From 1d2ce01039999c543eb5c8d8efb6457ea5d658b8 Mon Sep 17 00:00:00 2001
From: Mloc-Hibernia <colmohici@gmail.com>
Date: Sat, 10 May 2014 22:33:33 +0000
Subject: [PATCH] mob: fix #4955

Name parameter to track wasn't sanitized correctly.

Signed-off-by: Mloc-Hibernia <colmohici@gmail.com>
---
 code/modules/mob/hear_say.dm             | 4 ++--
 code/modules/mob/living/silicon/ai/ai.dm | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/code/modules/mob/hear_say.dm b/code/modules/mob/hear_say.dm
index 7aa359c2c4..1853826f34 100644
--- a/code/modules/mob/hear_say.dm
+++ b/code/modules/mob/hear_say.dm
@@ -124,11 +124,11 @@
 
 		if(changed_voice)
 			if(impersonating)
-				track = "<a href='byond://?src=\ref[src];trackname=[speaker_name];track=\ref[impersonating]'>[speaker_name] ([jobname])</a>"
+				track = "<a href='byond://?src=\ref[src];trackname=[html_encode(speaker_name)];track=\ref[impersonating]'>[speaker_name] ([jobname])</a>"
 			else
 				track = "[speaker_name] ([jobname])"
 		else
-			track = "<a href='byond://?src=\ref[src];trackname=[speaker_name];track=\ref[speaker]'>[speaker_name] ([jobname])</a>"
+			track = "<a href='byond://?src=\ref[src];trackname=[html_encode(speaker_name)];track=\ref[speaker]'>[speaker_name] ([jobname])</a>"
 
 	if(istype(src, /mob/dead/observer))
 		if(speaker_name != speaker.real_name && !isAI(speaker)) //Announce computer and various stuff that broadcasts doesn't use it's real name but AI's can't pretend to be other mobs.
diff --git a/code/modules/mob/living/silicon/ai/ai.dm b/code/modules/mob/living/silicon/ai/ai.dm
index 88c1c9b79d..dfda7bae5c 100644
--- a/code/modules/mob/living/silicon/ai/ai.dm
+++ b/code/modules/mob/living/silicon/ai/ai.dm
@@ -418,10 +418,10 @@ var/list/ai_list = list()
 		if(index)
 			seeking = copytext(seeking, 1, index-1)
 
-		if(target && href_list["trackname"] == seeking)
+		if(target && html_decode(href_list["trackname"]) == seeking)
 			ai_actual_track(target)
 		else
-			src << "\red System error. Cannot locate [href_list["trackname"]]."
+			src << "\red System error. Cannot locate [html_decode(href_list["trackname"])]."
 		return
 
 	else if (href_list["faketrack"])