Merge pull request #14247 from timothyteakettle/another-dumb-href-exploit

[s] stops you purging sec records without being logged in
2021-02-14 17:05:43 -06:00
parent 1d00bc51cb 8f0fbb75ac
commit 27e3e8de26
1 changed files with 2 additions and 0 deletions
@@ -264,6 +264,8 @@ What a mess.*/
 		active1 = null
 	if(!( GLOB.data_core.security.Find(active2) ))
 		active2 = null
+	if(!authenticated && href_list["choice"] != "Log In") // logging in is the only action you can do if not logged in
+		return
 	if(usr.contents.Find(src) || (in_range(src, usr) && isturf(loc)) || hasSiliconAccessInArea(usr) || IsAdminGhost(usr))
 		usr.set_machine(src)
 		switch(href_list["choice"])