Merge pull request #4131 from Zuhayr/master

Href exploit fix.

code/WorkInProgress/carn/master_controller_semi-seq.dm

@@ -50,7 +50,7 @@ datum/controller/game_controller/New()
 	if(!syndicate_code_response)	syndicate_code_response	= generate_code_phrase()
 	if(!ticker)						ticker = new /datum/controller/gameticker()
 	if(!emergency_shuttle)			emergency_shuttle = new /datum/shuttle_controller/emergency_shuttle()
-
+	if(artifact_spawn)				artifact_spawning_turfs = artifact_spawn
 
 datum/controller/game_controller/proc/setup()
 	world.tick_lag = config.Ticklag

code/game/objects/items/devices/uplinks.dm

@@ -7,8 +7,10 @@ A list of items and costs is stored under the datum of every game mode, alongsid
 */
 
 /obj/item/device/uplink
+
 	var/welcome 					// Welcoming menu message
 	var/items						// List of items
+	var/valid_items = list()
 	var/item_data					// raw item text
 	var/list/ItemList				// Parsed list of items
 	var/uses 						// Numbers of crystals
@@ -24,6 +26,12 @@ A list of items and costs is stored under the datum of every game mode, alongsid
 	ItemList = text2list(src.items, ";")	// Parsing the items text string
 	uses = ticker.mode.uplink_uses
 
+	//Halfassed fix for href exploit ~Z
+	for(var/D in ItemList)
+		var/list/O = stringsplit(D, ":")
+		if(O.len>0)
+			valid_items += O[1]
+
 //Let's build a menu!
 /obj/item/device/uplink/proc/generate_menu()
 
@@ -53,7 +61,7 @@ A list of items and costs is stored under the datum of every game mode, alongsid
 			continue
 
 		path_text = O[1]
-		cost = text2num(O[2])
+		cost = Clamp(text2num(O[2]),1,20) //Another halfassed fix for href exploit ~Z
 
 		if(cost>uses)
 			continue
@@ -327,7 +335,12 @@ A list of items and costs is stored under the datum of every game mode, alongsid
 			return 1
 
 		if(..(href, href_list) == 1)
+
+			if(!(href_list["buy_item"] in valid_items))
+				return
+
 			var/path_obj = text2path(href_list["buy_item"])
+
 			var/obj/I = new path_obj(get_turf(usr))
 			if(ishuman(usr))
 				var/mob/living/carbon/human/A = usr
@@ -375,7 +388,4 @@ A list of items and costs is stored under the datum of every game mode, alongsid
 /obj/item/device/radio/headset/uplink/New()
 	..()
 	hidden_uplink = new(src)
-	hidden_uplink.uses = 10
-
-
-
+	hidden_uplink.uses = 10

code/modules/mining/mine_turfs.dm

@@ -5,6 +5,7 @@
 #define ARTIFACT_SPAWN_CHANCE 20
 
 /datum/controller/game_controller/var/list/artifact_spawning_turfs = list()
+/var/global/list/artifact_spawn = list() // Runtime fix for geometry loading before controller is instantiated.
 
 /turf/simulated/mineral //wall piece
 	name = "Rock"
@@ -129,7 +130,7 @@
 			//dont create artifact machinery in animal or plant digsites, or if we already have one
 			if(!artifact_find && digsite != 1 && digsite != 2 && prob(ARTIFACT_SPAWN_CHANCE))
 				artifact_find = new()
-				master_controller.artifact_spawning_turfs.Add(src)
+				artifact_spawn.Add(src)
 
 		if(!src.geological_data)
 			src.geological_data = new/datum/geosample(src)

code/modules/research/xenoarchaeology/geosample.dm

@@ -126,14 +126,15 @@
 		artifact_distance = rand()
 		artifact_id = container.artifact_find.artifact_id
 	else
-		for(var/turf/simulated/mineral/T in master_controller.artifact_spawning_turfs)
-			if(T.artifact_find)
-				var/cur_dist = get_dist(container, T) * 2
-				if( (artifact_distance < 0 || cur_dist < artifact_distance) && cur_dist <= T.artifact_find.artifact_detect_range )
-					artifact_distance = cur_dist + rand() * 2 - 1
-					artifact_id = T.artifact_find.artifact_id
-			else
-				master_controller.artifact_spawning_turfs.Remove(T)
+		if(master_controller) //Sanity check due to runtimes ~Z
+			for(var/turf/simulated/mineral/T in master_controller.artifact_spawning_turfs)
+				if(T.artifact_find)
+					var/cur_dist = get_dist(container, T) * 2
+					if( (artifact_distance < 0 || cur_dist < artifact_distance) && cur_dist <= T.artifact_find.artifact_detect_range )
+						artifact_distance = cur_dist + rand() * 2 - 1
+						artifact_id = T.artifact_find.artifact_id
+				else
+					master_controller.artifact_spawning_turfs.Remove(T)
 
 /*
 #undef FIND_PLANT

code/modules/research/xenoarchaeology/tools/tools_anoscanner.dm

@@ -36,13 +36,14 @@
 	last_scan_time = world.time
 	nearest_artifact_distance = -1
 	var/turf/cur_turf = get_turf(src)
-	for(var/turf/simulated/mineral/T in master_controller.artifact_spawning_turfs)
-		if(T.artifact_find)
-			if(T.z == cur_turf.z)
-				var/cur_dist = get_dist(cur_turf, T) * 2
-				if( (nearest_artifact_distance < 0 || cur_dist < nearest_artifact_distance) && cur_dist <= T.artifact_find.artifact_detect_range )
-					nearest_artifact_distance = cur_dist + rand() * 2 - 1
-					nearest_artifact_id = T.artifact_find.artifact_id
-		else
-			master_controller.artifact_spawning_turfs.Remove(T)
+	if(master_controller) //Sanity check due to runtimes ~Z
+		for(var/turf/simulated/mineral/T in master_controller.artifact_spawning_turfs)
+			if(T.artifact_find)
+				if(T.z == cur_turf.z)
+					var/cur_dist = get_dist(cur_turf, T) * 2
+					if( (nearest_artifact_distance < 0 || cur_dist < nearest_artifact_distance) && cur_dist <= T.artifact_find.artifact_detect_range )
+						nearest_artifact_distance = cur_dist + rand() * 2 - 1
+						nearest_artifact_id = T.artifact_find.artifact_id
+			else
+				master_controller.artifact_spawning_turfs.Remove(T)
 	cur_turf.visible_message("<span class='info'>[src] clicks.</span>")