Some fixes for topic calls and inputs.

There's like 1001 things to fix so some of this is somewhat crude for now.

new helper proc located in procs/helpers.dm
reject_bad_text(var/text)
just feed any text in and it will either return the original text or null (if it contains odd characters such as \ / < > or characters reserved by BYOND. It also rejects if there are no non-whitespace characters)

git-svn-id: http://tgstation13.googlecode.com/svn/trunk@3571 316c924e-a436-60f5-8080-3fe189b3f50e

code/datums/datumvars.dm

@@ -389,8 +389,27 @@ client
 
 		return html
 
-	Topic(href, href_list, hsrc)
+//All BYOND links pass through client/Topic() FIRST and are then directed to [hsrc]/Topic() by the ..() call at the end.
+client/Topic(href, href_list, hsrc)
 
+	//search the href for script injection	//This is a temporary measure
+	if( findtext(href,"<script",1,0) )
+		world.log << "Attempted use of scripts within a topic call, by [src]"
+		message_admins("Attempted use of scripts within a topic call, by [src]")
+		del(usr)
+		return
+
+	if(href_list["priv_msg"])
+		var/client/C = locate(href_list["priv_msg"])
+		if(ismob(C)) //Old stuff can pass in mobs instead of clients
+			var/mob/M = C
+			C = M.client
+		cmd_admin_pm(C,null)
+		return
+
+	else
+		//THIS **REALLY** NEEDS TO BE REWRITTEN AS obj/admin/Topic or something. As a matter of urgency.
+		if( (usr.client == src) && src.holder )
 			if (href_list["Vars"])
 				debug_variables(locate(href_list["Vars"]))
 
@@ -757,7 +776,6 @@ client
 			else
 				..()
 
-
 			if (href_list["datumrefresh"])
 				if(!href_list["datumrefresh"])
 					return
@@ -767,3 +785,8 @@ client
 				if(!istype(DAT,/datum))
 					return
 				src.debug_variables(DAT)
+			return
+
+
+		//Ok, all done with that admin crap. redirect it to the Topic for hsrc
+		..()

code/defines/procs/helpers.dm

@@ -125,6 +125,19 @@
 			index = findtext(t, char)
 	return t
 
+//For sanitizing user inputs
+/proc/reject_bad_text(var/text)
+	if(length(text) > 512)	return			//message too long
+	var/non_whitespace = 0
+	for(var/i=1, i<=length(text), i++)
+		switch(text2ascii(text,i))
+			if(62,60,92,47)	return			//rejects the text if it contains these bad characters: <, >, \ or /
+			if(127 to 255)	return			//rejects weird letters like <20>
+			if(0 to 31)		return			//more weird stuff
+			if(32)							//whitespace
+			else			non_whitespace = 1
+	if(non_whitespace)		return text		//only accepts the text if it has some non-spaces
+
 /proc/strip_html_simple(var/t,var/limit=MAX_MESSAGE_LEN)
 	var/list/strip_chars = list("<",">")
 	t = copytext(t,1,limit)

code/defines/world.dm

@@ -6,12 +6,12 @@ world
 
 
 	Topic(href, href_list[])
-		world << "Received a Topic() call!"
+//		world << "Received a Topic() call!"
-		world << "[href]"
+//		world << "[href]"
-		for(var/a in href_list)
+//		for(var/a in href_list)
-			world << "[a]"
+//			world << "[a]"
-		if(href_list["hello"])
+//		if(href_list["hello"])
-			world << "Hello world!"
+//			world << "Hello world!"
-			return "Hello world!"
+//			return "Hello world!"
-		world << "End of Topic() call."
+//		world << "End of Topic() call."
-		..()
+//		..()

code/game/machinery/computer/HolodeckControl.dm

@@ -34,9 +34,6 @@
 
 		dat += "Please ensure that only holographic weapons are used in the holodeck if a combat simulation has been loaded.<BR>"
 
-		if(issilicon(user) && !emagged)
-			dat += "<A href='?src=\ref[src];AIoverride=1'>(<font color=red>Override Safety Protocols?</font>)</A><BR>"
-
 		if(emagged)
 			dat += "<A href='?src=\ref[src];burntest=1'>(<font color=red>Begin Atmospheric Burn Simulation</font>)</A><BR>"
 			dat += "Ensure the holodeck is empty before testing.<BR>"
@@ -46,6 +43,8 @@
 			dat += "<BR>"
 			dat += "Safety Protocols are <font color=red> DISABLED </font><BR>"
 		else
+			if(issilicon(user))
+				dat += "<A href='?src=\ref[src];AIoverride=1'>(<font color=red>Override Safety Protocols?</font>)</A><BR>"
 			dat += "<BR>"
 			dat += "Safety Protocols are <font color=green> ENABLED </font><BR>"
 
@@ -88,16 +87,19 @@
 					loadProgram(target)
 
 			else if(href_list["burntest"])
+				if(!emagged)	return
 				target = locate(/area/holodeck/source_burntest)
 				if(target)
 					loadProgram(target)
 
 			else if(href_list["wildlifecarp"])
+				if(!emagged)	return
 				target = locate(/area/holodeck/source_wildlife)
 				if(target)
 					loadProgram(target)
 
 			else if(href_list["AIoverride"])
+				if(!issilicon(usr))	return
 				emagged = 1
 
 			src.add_fingerprint(usr)

code/game/machinery/requests_console.dm

@@ -1,5 +1,5 @@
 /******************** Requests Console ********************/
-/** Originally written by errorage, updated by: <sign your updates here> **/
+/** Originally written by errorage, updated by: Carn, needs more work though. I just added some security fixes */
 
 var/req_console_assistance = list()
 var/req_console_supplies = list()
@@ -41,7 +41,7 @@ var/list/obj/machinery/requests_console/allConsoles = list()
 		// 9 = authentication before sending
 		// 10 = send announcement
 	var/silent = 0 // set to 1 for it not to beep all the time
-	var/hackState = 0
+//	var/hackState = 0
 		// 0 = not hacked
 		// 1 = hacked
 	var/announcementConsole = 0
@@ -57,270 +57,319 @@ var/list/obj/machinery/requests_console/allConsoles = list()
 	luminosity = 0
 
 /obj/machinery/requests_console/New()
-	src.name = "[src.department] Requests Console"
+	name = "[department] Requests Console"
 	allConsoles += src
 	//req_console_departments += department
-	switch(src.departmentType)
+	switch(departmentType)
 		if(1)
-			if(!("[src.department]" in req_console_assistance))
+			if(!("[department]" in req_console_assistance))
 				req_console_assistance += department
 		if(2)
-			if(!("[src.department]" in req_console_supplies))
+			if(!("[department]" in req_console_supplies))
 				req_console_supplies += department
 		if(3)
-			if(!("[src.department]" in req_console_information))
+			if(!("[department]" in req_console_information))
 				req_console_information += department
 		if(4)
-			if(!("[src.department]" in req_console_assistance))
+			if(!("[department]" in req_console_assistance))
 				req_console_assistance += department
-			if(!("[src.department]" in req_console_supplies))
+			if(!("[department]" in req_console_supplies))
 				req_console_supplies += department
 		if(5)
-			if(!("[src.department]" in req_console_assistance))
+			if(!("[department]" in req_console_assistance))
 				req_console_assistance += department
-			if(!("[src.department]" in req_console_information))
+			if(!("[department]" in req_console_information))
 				req_console_information += department
 		if(6)
-			if(!("[src.department]" in req_console_supplies))
+			if(!("[department]" in req_console_supplies))
 				req_console_supplies += department
-			if(!("[src.department]" in req_console_information))
+			if(!("[department]" in req_console_information))
 				req_console_information += department
 		if(7)
-			if(!("[src.department]" in req_console_assistance))
+			if(!("[department]" in req_console_assistance))
 				req_console_assistance += department
-			if(!("[src.department]" in req_console_supplies))
+			if(!("[department]" in req_console_supplies))
 				req_console_supplies += department
-			if(!("[src.department]" in req_console_information))
+			if(!("[department]" in req_console_information))
 				req_console_information += department
 
 
 /obj/machinery/requests_console/attack_hand(user as mob)
 	var/dat
-	dat = text("<HEAD><TITLE>Requests Console</TITLE></HEAD><H3>[src.department] Requests Console</H3>")
+	dat = text("<HEAD><TITLE>Requests Console</TITLE></HEAD><H3>[department] Requests Console</H3>")
-	if(!src.open)
+	if(!open)
-		if (src.screen == 0)
+		switch(screen)
-			announceAuth = 0
+			if(1)	//req. assistance
-			if (src.newmessagepriority == 1)
-				dat += text("<FONT COLOR='RED'>There are new messages</FONT><BR>")
-			if (src.newmessagepriority == 2)
-				dat += text("<FONT COLOR='RED'><B>NEW PRIORITY MESSAGES</B></FONT><BR>")
-			dat += text("<A href='?src=\ref[src];setScreen=[8]'>View Messages</A><BR><BR>")
-
-			dat += text("<A href='?src=\ref[src];setScreen=[1]'>Request Assistance</A><BR>")
-			dat += text("<A href='?src=\ref[src];setScreen=[2]'>Request Supplies</A><BR>")
-			dat += text("<A href='?src=\ref[src];setScreen=[3]'>Relay Anonymous Information</A><BR><BR>")
-			if(announcementConsole)
-				dat += text("<A href='?src=\ref[src];setScreen=[10]'>Send station-wide announcement</A><BR><BR>")
-			//dat += text("<BR><A href='?src=\ref[src];callMailman=[1];location=[src.department]'>Call Mailman</A><BR><BR>")   // This is the line to call the mailman, it's intended for it to message him on his PDA
-			if (src.silent)
-				dat += text("Speaker <A href='?src=\ref[src];setSilent=[0]'>OFF</A>")
-			else
-				dat += text("Speaker <A href='?src=\ref[src];setSilent=[1]'>ON</A>")
-		if (src.screen == 1)
 				dat += text("Which department do you need assistance from?<BR><BR>")
 				for(var/dpt in req_console_assistance)
-				if (dpt != src.department)
+					if (dpt != department)
 						dat += text("[dpt] (<A href='?src=\ref[src];write=[ckey(dpt)]'>Message</A> or ")
-					dat += text("<A href='?src=\ref[src];write=[ckey(dpt)];priority=[2]'>High Priority</A>")
+						dat += text("<A href='?src=\ref[src];write=[ckey(dpt)];priority=2'>High Priority</A>")
-					if (src.hackState == 1)
+//						if (hackState == 1)
-						dat += text(" or <A href='?src=\ref[src];write=[ckey(dpt)];priority=[3]'>EXTREME</A>)")
+//							dat += text(" or <A href='?src=\ref[src];write=[ckey(dpt)];priority=3'>EXTREME</A>)")
 						dat += text(")<BR>")
-			dat += text("<BR><A href='?src=\ref[src];setScreen=[0]'>Back</A><BR>")
+				dat += text("<BR><A href='?src=\ref[src];setScreen=0'>Back</A><BR>")
-		if (src.screen == 2)
+
+			if(2)	//req. supplies
 				dat += text("Which department do you need supplies from?<BR><BR>")
 				for(var/dpt in req_console_supplies)
-				if (dpt != src.department)
+					if (dpt != department)
 						dat += text("[dpt] (<A href='?src=\ref[src];write=[ckey(dpt)]'>Message</A> or ")
-					dat += text("<A href='?src=\ref[src];write=[ckey(dpt)];priority=[2]'>High Priority</A>")
+						dat += text("<A href='?src=\ref[src];write=[ckey(dpt)];priority=2'>High Priority</A>")
-					if (src.hackState == 1)
+//						if (hackState == 1)
-						dat += text(" or <A href='?src=\ref[src];write=[ckey(dpt)];priority=[3]'>EXTREME</A>)")
+//							dat += text(" or <A href='?src=\ref[src];write=[ckey(dpt)];priority=3'>EXTREME</A>)")
 						dat += text(")<BR>")
-			dat += text("<BR><A href='?src=\ref[src];setScreen=[0]'>Back</A><BR>")
+				dat += text("<BR><A href='?src=\ref[src];setScreen=0'>Back</A><BR>")
-		if (src.screen == 3)
+
+			if(3)	//relay information
 				dat += text("Which department would you like to send information to?<BR><BR>")
 				for(var/dpt in req_console_information)
-				if (dpt != src.department)
+					if (dpt != department)
 						dat += text("[dpt] (<A href='?src=\ref[src];write=[ckey(dpt)]'>Message</A> or ")
-					dat += text("<A href='?src=\ref[src];write=[ckey(dpt)];priority=[2]'>High Priority</A>")
+						dat += text("<A href='?src=\ref[src];write=[ckey(dpt)];priority=2'>High Priority</A>")
-					if (src.hackState == 1)
+//						if (hackState == 1)
-						dat += text(" or <A href='?src=\ref[src];write=[ckey(dpt)];priority=[3]'>EXTREME</A>)")
+//							dat += text(" or <A href='?src=\ref[src];write=[ckey(dpt)];priority=3'>EXTREME</A>)")
 						dat += text(")<BR>")
-			dat += text("<BR><A href='?src=\ref[src];setScreen=[0]'>Back</A><BR>")
+				dat += text("<BR><A href='?src=\ref[src];setScreen=0'>Back</A><BR>")
-		if (src.screen == 6)
+
+			if(6)	//sent successfully
 				dat += text("<FONT COLOR='GREEN'>Message sent</FONT><BR><BR>")
-			dat += text("<A href='?src=\ref[src];setScreen=[0]'>Continue</A><BR>")
+				dat += text("<A href='?src=\ref[src];setScreen=0'>Continue</A><BR>")
-		if (src.screen == 7)
+
+			if(7)	//unsuccessful; not sent
 				dat += text("<FONT COLOR='RED'>An error occurred. </FONT><BR><BR>")
-			dat += text("<A href='?src=\ref[src];setScreen=[0]'>Continue</A><BR>")
+				dat += text("<A href='?src=\ref[src];setScreen=0'>Continue</A><BR>")
-		if (src.screen == 8)
+
-			for (var/obj/machinery/requests_console/CONSOLE in allConsoles)
+			if(8)	//view messages
-				if (CONSOLE.department == src.department)
+				for (var/obj/machinery/requests_console/Console in allConsoles)
-					CONSOLE.newmessagepriority = 0
+					if (Console.department == department)
-					CONSOLE.icon_state = "req_comp0"
+						Console.newmessagepriority = 0
-					CONSOLE.luminosity = 1
+						Console.icon_state = "req_comp0"
-			src.newmessagepriority = 0
+						Console.luminosity = 1
+				newmessagepriority = 0
 				icon_state = "req_comp0"
-			for(var/msg in src.messages)
+				for(var/msg in messages)
 					dat += text("[msg]<BR>")
-			dat += text("<A href='?src=\ref[src];setScreen=[0]'>Back to main menu</A><BR>")
+				dat += text("<A href='?src=\ref[src];setScreen=0'>Back to main menu</A><BR>")
-		if (src.screen == 9)
+
+			if(9)	//authentication before sending
 				dat += text("<B>Message Authentication</B><BR><BR>")
-			dat += text("<b>Message for [src.dpt]: </b>[message]<BR><BR>")
+				dat += text("<b>Message for [dpt]: </b>[message]<BR><BR>")
 				dat += text("You may authenticate your message now by scanning your ID or your stamp<BR><BR>")
 				dat += text("Validated by: [msgVerified]<br>");
 				dat += text("Stamped by: [msgStamped]<br>");
-			dat += text("<A href='?src=\ref[src];department=[src.dpt]'>Send</A><BR>");
+				dat += text("<A href='?src=\ref[src];department=[dpt]'>Send</A><BR>");
-			dat += text("<BR><A href='?src=\ref[src];setScreen=[0]'>Back</A><BR>")
+				dat += text("<BR><A href='?src=\ref[src];setScreen=0'>Back</A><BR>")
-		if (src.screen == 10)
+
+			if(10)	//send announcement
 				dat += text("<B>Station wide announcement</B><BR><BR>")
 				if(announceAuth)
 					dat += text("<b>Authentication accepted</b><BR><BR>")
 				else
 					dat += text("Swipe your card to authenticate yourself.<BR><BR>")
-			dat += text("<b>Message: </b>[message] <A href='?src=\ref[src];writeAnnouncement=[1]'>Write</A><BR><BR>")
+				dat += text("<b>Message: </b>[message] <A href='?src=\ref[src];writeAnnouncement=1'>Write</A><BR><BR>")
 				if (announceAuth && message)
-				dat += text("<A href='?src=\ref[src];sendAnnouncement=[1]'>Announce</A><BR>");
+					dat += text("<A href='?src=\ref[src];sendAnnouncement=1'>Announce</A><BR>");
-			dat += text("<BR><A href='?src=\ref[src];setScreen=[0]'>Back</A><BR>")
+				dat += text("<BR><A href='?src=\ref[src];setScreen=0'>Back</A><BR>")
+
+			else	//main menu
+				screen = 0
+				announceAuth = 0
+				if (newmessagepriority == 1)
+					dat += text("<FONT COLOR='RED'>There are new messages</FONT><BR>")
+				if (newmessagepriority == 2)
+					dat += text("<FONT COLOR='RED'><B>NEW PRIORITY MESSAGES</B></FONT><BR>")
+				dat += text("<A href='?src=\ref[src];setScreen=8'>View Messages</A><BR><BR>")
+
+				dat += text("<A href='?src=\ref[src];setScreen=1'>Request Assistance</A><BR>")
+				dat += text("<A href='?src=\ref[src];setScreen=2'>Request Supplies</A><BR>")
+				dat += text("<A href='?src=\ref[src];setScreen=3'>Relay Anonymous Information</A><BR><BR>")
+				if(announcementConsole)
+					dat += text("<A href='?src=\ref[src];setScreen=10'>Send station-wide announcement</A><BR><BR>")
+				if (silent)
+					dat += text("Speaker <A href='?src=\ref[src];setSilent=0'>OFF</A>")
+				else
+					dat += text("Speaker <A href='?src=\ref[src];setSilent=1'>ON</A>")
+
 		user << browse("[dat]", "")
 		onclose(user, "req_console")
 	return
 
 /obj/machinery/requests_console/Topic(href, href_list)
-	if(..())
+	if(..())	return
-		return
 	usr.machine = src
-	src.add_fingerprint(usr)
+	add_fingerprint(usr)
-	if(href_list["write"])
+
-		src.dpt = href_list["write"] //write contains the string of the receiving department's name
+	if(reject_bad_text(href_list["write"]))
-		src.message = strip_html(input(usr, "Write your message", "Messanger", ""))
+		dpt = ckey(href_list["write"]) //write contains the string of the receiving department's name
-		src.priority = href_list["priority"]
+
-		while (findtext(src.message," ") == 1)
+		var/new_message = reject_bad_text(input(usr, "Write your message:", "Awaiting Input", ""))
-			src.message = copytext(src.message,2,lentext(src.message)+1)
+		if(new_message)
-		if (findtext(src.message," ") == 1)
+			message = new_message
-			src.message = "";
-		if (src.message != "")
 			screen = 9
+			switch(href_list["priority"])
+				if("2")	priority = 2
+				else	priority = -1
 		else
 			dpt = "";
-			msgVerified = "";
+			msgVerified = ""
-			msgStamped = "";
+			msgStamped = ""
 			screen = 0
 			priority = -1
+
 	if(href_list["writeAnnouncement"])
-		src.message = input(usr, "Write your message", "Messanger", "")
+		var/new_message = reject_bad_text(input(usr, "Write your message:", "Awaiting Input", ""))
-		src.priority = href_list["priority"]
+		if(new_message)
-		while (findtext(src.message," ") == 1)
+			message = new_message
-			src.message = copytext(src.message,2,lentext(src.message)+1)
+			switch(href_list["priority"])
-		if (findtext(src.message," ") == 1)
+				if("2")	priority = 2
-			src.message = "";
+				else	priority = -1
-		if (src.message == "")
+		else
-			announceAuth = 0;
+			message = ""
+			announceAuth = 0
 			screen = 0
+
 	if(href_list["sendAnnouncement"])
-		world << "<b><font size = 3><font color = red>[department] announcement:</font color> [html_encode(message)]</font size></b>"
+		if(!announcementConsole)	return
+		world << "<b><font size = 3><font color = red>[department] announcement:</font color> [message]</font size></b>"
 		announceAuth = 0
 		message = ""
 		screen = 0
-	if(href_list["department"] && src.message)
+
-		var/log_msg = src.message
+	if( href_list["department"] && message )
-		var/message = src.message;
+		var/log_msg = message
-		message += "<br>"
+		var/sending = message
-		if (src.msgVerified)
+		sending += "<br>"
-			message += src.msgVerified
+		if (msgVerified)
-			message += "<br>"
+			sending += msgVerified
-		if (src.msgStamped)
+			sending += "<br>"
-			message += src.msgStamped
+		if (msgStamped)
-			message += "<br>"
+			sending += msgStamped
-		src.screen = 7 //if it's successful, this will get overrwritten (7 = unsufccessfull, 6 = successfull)
+			sending += "<br>"
-		if (message)
+		screen = 7 //if it's successful, this will get overrwritten (7 = unsufccessfull, 6 = successfull)
+		if (sending)
 			for (var/obj/machinery/message_server/MS in world)
-				MS.send_rc_message(href_list["department"],src.department,log_msg,msgStamped,msgVerified,priority)
+				MS.send_rc_message(href_list["department"],department,log_msg,msgStamped,msgVerified,priority)
-			for (var/obj/machinery/requests_console/CONSOLE in allConsoles)
+
-				if (ckey(CONSOLE.department) == ckey(href_list["department"]))
+			for (var/obj/machinery/requests_console/Console in allConsoles)
-					if(src.priority == "2") //High priority
+				if (ckey(Console.department) == ckey(href_list["department"]))
-						if(CONSOLE.newmessagepriority < 2)
+
-							CONSOLE.newmessagepriority = 2
+					switch(priority)
-							CONSOLE.icon_state = "req_comp2"
+						if("2")		//High priority
-						if(!CONSOLE.silent)
+							if(Console.newmessagepriority < 2)
-							playsound(CONSOLE.loc, 'twobeep.ogg', 50, 1)
+								Console.newmessagepriority = 2
-							for (var/mob/O in hearers(5, CONSOLE.loc))
+								Console.icon_state = "req_comp2"
-								O.show_message(text("\icon[CONSOLE] *The Requests Console beeps: 'PRIORITY Alert in [src.department]'"))
+							if(!Console.silent)
-						CONSOLE.messages += "<B><FONT color='red'>High Priority message from <A href='?src=\ref[CONSOLE];write=[ckey(src.department)]'>[src.department]</A></FONT></B><BR>[message]"
+								playsound(Console.loc, 'twobeep.ogg', 50, 1)
-					else if(src.priority == "3"
+								for (var/mob/O in hearers(5, Console.loc))
-					) //Not implemanted, but will be
+									O.show_message(text("\icon[Console] *The Requests Console beeps: 'PRIORITY Alert in [department]'"))
-						if(CONSOLE.newmessagepriority < 3)
+							Console.messages += "<B><FONT color='red'>High Priority message from <A href='?src=\ref[Console];write=[ckey(department)]'>[department]</A></FONT></B><BR>[sending]"
-							CONSOLE.newmessagepriority = 3
+
-							CONSOLE.icon_state = "req_comp3"
+	//					if("3")		//Not implemanted, but will be 		//Removed as it doesn't look like anybody intends on implimenting it ~Carn
-						if(!CONSOLE.silent)
+	//						if(Console.newmessagepriority < 3)
-							playsound(CONSOLE.loc, 'twobeep.ogg', 50, 1)
+	//							Console.newmessagepriority = 3
-							for (var/mob/O in hearers(7, CONSOLE.loc))
+	//							Console.icon_state = "req_comp3"
-								O.show_message(text("\icon[CONSOLE] *The Requests Console yells: 'EXTREME PRIORITY alert in [src.department]'"))
+	//						if(!Console.silent)
-						CONSOLE.messages += "<B><FONT color='red'>Extreme Priority message from [ckey(src.department)]</FONT></B><BR>[message]"
+	//							playsound(Console.loc, 'twobeep.ogg', 50, 1)
+	//							for (var/mob/O in hearers(7, Console.loc))
+	//								O.show_message(text("\icon[Console] *The Requests Console yells: 'EXTREME PRIORITY alert in [department]'"))
+	//						Console.messages += "<B><FONT color='red'>Extreme Priority message from [ckey(department)]</FONT></B><BR>[message]"
+
 						else		// Normal priority
-						if(CONSOLE.newmessagepriority < 1)
+							if(Console.newmessagepriority < 1)
-							CONSOLE.newmessagepriority = 1
+								Console.newmessagepriority = 1
-							CONSOLE.icon_state = "req_comp1"
+								Console.icon_state = "req_comp1"
-						if(!CONSOLE.silent)
+							if(!Console.silent)
-							playsound(CONSOLE.loc, 'twobeep.ogg', 50, 1)
+								playsound(Console.loc, 'twobeep.ogg', 50, 1)
-							for (var/mob/O in hearers(4, CONSOLE.loc))
+								for (var/mob/O in hearers(4, Console.loc))
-								O.show_message(text("\icon[CONSOLE] *The Requests Console beeps: 'Message from [src.department]'"))
+									O.show_message(text("\icon[Console] *The Requests Console beeps: 'Message from [department]'"))
-						CONSOLE.messages += "<B>Message from <A href='?src=\ref[CONSOLE];write=[ckey(src.department)]'>[src.department]</A></FONT></B><BR>[message]"
+							Console.messages += "<B>Message from <A href='?src=\ref[Console];write=[ckey(department)]'>[department]</A></FONT></B><BR>[message]"
-					src.screen = 6
+
-					CONSOLE.luminosity = 2
+					screen = 6
-			src.messages += "<B>Message sent to [src.dpt]</B><BR>[message]"
+					Console.luminosity = 2
-	if(href_list["setScreen"])
+			messages += "<B>Message sent to [dpt]</B><BR>[message]"
-		src.screen = text2num(href_list["setScreen"])
+
-		if (src.screen == 0)
+	//Handle screen switching
-			dpt = "";
+	switch(text2num(href_list["setScreen"]))
-			msgVerified = "";
+		if(null)	//skip
-			msgStamped = "";
+		if(1)		//req. assistance
-			message = "";
+			screen = 1
-			priority = -1;
+		if(2)		//req. supplies
-	if(href_list["setSilent"])
+			screen = 2
-		src.silent = text2num(href_list["setSilent"])
+		if(3)		//relay information
-	src.updateUsrDialog()
+			screen = 3
+//		if(4)		//write message
+//			screen = 4
+		if(5)		//choose priority
+			screen = 5
+		if(6)		//sent successfully
+			screen = 6
+		if(7)		//unsuccessfull; not sent
+			screen = 7
+		if(8)		//view messages
+			screen = 8
+		if(9)		//authentication
+			screen = 9
+		if(10)		//send announcement
+			if(!announcementConsole)	return
+			screen = 10
+		else		//main menu
+			dpt = ""
+			msgVerified = ""
+			msgStamped = ""
+			message = ""
+			priority = -1
+			screen = 0
+
+	//Handle silencing the console
+	switch( href_list["setSilent"] )
+		if(null)	//skip
+		if("1")	silent = 1
+		else	silent = 0
+
+	updateUsrDialog()
 	return
 
 					//err... hacking code, which has no reason for existing... but anyway... it's supposed to unlock priority 3 messanging on that console (EXTREME priority...) the code for that actually exists.
 /obj/machinery/requests_console/attackby(var/obj/item/weapon/O as obj, var/mob/user as mob)
 	/*
 	if (istype(O, /obj/item/weapon/crowbar))
-		if(src.open)
+		if(open)
-			src.open = 0
+			open = 0
-			src.icon_state="req_comp0"
+			icon_state="req_comp0"
 		else
-			src.open = 1
+			open = 1
-			if(src.hackState == 0)
+			if(hackState == 0)
-				src.icon_state="req_comp_open"
+				icon_state="req_comp_open"
-			else if(src.hackState == 1)
+			else if(hackState == 1)
-				src.icon_state="req_comp_rewired"
+				icon_state="req_comp_rewired"
 	if (istype(O, /obj/item/weapon/screwdriver))
-		if(src.open)
+		if(open)
-			if(src.hackState == 0)
+			if(hackState == 0)
-				src.hackState = 1
+				hackState = 1
-				src.icon_state="req_comp_rewired"
+				icon_state="req_comp_rewired"
-			else if(src.hackState == 1)
+			else if(hackState == 1)
-				src.hackState = 0
+				hackState = 0
-				src.icon_state="req_comp_open"
+				icon_state="req_comp_open"
 		else
 			user << "You can't do much with that."*/
 
 	if (istype(O, /obj/item/weapon/card/id))
-		if(src.screen == 9)
+		if(screen == 9)
 			var/obj/item/weapon/card/id/T = O
-			src.msgVerified = text("<font color='green'><b>Verified by [T.registered_name] ([T.assignment])</b></font>")
+			msgVerified = text("<font color='green'><b>Verified by [T.registered_name] ([T.assignment])</b></font>")
-			src.updateUsrDialog()
+			updateUsrDialog()
-		if(src.screen == 10)
+		if(screen == 10)
 			var/obj/item/weapon/card/id/ID = O
 			if (access_RC_announce in ID.access)
 				announceAuth = 1
 			else
 				announceAuth = 0
 				user << "\red You are not authorized to send announcements."
-			src.updateUsrDialog()
+			updateUsrDialog()
 	if (istype(O, /obj/item/weapon/stamp))
-		if(src.screen == 9)
+		if(screen == 9)
 			var/obj/item/weapon/stamp/T = O
-			src.msgStamped = text("<font color='blue'><b>Stamped with the [T.name]</b></font>")
+			msgStamped = text("<font color='blue'><b>Stamped with the [T.name]</b></font>")
-			src.updateUsrDialog()
+			updateUsrDialog()
 	return

code/modules/chemical/Chemistry-Machinery.dm

@@ -206,6 +206,7 @@
 		if(usr.stat || usr.restrained()) return
 		if(!in_range(src, usr)) return
 
+		src.add_fingerprint(usr)
 		usr.machine = src
 		if(!beaker) return
 		var/datum/reagents/R = beaker:reagents
@@ -259,18 +260,18 @@
 			reagents.clear_reagents()
 			icon_state = "mixer0"
 		else if (href_list["createpill"])
-			var/name = input(usr,"Name:","Name your pill!",reagents.get_master_reagent_name())
+			var/name = reject_bad_text(input(usr,"Name:","Name your pill!",reagents.get_master_reagent_name()))
 			var/obj/item/weapon/reagent_containers/pill/P = new/obj/item/weapon/reagent_containers/pill(src.loc)
-			if(!name || name == " ") name = reagents.get_master_reagent_name()
+			if(!name) name = reagents.get_master_reagent_name()
 			P.name = "[name] pill"
 			P.pixel_x = rand(-7, 7) //random position
 			P.pixel_y = rand(-7, 7)
 			reagents.trans_to(P,50)
 		else if (href_list["createbottle"])
 			if(!condi)
-				var/name = input(usr,"Name:","Name your bottle!",reagents.get_master_reagent_name())
+				var/name = reject_bad_text(input(usr,"Name:","Name your bottle!",reagents.get_master_reagent_name()))
 				var/obj/item/weapon/reagent_containers/glass/bottle/P = new/obj/item/weapon/reagent_containers/glass/bottle(src.loc)
-				if(!name || name == " ") name = reagents.get_master_reagent_name()
+				if(!name) name = reagents.get_master_reagent_name()
 				P.name = "[name] bottle"
 				P.pixel_x = rand(-7, 7) //random position
 				P.pixel_y = rand(-7, 7)
@@ -281,7 +282,6 @@
 		else
 			usr << browse(null, "window=chem_master")
 		src.updateUsrDialog()
-		src.add_fingerprint(usr)
 		return
 
 	attack_ai(mob/user as mob)

code/modules/mob/mob.dm

@@ -582,27 +582,12 @@
 		if(src:cameraFollow)
 			src:cameraFollow = null
 
-
-/client/Topic(href, href_list)
-	if(href_list["priv_msg"])
-		var/client/C = locate(href_list["priv_msg"])
-		if(ismob(C)) //Old stuff can pass in mobs instead of clients
-			var/mob/M = C
-			C = M.client
-		cmd_admin_pm(C,null)
-	else
-		..()
-
 /mob/Topic(href, href_list)
-	if(href_list["priv_msg"])	//for priv_msg references that have yet to be updated to target clients. Forwards it to client/Topic()
-		if(client)
-			client.Topic(href, href_list)
-
 	if(href_list["mach_close"])
 		var/t1 = text("window=[href_list["mach_close"]]")
 		machine = null
 		src << browse(null, t1)
-	..()
+//	..()
 	return
 
 /mob/proc/get_damage()

code/modules/paperwork/handlabeler.dm

@@ -40,7 +40,7 @@
 	if(mode)
 		usr << "\blue You turn on the hand labeler."
 		//Now let them chose the text.
-		var/str = input(usr,"Label text?","Set label","")
+		var/str = reject_bad_text(input(usr,"Label text?","Set label",""))	//sanitize stuff! GOD DAMN THIS IS A SECURITY HOLE
 		if(!str || !length(str))
 			usr << "\red Invalid text."
 			return