Sanitize all inputs

code/modules/admin/admin_verbs.dm

@@ -475,7 +475,7 @@ var/list/admin_verbs_ticket = list(
 		if(holder.fakekey)
 			holder.fakekey = null
 		else
-			var/new_key = ckeyEx(input("Enter your desired display name.", "Fake Key", key) as text|null)
+			var/new_key = ckeyEx(clean_input("Enter your desired display name.", "Fake Key", key))
 			if(!new_key)	return
 			if(length(new_key) >= 26)
 				new_key = copytext(new_key, 1, 26)
@@ -497,7 +497,7 @@ var/list/admin_verbs_ticket = list(
 			holder.fakekey = null
 			holder.big_brother = 0
 		else
-			var/new_key = ckeyEx(input("Enter your desired display name. Unlike normal stealth mode, this will not appear in Who at all, except for other heads.", "Fake Key", key) as text|null)
+			var/new_key = ckeyEx(clean_input("Enter your desired display name. Unlike normal stealth mode, this will not appear in Who at all, except for other heads.", "Fake Key", key))
 			if(!new_key)
 				return
 			if(length(new_key) >= 26)
@@ -638,7 +638,7 @@ var/list/admin_verbs_ticket = list(
 		return
 
 	if(O)
-		var/message = input("What do you want the message to be?", "Make Sound") as text|null
+		var/message = clean_input("What do you want the message to be?", "Make Sound")
 		if(!message)
 			return
 		for(var/mob/V in hearers(O))

code/modules/admin/sql_notes.dm

@@ -5,7 +5,7 @@
 		to_chat(usr, "<span class='danger'>Failed to establish database connection.</span>")
 		return
 	if(!target_ckey)
-		var/new_ckey = ckey(input(usr,"Who would you like to add a note for?","Enter a ckey",null) as text|null)
+		var/new_ckey = ckey(clean_input("Who would you like to add a note for?","Enter a ckey",null))
 		if(!new_ckey)
 			return
 		new_ckey = ckey(new_ckey)

code/modules/admin/stickyban.dm

@@ -16,7 +16,7 @@
 			if(data["ckey"])
 				ckey = ckey(data["ckey"])
 			else
-				ckey = input(usr,"Ckey","Ckey","") as text|null
+				ckey = clean_input("Ckey","Ckey","")
 				if(!ckey)
 					return
 				ckey = ckey(ckey)
@@ -26,7 +26,7 @@
 			if(data["reason"])
 				ban["message"] = data["reason"]
 			else
-				var/reason = input(usr,"Reason","Reason","Ban Evasion") as text|null
+				var/reason = clean_input("Reason","Reason","Ban Evasion")
 				if(!reason)
 					return
 				ban["message"] = "[reason]"
@@ -112,7 +112,7 @@
 				to_chat(usr, "<span class='adminnotice'>Error: No sticky ban for [ckey] found!")
 				return
 			var/oldreason = ban["message"]
-			var/reason = input(usr,"Reason","Reason","[ban["message"]]") as text|null
+			var/reason = clean_input("Reason","Reason","[ban["message"]]")
 			if(!reason || reason == oldreason)
 				return
 			//we have to do this again incase something changed while we waited for input

code/modules/admin/topic.dm

@@ -189,7 +189,7 @@
 
 		var/task = href_list["editrights"]
 		if(task == "add")
-			var/new_ckey = ckey(input(usr,"New admin's ckey","Admin ckey", null) as text|null)
+			var/new_ckey = ckey(clean_input("New admin's ckey","Admin ckey", null))
 			if(!new_ckey)	return
 			if(new_ckey in admin_datums)
 				to_chat(usr, "<font color='red'>Error: Topic 'editrights': [new_ckey] is already an admin</font>")
@@ -1700,7 +1700,7 @@
 		var/eviltype = input(src.owner, "Which type of evil fax do you wish to send [H]?","Its good to be baaaad...", "") as null|anything in etypes
 		if(!(eviltype in etypes))
 			return
-		var/customname = input(src.owner, "Pick a title for the evil fax.", "Fax Title") as text|null
+		var/customname = clean_input("Pick a title for the evil fax.", "Fax Title", , owner)
 		if(!customname)
 			customname = "paper"
 		var/obj/item/paper/evilfax/P = new /obj/item/paper/evilfax(null)
@@ -2183,7 +2183,7 @@
 			return
 		input = P.parsepencode(input) // Encode everything from pencode to html
 
-		var/customname = input(src.owner, "Pick a title for the fax.", "Fax Title") as text|null
+		var/customname = clean_input("Pick a title for the fax.", "Fax Title", , owner)
 		if(!customname)
 			customname = "paper"
 
@@ -2216,14 +2216,14 @@
 						if("clown")
 							stampvalue = "clown"
 				else if(stamptype == "text")
-					stampvalue = input(src.owner, "What should the stamp say?", "Stamp Text") as text|null
+					stampvalue = clean_input("What should the stamp say?", "Stamp Text", , owner)
 				else if(stamptype == "none")
 					stamptype = ""
 				else
 					qdel(P)
 					return
 
-				sendername = input(src.owner, "What organization does the fax come from? This determines the prefix of the paper (i.e. Central Command- Title). This is optional.", "Organization") as text|null
+				sendername = clean_input("What organization does the fax come from? This determines the prefix of the paper (i.e. Central Command- Title). This is optional.", "Organization", , owner)
 
 		if(sender)
 			notify = alert(src.owner, "Would you like to inform the original sender that a fax has arrived?","Notify Sender","Yes","No")
@@ -3283,7 +3283,7 @@
 			return
 		var/datum/station_goal/G = new picked()
 		if(picked == /datum/station_goal)
-			var/newname = input("Enter goal name:") as text|null
+			var/newname = clean_input("Enter goal name:")
 			if(!newname)
 				return
 			G.name = newname

code/modules/admin/verbs/adminhelp.dm

@@ -18,7 +18,7 @@ var/list/adminhelp_ignored_words = list("unknown","the","a","an","of","monkey","
 	var/list/type = list("Mentorhelp","Adminhelp")
 	var/selected_type = input("Pick a category.", "Admin Help", null, null) as null|anything in type
 	if(selected_type)
-		msg = input("Please enter your message.", "Admin Help", null, null) as text|null
+		msg = clean_input("Please enter your message.", "Admin Help", null)
 
 	//clean the input msg
 	if(!msg)

code/modules/admin/verbs/adminpm.dm

@@ -89,7 +89,7 @@
 	//get message text, limit it's length.and clean/escape html
 	if(!msg)
 		set_typing(C, TRUE)
-		msg = input(src,"Message:", "Private message to [holder ? key_name(C, FALSE) : key_name_hidden(C, FALSE)]") as text|null
+		msg = clean_input("Message:", "Private message to [holder ? key_name(C, FALSE) : key_name_hidden(C, FALSE)]", , src)
 		set_typing(C, FALSE)
 
 		if(!msg)
@@ -109,6 +109,8 @@
 		msg = sanitize(copytext(msg,1,MAX_MESSAGE_LEN))
 		if(!msg)
 			return
+	else
+		msg = pencode_to_html(msg)
 
 	var/recieve_span = "playerreply"
 	var/send_pm_type = " "
@@ -147,7 +149,7 @@
 			spawn(0)	//so we don't hold the caller proc up
 				var/sender = src
 				var/sendername = key
-				var/reply = input(C, msg,"[recieve_pm_type] [type] from-[sendername]", "") as text|null		//show message and await a reply
+				var/reply = clean_input(msg,"[recieve_pm_type] [type] from-[sendername]", "", C)		//show message and await a reply
 				if(C && reply)
 					if(sender)
 						C.cmd_admin_pm(sender,reply)										//sender is still about, let's reply to them
@@ -216,7 +218,7 @@
 		to_chat(src, "<font color='red'>Error: Private-Message: You are unable to use PM-s (muted).</font>")
 		return
 
-	var/msg = input(src,"Message:", "Private message to admins on IRC / 400 character limit") as text|null
+	var/msg = clean_input("Message:", "Private message to admins on IRC / 400 character limit", , src) as text|null
 
 	if(!msg)
 		return

code/modules/admin/verbs/debug.dm

@@ -68,7 +68,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
 				target = null
 				targetselected = 0
 
-		var/procname = input("Proc path, eg: /proc/fake_blood","Path:", null) as text|null
+		var/procname = clean_input("Proc path, eg: /proc/fake_blood","Path:", null)
 		if(!procname)	return
 
 		if(targetselected && !hascall(target,procname))
@@ -102,7 +102,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
 	if(!check_rights(R_PROCCALL))
 		return
 
-	var/procname = input("Proc name, eg: fake_blood","Proc:", null) as text|null
+	var/procname = clean_input("Proc name, eg: fake_blood","Proc:", null)
 	if(!procname)
 		return
 
@@ -149,7 +149,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
 				return null
 
 			if("text")
-				lst += input("Enter new text:","Text",null) as text
+				lst += clean_input("Enter new text:","Text",null)
 
 			if("num")
 				lst += input("Enter new number:","Num",0) as num
@@ -271,7 +271,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
 			return 0
 	var/obj/item/paicard/card = new(T)
 	var/mob/living/silicon/pai/pai = new(card)
-	var/raw_name = input(choice, "Enter your pAI name:", "pAI Name", "Personal AI") as text
+	var/raw_name = clean_input("Enter your pAI name:", "pAI Name", "Personal AI", choice)
 	var/new_name = reject_bad_name(raw_name, 1)
 	if(new_name)
 		pai.name = new_name

code/modules/admin/verbs/diagnostics.dm

@@ -145,7 +145,7 @@
 	if(!check_rights(R_DEBUG))
 		return
 
-	var/filter = input("Contains what?","Filter") as text|null
+	var/filter = clean_input("Contains what?","Filter")
 	if(!filter)
 		return
 
@@ -166,7 +166,7 @@
 	if(!check_rights(R_DEBUG))
 		return
 
-	var/refstring = input("Which reference?","Ref") as text|null
+	var/refstring = clean_input("Which reference?","Ref")
 	if(!refstring)
 		return
 

code/modules/admin/verbs/mapping.dm

@@ -132,13 +132,13 @@ var/intercom_range_display_status = 0
 	if(!check_rights(R_DEBUG))
 		return
 
-	var/level = input("Which z-level?","Level?") as text
+	var/level = clean_input("Which z-level?","Level?")
 	if(!level) return
 	var/num_level = text2num(level)
 	if(!num_level) return
 	if(!isnum(num_level)) return
 
-	var/type_text = input("Which type path?","Path?") as text
+	var/type_text = clean_input("Which type path?","Path?")
 	if(!type_text) return
 	var/type_path = text2path(type_text)
 	if(!type_path) return
@@ -170,7 +170,7 @@ var/intercom_range_display_status = 0
 	if(!check_rights(R_DEBUG))
 		return
 
-	var/type_text = input("Which type path?","") as text
+	var/type_text = clean_input("Which type path?","")
 	if(!type_text) return
 	var/type_path = text2path(type_text)
 	if(!type_path) return

code/modules/admin/verbs/randomverbs.dm

@@ -54,7 +54,7 @@
 	if(!check_rights(R_SERVER|R_EVENT))
 		return
 
-	var/msg = input("Message:", text("Subtle PM to [M.key]")) as text
+	var/msg = clean_input("Message:", text("Subtle PM to [M.key]"))
 
 	if(!msg)
 		return
@@ -109,10 +109,11 @@
 	if(!check_rights(R_SERVER|R_EVENT))
 		return
 
-	var/msg = input("Message:", text("Enter the text you wish to appear to everyone:")) as text
+	var/msg = clean_input("Message:", text("Enter the text you wish to appear to everyone:"))
 
 	if(!msg)
 		return
+	msg = pencode_to_html(msg)
 	to_chat(world, "[msg]")
 	log_admin("GlobalNarrate: [key_name(usr)] : [msg]")
 	message_admins("<span class='boldnotice'>GlobalNarrate: [key_name_admin(usr)]: [msg]<BR></span>", 1)
@@ -131,10 +132,11 @@
 	if(!M)
 		return
 
-	var/msg = input("Message:", text("Enter the text you wish to appear to your target:")) as text
+	var/msg = clean_input("Message:", text("Enter the text you wish to appear to your target:"))
 
 	if( !msg )
 		return
+	msg = pencode_to_html(msg)
 
 	to_chat(M, msg)
 	log_admin("DirectNarrate: [key_name(usr)] to ([key_name(M)]): [msg]")
@@ -169,7 +171,7 @@
 			return
 
 	message_admins("[key_name_admin(src)] has started answering [key_name_admin(H)]'s [sender] request.")
-	var/input = input("Please enter a message to reply to [key_name(H)] via their headset.", "Outgoing message from [sender]", "") as text|null
+	var/input = clean_input("Please enter a message to reply to [key_name(H)] via their headset.", "Outgoing message from [sender]", "")
 	if(!input)
 		message_admins("[key_name_admin(src)] decided not to answer [key_name_admin(H)]'s [sender] request.")
 		return
@@ -550,7 +552,7 @@ Traitors and the like can also be revived with the previous role mostly intact.
 	if(!check_rights(R_EVENT))
 		return
 
-	var/input = input(usr, "Please enter anything you want the AI to do. Anything. Serious.", "What?", "") as text|null
+	var/input = clean_input("Please enter anything you want the AI to do. Anything. Serious.", "What?", "")
 	if(!input)
 		return
 
@@ -603,14 +605,15 @@ Traitors and the like can also be revived with the previous role mostly intact.
 	var/type = input(usr, "Pick a type of report to send", "Report Type", "") as anything in MsgType
 
 	if(type == "Custom")
-		type = input(usr, "What would you like the report type to be?", "Report Type", "Encrypted Transmission") as text|null
+		type = clean_input("What would you like the report type to be?", "Report Type", "Encrypted Transmission")
 
-	var/customname = input(usr, "Pick a title for the report.", "Title", MsgType[type]) as text|null
+	var/customname = clean_input("Pick a title for the report.", "Title", MsgType[type])
 	if(!customname)
 		return
 	var/input = input(usr, "Please enter anything you want. Anything. Serious.", "What's the message?") as message|null
 	if(!input)
 		return
+	input = pencode_to_html(html_encode(input))
 
 	switch(alert("Should this be announced to the general population?",,"Yes","No", "Cancel"))
 		if("Yes")

code/modules/admin/watchlist.dm

@@ -2,7 +2,7 @@
 	if(!check_rights(R_ADMIN))
 		return
 	if(!target_ckey)
-		var/new_ckey = ckey(input(usr,"Who would you like to add to the watchlist?","Enter a ckey",null) as text)
+		var/new_ckey = ckey(clean_input("Who would you like to add to the watchlist?","Enter a ckey",null))
 		if(!new_ckey)
 			return
 		new_ckey = sanitizeSQL(new_ckey)