Some hotfixes (#17464)

code/__HELPERS/unsorted.dm

@@ -2059,3 +2059,38 @@ GLOBAL_DATUM_INIT(dview_mob, /mob/dview, new)
 			return slot_wear_pda
 		if(SLOT_TIE)
 			return slot_tie
+
+
+/**
+  * HTTP Get (Powered by RUSTG)
+  *
+  * This proc should be used as a replacement for [world.Export()] due to an underlying issue with it.
+  * See: https://www.byond.com/forum/post/2772166
+  * The one thing you will need to be aware of is that this no longer wraps the response inside a "file", so anything that relies on a file2text() unwrap will need tweaking.
+  * RUST HTTP also has better support for HTTPS as well as weird quirks with modern webservers.
+  * Returns an assoc list that follows the standard [world.Export()] format (https://secure.byond.com/docs/ref/index.html#/world/proc/Export), with the above exception
+  *
+  * Arguments:
+  * * url - URL to GET
+  */
+/proc/HTTPGet(url)
+	var/datum/http_request/req = new()
+	req.prepare(RUSTG_HTTP_METHOD_GET, url)
+	req.begin_async()
+
+	// Check if we are complete
+	UNTIL(req.is_complete())
+	var/datum/http_response/res = req.into_response()
+
+	if(res.errored)
+		. = list() // Return an empty list
+		CRASH("Internal error during HTTP get: [res.error]")
+
+	var/list/output = list()
+	output["STATUS"] = res.status_code
+
+	// Handle changes of line format. ASCII 13 = CR
+	var/content = replacetext(res.body, "[ascii2text(13)]\n", "\n")
+	output["CONTENT"] = content
+
+	return output

code/controllers/subsystem/instancing.dm

@@ -151,6 +151,7 @@ SUBSYSTEM_DEF(instancing)
 
 	for(var/server in servers_outer)
 		var/server_data = servers_outer[server]
+		// TODO: Move this to redis PubSub. world.Export() cannot be trusted. Redis is more reliable anyway
 		world.Export("byond://[server_data["internal_ip"]]:[server_data["server_port"]]?[raw_topic]&key=[server_data["topic_key"]]")
 
 

code/controllers/subsystem/ipintel.dm

@@ -139,13 +139,13 @@ SUBSYSTEM_DEF(ipintel)
 		return
 
 	// Do not refactor this to use SShttp, because that requires the subsystem to be firing for requests to be made, and this will be triggered before the MC has finished loading
-	var/list/http[] = world.Export("http://[GLOB.configuration.ipintel.ipintel_domain]/check.php?ip=[ip]&contact=[GLOB.configuration.ipintel.contact_email]&format=json&flags=b")
+	var/list/http[] = HTTPGet("http://[GLOB.configuration.ipintel.ipintel_domain]/check.php?ip=[ip]&contact=[GLOB.configuration.ipintel.contact_email]&format=json&flags=b")
 
 	if(http)
 		var/status = text2num(http["STATUS"])
 
 		if(status == 200)
-			var/response = json_decode(file2text(http["CONTENT"]))
+			var/response = json_decode(http["CONTENT"])
 			if(response)
 				if(response["status"] == "success")
 					var/intelnum = text2num(response["result"])

code/modules/admin/cookielog.dm

@@ -110,4 +110,4 @@
 			return
 		qdel(update_existing_note)
 	else // They dont have a note. Insert.
-		add_note(cookie_holder_ckey, serialized_text, adminckey = COOKIERECORD_PSUEDO_CKEY, logged = FALSE, checkrights = FALSE, automated = TRUE)
+		add_note(cookie_holder_ckey, serialized_text, adminckey = COOKIERECORD_PSUEDO_CKEY, logged = FALSE, checkrights = FALSE, automated = TRUE, sanitise_html = FALSE) // No sanitize because we rely on formatting

code/modules/admin/sql_notes.dm

@@ -1,6 +1,13 @@
-/proc/add_note(target_ckey, notetext, timestamp, adminckey, logged = 1, checkrights = 1, show_after = TRUE, automated = FALSE)
+/proc/add_note(target_ckey, notetext, timestamp, adminckey, logged = 1, checkrights = 1, show_after = TRUE, automated = FALSE, sanitise_html = TRUE) // Dont you EVER disable this last param unless you know what you're doing
 	if(checkrights && !check_rights(R_ADMIN|R_MOD))
 		return
+	if(IsAdminAdvancedProcCall() && !sanitise_html)
+		// *sigh*
+		to_chat(usr, "<span class='boldannounce'>Unsanitized note add blocked: Advanced ProcCall detected.</span>")
+		message_admins("[key_name(usr)] attempted to possibly inject HTML into notes via advanced proc-call")
+		log_admin("[key_name(usr)] attempted to possibly inject HTML into notes via advanced proc-call")
+		return
+
 	if(!SSdbcore.IsConnected())
 		if(usr)
 			to_chat(usr, "<span class='danger'>Failed to establish database connection.</span>")
@@ -55,14 +62,15 @@
 	// Force cast this to 1/0 incase someone tries to feed bad data
 	automated = !!automated
 
-	var/safe_text = html_encode(notetext)
+	if(sanitise_html)
+		notetext = html_encode(notetext)
 
 	var/datum/db_query/query_noteadd = SSdbcore.NewQuery({"
 		INSERT INTO notes (ckey, timestamp, notetext, adminckey, server, crew_playtime, round_id, automated)
 		VALUES (:targetckey, NOW(), :notetext, :adminkey, :server, :crewnum, :roundid, :automated)
 	"}, list(
 		"targetckey" = target_ckey,
-		"notetext" = safe_text,
+		"notetext" = notetext,
 		"adminkey" = adminckey,
 		"server" = GLOB.configuration.system.instance_id,
 		"crewnum" = crew_number,
@@ -74,8 +82,8 @@
 		return
 	qdel(query_noteadd)
 	if(logged)
-		log_admin("[usr ? key_name(usr) : adminckey] has added a note to [target_ckey]: [safe_text]")
-		message_admins("[usr ? key_name_admin(usr) : adminckey] has added a note to [target_ckey]:<br>[safe_text]")
+		log_admin("[usr ? key_name(usr) : adminckey] has added a note to [target_ckey]: [notetext]")
+		message_admins("[usr ? key_name_admin(usr) : adminckey] has added a note to [target_ckey]:<br>[notetext]")
 		if(show_after)
 			show_note(target_ckey)
 

code/modules/client/client_procs.dm

@@ -983,14 +983,14 @@
   */
 /client/proc/retrieve_byondacc_data()
 	// Do not refactor this to use SShttp, because that requires the subsystem to be firing for requests to be made, and this will be triggered before the MC has finished loading
-	var/list/http[] = world.Export("http://www.byond.com/members/[ckey]?format=text")
+	var/list/http[] = HTTPGet("http://www.byond.com/members/[ckey]?format=text")
 	if(http)
 		var/status = text2num(http["STATUS"])
 
 		if(status == 200)
 			// This is wrapped in try/catch because lummox could change the format on any day without informing anyone
 			try
-				var/list/lines = splittext(file2text(http["CONTENT"]), "\n")
+				var/list/lines = splittext(http["CONTENT"], "\n")
 				var/list/initial_data = list()
 				var/current_index = ""
 				for(var/L in lines)