Merge pull request #7841 from Crazylemon64/oh_my_gooooooooooooooood

[s] Oh my gooooooooo-

code/__HELPERS/text.dm

@@ -59,6 +59,10 @@
 /proc/sanitize(var/t,var/list/repl_chars = null)
 	return html_encode(sanitize_simple(t,repl_chars))
 
+/proc/paranoid_sanitize(t)
+	var/regex/alphanum_only = regex("\[^a-zA-Z0-9#]", "g")
+	return alphanum_only.Replace(t, "#")
+
 //Runs sanitize and strip_html_simple
 //I believe strip_html_simple() is required to run first to prevent '<' from displaying as '&lt;' after sanitize() calls byond's html_encode()
 /proc/strip_html(var/t,var/limit=MAX_MESSAGE_LEN)
@@ -542,4 +546,3 @@ proc/checkhtml(var/t)
 	text = replacetext(text, "<td>",					"\[cell\]")
 	text = replacetext(text, "<img src = ntlogo.png>",	"\[logo\]")
 	return text
-

code/_globalvars/configuration.dm

@@ -23,6 +23,9 @@ var/mouse_respawn_time = 5 //Amount of time that must pass between a player dyin
 // It's defined here as a global because this is a hilariously bad thing to have on the easily-edited config datum
 var/global/shutdown_shell_command
 
+// Also global to prevent easy edits
+var/global/python_path = "" //Path to the python executable.  Defaults to "python" on windows and "/usr/bin/env python2" on unix
+
 // Debug is used exactly once (in living.dm) but is commented out in a lot of places.  It is not set anywhere and only checked.
 // Debug2 is used in conjunction with a lot of admin verbs and therefore is actually legit.
 var/Debug = 0	// global debug switch
@@ -44,4 +47,4 @@ var/blobevent = 0
 //Medals hub related variables
 var/global/medal_hub = null
 var/global/medal_pass = " "
-var/global/medals_enabled = TRUE	//will be auto set to false if the game fails contacting the medal hub to prevent unneeded calls.
+var/global/medals_enabled = TRUE	//will be auto set to false if the game fails contacting the medal hub to prevent unneeded calls.

code/controllers/configuration.dm

@@ -142,7 +142,6 @@
 	var/admin_irc = ""
 	var/admin_notify_irc = ""
 	var/cidrandomizer_irc = ""
-	var/python_path = "" //Path to the python executable.  Defaults to "python" on windows and "/usr/bin/env python2" on unix
 
 	var/default_laws = 0 //Controls what laws the AI spawns with.
 
@@ -494,12 +493,12 @@
 
 				if("python_path")
 					if(value)
-						config.python_path = value
+						python_path = value
 					else
 						if(world.system_type == UNIX)
-							config.python_path = "/usr/bin/env python2"
+							python_path = "/usr/bin/env python2"
 						else //probably windows, if not this should work anyway
-							config.python_path = "pythonw"
+							python_path = "pythonw"
 
 				if("assistant_limit")
 					config.assistantlimit = 1

code/modules/admin/verbs/SDQL2/SDQL_2.dm

@@ -89,7 +89,8 @@
 
 				if("delete")
 					for(var/d in objs)
-						qdel(d)
+						if(!datum_is_forbidden(d))
+							qdel(d)
 
 				if("select")
 					var/text = ""
@@ -117,6 +118,9 @@
 					if("set" in query_tree)
 						var/list/set_list = query_tree["set"]
 						for(var/d in objs)
+							// Forbid explicitly modifying an admin datum's vars
+							if(datum_is_forbidden(d))
+								return
 							for(var/list/sets in set_list)
 								var/datum/temp = d
 								var/i = 0
@@ -124,11 +128,11 @@
 									if(++i == sets.len)
 										if(istype(temp, /turf) && (v == "x" || v == "y" || v == "z"))
 											continue
-										if(istype(temp.vars[v], /datum/admins))
-											continue
+										if(!datum_is_forbidden(temp.vars[v]))
+											return
 										temp.vars[v] = SDQL_expression(d, set_list[sets])
 										break
-									if(temp.vars.Find(v) && (istype(temp.vars[v], /datum) || istype(temp.vars[v], /client)) && !istype(temp.vars[v], /datum/admins))
+									if(temp.vars.Find(v) && (istype(temp.vars[v], /datum) || istype(temp.vars[v], /client)) && !datum_is_forbidden(temp.vars[v]))
 										temp = temp.vars[v]
 									else
 										break
@@ -436,6 +440,11 @@
 	for(var/arg in arguments)
 		new_args[++new_args.len] = SDQL_expression(source, arg)
 
+	for(var/p in forbidden_varedit_object_types)
+		if(istype(object, p))
+			to_chat(usr, "<span class='warning'>It is forbidden to run this object's procs.</span>")
+			return
+
 	if(object == world) // Global proc.
 		procname = "/proc/[procname]"
 		return call(procname)(arglist(new_args))

code/modules/admin/verbs/modifyvariables.dm

@@ -13,6 +13,14 @@ var/list/forbidden_varedit_object_types = list(
 	feedback_add_details("admin_verb","EDITV") //If you are copy-pasting this, ensure the 2nd parameter is unique to the new proc!
 */
 
+/proc/datum_is_forbidden(type)
+	for(var/p in forbidden_varedit_object_types)
+		if(istype(type, p))
+			to_chat(usr, "<span class='warning'>It is forbidden to tamper with this object.</span>")
+			return FALSE
+	return TRUE
+
+
 /client/proc/cmd_modify_ticker_variables()
 	set category = "Debug"
 	set name = "Edit Ticker Variables"
@@ -131,7 +139,7 @@ var/list/forbidden_varedit_object_types = list(
 			L[var_value] = mod_list_add_ass() //haha
 		if("No")
 			L += var_value
-			
+
 /client/proc/mod_list(var/list/L)
 	if(!check_rights(R_VAREDIT))	return
 
@@ -497,4 +505,4 @@ var/list/forbidden_varedit_object_types = list(
 		to_chat(usr, "Variable type is <b>UNKNOWN</b>.")
 		class = null
 
-	return class
+	return class

code/modules/ext_scripts/irc.dm

@@ -2,7 +2,8 @@
 	if(config.use_irc_bot && config.irc_bot_host.len)
 		for(var/IP in config.irc_bot_host)
 			spawn(0)
-				ext_python("ircbot_message.py", "[config.comms_password] [IP] [channel] [msg]")
+				// I have no means of trusting you, cmd
+				ext_python("ircbot_message.py", "[config.comms_password] [IP] [channel] [paranoid_sanitize(msg)]")
 	return
 
 /proc/send2mainirc(var/msg)

code/modules/ext_scripts/python.dm

@@ -4,6 +4,6 @@
 	if(world.system_type == MS_WINDOWS)
 		script = replacetext(script, "/", "\\")
 
-	var/command = config.python_path + " " + script + " " + args
+	var/command = python_path + " " + script + " " + args
 	shell("[command]")
-	return
+	return