From e8b065ebd8a4182e360a475d355c4367877bc345 Mon Sep 17 00:00:00 2001
From: OrbisAnima <orbisanima@gmail.com>
Date: Thu, 2 Jul 2026 02:30:42 -0300
Subject: [PATCH] Fixing an exploit with departamental budget cards and custom
 vendors (#96597)

## About The Pull Request
Puts a check on departamental budget cards to not be used with custom
vendors

## Why It's Good For The Game
Keeps those that manage to get their hands in departamental cards from
draining it completly on custom vendors they can easily make (hell, on
Meta you got the machine that sell the parts for it 5 tiles away).

## Did You Test Shit?

<img width="912" height="695" alt="image"
src="https://github.com/user-attachments/assets/56469110-6dcc-41c1-ae50-e6d28c439c82"
/>

<img width="1147" height="849" alt="image"
src="https://github.com/user-attachments/assets/8c852d59-c324-4c59-a56e-9cdba6fd7ee6"
/>

<img width="778" height="881" alt="image"
src="https://github.com/user-attachments/assets/2eae235f-cad5-4b80-9e47-e4600ae8fedf"
/>


## Changelog
:cl:
fix: Puts a check on departamental budget cards to not be used with
custom vendors.
/:cl:

---------

Co-authored-by: Ghom <42542238+Ghommie@users.noreply.github.com>
Co-authored-by: Lucy <lucy@absolucy.moe>
---
 code/modules/vending/custom.dm | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/code/modules/vending/custom.dm b/code/modules/vending/custom.dm
index 78a1f811fe9..979abb5ec88 100644
--- a/code/modules/vending/custom.dm
+++ b/code/modules/vending/custom.dm
@@ -285,6 +285,10 @@
 	/// Charges the user if its not the owner
 	var/datum/bank_account/payee = id_card.registered_account
 	if(!compartmentLoadAccessCheck(user))
+		if(istype(id_card, /obj/item/card/id/departmental_budget))
+			balloon_alert(user, "invalid payment card")
+			to_chat(user, span_warning("You cannot use a departmental card for this."))
+			return
 		if(!payee.has_money(dispensed_item.custom_price))
 			balloon_alert(user, "insufficient funds!")
 			return