From a4b418dd7f30bf14718d4299ae54622f5fbc12cc Mon Sep 17 00:00:00 2001
From: Crazylemon64 <tlrgue17@gmail.com>
Date: Wed, 19 Jul 2017 23:00:55 -0700
Subject: [PATCH] Closes up stuff in SDQL2

---
 code/modules/admin/verbs/SDQL2/SDQL_2.dm    | 17 +++++++++++++----
 code/modules/admin/verbs/modifyvariables.dm | 12 ++++++++++--
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/code/modules/admin/verbs/SDQL2/SDQL_2.dm b/code/modules/admin/verbs/SDQL2/SDQL_2.dm
index 84577b51102..7b111e8ed20 100644
--- a/code/modules/admin/verbs/SDQL2/SDQL_2.dm
+++ b/code/modules/admin/verbs/SDQL2/SDQL_2.dm
@@ -89,7 +89,8 @@
 
 				if("delete")
 					for(var/d in objs)
-						qdel(d)
+						if(!datum_is_forbidden(d))
+							qdel(d)
 
 				if("select")
 					var/text = ""
@@ -117,6 +118,9 @@
 					if("set" in query_tree)
 						var/list/set_list = query_tree["set"]
 						for(var/d in objs)
+							// Forbid explicitly modifying an admin datum's vars
+							if(datum_is_forbidden(d))
+								return
 							for(var/list/sets in set_list)
 								var/datum/temp = d
 								var/i = 0
@@ -124,11 +128,11 @@
 									if(++i == sets.len)
 										if(istype(temp, /turf) && (v == "x" || v == "y" || v == "z"))
 											continue
-										if(istype(temp.vars[v], /datum/admins))
-											continue
+										if(!datum_is_forbidden(temp.vars[v]))
+											return
 										temp.vars[v] = SDQL_expression(d, set_list[sets])
 										break
-									if(temp.vars.Find(v) && (istype(temp.vars[v], /datum) || istype(temp.vars[v], /client)) && !istype(temp.vars[v], /datum/admins))
+									if(temp.vars.Find(v) && (istype(temp.vars[v], /datum) || istype(temp.vars[v], /client)) && !datum_is_forbidden(temp.vars[v]))
 										temp = temp.vars[v]
 									else
 										break
@@ -436,6 +440,11 @@
 	for(var/arg in arguments)
 		new_args[++new_args.len] = SDQL_expression(source, arg)
 
+	for(var/p in forbidden_varedit_object_types)
+		if(istype(object, p))
+			to_chat(usr, "<span class='warning'>It is forbidden to run this object's procs.</span>")
+			return
+
 	if(object == world) // Global proc.
 		procname = "/proc/[procname]"
 		return call(procname)(arglist(new_args))
diff --git a/code/modules/admin/verbs/modifyvariables.dm b/code/modules/admin/verbs/modifyvariables.dm
index 8cce4c5a761..cb50d2e6391 100644
--- a/code/modules/admin/verbs/modifyvariables.dm
+++ b/code/modules/admin/verbs/modifyvariables.dm
@@ -13,6 +13,14 @@ var/list/forbidden_varedit_object_types = list(
 	feedback_add_details("admin_verb","EDITV") //If you are copy-pasting this, ensure the 2nd parameter is unique to the new proc!
 */
 
+/proc/datum_is_forbidden(type)
+	for(var/p in forbidden_varedit_object_types)
+		if(istype(type, p))
+			to_chat(usr, "<span class='warning'>It is forbidden to tamper with this object.</span>")
+			return FALSE
+	return TRUE
+
+
 /client/proc/cmd_modify_ticker_variables()
 	set category = "Debug"
 	set name = "Edit Ticker Variables"
@@ -131,7 +139,7 @@ var/list/forbidden_varedit_object_types = list(
 			L[var_value] = mod_list_add_ass() //haha
 		if("No")
 			L += var_value
-			
+
 /client/proc/mod_list(var/list/L)
 	if(!check_rights(R_VAREDIT))	return
 
@@ -497,4 +505,4 @@ var/list/forbidden_varedit_object_types = list(
 		to_chat(usr, "Variable type is <b>UNKNOWN</b>.")
 		class = null
 
-	return class
\ No newline at end of file
+	return class