Merge pull request #20732 from optimumtact/justhrefthings

Fix multiple href exploits from incorrectly scoped locates

code/game/objects/items/devices/camera_bug.dm

@@ -136,11 +136,16 @@
 				return .(cameras)
 	return html
 
+/obj/item/device/camera_bug/proc/get_seens()
+	if(current && current.can_use())
+		var/list/seen = current.can_see()
+		return seen
+
 /obj/item/device/camera_bug/proc/camera_report()
 	// this should only be called if current exists
 	var/dat = ""
-	if(current && current.can_use())
-		var/list/seen = current.can_see()
+	var/list/seen = get_seens()
+	if(seen && seen.len >= 1)
 		var/list/names = list()
 		for(var/obj/singularity/S in seen) // god help you if you see more than one
 			if(S.name in names)
@@ -190,23 +195,29 @@
 	if("mode" in href_list)
 		track_mode = text2num(href_list["mode"])
 	if("monitor" in href_list)
-		var/obj/machinery/camera/C = locate(href_list["monitor"])
-		if(C)
+		//You can't locate on a list with keys
+		var/list/cameras = flatten_list(bugged_cameras)
+		var/obj/machinery/camera/C = locate(href_list["monitor"]) in cameras
+		if(C && istype(C))
 			track_mode = BUGMODE_MONITOR
 			current = C
 			usr.reset_perspective(null)
 			interact()
 	if("track" in href_list)
-		var/atom/A = locate(href_list["track"])
-		if(A)
-			tracking = A
-			tracked_name = A.name
-			last_found = current.c_tag
-			last_seen = world.time
-			track_mode = BUGMODE_TRACK
+		var/list/seen = get_seens()
+		if(seen && seen.len >= 1)
+			var/atom/A = locate(href_list["track"]) in seen
+			if(A && istype(A))
+				tracking = A
+				tracked_name = A.name
+				last_found = current.c_tag
+				last_seen = world.time
+				track_mode = BUGMODE_TRACK
 	if("emp" in href_list)
-		var/obj/machinery/camera/C = locate(href_list["emp"])
-		if(istype(C) && C.bug == src)
+		//You can't locate on a list with keys
+		var/list/cameras = flatten_list(bugged_cameras)
+		var/obj/machinery/camera/C = locate(href_list["emp"]) in cameras
+		if(C && istype(C) && C.bug == src)
 			C.emp_act(1)
 			C.bug = null
 			bugged_cameras -= C.c_tag
@@ -217,8 +228,10 @@
 		current = null
 		return
 	if("view" in href_list)
-		var/obj/machinery/camera/C = locate(href_list["view"])
-		if(istype(C))
+		//You can't locate on a list with keys
+		var/list/cameras = flatten_list(bugged_cameras)
+		var/obj/machinery/camera/C = locate(href_list["view"]) in cameras
+		if(C && istype(C))
 			if(!C.can_use())
 				usr << "<span class='warning'>Something's wrong with that camera!  You can't get a feed.</span>"
 				return

code/game/objects/items/weapons/implants/implant_chem.dm

@@ -24,11 +24,11 @@
 /obj/item/weapon/implant/chem/New()
 	..()
 	create_reagents(50)
-	tracked_implants += src
+	tracked_chem_implants += src
 
 /obj/item/weapon/implant/chem/Destroy()
 	..()
-	tracked_implants -= src
+	tracked_chem_implants -= src
 
 
 

code/game/objects/structures/guncase.dm

@@ -76,7 +76,9 @@
 
 /obj/structure/guncase/Topic(href, href_list)
 	if(href_list["retrieve"])
-		var/obj/item/O = locate(href_list["retrieve"])
+		var/obj/item/O = locate(href_list["retrieve"]) in contents
+		if(!O || !istype(O))
+			return
 		if(!usr.canUseTopic(src))
 			return
 		if(ishuman(usr))