adds a permission check to force event's topic

There existed a href exploit that allowed any admin to force an event.
This commit is contained in:
MrStonedOne
2015-04-14 10:48:24 -07:00
parent 8402c714be
commit d9a9ae1358
+1
View File
@@ -81,6 +81,7 @@
usr << "<span class='danger'>Unfortunatly there were not enough candidates available.</span>"
else if(href_list["forceevent"])
if(!check_rights(R_FUN)) return
var/datum/round_event_control/E = locate(href_list["forceevent"]) in SSevent.control
if(E)
var/datum/round_event/event = E.runEvent()