From c1b6bba1ec863cbf07cb0c442d6756c8f445b6e2 Mon Sep 17 00:00:00 2001
From: Markolie <markvanalphen2@gmail.com>
Date: Sun, 8 Feb 2015 17:07:55 +0100
Subject: [PATCH] Fix vulnerabilities in air alarm and APC, fix mitochondria
 log

---
 code/game/dna/genes/goon_disabilities.dm      |  2 +-
 code/game/machinery/alarm.dm                  | 47 +++++++++++++++++++
 .../crates_lockers/closets/secure/personal.dm | 10 ++--
 code/modules/power/apc.dm                     | 32 +++++++++++--
 nano/templates/air_alarm.tmpl                 |  4 +-
 5 files changed, 86 insertions(+), 9 deletions(-)

diff --git a/code/game/dna/genes/goon_disabilities.dm b/code/game/dna/genes/goon_disabilities.dm
index c0973e2206d..5de6a0c35c3 100644
--- a/code/game/dna/genes/goon_disabilities.dm
+++ b/code/game/dna/genes/goon_disabilities.dm
@@ -335,7 +335,7 @@
 
 	if(L)
 		usr.attack_log += text("\[[time_stamp()]\] <font color='red'>[usr.real_name] ([usr.ckey]) cast the spell [name] on [L.real_name] ([L.ckey]).</font>")
-		msg_admin_attack("[usr.real_name] ([usr.ckey]) has cast the spell [name] on  [L.real_name] ([L.ckey]) (<A HREF='?_src_=holder;adminplayerobservecoodjump=1;X=[usr.x];Y=[usr.y];Z=[usr.z]'>)")
+		msg_admin_attack("[usr.real_name] ([usr.ckey]) has cast the spell [name] on  [L.real_name] ([L.ckey]) (<A HREF='?_src_=holder;adminplayerobservecoodjump=1;X=[usr.x];Y=[usr.y];Z=[usr.z]'>JMP</a>)")
 
 	L.adjust_fire_stacks(0.5)
 	L.visible_message("\red <b>[L.name]</b> suddenly bursts into flames!")
diff --git a/code/game/machinery/alarm.dm b/code/game/machinery/alarm.dm
index b2fcd154036..986fce47705 100644
--- a/code/game/machinery/alarm.dm
+++ b/code/game/machinery/alarm.dm
@@ -727,8 +727,37 @@
 		wires.Interact(user)
 	if(!shorted)
 		ui_interact(user)
+		
+/obj/machinery/alarm/proc/can_use(mob/user as mob)
+	if (user.stat && !isobserver(user))
+		user << "\red You must be conscious to use this [src]!"
+		return 0
+		
+	if(stat & (NOPOWER|BROKEN))
+		return 0
+		
+	if(buildstage != 2)
+		return 0
+
+	if((get_dist(src, user) > 1) && !istype(user, /mob/living/silicon))
+		return 0
+
+	if(istype(user, /mob/living/silicon) && aidisabled)
+		user << "AI control for this air alarm interface has been disabled."
+		return 0
+
+	return 1
+	
+/obj/machinery/alarm/proc/is_authenticated(mob/user as mob)
+	if(isAI(user) || isrobot(user))
+		return 1
+	else
+		return !locked
 
 /obj/machinery/alarm/Topic(href, href_list)
+	if(!can_use(usr))
+		return 0
+
 	var/changed=0
 
 	if(href_list["rcon"])
@@ -747,6 +776,9 @@
 
 	//testing(href)
 	if(href_list["command"])
+		if(!is_authenticated(usr))
+			return
+			
 		var/device_id = href_list["id_tag"]
 		switch(href_list["command"])
 			if( "power",
@@ -832,11 +864,17 @@
 				return 1
 
 	if(href_list["screen"])
+		if(!is_authenticated(usr))
+			return
+			
 		screen = text2num(href_list["screen"])
 		ui_interact(usr)
 		return 1
 
 	if(href_list["atmos_alarm"])
+		if(!is_authenticated(usr))
+			return
+			
 		alarmActivated=1
 		alarm_area.updateDangerLevel()
 		update_icon()
@@ -844,6 +882,9 @@
 		return 1
 
 	if(href_list["atmos_reset"])
+		if(!is_authenticated(usr))
+			return
+			
 		alarmActivated=0
 		alarm_area.updateDangerLevel()
 		update_icon()
@@ -851,12 +892,18 @@
 		return 1
 
 	if(href_list["mode"])
+		if(!is_authenticated(usr))
+			return
+			
 		mode = text2num(href_list["mode"])
 		apply_mode()
 		ui_interact(usr)
 		return 1
 
 	if(href_list["preset"])
+		if(!is_authenticated(usr))
+			return
+			
 		preset = text2num(href_list["preset"])
 		apply_preset()
 		ui_interact(usr)
diff --git a/code/game/objects/structures/crates_lockers/closets/secure/personal.dm b/code/game/objects/structures/crates_lockers/closets/secure/personal.dm
index f48a0e69e4f..01505311c9b 100644
--- a/code/game/objects/structures/crates_lockers/closets/secure/personal.dm
+++ b/code/game/objects/structures/crates_lockers/closets/secure/personal.dm
@@ -75,10 +75,14 @@
 		else if(src.allowed(user) || !src.registered_name || (istype(I) && (src.registered_name == I.registered_name)))
 			//they can open all lockers, or nobody owns this, or they own this locker
 			src.locked = !( src.locked )
-			if(src.locked)	src.icon_state = src.icon_locked
-			else	src.icon_state = src.icon_closed
+			if(src.locked)	
+				src.icon_state = src.icon_locked
+			else	
+				src.icon_state = src.icon_closed
+				registered_name = null
+				desc = initial(desc)
 
-			if(!src.registered_name)
+			if(!src.registered_name && src.locked)
 				src.registered_name = I.registered_name
 				src.desc = "Owned by [I.registered_name]."
 		else
diff --git a/code/modules/power/apc.dm b/code/modules/power/apc.dm
index 9697509e5e1..7a2eb7c5a38 100644
--- a/code/modules/power/apc.dm
+++ b/code/modules/power/apc.dm
@@ -805,6 +805,8 @@
 	if (user.stat && !isobserver(user))
 		user << "\red You must be conscious to use this [src]!"
 		return 0
+	if(stat & (NOPOWER|BROKEN))
+		return 0
 	if(!user.client)
 		return 0
 	if ( ! (istype(user, /mob/living/carbon/human) || \
@@ -849,36 +851,60 @@
 			user << "\red You momentarily forget how to use [src]."
 			return 0
 	return 1
+	
+/obj/machinery/power/apc/proc/is_authenticated(mob/user as mob)
+	if(isAI(user) || isrobot(user))
+		return 1
+	else
+		return !locked
 
 /obj/machinery/power/apc/Topic(href, href_list, var/usingUI = 1)
 	if(!can_use(usr, 1))
-		return 0
+		return 0	
 
 	if (href_list["lock"])
+		if(!is_authenticated(usr))
+			return
+			
 		coverlocked = !coverlocked
 
 	else if (href_list["breaker"])
+		if(!is_authenticated(usr))
+			return
+			
 		toggle_breaker()
 
 	else if (href_list["cmode"])
+		if(!is_authenticated(usr))
+			return
+			
 		chargemode = !chargemode
 		if(!chargemode)
 			charging = 0
 			update_icon()
 
 	else if (href_list["eqp"])
+		if(!is_authenticated(usr))
+			return
+			
 		var/val = text2num(href_list["eqp"])
 		equipment = setsubsystem(val)
 		update_icon()
 		update()
 
 	else if (href_list["lgt"])
+		if(!is_authenticated(usr))
+			return
+			
 		var/val = text2num(href_list["lgt"])
 		lighting = setsubsystem(val)
 		update_icon()
 		update()
 
 	else if (href_list["env"])
+		if(!is_authenticated(usr))
+			return
+			
 		var/val = text2num(href_list["env"])
 		environ = setsubsystem(val)
 		update_icon()
@@ -893,7 +919,7 @@
 		return 0
 
 	else if (href_list["overload"])
-		if(istype(usr, /mob/living/silicon))
+		if(istype(usr, /mob/living/silicon) && !aidisabled)
 			src.overload_lighting()
 
 	else if (href_list["malfhack"])
@@ -931,7 +957,7 @@
 
 	else if (href_list["toggleaccess"])
 		if(istype(usr, /mob/living/silicon))
-			if(emagged || (stat & (BROKEN|MAINT)))
+			if(emagged || aidisabled || (stat & (BROKEN|MAINT)))
 				usr << "The APC does not respond to the command."
 			else
 				locked = !locked
diff --git a/nano/templates/air_alarm.tmpl b/nano/templates/air_alarm.tmpl
index 9c850641e01..3620b5d1756 100644
--- a/nano/templates/air_alarm.tmpl
+++ b/nano/templates/air_alarm.tmpl
@@ -132,7 +132,7 @@ Used In File(s): /code/game/machinery/alarm.dm
 				<div class="line">
 					<div class="statusLabel">Operating:</div>
 					<div class="statusValue">
-						{{:helper.link(value.power ? 'On':'Off','power',{'id_tag':value.id_tag,'command':'power','val':value.power?0:1},null,(value.power?'linkOn':'red'))}}
+						{{:helper.link(value.power ? 'On':'Off','power',{'id_tag':value.id_tag,'command':'power','val':value.power?0:1},null)}}
 						{{if value.direction=="siphon"}}
 							{{:helper.link('Siphoning','arrowthickstop-1-s',{'id_tag':value.id_tag,'command':'direction','val':'1'})}}
 						{{else}}
@@ -170,7 +170,7 @@ Used In File(s): /code/game/machinery/alarm.dm
 				<div class="line">
 					<div class="statusLabel">Operating:</div>
 					<div class="statusValue">
-						{{:helper.link(value.power ? 'On':'Off','power',{'id_tag':value.id_tag,'command':'power','val':value.power?0:1},null,(value.power?'linkOn':'red'))}}
+						{{:helper.link(value.power ? 'On':'Off','power',{'id_tag':value.id_tag,'command':'power','val':value.power?0:1},null)}}
 					</div>
 				</div>
 				<div class="line">