From f5e97b5e52833dc084b01f538bdb7bc457b0bd19 Mon Sep 17 00:00:00 2001 From: leaKsi <59278564+leaKsi@users.noreply.github.com> Date: Thu, 18 Dec 2025 14:15:01 +0000 Subject: [PATCH] Fixes 2 infinite credits exploits. (#94523) ## About The Pull Request What it says in the title. 2 href exploits. ## Changelog :cl: fix: Fixed 2 infinite credit exploits. /:cl: --- code/game/machinery/computer/warrant.dm | 2 +- .../modules/modular_computers/file_system/programs/betting.dm | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/code/game/machinery/computer/warrant.dm b/code/game/machinery/computer/warrant.dm index cc393e14a21..dd85df26060 100644 --- a/code/game/machinery/computer/warrant.dm +++ b/code/game/machinery/computer/warrant.dm @@ -105,7 +105,7 @@ return FALSE var/amount = params["amount"] - if(!amount || !isnum(amount) || amount > warrant.fine || !account.adjust_money(-amount, "Paid fine for [target.name]")) + if(!amount || !isnum(amount) || amount <= 0 || amount > warrant.fine || !account.adjust_money(-amount, "Paid fine for [target.name]")) to_chat(user, span_warning("ACCESS DENIED: Invalid amount.")) playsound(src, 'sound/machines/terminal/terminal_error.ogg', 100, TRUE) return FALSE diff --git a/code/modules/modular_computers/file_system/programs/betting.dm b/code/modules/modular_computers/file_system/programs/betting.dm index 98b827bcb4a..bb1a6d604f0 100644 --- a/code/modules/modular_computers/file_system/programs/betting.dm +++ b/code/modules/modular_computers/file_system/programs/betting.dm @@ -267,6 +267,8 @@ GLOBAL_LIST_EMPTY_TYPED(active_bets, /datum/active_bet) return //taking money out if(text2num(existing_bets[2]) > money_betting) + if(money_betting < 0) + return var/money_taking_out = text2num(existing_bets[2]) - money_betting total_amount_bet -= money_taking_out better.bank_card_talk("Refunded [money_taking_out][MONEY_SYMBOL] for taking money out of your bet on [name].") @@ -274,7 +276,7 @@ GLOBAL_LIST_EMPTY_TYPED(active_bets, /datum/active_bet) existing_bets[2] = "[money_betting]" return - if(!better.adjust_money(-money_betting, "Gambling on [name]")) + if(money_betting <= 0 || !better.adjust_money(-money_betting, "Gambling on [name]")) return total_amount_bet += money_betting options[option_betting] += list(list(better, "[money_betting]"))