From 920bcbed829a3a72f0b9ddb4dbe2e51bf54c8ba0 Mon Sep 17 00:00:00 2001
From: Timothy Teakettle <59849408+timothyteakettle@users.noreply.github.com>
Date: Wed, 17 Dec 2025 17:02:08 +0000
Subject: [PATCH] loadout sanitization fixes (#7432)

## About The Pull Request
loadout name/desc is stored not encoded and is encoded when it's applied
to the item
we still do a length check on it

collars don't reset their name when you apply a tag now, by storing what
it considers its initial name

## Why It's Good For The Game
fixes bugs

## Changelog

<!-- If your PR modifies aspects of the game that can be concretely
observed by players or admins you should add a changelog. If your change
does NOT meet this description, remove this section. Please note that
maintainers freely reserve the right to remove and add tags should they
deem it appropriate. You can attempt to finagle the system all you want,
but it's best to shoot for clear communication right off the bat. -->

:cl:
fix: loadout items with a changed name/desc should no longer double
sanitize
fix: collars don't reset their name when you apply a tag now
:cl:

<!-- Both :cl:'s are required for the changelog to work! You can put
your name to the right of the first :cl: if you want to overwrite your
GitHub username as author ingame. -->
<!-- You can use multiple of the same prefix (they're only used for the
icon ingame) and delete the unneeded ones. Despite some of the tags,
changelogs should generally represent how a player might be affected by
the changes rather than a summary of the PR's contents. -->
---
 .../clothing/legacy_accessories/accessory.dm  | 59 ++++++++-----------
 code/modules/loadout/loadout_entry.dm         |  4 +-
 code/modules/loadout/loadout_tweak.dm         |  4 +-
 .../preference_setup/loadout/loadout.dm       |  8 ++-
 code/modules/species/holosphere/appearance.dm |  4 +-
 5 files changed, 37 insertions(+), 42 deletions(-)

diff --git a/code/modules/clothing/legacy_accessories/accessory.dm b/code/modules/clothing/legacy_accessories/accessory.dm
index 74c1473cf71..3ac936b05dc 100644
--- a/code/modules/clothing/legacy_accessories/accessory.dm
+++ b/code/modules/clothing/legacy_accessories/accessory.dm
@@ -521,7 +521,21 @@
 	icon = 'icons/obj/clothing/collars.dmi'
 	icon_override = 'icons/mob/clothing/ties.dmi'
 	var/icon_previous_override
-	var/writtenon = 0
+	var/collar_name
+	var/collar_tag
+
+/obj/item/clothing/accessory/collar/proc/set_collar_tag(var/new_tag, var/update_name = TRUE, var/update_desc = TRUE, var/name_format = "COLLAR_NAME (COLLAR_TAG)", var/desc_format = "The tag says \"COLLAR_TAG\".")
+	// if there's no tag, we can safely say the current name is the new name to use when applying a tag, rather than the initial name
+	if(!length(collar_tag))
+		collar_name = name
+
+	collar_tag = new_tag
+
+	var/applicable_name = length(collar_name) ? collar_name : initial(name)
+	if(update_name)
+		name = length(new_tag) ? replacetext(replacetext(name_format, "COLLAR_NAME", applicable_name), "COLLAR_TAG", new_tag) : applicable_name
+	if(update_desc)
+		desc = length(new_tag) ? replacetext(replacetext(desc_format, "COLLAR_NAME", applicable_name), "COLLAR_TAG", new_tag) : initial(desc)
 
 // Forces different sprite sheet on equip
 /obj/item/clothing/accessory/collar/Initialize(mapload)
@@ -532,15 +546,7 @@
 	if(istype(P, /obj/item/pen))
 		to_chat(user,"<span class='notice'>You write on [name]'s tag.</span>")
 		var/str = copytext(reject_bad_text(input(user,"Tag text?","Set tag","")),1,MAX_NAME_LEN)
-
-		if(!str || !length(str))
-			to_chat(user,"<span class='notice'>[name]'s tag set to be blank.</span>")
-			name = initial(name)
-			desc = initial(desc)
-		else
-			to_chat(user,"<span class='notice'>You set the [name]'s tag to '[str]'.</span>")
-			name = initial(name) + " ([str])"
-			desc = initial(desc) + " The tag says \"[str]\"."
+		set_collar_tag(str)
 		return CLICKCHAIN_DID_SOMETHING
 	return ..()
 
@@ -778,29 +784,17 @@
 	if(istype(src,/obj/item/clothing/accessory/collar/holo))
 		to_chat(user,"<span class='notice'>[name]'s interface is projected onto your hand.</span>")
 	else
-		if(writtenon)
+		if(length(collar_tag))
 			to_chat(user,"<span class='notice'>You need a pen or a screwdriver to edit the tag on this collar.</span>")
 			return
 		to_chat(user,"<span class='notice'>You adjust the [name]'s tag.</span>")
 
 	var/str = copytext(reject_bad_text(input(user,"Tag text?","Set tag","")),1,MAX_NAME_LEN)
 
-	if(!str || !length(str))
-		to_chat(user,"<span class='notice'>[name]'s tag set to be blank.</span>")
-		name = initial(name)
-		desc = initial(desc)
-	else
-		to_chat(user,"<span class='notice'>You set the [name]'s tag to '[str]'.</span>")
-		initialize_tag(str)
+	set_collar_tag(str)
 
-/obj/item/clothing/accessory/collar/proc/initialize_tag(var/tag)
-		name = initial(name) + " ([tag])"
-		desc = initial(desc) + " \"[tag]\" has been engraved on the tag."
-		writtenon = 1
-
-/obj/item/clothing/accessory/collar/holo/initialize_tag(var/tag)
-		..()
-		desc = initial(desc) + " The tag says \"[tag]\"."
+/obj/item/clothing/accessory/collar/holo/set_collar_tag(var/new_tag, var/update_name = FALSE, var/update_desc = TRUE, var/name_format = "COLLAR_NAME (COLLAR_TAG)", var/desc_format = "The tag says \"COLLAR_TAG\".")
+		..(tag, update_name = FALSE)
 
 /obj/item/clothing/accessory/collar/attackby(obj/item/I, mob/user)
 	if(istype(src,/obj/item/clothing/accessory/collar/holo))
@@ -823,22 +817,19 @@
 	var/str = copytext(reject_bad_text(input(user,"Tag text?","Set tag","")),1,MAX_NAME_LEN)
 
 	if(!str || !length(str))
-		if(!writtenon)
+		if(!length(collar_tag))
 			to_chat(user,"<span class='notice'>You don't write anything.</span>")
 		else
 			to_chat(user,"<span class='notice'>You [erasing] the words with the [I].</span>")
-			name = initial(name)
+			set_collar_tag("")
 			desc = initial(desc) + " The tag has had the words [erasemethod]."
 	else
-		if(!writtenon)
+		if(!length(collar_tag))
 			to_chat(user,"<span class='notice'>You write '[str]' on the tag with the [I].</span>")
-			name = initial(name) + " ([str])"
-			desc = initial(desc) + " \"[str]\" has been [writemethod] on the tag."
-			writtenon = 1
+			set_collar_tag(str, desc_format = "\"COLLAR_TAG\" has been [writemethod] on the tag.")
 		else
 			to_chat(user,"<span class='notice'>You [erasing] the words on the tag with the [I], and write '[str]'.</span>")
-			name = initial(name) + " ([str])"
-			desc = initial(desc) + " Something has been [erasemethod] on the tag, and it now has \"[str]\" [writemethod] on it."
+			set_collar_tag(str, desc_format = "Something has been [erasemethod] on the tag, and it now has \"COLLAR_TAG\" [writemethod] on it.")
 
 //Medals
 
diff --git a/code/modules/loadout/loadout_entry.dm b/code/modules/loadout/loadout_entry.dm
index 7154639c596..f778d9c217d 100644
--- a/code/modules/loadout/loadout_entry.dm
+++ b/code/modules/loadout/loadout_entry.dm
@@ -99,9 +99,9 @@ var/list/gear_datums = list()
 		CRASH("[src] ([src.type]) attempted to spawn a null path with data: '[json_encode(entry_data)]'.")
 	var/obj/item/spawned = new path(where)
 	if((loadout_customize_flags & LOADOUT_CUSTOMIZE_NAME) && entry_data[LOADOUT_ENTRYDATA_RENAME])
-		spawned.name = entry_data[LOADOUT_ENTRYDATA_RENAME]
+		spawned.name = sanitize(entry_data[LOADOUT_ENTRYDATA_RENAME])
 	if((loadout_customize_flags & LOADOUT_CUSTOMIZE_DESC) && entry_data[LOADOUT_ENTRYDATA_REDESC])
-		spawned.desc = entry_data[LOADOUT_ENTRYDATA_REDESC]
+		spawned.desc = sanitize(entry_data[LOADOUT_ENTRYDATA_REDESC])
 	if((loadout_customize_flags & LOADOUT_CUSTOMIZE_COLOR) && entry_data[LOADOUT_ENTRYDATA_RECOLOR])
 		spawned.color = entry_data[LOADOUT_ENTRYDATA_RECOLOR]
 	for(var/datum/loadout_tweak/tweak as anything in tweak_assembled)
diff --git a/code/modules/loadout/loadout_tweak.dm b/code/modules/loadout/loadout_tweak.dm
index d7f01d6f50d..04f9c6ded66 100644
--- a/code/modules/loadout/loadout_tweak.dm
+++ b/code/modules/loadout/loadout_tweak.dm
@@ -1,4 +1,4 @@
-/**
+gear_tweak_collar_tag/**
  * arbitrary loadout tweaks
  *
  * stored data should always be a string.
@@ -473,4 +473,4 @@
 	if(metadata == "")
 		return ..()
 	else
-		C.initialize_tag(metadata)
+		C.set_collar_tag(metadata)
diff --git a/code/modules/preferences/preference_setup/loadout/loadout.dm b/code/modules/preferences/preference_setup/loadout/loadout.dm
index 34c12b26d0d..7a9a71e7a64 100644
--- a/code/modules/preferences/preference_setup/loadout/loadout.dm
+++ b/code/modules/preferences/preference_setup/loadout/loadout.dm
@@ -220,7 +220,9 @@
 			entries[id] = entry_data
 			if(!(entry.loadout_customize_flags & LOADOUT_CUSTOMIZE_NAME))
 				return TRUE
-			var/name = sanitize(params["name"], MAX_NAME_LEN)
+			var/name = params["name"]
+			if(length(name) > MAX_NAME_LEN)
+				return TRUE
 			if(isnull(name))
 				return TRUE
 			if(name)
@@ -251,7 +253,9 @@
 			entries[id] = entry_data
 			if(!(entry.loadout_customize_flags & LOADOUT_CUSTOMIZE_DESC))
 				return TRUE
-			var/desc = sanitize(params["desc"], MAX_MESSAGE_LEN)
+			var/desc = params["desc"]
+			if(length(desc) > MAX_MESSAGE_LEN)
+				return TRUE
 			if(isnull(desc))
 				return TRUE
 			if(desc)
diff --git a/code/modules/species/holosphere/appearance.dm b/code/modules/species/holosphere/appearance.dm
index d931a02b076..5a0aa46d9c3 100644
--- a/code/modules/species/holosphere/appearance.dm
+++ b/code/modules/species/holosphere/appearance.dm
@@ -80,9 +80,9 @@
 		equipped.disguise(entry.path, H)
 
 		if((entry.loadout_customize_flags & LOADOUT_CUSTOMIZE_NAME) && entry_data[LOADOUT_ENTRYDATA_RENAME])
-			equipped.name = entry_data[LOADOUT_ENTRYDATA_RENAME]
+			equipped.name = sanitize(entry_data[LOADOUT_ENTRYDATA_RENAME])
 		if((entry.loadout_customize_flags & LOADOUT_CUSTOMIZE_DESC) && entry_data[LOADOUT_ENTRYDATA_REDESC])
-			equipped.desc = entry_data[LOADOUT_ENTRYDATA_REDESC]
+			equipped.desc = sanitize(entry_data[LOADOUT_ENTRYDATA_REDESC])
 		if((entry.loadout_customize_flags & LOADOUT_CUSTOMIZE_COLOR) && entry_data[LOADOUT_ENTRYDATA_RECOLOR])
 			equipped.color = entry_data[LOADOUT_ENTRYDATA_RECOLOR]