Fixes a ton of security issues (#19005)

code/modules/admin/admin_investigate.dm

@@ -9,7 +9,7 @@
 
 //SYSTEM
 /proc/investigate_subject2file(subject)
-	return file("[INVESTIGATE_DIR][subject].html")
+	return wrap_file("[INVESTIGATE_DIR][subject].html")
 
 /proc/investigate_reset()
 	if(fdel(INVESTIGATE_DIR))	return 1

code/modules/admin/outfits.dm

@@ -35,7 +35,7 @@ GLOBAL_LIST_EMPTY(custom_outfits) //Admin created outfits
 	var/outfit_file = input("Pick outfit json file:", "File") as null|file
 	if(!outfit_file)
 		return
-	var/filedata = file2text(outfit_file)
+	var/filedata = wrap_file2text(outfit_file)
 	var/json = json_decode(filedata)
 	if(!json)
 		to_chat(admin,"<span class='warning'>JSON decode error.</span>")

code/modules/admin/verbs/getlogs.dm

@@ -30,11 +30,11 @@
 	message_admins("[key_name_admin(src)] accessed file: [path]")
 	switch(alert("View (in game), Open (in your system's text editor), or Download?", path, "View", "Open", "Download"))
 		if ("View")
-			src << browse("<pre style='word-wrap: break-word;'>[html_encode(file2text(file(path)))]</pre>", list2params(list("window" = "viewfile.[path]")))
+			src << browse("<pre style='word-wrap: break-word;'>[html_encode(wrap_file2text(wrap_file(path)))]</pre>", list2params(list("window" = "viewfile.[path]")))
 		if ("Open")
-			src << run(file(path))
+			src << run(wrap_file(path))
 		if ("Download")
-			src << ftp(file(path))
+			src << ftp(wrap_file(path))
 		else
 			return
 	to_chat(src, "Attempting to send [path], this may take a fair few minutes if the file is very large.")

code/modules/awaymissions/maploader/reader.dm

@@ -35,7 +35,7 @@ GLOBAL_DATUM_INIT(_preloader, /datum/dmm_suite/preloader, new())
 		if(lastchar == "/" || lastchar == "\\")
 			log_debug("Attempted to load map template without filename (Attempted [tfile])")
 			return
-		tfile = file2text(tfile)
+		tfile = wrap_file2text(tfile)
 		if(!length(tfile))
 			throw EXCEPTION("Map path '[fname]' does not exist!")
 
@@ -407,7 +407,7 @@ GLOBAL_DATUM_INIT(_preloader, /datum/dmm_suite/preloader, new())
 
 	// Check for file
 	else if(copytext(value_text, 1, 2) == "'")
-		. = file(copytext(value_text, 2, length(value_text)))
+		. = wrap_file(copytext(value_text, 2, length(value_text)))
 
 	// Check for path
 	else if(ispath(text2path(value_text)))

code/modules/awaymissions/maploader/writer.dm

@@ -18,7 +18,7 @@
 	var/map_path = "[map_prefix][map_name].dmm"
 	if(fexists(map_path))
 		fdel(map_path)
-	var/saved_map = file(map_path)
+	var/saved_map = wrap_file(map_path)
 	var/map_text = write_map(t1, t2, flags, saved_map)
 	saved_map << map_text
 	return saved_map

code/modules/instruments/songs/play_legacy.dm

@@ -71,7 +71,7 @@
 
 	// now generate name
 	var/filename = "sound/instruments/[cached_legacy_dir]/[ascii2text(note + 64)][acc][oct].[cached_legacy_ext]"
-	var/soundfile = file(filename)
+	var/soundfile = wrap_file(filename)
 	// make sure the note exists
 	var/cached_fexists = valid_files[filename]
 	if(!isnull(cached_fexists))

code/modules/mob/living/simple_animal/friendly/dog.dm

@@ -443,7 +443,7 @@
 		var/json_file = file("data/npc_saves/Ian.json")
 		if(!fexists(json_file))
 			return
-		var/list/json = json_decode(file2text(json_file))
+		var/list/json = json_decode(wrap_file2text(json_file))
 		age = json["age"]
 		record_age = json["record_age"]
 		saved_head = json["saved_head"]

code/modules/tooltip/tooltip.dm

@@ -43,7 +43,7 @@ Notes:
 /datum/tooltip/New(client/C)
 	if(C)
 		owner = C
-		owner << browse(file2text(file), "window=[control]")
+		owner << browse(wrap_file2text(file), "window=[control]")
 
 	..()