item_ref = null
 			update_appearance()
-				
+
 		if("history_clear")
 			history_clear()
 			return TRUE