From d3b6da0d5bfbe2a875d6645596dfd0e4dc13abb3 Mon Sep 17 00:00:00 2001 From: SkyratBot <59378654+SkyratBot@users.noreply.github.com> Date: Mon, 19 Oct 2020 03:22:57 +0200 Subject: [PATCH] [MIRROR] [s] Fixes exploit to bypass authentication on requests consoles (#1365) * [s] Fixes exploit to bypass authentication on requests consoles (#54445) * [s] Fixes exploit to bypass authentication on requests consoles Credit @ alexkar598 https://github.com/yogstation13/Yogstation/pull/10030 * Fix proc call name * [s] Fixes exploit to bypass authentication on requests consoles Co-authored-by: Jordan Brown --- code/game/machinery/requests_console.dm | 2 ++ 1 file changed, 2 insertions(+) diff --git a/code/game/machinery/requests_console.dm b/code/game/machinery/requests_console.dm index fa635e6d16a..12d0b401d13 100644 --- a/code/game/machinery/requests_console.dm +++ b/code/game/machinery/requests_console.dm @@ -259,6 +259,8 @@ GLOBAL_LIST_EMPTY(req_console_ckey_departments) if(href_list["sendAnnouncement"]) if(!announcementConsole) return + if(!(announceAuth || isAdminGhostAI(usr))) + return if(isliving(usr)) var/mob/living/L = usr message = L.treat_message(message)