From d96afec583c08dc2d4254d93b864e2ff14d2a8b9 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Fri, 18 Apr 2025 03:55:21 -0400 Subject: [PATCH] [s] Fix a class of secret variable dumping via SDQL by stopping `vars` from being accessed by `can_vv_get()` (#90665) --- code/datums/datumvars.dm | 2 ++ 1 file changed, 2 insertions(+) diff --git a/code/datums/datumvars.dm b/code/datums/datumvars.dm index 944532324af..9413956fa7c 100644 --- a/code/datums/datumvars.dm +++ b/code/datums/datumvars.dm @@ -2,6 +2,8 @@ return TRUE /datum/proc/can_vv_get(var_name) + if(var_name == NAMEOF(src, vars)) + return FALSE return TRUE /// Called when a var is edited with the new value to change to