From 2ee7413197191e1d023ca44bd3cede27fc6f8196 Mon Sep 17 00:00:00 2001
From: dearmochi <1496804+dearmochi@users.noreply.github.com>
Date: Wed, 7 Jul 2021 14:50:28 +0200
Subject: [PATCH] Sanitizes incoming Discord PMs (#16321)

---
 code/modules/world_topic/adminmsg.dm | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/code/modules/world_topic/adminmsg.dm b/code/modules/world_topic/adminmsg.dm
index e3582b0ae46..5ad8f535e47 100644
--- a/code/modules/world_topic/adminmsg.dm
+++ b/code/modules/world_topic/adminmsg.dm
@@ -19,8 +19,9 @@
 	if(!C)
 		return json_encode(list("error" = "No client with that name on server"))
 
-	var/message =	"<font color='red'>Discord PM from <b><a href='?discord_msg=1'>[input["sender"]]</a></b>: [input["msg"]]</font>"
-	var/amessage =  "<font color='blue'>Discord PM from <a href='?discord_msg=1'>[input["sender"]]</a> to <b>[key_name_admin(C)]</b>: [input["msg"]]</font>"
+	var/sanitized = sanitize(input["msg"])
+	var/message =	"<font color='red'>Discord PM from <b><a href='?discord_msg=1'>[input["sender"]]</a></b>: [sanitized]</font>"
+	var/amessage =  "<font color='blue'>Discord PM from <a href='?discord_msg=1'>[input["sender"]]</a> to <b>[key_name_admin(C)]</b>: [sanitized]</font>"
 
 	// THESE TWO VARS DO VERY DIFFERENT THINGS. DO NOT ATTEMPT TO COMBINE THEM
 	C.received_discord_pm = world.time