Possible fix for href exploit in uplinks, unable to test locally.

code/game/objects/items/devices/uplinks.dm

@@ -7,8 +7,10 @@ A list of items and costs is stored under the datum of every game mode, alongsid
 */
 
 /obj/item/device/uplink
+
 	var/welcome 					// Welcoming menu message
 	var/items						// List of items
+	var/valid_items = list()
 	var/item_data					// raw item text
 	var/list/ItemList				// Parsed list of items
 	var/uses 						// Numbers of crystals
@@ -24,6 +26,12 @@ A list of items and costs is stored under the datum of every game mode, alongsid
 	ItemList = text2list(src.items, ";")	// Parsing the items text string
 	uses = ticker.mode.uplink_uses
 
+	//Halfassed fix for href exploit ~Z
+	for(var/D in ItemList)
+		var/list/O = stringsplit(D, ":")
+		if(O.len>0)
+			valid_items += O[1]
+
 //Let's build a menu!
 /obj/item/device/uplink/proc/generate_menu()
 
@@ -53,7 +61,7 @@ A list of items and costs is stored under the datum of every game mode, alongsid
 			continue
 
 		path_text = O[1]
-		cost = text2num(O[2])
+		cost = Clamp(text2num(O[2]),1,20) //Another halfassed fix for href exploit ~Z
 
 		if(cost>uses)
 			continue
@@ -327,7 +335,12 @@ A list of items and costs is stored under the datum of every game mode, alongsid
 			return 1
 
 		if(..(href, href_list) == 1)
+
+			if(!(href_list["buy_item"] in valid_items))
+				return
+
 			var/path_obj = text2path(href_list["buy_item"])
+
 			var/obj/I = new path_obj(get_turf(usr))
 			if(ishuman(usr))
 				var/mob/living/carbon/human/A = usr
@@ -375,7 +388,4 @@ A list of items and costs is stored under the datum of every game mode, alongsid
 /obj/item/device/radio/headset/uplink/New()
 	..()
 	hidden_uplink = new(src)
-	hidden_uplink.uses = 10
-
-
-
+	hidden_uplink.uses = 10