From f9f5cfbe4096c48395bba0fbfdad80fd4392a9c2 Mon Sep 17 00:00:00 2001
From: Citinited <kendo123@hotmail.co.uk>
Date: Tue, 9 Oct 2018 20:48:54 +0100
Subject: [PATCH 1/2] Adds img to list of banned html tags; fixes an easy way
 to circumvent the check

---
 code/modules/scripting/Implementations/Telecomms.dm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/code/modules/scripting/Implementations/Telecomms.dm b/code/modules/scripting/Implementations/Telecomms.dm
index 8b0675d90de..b2f25b6ab38 100644
--- a/code/modules/scripting/Implementations/Telecomms.dm
+++ b/code/modules/scripting/Implementations/Telecomms.dm
@@ -248,7 +248,7 @@
 	   But I like HTML, so back to no sanitizing.*/
 
 	var/message = interpreter.GetVar("$content")
-	var/regex/bannedTags = new ("(<script|<iframe|<video|<audio|<embed|<svg)")
+	var/regex/bannedTags = new ("(<script|<iframe|<video|<audio|<embed|<svg|<img)", "i")
 	if(bannedTags.Find(message)) //uh oh
 		message_admins("Warning: Current Telecomms script contains banned html. Stripping message.")
 		log_admin("Warning: Current Telecomms script contains banned html. Stripping message.")

From 07572d672ffabf29de2263515e90a0dc8a7f6374 Mon Sep 17 00:00:00 2001
From: Citinited <kendo123@hotmail.co.uk>
Date: Tue, 9 Oct 2018 22:25:58 +0100
Subject: [PATCH 2/2] Keeps img functionality in chat while fixing the other
 exploit

---
 code/modules/scripting/Implementations/Telecomms.dm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/code/modules/scripting/Implementations/Telecomms.dm b/code/modules/scripting/Implementations/Telecomms.dm
index b2f25b6ab38..e8fa2ed19b6 100644
--- a/code/modules/scripting/Implementations/Telecomms.dm
+++ b/code/modules/scripting/Implementations/Telecomms.dm
@@ -248,7 +248,7 @@
 	   But I like HTML, so back to no sanitizing.*/
 
 	var/message = interpreter.GetVar("$content")
-	var/regex/bannedTags = new ("(<script|<iframe|<video|<audio|<embed|<svg|<img)", "i")
+	var/regex/bannedTags = new ("(<script|<iframe|<video|<audio|<embed|<svg)", "i")
 	if(bannedTags.Find(message)) //uh oh
 		message_admins("Warning: Current Telecomms script contains banned html. Stripping message.")
 		log_admin("Warning: Current Telecomms script contains banned html. Stripping message.")