diff --git a/code/__DEFINES/admin.dm b/code/__DEFINES/admin.dm index 26a1535e33..00d81fe7c7 100644 --- a/code/__DEFINES/admin.dm +++ b/code/__DEFINES/admin.dm @@ -1,3 +1,4 @@ +<<<<<<< HEAD //A set of constants used to determine which type of mute an admin wishes to apply: //Please read and understand the muting/automuting stuff before changing these. MUTE_IC_AUTO etc = (MUTE_IC << 1) //Therefore there needs to be a gap between the flags_1 for the automute flags_1 @@ -72,3 +73,79 @@ #define AHELP_ACTIVE 1 #define AHELP_CLOSED 2 #define AHELP_RESOLVED 3 +======= +//A set of constants used to determine which type of mute an admin wishes to apply: +//Please read and understand the muting/automuting stuff before changing these. MUTE_IC_AUTO etc = (MUTE_IC << 1) +//Therefore there needs to be a gap between the flags for the automute flags +#define MUTE_IC 1 +#define MUTE_OOC 2 +#define MUTE_PRAY 4 +#define MUTE_ADMINHELP 8 +#define MUTE_DEADCHAT 16 +#define MUTE_ALL 31 + +//Some constants for DB_Ban +#define BANTYPE_PERMA 1 +#define BANTYPE_TEMP 2 +#define BANTYPE_JOB_PERMA 3 +#define BANTYPE_JOB_TEMP 4 +#define BANTYPE_ANY_FULLBAN 5 //used to locate stuff to unban. + +#define BANTYPE_ADMIN_PERMA 7 +#define BANTYPE_ADMIN_TEMP 8 +#define BANTYPE_ANY_JOB 9 //used to remove jobbans + +//Please don't edit these values without speaking to Errorage first ~Carn +//Admin Permissions +#define R_BUILDMODE 1 +#define R_ADMIN 2 +#define R_BAN 4 +#define R_FUN 8 +#define R_SERVER 16 +#define R_DEBUG 32 +#define R_POSSESS 64 +#define R_PERMISSIONS 128 +#define R_STEALTH 256 +#define R_POLL 512 +#define R_VAREDIT 1024 +#define R_SOUNDS 2048 +#define R_SPAWN 4096 + +#if DM_VERSION > 512 +#error Remove the flag below , its been long enough +#endif +//legacy , remove post 512, it was replaced by R_POLL +#define R_REJUVINATE 2 + +#define R_MAXPERMISSION 4096 //This holds the maximum value for a permission. It is used in iteration, so keep it updated. + +#define ADMIN_QUE(user) "(?)" +#define ADMIN_FLW(user) "(FLW)" +#define ADMIN_PP(user) "(PP)" +#define ADMIN_VV(atom) "(VV)" +#define ADMIN_SM(user) "(SM)" +#define ADMIN_TP(user) "(TP)" +#define ADMIN_KICK(user) "(KICK)" +#define ADMIN_CENTCOM_REPLY(user) "(RPLY)" +#define ADMIN_SYNDICATE_REPLY(user) "(RPLY)" +#define ADMIN_SC(user) "(SC)" +#define ADMIN_SMITE(user) "(SMITE)" +#define ADMIN_LOOKUP(user) "[key_name_admin(user)][ADMIN_QUE(user)]" +#define ADMIN_LOOKUPFLW(user) "[key_name_admin(user)][ADMIN_QUE(user)] [ADMIN_FLW(user)]" +#define ADMIN_SET_SD_CODE "(SETCODE)" +#define ADMIN_FULLMONTY_NONAME(user) "[ADMIN_QUE(user)] [ADMIN_PP(user)] [ADMIN_VV(user)] [ADMIN_SM(user)] [ADMIN_FLW(user)] [ADMIN_TP(user)] [ADMIN_INDIVIDUALLOG(user)] [ADMIN_SMITE(user)]" +#define ADMIN_FULLMONTY(user) "[key_name_admin(user)] [ADMIN_FULLMONTY_NONAME(user)]" +#define ADMIN_JMP(src) "(JMP)" +#define COORD(src) "[src ? "([src.x],[src.y],[src.z])" : "nonexistent location"]" +#define ADMIN_COORDJMP(src) "[src ? "[COORD(src)] [ADMIN_JMP(src)]" : "nonexistent location"]" +#define ADMIN_INDIVIDUALLOG(user) "(LOGS)" + +#define ADMIN_PUNISHMENT_LIGHTNING "Lightning bolt" +#define ADMIN_PUNISHMENT_BRAINDAMAGE "Brain damage" +#define ADMIN_PUNISHMENT_GIB "Gib" +#define ADMIN_PUNISHMENT_BSA "Bluespace Artillery Device" + +#define AHELP_ACTIVE 1 +#define AHELP_CLOSED 2 +#define AHELP_RESOLVED 3 +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839) diff --git a/code/controllers/configuration.dm b/code/controllers/configuration.dm index 1d853c332b..e430ecb337 100644 --- a/code/controllers/configuration.dm +++ b/code/controllers/configuration.dm @@ -278,6 +278,8 @@ GLOBAL_PROTECT(config_dir) var/list/policies = list() + var/debug_admin_hrefs = FALSE //turns off admin href token protection for debugging purposes + /datum/configuration/New() gamemode_cache = typecacheof(/datum/game_mode,TRUE) for(var/T in gamemode_cache) @@ -559,6 +561,8 @@ GLOBAL_PROTECT(config_dir) error_msg_delay = text2num(value) if("irc_announce_new_game") irc_announce_new_game = TRUE + if("debug_admin_hrefs") + debug_admin_hrefs = TRUE else #if DM_VERSION > 511 #error Replace the line below with WRITE_FILE(GLOB.config_error_log, "Unknown setting in configuration: '[name]'") diff --git a/code/controllers/subsystem/events.dm b/code/controllers/subsystem/events.dm index c41f422575..7816a6bdf8 100644 --- a/code/controllers/subsystem/events.dm +++ b/code/controllers/subsystem/events.dm @@ -116,6 +116,8 @@ SUBSYSTEM_DEF(events) //allows a client to trigger an event //aka Badmin Central +// > Not in modules/admin +// REEEEEEEEE /client/proc/forceEvent() set name = "Trigger Event" set category = "Fun" @@ -131,7 +133,7 @@ SUBSYSTEM_DEF(events) var/magic = "" var/holiday = "" for(var/datum/round_event_control/E in SSevents.control) - dat = "
[E]" + dat = "
[E]" if(E.holidayID) holiday += dat else if(E.wizardevent) diff --git a/code/datums/datumvars.dm b/code/datums/datumvars.dm index 87c6ad7334..44661316ab 100644 --- a/code/datums/datumvars.dm +++ b/code/datums/datumvars.dm @@ -22,6 +22,7 @@ //please call . = ..() first and append to the result, that way parent items are always at the top and child items are further down //add separaters by doing . += "---" +<<<<<<< HEAD /datum/proc/vv_get_dropdown() . = list() . += "---" @@ -62,6 +63,49 @@ +======= +/datum/proc/vv_get_dropdown() + . = list() + . += "---" + .["Call Proc"] = "?_src_=vars;[HrefToken()];proc_call=\ref[src]" + .["Mark Object"] = "?_src_=vars;[HrefToken()];mark_object=\ref[src]" + .["Delete"] = "?_src_=vars;[HrefToken()];delete=\ref[src]" + .["Show VV To Player"] = "?_src_=vars;[HrefToken(TRUE)];expose=\ref[src]" + + +/datum/proc/on_reagent_change() + return + + +/client/proc/debug_variables(datum/D in world) + set category = "Debug" + set name = "View Variables" + //set src in world + var/static/cookieoffset = rand(1, 9999) //to force cookies to reset after the round. + + if(!usr.client || !usr.client.holder) //The usr vs src abuse in this proc is intentional and must not be changed + to_chat(usr, "You need to be an administrator to access this.") + return + + if(!D) + return + + var/islist = islist(D) + if (!islist && !istype(D)) + return + + var/title = "" + var/refid = "\ref[D]" + var/icon/sprite + var/hash + + var/type = /list + if (!islist) + type = D.type + + + +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839) if(istype(D, /atom)) var/atom/AT = D if(AT.icon && AT.icon_state) @@ -78,6 +122,7 @@ var/list/atomsnowflake = list() if(istype(D, /atom)) +<<<<<<< HEAD var/atom/A = D if(isliving(A)) atomsnowflake += "[D]" @@ -485,6 +530,415 @@ if(!check_rights(0)) return +======= + var/atom/A = D + if(isliving(A)) + atomsnowflake += "[D]" + if(A.dir) + atomsnowflake += "
<< [dir2text(A.dir)] >>" + var/mob/living/M = A + atomsnowflake += {" +
[M.ckey ? M.ckey : "No ckey"] / [M.real_name ? M.real_name : "No real name"] +
+ BRUTE:[M.getBruteLoss()] + FIRE:[M.getFireLoss()] + TOXIN:[M.getToxLoss()] + OXY:[M.getOxyLoss()] + CLONE:[M.getCloneLoss()] + BRAIN:[M.getBrainLoss()] + STAMINA:[M.getStaminaLoss()] + + "} + else + atomsnowflake += "[D]" + if(A.dir) + atomsnowflake += "
<< [dir2text(A.dir)] >>" + else + atomsnowflake += "[D]" + + var/formatted_type = "[type]" + if(length(formatted_type) > 25) + var/middle_point = length(formatted_type) / 2 + var/splitpoint = findtext(formatted_type,"/",middle_point) + if(splitpoint) + formatted_type = "[copytext(formatted_type,1,splitpoint)]
[copytext(formatted_type,splitpoint)]" + else + formatted_type = "Type too long" //No suitable splitpoint (/) found. + + var/marked + if(holder && holder.marked_datum && holder.marked_datum == D) + marked = "
Marked Object" + var/varedited_line = "" + if(!islist && D.var_edited) + varedited_line = "
Var Edited" + + var/list/dropdownoptions = list() + if (islist) + dropdownoptions = list( + "---", + "Add Item" = "?_src_=vars;[HrefToken()];listadd=[refid]", + "Remove Nulls" = "?_src_=vars;[HrefToken()];listnulls=[refid]", + "Remove Dupes" = "?_src_=vars;[HrefToken()];listdupes=[refid]", + "Set len" = "?_src_=vars;[HrefToken()];listlen=[refid]", + "Shuffle" = "?_src_=vars;[HrefToken()];listshuffle=[refid]", + "Show VV To Player" = "?_src_=vars;[HrefToken()];expose=[refid]" + ) + else + dropdownoptions = D.vv_get_dropdown() + var/list/dropdownoptions_html = list() + + for (var/name in dropdownoptions) + var/link = dropdownoptions[name] + if (link) + dropdownoptions_html += "" + else + dropdownoptions_html += "" + + var/list/names = list() + if (!islist) + for (var/V in D.vars) + names += V + sleep(1)//For some reason, without this sleep, VVing will cause client to disconnect on certain objects. + + var/list/variable_html = list() + if (islist) + var/list/L = D + for (var/i in 1 to L.len) + var/key = L[i] + var/value + if (IS_NORMAL_LIST(L) && !isnum(key)) + value = L[key] + variable_html += debug_variable(i, value, 0, D) + else + + names = sortList(names) + for (var/V in names) + if(D.can_vv_get(V)) + variable_html += D.vv_get_var(V) + + var/html = {" + + + [title] + + + + +
+ + + + + +
+ + + + +
+ [sprite_text] +
+ [atomsnowflake.Join()] +
+
+
+ [formatted_type] + [marked] + [varedited_line] +
+ 		+
+ Refresh +
+ +
+
+
+
+
+ + E - Edit, tries to determine the variable type by itself.
+ C - Change, asks you for the var type first.
+ M - Mass modify: changes this variable for all objects of this type.
+ +
+ + + + + +
+
+ Search: +
+ 		+ +
+
+
    + [variable_html.Join()] +
+ + + +"} + src << browse(html, "window=variables[refid];size=475x650") + + +#define VV_HTML_ENCODE(thing) ( sanitize ? html_encode(thing) : thing ) +/proc/debug_variable(name, value, level, datum/DA = null, sanitize = TRUE) + var/header + if(DA) + if (islist(DA)) + var/index = name + if (value) + name = DA[name] //name is really the index until this line + else + value = DA[name] + header = "
  • (E) (C) (-) " + else + header = "
  • (E) (C) (M) " + else + header = "
  • " + + var/item + if (isnull(value)) + item = "[VV_HTML_ENCODE(name)] = null" + + else if (istext(value)) + item = "[VV_HTML_ENCODE(name)] = \"[VV_HTML_ENCODE(value)]\"" + + else if (isicon(value)) + #ifdef VARSICON + var/icon/I = new/icon(value) + var/rnd = rand(1,10000) + var/rname = "tmp\ref[I][rnd].png" + usr << browse_rsc(I, rname) + item = "[VV_HTML_ENCODE(name)] = ([value]) " + #else + item = "[VV_HTML_ENCODE(name)] = /icon ([value])" + #endif + +/* else if (istype(value, /image)) + #ifdef VARSICON + var/rnd = rand(1, 10000) + var/image/I = value + + src << browse_rsc(I.icon, "tmp\ref[value][rnd].png") + html += "[name] = " + #else + html += "[name] = /image ([value])" + #endif +*/ + else if (isfile(value)) + item = "[VV_HTML_ENCODE(name)] = '[value]'" + + //else if (istype(value, /client)) + // var/client/C = value + // item = "[VV_HTML_ENCODE(name)] \ref[value] = [C] [C.type]" + + else if (istype(value, /datum)) + var/datum/D = value + if ("[D]" != "[D.type]") //if the thing as a name var, lets use it. + item = "[VV_HTML_ENCODE(name)] \ref[value] = [D] [D.type]" + else + item = "[VV_HTML_ENCODE(name)] \ref[value] = [D.type]" + + else if (islist(value)) + var/list/L = value + var/list/items = list() + + if (L.len > 0 && !(name == "underlays" || name == "overlays" || L.len > (IS_NORMAL_LIST(L) ? 50 : 150))) + for (var/i in 1 to L.len) + var/key = L[i] + var/val + if (IS_NORMAL_LIST(L) && !isnum(key)) + val = L[key] + if (!val) + val = key + key = i + + items += debug_variable(key, val, level + 1, sanitize = sanitize) + + item = "[VV_HTML_ENCODE(name)] = /list ([L.len])
      [items.Join()]
    " + else + item = "[VV_HTML_ENCODE(name)] = /list ([L.len])" + + else + item = "[VV_HTML_ENCODE(name)] = [VV_HTML_ENCODE(value)]" + + return "[header][item]
    • " + +#undef VV_HTML_ENCODE + +/client/proc/view_var_Topic(href, href_list, hsrc) + if( (usr.client != src) || !src.holder || !holder.CheckAdminHref(href, href_list)) + return + if(href_list["Vars"]) + debug_variables(locate(href_list["Vars"])) + + else if(href_list["datumrefresh"]) + var/datum/DAT = locate(href_list["datumrefresh"]) + if(!DAT) //can't be an istype() because /client etc aren't datums + return + src.debug_variables(DAT) + + else if(href_list["mob_player_panel"]) + if(!check_rights(0)) + return + +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839) var/mob/M = locate(href_list["mob_player_panel"]) in GLOB.mob_list if(!istype(M)) to_chat(usr, "This can only be used on instances of type /mob") @@ -541,6 +995,7 @@ return var/mob/M = locate(href_list["regenerateicons"]) in GLOB.mob_list +<<<<<<< HEAD if(!ismob(M)) to_chat(usr, "This can only be done to instances of type /mob") return @@ -557,6 +1012,44 @@ if(!check_rights(0)) return +======= + if(!ismob(M)) + to_chat(usr, "This can only be done to instances of type /mob") + return + M.regenerate_icons() + else if(href_list["expose"]) + if(!check_rights(R_ADMIN, FALSE)) + return + var/thing = locate(href_list["expose"]) + if (!thing) + return + var/value = vv_get_value(VV_CLIENT) + if (value["class"] != VV_CLIENT) + return + var/client/C = value["value"] + if (!C) + return + var/prompt = alert("Do you want to grant [C] access to view this VV window? (they will not be able to edit or change anything nor open nested vv windows unless they themselves are an admin)", "Confirm", "Yes", "No") + if (prompt != "Yes" || !usr.client) + return + message_admins("[key_name_admin(usr)] Showed [key_name_admin(C)] a VV window") + log_admin("Admin [key_name(usr)] Showed [key_name(C)] a VV window of a [thing]") + to_chat(C, "[usr.client.holder.fakekey ? "an Administrator" : "[usr.client.key]"] has granted you access to view a View Variables window") + C.debug_variables(thing) + + +//Needs +VAREDIT past this point + + else if(check_rights(R_VAREDIT)) + + + //~CARN: for renaming mobs (updates their name, real_name, mind.name, their ID/PDA and datacore records). + + if(href_list["rename"]) + if(!check_rights(0)) + return + +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839) var/mob/M = locate(href_list["rename"]) in GLOB.mob_list if(!istype(M)) to_chat(usr, "This can only be used on instances of type /mob") diff --git a/code/game/atoms.dm b/code/game/atoms.dm index 77bcefeddf..049d9bf838 100644 --- a/code/game/atoms.dm +++ b/code/game/atoms.dm @@ -613,10 +613,10 @@ GLOBAL_LIST_EMPTY(blood_splatter_icons) . += "---" var/turf/curturf = get_turf(src) if (curturf) - .["Jump to"] = "?_src_=holder;adminplayerobservecoodjump=1;X=[curturf.x];Y=[curturf.y];Z=[curturf.z]" - .["Add reagent"] = "?_src_=vars;addreagent=\ref[src]" - .["Trigger EM pulse"] = "?_src_=vars;emp=\ref[src]" - .["Trigger explosion"] = "?_src_=vars;explode=\ref[src]" + .["Jump to"] = "?_src_=holder;[HrefToken()];adminplayerobservecoodjump=1;X=[curturf.x];Y=[curturf.y];Z=[curturf.z]" + .["Add reagent"] = "?_src_=vars;[HrefToken()];addreagent=\ref[src]" + .["Trigger EM pulse"] = "?_src_=vars;[HrefToken()];emp=\ref[src]" + .["Trigger explosion"] = "?_src_=vars;[HrefToken()];explode=\ref[src]" /atom/proc/drop_location() var/atom/L = loc diff --git a/code/game/atoms_movable.dm b/code/game/atoms_movable.dm index f4cbcda098..e8c30f1fcc 100644 --- a/code/game/atoms_movable.dm +++ b/code/game/atoms_movable.dm @@ -497,7 +497,7 @@ /atom/movable/vv_get_dropdown() . = ..() . -= "Jump to" - .["Follow"] = "?_src_=holder;adminplayerobservefollow=\ref[src]" + .["Follow"] = "?_src_=holder;[HrefToken()];adminplayerobservefollow=\ref[src]" /atom/movable/proc/ex_check(ex_id) if(!ex_id) diff --git a/code/game/objects/objs.dm b/code/game/objects/objs.dm index 1f3668f283..568921cfbf 100644 --- a/code/game/objects/objs.dm +++ b/code/game/objects/objs.dm @@ -198,7 +198,7 @@ /obj/vv_get_dropdown() . = ..() - .["Delete all of type"] = "?_src_=vars;delall=\ref[src]" + .["Delete all of type"] = "?_src_=vars;[HrefToken()];delall=\ref[src]" /obj/examine(mob/user) ..() diff --git a/code/modules/admin/DB_ban/functions.dm b/code/modules/admin/DB_ban/functions.dm index e580b306b3..c6f44fd1da 100644 --- a/code/modules/admin/DB_ban/functions.dm +++ b/code/modules/admin/DB_ban/functions.dm @@ -414,7 +414,7 @@ if(bancount > bansperpage) output += "
    Page: " while(bancount > 0) - output+= "|[pagecount == page ? "\[[pagecount]\]" : "\[[pagecount]\]"]" + output+= "|[pagecount == page ? "\[[pagecount]\]" : "\[[pagecount]\]"]" bancount -= bansperpage pagecount++ output += "|" @@ -462,25 +462,25 @@ if("PERMABAN") typedesc = "PERMABAN" if("TEMPBAN") - typedesc = "TEMPBAN
    ([duration] minutes [(unbanned) ? "" : "(Edit))"]
    Expires [expiration]    " + typedesc = "TEMPBAN
    ([duration] minutes [(unbanned) ? "" : "(Edit))"]
    Expires [expiration]    " if("JOB_PERMABAN") typedesc = "JOBBAN
    ([job])" if("JOB_TEMPBAN") - typedesc = "TEMP JOBBAN
    ([job])
    ([duration] minutes [(unbanned) ? "" : "(Edit))"]
    Expires [expiration]" + typedesc = "TEMP JOBBAN
    ([job])
    ([duration] minutes [(unbanned) ? "" : "(Edit))"]
    Expires [expiration]" if("ADMIN_PERMABAN") typedesc = "ADMIN PERMABAN" if("ADMIN_TEMPBAN") - typedesc = "ADMIN TEMPBAN
    ([duration] minutes [(unbanned) ? "" : "(Edit))"]
    Expires [expiration]    " + typedesc = "ADMIN TEMPBAN
    ([duration] minutes [(unbanned) ? "" : "(Edit))"]
    Expires [expiration]    " output += "" output += "[typedesc]" output += "[ckey]" output += "[bantime]" output += "[ackey]" - output += "[(unbanned) ? "" : "Unban"]" + output += "[(unbanned) ? "" : "Unban"]" output += "" output += "" - output += "Reason: [(unbanned) ? "" : "(Edit)"] \"[reason]\"" + output += "Reason: [(unbanned) ? "" : "(Edit)"] \"[reason]\"" output += "" if(edits) output += "" diff --git a/code/modules/admin/admin.dm b/code/modules/admin/admin.dm index b88451b724..392d361773 100644 --- a/code/modules/admin/admin.dm +++ b/code/modules/admin/admin.dm @@ -30,68 +30,68 @@ body += "Options panel for [M]" if(M.client) body += " played by [M.client] " - body += "\[[M.client.holder ? M.client.holder.rank : "Player"]\]" + body += "\[[M.client.holder ? M.client.holder.rank : "Player"]\]" if(config.use_exp_tracking) - body += "\[" + M.client.get_exp_living() + "\]" + body += "\[" + M.client.get_exp_living() + "\]" if(isnewplayer(M)) body += " Hasn't Entered Game " else - body += " \[Heal\] " + body += " \[Heal\] " if(M.client) body += "
    \[First Seen: [M.client.player_join_date]\]\[Byond account registered on: [M.client.account_join_date]\]" body += "

    Show related accounts by: " - body += "\[ CID | " - body += "IP \]" + body += "\[ CID | " + body += "IP \]" body += "

    \[ " - body += "VV - " - body += "TP - " + body += "VV - " + body += "TP - " body += "PM - " - body += "SM - " - body += "FLW - " - body += "LOGS\]
    " + body += "SM - " + body += "FLW - " + body += "LOGS\]
    " body += "Mob type = [M.type]

    " - body += "Kick | " - body += "Ban | " - body += "Jobban | " - body += "Identity Ban | " + body += "Kick | " + body += "Ban | " + body += "Jobban | " + body += "Identity Ban | " if(jobban_isbanned(M, "OOC")) - body+= "OOCBan | " + body+= "OOCBan | " else - body+= "OOCBan | " + body+= "OOCBan | " if(jobban_isbanned(M, "emote")) - body+= "EmoteBan | " + body+= "EmoteBan | " else - body+= "Emoteban | " + body+= "Emoteban | " - body += "Notes | Messages | Watchlist | " + body += "Notes | Messages | Watchlist | " if(M.client) - body += "| Prison | " - body += "\ Send back to Lobby | " + body += "| Prison | " + body += "\ Send back to Lobby | " var/muted = M.client.prefs.muted body += "
    Mute: " - body += "\[IC | " - body += "OOC | " - body += "PRAY | " - body += "ADMINHELP | " - body += "DEADCHAT\]" - body += "(toggle all)" + body += "\[IC | " + body += "OOC | " + body += "PRAY | " + body += "ADMINHELP | " + body += "DEADCHAT\]" + body += "(toggle all)" body += "

    " - body += "Jump to | " - body += "Get | " - body += "Send To" + body += "Jump to | " + body += "Get | " + body += "Send To" body += "

    " - body += "Traitor panel | " - body += "Narrate to | " - body += "Subtle message | " - body += "Language Menu" + body += "Traitor panel | " + body += "Narrate to | " + body += "Subtle message | " + body += "Language Menu" if (M.client) if(!isnewplayer(M)) @@ -103,73 +103,71 @@ if(ishuman(M)) body += "Human | " else - body += "Humanize | " + body += "Humanize | " //Monkey if(ismonkey(M)) body += "Monkeyized | " else - body += "Monkeyize | " + body += "Monkeyize | " //Corgi if(iscorgi(M)) body += "Corgized | " else - body += "Corgize | " + body += "Corgize | " //AI / Cyborg if(isAI(M)) body += "Is an AI " else if(ishuman(M)) - body += "Make AI | " - body += "Make Robot | " - body += "Make Alien | " - body += "Make Slime | " - body += "Make Blob | " + body += "Make AI | " + body += "Make Robot | " + body += "Make Alien | " + body += "Make Slime | " + body += "Make Blob | " //Simple Animals if(isanimal(M)) - body += "Re-Animalize | " + body += "Re-Animalize | " else - body += "Animalize | " + body += "Animalize | " body += "

    " body += "Rudimentary transformation:
    These transformations only create a new mob type and copy stuff over. They do not take into account MMIs and similar mob-specific things. The buttons in 'Transformations' are preferred, when possible.
    " - body += "Observer | " - body += "\[ Alien: Drone, " - body += "Hunter, " - body += "Sentinel, " - body += "Praetorian, " - body += "Queen, " - body += "Larva \] " - body += "Human " - body += "\[ slime: Baby, " - body += "Adult \] " - body += "Monkey | " - body += "Cyborg | " - body += "Cat | " - body += "Runtime | " - body += "Corgi | " - body += "Ian | " - body += "Crab | " - body += "Coffee | " - //body += "Parrot | " - //body += "Poly | " - body += "\[ Construct: Juggernaut , " - body += "Artificer , " - body += "Wraith \] " - body += "Shade" + body += "Observer | " + body += "\[ Alien: Drone, " + body += "Hunter, " + body += "Sentinel, " + body += "Praetorian, " + body += "Queen, " + body += "Larva \] " + body += "Human " + body += "\[ slime: Baby, " + body += "Adult \] " + body += "Monkey | " + body += "Cyborg | " + body += "Cat | " + body += "Runtime | " + body += "Corgi | " + body += "Ian | " + body += "Crab | " + body += "Coffee | " + body += "\[ Construct: Juggernaut , " + body += "Artificer , " + body += "Wraith \] " + body += "Shade" body += "
    " if (M.client) body += "

    " body += "Other actions:" body += "
    " - body += "Forcesay | " - body += "Thunderdome 1 | " - body += "Thunderdome 2 | " - body += "Thunderdome Admin | " - body += "Thunderdome Observer | " + body += "Forcesay | " + body += "Thunderdome 1 | " + body += "Thunderdome 2 | " + body += "Thunderdome Admin | " + body += "Thunderdome Observer | " body += "
    " body += "" @@ -197,19 +195,19 @@ dat += "
    Feed channels and stories entered through here will be uneditable and handled as official news by the rest of the units." dat += "
    Note that this panel allows full freedom over the news network, there are no constrictions except the few basic ones. Don't break things!    " if(GLOB.news_network.wanted_issue.active) - dat+= "
    Read Wanted Issue" - dat+= "

    Create Feed Channel" - dat+= "
    View Feed Channels" - dat+= "
    Submit new Feed story" - dat+= "

    Exit" + dat+= "
    Read Wanted Issue" + dat+= "

    Create Feed Channel" + dat+= "
    View Feed Channels" + dat+= "
    Submit new Feed story" + dat+= "

    Exit" var/wanted_already = 0 if(GLOB.news_network.wanted_issue.active) wanted_already = 1 dat+="
    Feed Security functions:
    " - dat+="
    [(wanted_already) ? ("Manage") : ("Publish")] \"Wanted\" Issue" - dat+="
    Censor Feed Stories" - dat+="
    Mark Feed Channel with Nanotrasen D-Notice (disables and locks the channel)." - dat+="
    The newscaster recognises you as:
    [src.admin_signature]    " + dat+="
    [(wanted_already) ? ("Manage") : ("Publish")] \"Wanted\" Issue" + dat+="
    Censor Feed Stories" + dat+="
    Mark Feed Channel with Nanotrasen D-Notice (disables and locks the channel)." + dat+="
    The newscaster recognises you as:
    [src.admin_signature]    " if(1) dat+= "Station Feed Channels
    " if( isemptylist(GLOB.news_network.network_channels) ) @@ -219,34 +217,34 @@ if(CHANNEL.is_admin_channel) dat+="[CHANNEL.channel_name]
    " else - dat+="[CHANNEL.channel_name] [(CHANNEL.censored) ? ("***") : ()]
    " - dat+="
    Refresh" - dat+="
    Back" + dat+="[CHANNEL.channel_name] [(CHANNEL.censored) ? ("***") : ()]
    " + dat+="
    Refresh" + dat+="
    Back" if(2) dat+="Creating new Feed Channel..." - dat+="
    Channel Name: [src.admincaster_feed_channel.channel_name]
    " - dat+="Channel Author: [src.admin_signature]
    " - dat+="Will Accept Public Feeds: [(src.admincaster_feed_channel.locked) ? ("NO") : ("YES")]

    " - dat+="
    Submit

    Cancel
    " + dat+="
    Channel Name: [src.admincaster_feed_channel.channel_name]
    " + dat+="Channel Author: [src.admin_signature]
    " + dat+="Will Accept Public Feeds: [(src.admincaster_feed_channel.locked) ? ("NO") : ("YES")]

    " + dat+="
    Submit

    Cancel
    " if(3) dat+="Creating new Feed Message..." - dat+="
    Receiving Channel: [src.admincaster_feed_channel.channel_name]
    " //MARK + dat+="
    Receiving Channel: [src.admincaster_feed_channel.channel_name]
    " //MARK dat+="Message Author: [src.admin_signature]
    " - dat+="Message Body: [src.admincaster_feed_message.returnBody(-1)]
    " - dat+="
    Submit

    Cancel
    " + dat+="Message Body: [src.admincaster_feed_message.returnBody(-1)]
    " + dat+="
    Submit

    Cancel
    " if(4) dat+="Feed story successfully submitted to [src.admincaster_feed_channel.channel_name].

    " - dat+="
    Return
    " + dat+="
    Return
    " if(5) dat+="Feed Channel [src.admincaster_feed_channel.channel_name] created successfully.

    " - dat+="
    Return
    " + dat+="
    Return
    " if(6) dat+="ERROR: Could not submit Feed story to Network.

    " if(src.admincaster_feed_channel.channel_name=="") dat+="•Invalid receiving channel name.
    " if(src.admincaster_feed_message.returnBody(-1) == "" || src.admincaster_feed_message.returnBody(-1) == "\[REDACTED\]") dat+="•Invalid message body.
    " - dat+="
    Return
    " + dat+="
    Return
    " if(7) dat+="ERROR: Could not submit Feed Channel to Network.

    " if(src.admincaster_feed_channel.channel_name =="" || src.admincaster_feed_channel.channel_name == "\[REDACTED\]") @@ -258,7 +256,7 @@ break if(check) dat+="•Channel name already in use.
    " - dat+="
    Return
    " + dat+="
    Return
    " if(9) dat+="[admincaster_feed_channel.channel_name]: \[created by: [admincaster_feed_channel.returnAuthor(-1)]\]
    " if(src.admincaster_feed_channel.censored) @@ -280,8 +278,8 @@ for(var/datum/newscaster/feed_comment/comment in MESSAGE.comments) dat+="[comment.body]
    [comment.author] [comment.time_stamp]
    " dat+="
    " - dat+="
    Refresh" - dat+="
    Back" + dat+="
    Refresh" + dat+="
    Back" if(10) dat+="Nanotrasen Feed Censorship Tool
    " dat+="NOTE: Due to the nature of news Feeds, total deletion of a Feed Story is not possible.
    " @@ -291,8 +289,8 @@ dat+="No feed channels found active...
    " else for(var/datum/newscaster/feed_channel/CHANNEL in GLOB.news_network.network_channels) - dat+="[CHANNEL.channel_name] [(CHANNEL.censored) ? ("***") : ()]
    " - dat+="
    Cancel" + dat+="[CHANNEL.channel_name] [(CHANNEL.censored) ? ("***") : ()]
    " + dat+="
    Cancel" if(11) dat+="Nanotrasen D-Notice Handler
    " dat+="A D-Notice is to be bestowed upon the channel if the handling Authority deems it as harmful for the station's" @@ -302,26 +300,26 @@ dat+="No feed channels found active...
    " else for(var/datum/newscaster/feed_channel/CHANNEL in GLOB.news_network.network_channels) - dat+="[CHANNEL.channel_name] [(CHANNEL.censored) ? ("***") : ()]
    " + dat+="[CHANNEL.channel_name] [(CHANNEL.censored) ? ("***") : ()]
    " - dat+="
    Back" + dat+="
    Back" if(12) dat+="[src.admincaster_feed_channel.channel_name]: \[ created by: [src.admincaster_feed_channel.returnAuthor(-1)] \]
    " - dat+="[(src.admincaster_feed_channel.authorCensor) ? ("Undo Author censorship") : ("Censor channel Author")]
    " + dat+="[(src.admincaster_feed_channel.authorCensor) ? ("Undo Author censorship") : ("Censor channel Author")]
    " if( isemptylist(src.admincaster_feed_channel.messages) ) dat+="No feed messages found in channel...
    " else for(var/datum/newscaster/feed_message/MESSAGE in src.admincaster_feed_channel.messages) dat+="-[MESSAGE.returnBody(-1)]
    \[Story by [MESSAGE.returnAuthor(-1)]\]
    " - dat+="[(MESSAGE.bodyCensor) ? ("Undo story censorship") : ("Censor story")] - [(MESSAGE.authorCensor) ? ("Undo Author Censorship") : ("Censor message Author")]
    " - dat+="[MESSAGE.comments.len] comment[MESSAGE.comments.len > 1 ? "s" : ""]: [MESSAGE.locked ? "Unlock" : "Lock"]
    " + dat+="[(MESSAGE.bodyCensor) ? ("Undo story censorship") : ("Censor story")] - [(MESSAGE.authorCensor) ? ("Undo Author Censorship") : ("Censor message Author")]
    " + dat+="[MESSAGE.comments.len] comment[MESSAGE.comments.len > 1 ? "s" : ""]: [MESSAGE.locked ? "Unlock" : "Lock"]
    " for(var/datum/newscaster/feed_comment/comment in MESSAGE.comments) - dat+="[comment.body] X
    [comment.author] [comment.time_stamp]
    " - dat+="
    Back" + dat+="[comment.body] X
    [comment.author] [comment.time_stamp]
    " + dat+="
    Back" if(13) dat+="[src.admincaster_feed_channel.channel_name]: \[ created by: [src.admincaster_feed_channel.returnAuthor(-1)] \]
    " - dat+="Channel messages listed below. If you deem them dangerous to the station, you can Bestow a D-Notice upon the channel.
    " + dat+="Channel messages listed below. If you deem them dangerous to the station, you can Bestow a D-Notice upon the channel.
    " if(src.admincaster_feed_channel.censored) dat+="ATTENTION: This channel has been deemed as threatening to the welfare of the station, and marked with a Nanotrasen D-Notice.
    " dat+="No further feed story additions are allowed while the D-Notice is in effect.

    " @@ -331,7 +329,7 @@ else for(var/datum/newscaster/feed_message/MESSAGE in src.admincaster_feed_channel.messages) dat+="-[MESSAGE.returnBody(-1)]
    \[Story by [MESSAGE.returnAuthor(-1)]\]
    " - dat+="
    Back" + dat+="
    Back" if(14) dat+="Wanted Issue Handler:" var/wanted_already = 0 @@ -342,29 +340,29 @@ if(wanted_already) dat+="
    A wanted issue is already in Feed Circulation. You can edit or cancel it below.    " dat+="
    " - dat+="Criminal Name: [src.admincaster_wanted_message.criminal]
    " - dat+="Description: [src.admincaster_wanted_message.body]
    " + dat+="Criminal Name: [src.admincaster_wanted_message.criminal]
    " + dat+="Description: [src.admincaster_wanted_message.body]
    " if(wanted_already) dat+="Wanted Issue created by:[GLOB.news_network.wanted_issue.scannedUser]
    " else dat+="Wanted Issue will be created under prosecutor:[src.admin_signature]
    " - dat+="
    [(wanted_already) ? ("Edit Issue") : ("Submit")]" + dat+="
    [(wanted_already) ? ("Edit Issue") : ("Submit")]" if(wanted_already) - dat+="
    Take down Issue" - dat+="
    Cancel" + dat+="
    Take down Issue" + dat+="
    Cancel" if(15) dat+="Wanted issue for [src.admincaster_wanted_message.criminal] is now in Network Circulation.

    " - dat+="
    Return
    " + dat+="
    Return
    " if(16) dat+="ERROR: Wanted Issue rejected by Network.

    " if(src.admincaster_wanted_message.criminal =="" || src.admincaster_wanted_message.criminal == "\[REDACTED\]") dat+="•Invalid name for person wanted.
    " if(src.admincaster_wanted_message.body == "" || src.admincaster_wanted_message.body == "\[REDACTED\]") dat+="•Invalid description.
    " - dat+="
    Return
    " + dat+="
    Return
    " if(17) dat+="Wanted Issue successfully deleted from Circulation
    " - dat+="
    Return
    " + dat+="
    Return
    " if(18) dat+="-- STATIONWIDE WANTED ISSUE --
    \[Submitted by: [GLOB.news_network.wanted_issue.scannedUser]\]
    " dat+="Criminal: [GLOB.news_network.wanted_issue.criminal]
    " @@ -375,10 +373,10 @@ dat+="
    " else dat+="None" - dat+="
    Back
    " + dat+="
    Back
    " if(19) dat+="Wanted issue for [src.admincaster_wanted_message.criminal] successfully edited.

    " - dat+="
    Return
    " + dat+="
    Return
    " else dat+="I'm sorry to break your immersion. This shit's bugged. Report this bug to Agouri, polyxenitopalidou@gmail.com" @@ -394,21 +392,21 @@ var/dat = {"
    Game Panel
    \n - Change Game Mode
    + Change Game Mode
    "} if(GLOB.master_mode == "secret") - dat += "(Force Secret Mode)
    " + dat += "(Force Secret Mode)
    " dat += {"
    - Create Object
    - Quick Create Object
    - Create Turf
    - Create Mob
    + Create Object
    + Quick Create Object
    + Create Turf
    + Create Mob
    "} if(marked_datum && istype(marked_datum, /atom)) - dat += "Duplicate Marked Datum
    " + dat += "Duplicate Marked Datum
    " usr << browse(dat, "window=admin2;size=210x200") return @@ -755,14 +753,14 @@ dat += " (Cannot Late Join)
    " continue if(job.total_positions >= 0) - dat += " Add | " + dat += " Add | " if(job.total_positions > job.current_positions) - dat += "Remove | " + dat += "Remove | " else dat += "Remove | " - dat += "Unlimit" + dat += "Unlimit" else - dat += " Limit" + dat += " Limit" dat += "
    " dat += "" diff --git a/code/modules/admin/create_mob.dm b/code/modules/admin/create_mob.dm index cf0d4be37f..7bfd7ec80a 100644 --- a/code/modules/admin/create_mob.dm +++ b/code/modules/admin/create_mob.dm @@ -1,3 +1,4 @@ +<<<<<<< HEAD /datum/admins/proc/create_mob(mob/user) var/static/create_mob_html @@ -23,4 +24,31 @@ H.dna.blood_type = random_blood_type() H.update_body() H.update_hair() +======= + +/datum/admins/proc/create_mob(mob/user) + var/static/create_mob_html + if (!create_mob_html) + var/mobjs = null + mobjs = jointext(typesof(/mob), ";") + create_mob_html = file2text('html/create_object.html') + create_mob_html = replacetext(create_mob_html, "null /* object types */", "\"[mobjs]\"") + + user << browse(replacetext(create_mob_html, "/* ref src */", "\ref[src];[HrefToken()]"), "window=create_mob;size=425x475") + +/proc/randomize_human(mob/living/carbon/human/H) + H.gender = pick(MALE, FEMALE) + H.real_name = random_unique_name(H.gender) + H.name = H.real_name + H.underwear = random_underwear(H.gender) + H.skin_tone = random_skin_tone() + H.hair_style = random_hair_style(H.gender) + H.facial_hair_style = random_facial_hair_style(H.gender) + H.hair_color = random_short_color() + H.facial_hair_color = H.hair_color + H.eye_color = random_eye_color() + H.dna.blood_type = random_blood_type() + H.update_body() + H.update_hair() +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839) H.update_body_parts() \ No newline at end of file diff --git a/code/modules/admin/create_object.dm b/code/modules/admin/create_object.dm index 32801149f9..cddadb4082 100644 --- a/code/modules/admin/create_object.dm +++ b/code/modules/admin/create_object.dm @@ -1,3 +1,4 @@ +<<<<<<< HEAD /datum/admins/proc/create_object(mob/user) var/static/create_object_html = null if (!create_object_html) @@ -23,4 +24,32 @@ html_form = replacetext(html_form, "null /* object types */", "\"[objectjs]\"") create_object_forms[path] = html_form - user << browse(replacetext(html_form, "/* ref src */", "\ref[src]"), "window=qco[path];size=425x475") \ No newline at end of file + user << browse(replacetext(html_form, "/* ref src */", "\ref[src]"), "window=qco[path];size=425x475") +======= +/datum/admins/proc/create_object(mob/user) + var/static/create_object_html = null + if (!create_object_html) + var/objectjs = null + objectjs = jointext(typesof(/obj), ";") + create_object_html = file2text('html/create_object.html') + create_object_html = replacetext(create_object_html, "null /* object types */", "\"[objectjs]\"") + + user << browse(replacetext(create_object_html, "/* ref src */", "\ref[src];[HrefToken()]"), "window=create_object;size=425x475") + +/datum/admins/proc/quick_create_object(mob/user) + var/static/list/create_object_forms = list( + /obj, /obj/structure, /obj/machinery, /obj/effect, + /obj/item, /obj/item/clothing, /obj/item/stack, /obj/item/device, + /obj/item/reagent_containers, /obj/item/gun) + + var/path = input("Select the path of the object you wish to create.", "Path", /obj) in create_object_forms + var/html_form = create_object_forms[path] + + if (!html_form) + var/objectjs = jointext(typesof(path), ";") + html_form = file2text('html/create_object.html') + html_form = replacetext(html_form, "null /* object types */", "\"[objectjs]\"") + create_object_forms[path] = html_form + + user << browse(replacetext(html_form, "/* ref src */", "\ref[src];[HrefToken()]"), "window=qco[path];size=425x475") +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839) diff --git a/code/modules/admin/create_turf.dm b/code/modules/admin/create_turf.dm index 63e3b8cf69..62e26d89d5 100644 --- a/code/modules/admin/create_turf.dm +++ b/code/modules/admin/create_turf.dm @@ -1,3 +1,4 @@ +<<<<<<< HEAD /datum/admins/proc/create_turf(mob/user) var/static/create_turf_html if (!create_turf_html) @@ -7,3 +8,14 @@ create_turf_html = replacetext(create_turf_html, "null /* object types */", "\"[turfjs]\"") user << browse(replacetext(create_turf_html, "/* ref src */", "\ref[src]"), "window=create_turf;size=425x475") +======= +/datum/admins/proc/create_turf(mob/user) + var/static/create_turf_html + if (!create_turf_html) + var/turfjs = null + turfjs = jointext(typesof(/turf), ";") + create_turf_html = file2text('html/create_object.html') + create_turf_html = replacetext(create_turf_html, "null /* object types */", "\"[turfjs]\"") + + user << browse(replacetext(create_turf_html, "/* ref src */", "\ref[src];[HrefToken()]"), "window=create_turf;size=425x475") +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839) diff --git a/code/modules/admin/holder2.dm b/code/modules/admin/holder2.dm index bdd799badf..d9c5b88364 100644 --- a/code/modules/admin/holder2.dm +++ b/code/modules/admin/holder2.dm @@ -1,3 +1,4 @@ +<<<<<<< HEAD GLOBAL_LIST_EMPTY(admin_datums) GLOBAL_PROTECT(admin_datums) @@ -102,4 +103,131 @@ you will have to do something like if(client.rights & R_ADMIN) yourself. if(rights_required && !(rights_required & subject.holder.rank.rights)) return 0 return 1 +======= +GLOBAL_LIST_EMPTY(admin_datums) +GLOBAL_PROTECT(admin_datums) + +GLOBAL_VAR_INIT(href_token, GenerateToken()) +GLOBAL_PROTECT(href_token) + +/datum/admins + var/datum/admin_rank/rank + + var/client/owner = null + var/fakekey = null + + var/datum/marked_datum + + var/spamcooldown = 0 + + var/admincaster_screen = 0 //TODO: remove all these 5 variables, they are completly unacceptable + var/datum/newscaster/feed_message/admincaster_feed_message = new /datum/newscaster/feed_message + var/datum/newscaster/wanted_message/admincaster_wanted_message = new /datum/newscaster/wanted_message + var/datum/newscaster/feed_channel/admincaster_feed_channel = new /datum/newscaster/feed_channel + var/admin_signature + var/href_token + +/datum/admins/New(datum/admin_rank/R, ckey) + if(!ckey) + QDEL_IN(src, 0) + throw EXCEPTION("Admin datum created without a ckey") + return + if(!istype(R)) + QDEL_IN(src, 0) + throw EXCEPTION("Admin datum created without a rank") + return + rank = R + admin_signature = "Nanotrasen Officer #[rand(0,9)][rand(0,9)][rand(0,9)]" + href_token = GenerateToken() + GLOB.admin_datums[ckey] = src + +/proc/GenerateToken() + . = "" + for(var/I in 1 to 32) + . += "[rand(10)]" + +/proc/HrefToken(forceGlobal = FALSE) + var/tok = GLOB.href_token + if(!forceGlobal && usr) + var/client/C = usr.client + if(!C) + CRASH("No client for HrefToken()!") + var/datum/admins/holder = C.holder + if(holder) + tok = holder.href_token + return "admin_token=[tok]" + +/datum/admins/proc/associate(client/C) + if(IsAdminAdvancedProcCall()) + var/msg = " has tried to elevate permissions!" + message_admins("[key_name_admin(usr)][msg]") + log_admin_private("[key_name(usr)][msg]") + return + if(istype(C)) + owner = C + owner.holder = src + owner.add_admin_verbs() //TODO + owner.verbs -= /client/proc/readmin + GLOB.admins |= C + +/datum/admins/proc/disassociate() + if(owner) + GLOB.admins -= owner + owner.remove_admin_verbs() + owner.holder = null + owner = null + +/datum/admins/proc/check_if_greater_rights_than_holder(datum/admins/other) + if(!other) + return 1 //they have no rights + if(rank.rights == 65535) + return 1 //we have all the rights + if(src == other) + return 1 //you always have more rights than yourself + if(rank.rights != other.rank.rights) + if( (rank.rights & other.rank.rights) == other.rank.rights ) + return 1 //we have all the rights they have and more + return 0 + +/datum/admins/vv_edit_var(var_name, var_value) + return FALSE //nice try trialmin + +/* +checks if usr is an admin with at least ONE of the flags in rights_required. (Note, they don't need all the flags) +if rights_required == 0, then it simply checks if they are an admin. +if it doesn't return 1 and show_msg=1 it will prints a message explaining why the check has failed +generally it would be used like so: + +/proc/admin_proc() + if(!check_rights(R_ADMIN)) return + to_chat(world, "you have enough rights!") + +NOTE: it checks usr! not src! So if you're checking somebody's rank in a proc which they did not call +you will have to do something like if(client.rights & R_ADMIN) yourself. +*/ +/proc/check_rights(rights_required, show_msg=1) + if(usr && usr.client) + if (check_rights_for(usr.client, rights_required)) + return 1 + else + if(show_msg) + to_chat(usr, "Error: You do not have sufficient rights to do that. You require one of the following flags:[rights2text(rights_required," ")].") + return 0 + +//probably a bit iffy - will hopefully figure out a better solution +/proc/check_if_greater_rights_than(client/other) + if(usr && usr.client) + if(usr.client.holder) + if(!other || !other.holder) + return 1 + return usr.client.holder.check_if_greater_rights_than_holder(other.holder) + return 0 + +//This proc checks whether subject has at least ONE of the rights specified in rights_required. +/proc/check_rights_for(client/subject, rights_required) + if(subject && subject.holder && subject.holder.rank) + if(rights_required && !(rights_required & subject.holder.rank.rights)) + return 0 + return 1 +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839) return 0 \ No newline at end of file diff --git a/code/modules/admin/permissionverbs/permissionedit.dm b/code/modules/admin/permissionverbs/permissionedit.dm index aafe3b393e..552757b750 100644 --- a/code/modules/admin/permissionverbs/permissionedit.dm +++ b/code/modules/admin/permissionverbs/permissionedit.dm @@ -20,7 +20,7 @@
    - + @@ -36,10 +36,10 @@ if(!rights) rights = "*none*" output += "" - output += "" - output += "" - output += "" - output += "" + output += "" + output += "" + output += "" + output += "" output += "" output += {" diff --git a/code/modules/admin/player_panel.dm b/code/modules/admin/player_panel.dm index 9237d1f1e2..0a3520285c 100644 --- a/code/modules/admin/player_panel.dm +++ b/code/modules/admin/player_panel.dm @@ -75,16 +75,16 @@ body += "
    CKEY \[+\]CKEY \[+\] RANK PERMISSIONS VERB-OVERRIDES
    [adm_ckey] \[-\][D.rank.name][rights][rights2text(0," ",D.rank.adds,D.rank.subs)][adm_ckey] \[-\][D.rank.name][rights][rights2text(0," ",D.rank.adds,D.rank.subs)]
    "; - body += "PP - " - body += "N - " + body += "PP - " + body += "N - " body += "VV - " - body += "TP - " + body += "TP - " body += "PM - " - body += "SM - " - body += "FLW - " - body += "LOGS
    " + body += "SM - " + body += "FLW - " + body += "LOGS
    " if(antagonist > 0) - body += "Antagonist"; + body += "Antagonist"; body += "
    "; @@ -195,7 +195,7 @@ Player panel
    - Hover over a line to see more information - Check antagonists - Kick everyone/AFKers in lobby + Hover over a line to see more information - Check antagonists - Kick everyone/AFKers in lobby

    @@ -320,26 +320,26 @@ dat += "Round Duration: [round(world.time / 36000)]:[add_zero("[world.time / 600 % 60]", 2)]:[world.time / 100 % 6][world.time / 100 % 10]
    " dat += "Emergency shuttle
    " if(EMERGENCY_IDLE_OR_RECALLED) - dat += "Call Shuttle
    " + dat += "Call Shuttle
    " else var/timeleft = SSshuttle.emergency.timeLeft() if(SSshuttle.emergency.mode == SHUTTLE_CALL) - dat += "ETA: [(timeleft / 60) % 60]:[add_zero(num2text(timeleft % 60), 2)]
    " - dat += "Send Back
    " + dat += "ETA: [(timeleft / 60) % 60]:[add_zero(num2text(timeleft % 60), 2)]
    " + dat += "Send Back
    " else - dat += "ETA: [(timeleft / 60) % 60]:[add_zero(num2text(timeleft % 60), 2)]
    " + dat += "ETA: [(timeleft / 60) % 60]:[add_zero(num2text(timeleft % 60), 2)]
    " dat += "Continuous Round Status
    " - dat += "[config.continuous[SSticker.mode.config_tag] ? "Continue if antagonists die" : "End on antagonist death"]" + dat += "[config.continuous[SSticker.mode.config_tag] ? "Continue if antagonists die" : "End on antagonist death"]" if(config.continuous[SSticker.mode.config_tag]) - dat += ", [config.midround_antag[SSticker.mode.config_tag] ? "creating replacement antagonists" : "not creating new antagonists"]
    " + dat += ", [config.midround_antag[SSticker.mode.config_tag] ? "creating replacement antagonists" : "not creating new antagonists"]
    " else dat += "
    " if(config.midround_antag[SSticker.mode.config_tag]) - dat += "Time limit: [config.midround_antag_time_check] minutes into round
    " - dat += "Living crew limit: [config.midround_antag_life_check * 100]% of crew alive
    " - dat += "If limits past: [SSticker.mode.round_ends_with_antag_death ? "End The Round" : "Continue As Extended"]
    " - dat += "End Round Now
    " - dat += "[SSticker.delay_end ? "End Round Normally" : "Delay Round End"]" + dat += "Time limit: [config.midround_antag_time_check] minutes into round
    " + dat += "Living crew limit: [config.midround_antag_life_check * 100]% of crew alive
    " + dat += "If limits past: [SSticker.mode.round_ends_with_antag_death ? "End The Round" : "Continue As Extended"]
    " + dat += "End Round Now
    " + dat += "[SSticker.delay_end ? "End Round Normally" : "Delay Round End"]" var/connected_players = GLOB.clients.len var/lobby_players = 0 var/observers = 0 @@ -389,11 +389,11 @@ for(var/datum/mind/N in SSticker.mode.syndicates) var/mob/M = N.current if(M) - dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "FLW" + dat += "FLW" else - dat += "[N.name]([N.key]) Nuclear Operative Body destroyed!" + dat += "[N.name]([N.key]) Nuclear Operative Body destroyed!" dat += "PM" dat += "
    " for(var/obj/item/disk/nuclear/N in GLOB.poi_list) @@ -402,7 +402,7 @@ while(!isturf(disk_loc)) if(ismob(disk_loc)) var/mob/M = disk_loc - dat += "carried by [M.real_name] " + dat += "carried by [M.real_name] " if(isobj(disk_loc)) var/obj/O = disk_loc dat += "in \a [O.name] " @@ -415,29 +415,29 @@ for(var/datum/mind/N in SSticker.mode.head_revolutionaries) var/mob/M = N.current if(!M) - dat += "" + dat += "" dat += "" else - dat += "" + dat += "" dat += "" - dat += "" + dat += "" for(var/datum/mind/N in SSticker.mode.revolutionaries) var/mob/M = N.current if(M) - dat += "" + dat += "" dat += "" - dat += "" + dat += "" dat += "
    Nuclear Disk(s)
    [N.name]([N.key])Head Revolutionary body destroyed!
    [N.name]([N.key])Head Revolutionary body destroyed!PM
    [M.real_name] (Leader)[M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]
    [M.real_name] (Leader)[M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]PMFLW
    FLW
    [M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]
    [M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]PMFLW
    FLW
    " for(var/datum/mind/N in SSticker.mode.get_living_heads()) var/mob/M = N.current if(M) - dat += "" + dat += "" dat += "" - dat += "" + dat += "" var/turf/mob_loc = get_turf(M) dat += "" else - dat += "" + dat += "" dat += "" dat += "
    Target(s)Location
    [M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]
    [M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]PMFLWFLW[mob_loc.loc]
    [N.name]([N.key])Head body destroyed!
    [N.name]([N.key])Head body destroyed!PM
    " @@ -464,12 +464,12 @@ for(var/datum/mind/changeling in SSticker.mode.changelings) var/mob/M = changeling.current if(M) - dat += "[M.mind.changeling.changelingID] as [M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.mind.changeling.changelingID] as [M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "FLW" - dat += "Show Objective" + dat += "FLW" + dat += "Show Objective" else - dat += "[changeling.name]([changeling.key])Changeling body destroyed!" + dat += "[changeling.name]([changeling.key])Changeling body destroyed!" dat += "PM" dat += "" @@ -478,12 +478,12 @@ for(var/datum/mind/wizard in SSticker.mode.wizards) var/mob/M = wizard.current if(M) - dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "FLW" - dat += "Show Objective" + dat += "FLW" + dat += "Show Objective" else - dat += "[wizard.name]([wizard.key])Wizard body destroyed!" + dat += "[wizard.name]([wizard.key])Wizard body destroyed!" dat += "PM" dat += "" @@ -492,12 +492,12 @@ for(var/datum/mind/apprentice in SSticker.mode.apprentices) var/mob/M = apprentice.current if(M) - dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "FLW" - dat += "Show Objective" + dat += "FLW" + dat += "Show Objective" else - dat += "[apprentice.name]([apprentice.key])Apprentice body destroyed!!" + dat += "[apprentice.name]([apprentice.key])Apprentice body destroyed!!" dat += "PM" dat += "" @@ -506,9 +506,9 @@ for(var/datum/mind/N in SSticker.mode.cult) var/mob/M = N.current if(M) - dat += "[M.real_name][N.has_antag_datum(ANTAG_DATUM_CULT_MASTER) ? " \[Master\]" : ""][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.real_name][N.has_antag_datum(ANTAG_DATUM_CULT_MASTER) ? " \[Master\]" : ""][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "FLW" + dat += "FLW" dat += "" if(SSticker.mode.servants_of_ratvar.len) @@ -516,9 +516,9 @@ for(var/datum/mind/N in SSticker.mode.servants_of_ratvar) var/mob/M = N.current if(M) - dat += "[M.real_name][M.client ? "" : " (ghost)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.real_name][M.client ? "" : " (ghost)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "FLW" + dat += "FLW" dat += "" if(SSticker.mode.traitors.len > 0) @@ -526,12 +526,12 @@ for(var/datum/mind/traitor in SSticker.mode.traitors) var/mob/M = traitor.current if(M) - dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "FLW" - dat += "Show Objective" + dat += "FLW" + dat += "Show Objective" else - dat += "[traitor.name]([traitor.key])Traitor body destroyed!" + dat += "[traitor.name]([traitor.key])Traitor body destroyed!" dat += "PM" dat += "" @@ -540,12 +540,12 @@ for(var/datum/mind/abductor in SSticker.mode.abductors) var/mob/M = abductor.current if(M) - dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "FLW" - dat += "Show Objective" + dat += "FLW" + dat += "Show Objective" else - dat += "[abductor.name]([abductor.key])Abductor body destroyed!" + dat += "[abductor.name]([abductor.key])Abductor body destroyed!" dat += "PM" dat += "" dat += "
    " @@ -553,12 +553,12 @@ for(var/datum/mind/abductee in E.abductee_minds) var/mob/M = abductee.current if(M) - dat += "" + dat += "" dat += "" - dat += "" - dat += "" + dat += "" + dat += "" else - dat += "" + dat += "" dat += "" dat += "
    Abductees
    [M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]
    [M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]PMFLWShow Objective
    FLWShow Objective
    [abductee.name]([abductee.key])Abductee body destroyed!
    [abductee.name]([abductee.key])Abductee body destroyed!PM
    " @@ -569,12 +569,12 @@ var/mob/M = devil.current var/datum/antagonist/devil/devilinfo = devil.has_antag_datum(ANTAG_DATUM_DEVIL) if(M) - dat += "[M.real_name] : [devilinfo.truename][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.real_name] : [devilinfo.truename][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "Show Objective" - dat += "Show all devil info" + dat += "Show Objective" + dat += "Show all devil info" else - dat += "[devil.name] : [devilinfo.truename] ([devil.key])devil body destroyed!" + dat += "[devil.name] : [devilinfo.truename] ([devil.key])devil body destroyed!" dat += "PM" dat += "" @@ -584,11 +584,11 @@ var/datum/mind/sintouched = X var/mob/M = sintouched.current if(M) - dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "Show Objective" + dat += "Show Objective" else - dat += "[sintouched.name]([sintouched.key])sintouched body destroyed!" + dat += "[sintouched.name]([sintouched.key])sintouched body destroyed!" dat += "PM" dat += "" @@ -606,11 +606,11 @@ for(var/datum/mind/blob in blob_minds) var/mob/M = blob.current if(M) - dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "FLW" + dat += "FLW" else - dat += "[blob.name]([blob.key])Blob not found!" + dat += "[blob.name]([blob.key])Blob not found!" dat += "PM" dat += "" @@ -622,11 +622,11 @@ for(var/datum/mind/eek in mode.ape_infectees) var/mob/M = eek.current if(M) - dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" + dat += "[M.real_name][M.client ? "" : " (No Client)"][M.stat == DEAD ? " (DEAD)" : ""]" dat += "PM" - dat += "FLW" + dat += "FLW" else - dat += "[eek.name]([eek.key])Monkey not found!" + dat += "[eek.name]([eek.key])Monkey not found!" dat += "PM" dat += "" diff --git a/code/modules/admin/secrets.dm b/code/modules/admin/secrets.dm index 70c7346369..899e763c92 100644 --- a/code/modules/admin/secrets.dm +++ b/code/modules/admin/secrets.dm @@ -7,9 +7,9 @@ dat +={" General Secrets

    - Show Job Debug
    - Admin Log
    - Show Admin List
    + Show Job Debug
    + Admin Log
    + Show Admin List

    "} @@ -17,27 +17,27 @@ dat += {" Admin Secrets

    - Cure all diseases currently in existence
    - Bombing List
    - Show current traitors and objectives
    - Show last [length(GLOB.lastsignalers)] signalers
    - Show last [length(GLOB.lawchanges)] law changes
    - Show AI Laws
    - Show Game Mode
    - Show Crew Manifest
    - List DNA (Blood)
    - List Fingerprints
    - Enable/Disable CTF

    - Reset Thunderdome to default state
    - Rename Station Name
    - Reset Station Name
    + Cure all diseases currently in existence
    + Bombing List
    + Show current traitors and objectives
    + Show last [length(GLOB.lastsignalers)] signalers
    + Show last [length(GLOB.lawchanges)] law changes
    + Show AI Laws
    + Show Game Mode
    + Show Crew Manifest
    + List DNA (Blood)
    + List Fingerprints
    + Enable/Disable CTF

    + Reset Thunderdome to default state
    + Rename Station Name
    + Reset Station Name

    Shuttles

    - Move Ferry
    - Toggle Arrivals Ferry
    - Move Mining Shuttle
    - Move Labor Shuttle
    + Move Ferry
    + Toggle Arrivals Ferry
    + Move Mining Shuttle
    + Move Labor Shuttle

    "} @@ -45,6 +45,7 @@ dat += {" Fun Secrets

    +<<<<<<< HEAD Trigger a Virus Outbreak
    Turn all humans into monkeys
    @@ -66,10 +67,35 @@ Break all lights
    Fix all lights
    The floor is lava! (DANGEROUS: extremely lame)
    +======= +<<<<<<< HEAD + +======= +>>>>>>> 6e5ebf9c41fc97d5ee0daf4fd22536844438ace0 + Trigger a Virus Outbreak
    + Turn all humans into monkeys
    + Chinese Cartoons
    + Change the species of all humans
    + Make all areas powered
    + Make all areas unpowered
    + Power all SMES
    + Triple AI mode (needs to be used in the lobby)
    + Everyone is the traitor
    + Summon Guns
    + Summon Magic
    + Summon Events (Toggle)
    + There can only be one!
    + There can only be one! (40-second delay)
    + Make all players retarded
    + Egalitarian Station Mode
    + Break all lights
    + Fix all lights
    + The floor is lava! (DANGEROUS: extremely lame)
    +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839)
    - Change bomb cap
    - Mass Purrbation
    - Mass Remove Purrbation
    + Change bomb cap
    + Mass Purrbation
    + Mass Remove Purrbation
    "} dat += "
    " @@ -78,9 +104,9 @@ dat += {" Security Level Elevated

    - Change all maintenance doors to engie/brig access only
    - Change all maintenance doors to brig access only
    - Remove cap on security officers
    + Change all maintenance doors to engie/brig access only
    + Change all maintenance doors to brig access only
    + Remove cap on security officers

    "} diff --git a/code/modules/admin/sql_message_system.dm b/code/modules/admin/sql_message_system.dm index b42fe93eef..9eb66986b0 100644 --- a/code/modules/admin/sql_message_system.dm +++ b/code/modules/admin/sql_message_system.dm @@ -147,10 +147,10 @@ return var/output var/ruler = "

    " - var/navbar = "\[All\]|\[#\]" + var/navbar = "\[All\]|\[#\]" for(var/letter in GLOB.alphabet) - navbar += "|\[[letter]\]" - navbar += "|\[Memos\]|\[Watchlist\]" + navbar += "|\[[letter]\]" + navbar += "|\[Memos\]|\[Watchlist\]" navbar += "
    \ \ \ @@ -160,14 +160,14 @@ if(type == "memo" || type == "watchlist entry") if(type == "memo") output += "

    Admin memos

    " - output += "\[Add memo\]" + output += "\[Add memo\]" else if(type == "watchlist entry") output += "

    Watchlist entries

    " - output += "\[Add watchlist entry\]" + output += "\[Add watchlist entry\]" if(filter) - output += "|\[Unfilter clients\]" + output += "|\[Unfilter clients\]" else - output += "|\[Filter offline clients\]" + output += "|\[Filter offline clients\]" output += ruler var/datum/DBQuery/query_get_type_messages = SSdbcore.NewQuery("SELECT id, targetckey, adminckey, text, timestamp, server, lasteditor FROM [format_table_name("messages")] WHERE type = '[type]'") if(!query_get_type_messages.warn_execute()) @@ -186,10 +186,10 @@ if(type == "watchlist entry") output += "[t_ckey] | " output += "[timestamp] | [server] | [admin_ckey]" - output += " \[Delete\]" - output += " \[Edit\]" + output += " \[Delete\]" + output += " \[Edit\]" if(editor_ckey) - output += " Last edit by [editor_ckey] (Click here to see edit log)" + output += " Last edit by [editor_ckey] (Click here to see edit log)" output += "
    [text]
    " if(target_ckey) target_ckey = sanitizeSQL(target_ckey) @@ -215,18 +215,23 @@ var/data data += "[timestamp] | [server] | [admin_ckey]" if(!linkless) - data += " \[Delete\]" + data += " \[Delete\]" if(type == "note") - data += " [secret ? "\[Secret\]" : "\[Not secret\]"]" + data += " [secret ? "\[Secret\]" : "\[Not secret\]"]" if(type == "message sent") data += " Message has been sent" if(editor_ckey) data += "|" else - data += " \[Edit\]" + data += " \[Edit\]" if(editor_ckey) +<<<<<<< HEAD data += " Last edit by [editor_ckey] (Click here to see edit log)" data += "
    [text]
    " +======= + data += " Last edit by [editor_ckey] (Click here to see edit log)" + data += "
    [text]

    " +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839) switch(type) if("message") messagedata += data @@ -238,12 +243,12 @@ notedata += data output += "

    [target_ckey]

    " if(!linkless) - output += "\[Add note\]" - output += " \[Add message\]" - output += " \[Add to watchlist\]" - output += " \[Refresh page\]
    " + output += "\[Add note\]" + output += " \[Add message\]" + output += " \[Add to watchlist\]" + output += " \[Refresh page\]" else - output += " \[Refresh page\]" + output += " \[Refresh page\]" output += ruler if(messagedata) output += "

    Messages

    " @@ -257,7 +262,7 @@ if(index) var/index_ckey var/search - output += "
    \[Add message\]\[Add watchlist entry\]\[Add note\]
    " + output += "
    \[Add message\]\[Add watchlist entry\]\[Add note\]
    " output += ruler if(!isnum(index)) index = sanitizeSQL(index) @@ -273,9 +278,9 @@ return while(query_list_messages.NextRow()) index_ckey = query_list_messages.item[1] - output += "[index_ckey]
    " + output += "[index_ckey]
    " else if(!type && !target_ckey && !index) - output += "
    \[Add message\]\[Add watchlist entry\]\[Add note\]
    " + output += "
    \[Add message\]\[Add watchlist entry\]\[Add note\]
    " output += ruler usr << browse(output, "window=browse_messages;size=900x500") @@ -313,7 +318,7 @@ proc/get_message_output(type, target_ckey) if("memo") output += "Memo by [admin_ckey] on [timestamp]" if(editor_ckey) - output += "
    Last edit by [editor_ckey] (Click here to see edit log)" + output += "
    Last edit by [editor_ckey] (Click here to see edit log)" output += "
    [text]
    " return output diff --git a/code/modules/admin/stickyban.dm b/code/modules/admin/stickyban.dm index 9ac85e49fa..f5d6c72ffb 100644 --- a/code/modules/admin/stickyban.dm +++ b/code/modules/admin/stickyban.dm @@ -152,11 +152,11 @@ /datum/admins/proc/stickyban_gethtml(ckey, ban) . = {" - \[-\] - \[revert\] + \[-\] + \[revert\] [ckey]
    " - [ban["message"]] \[Edit\]
    + [ban["message"]] \[Edit\]
    "} if (ban["admin"]) . += "[ban["admin"]]
    " @@ -166,7 +166,7 @@ for (var/key in ban["keys"]) if (ckey(key) == ckey) continue - . += "
  • \[-\][key]
    • " + . += "
  • \[-\][key]
    • " . += "\n" /datum/admins/proc/stickyban_show() @@ -185,7 +185,7 @@ Sticky Bans -

    All Sticky Bans:

    \[+\]
    +

    All Sticky Bans:

    \[+\]
    [banhtml] "} diff --git a/code/modules/admin/topic.dm b/code/modules/admin/topic.dm index f7b0f8b6ff..f5f3326001 100644 --- a/code/modules/admin/topic.dm +++ b/code/modules/admin/topic.dm @@ -1,3 +1,16 @@ +/datum/admins/proc/CheckAdminHref(href, href_list) + var/auth = href_list["admin_token"] + . = auth && auth != href_token && auth != GLOB.href_token + if(.) + return + var/msg = !auth ? "no" : "a bad" + message_admins("[key_name_admin(usr)] clicked an href with [msg] authorization key!") + if(config.debug_admin_hrefs) + message_admins("Debug mode enabled, call not blocked. Please ask your coders to review this round's logs.") + log_world("UAH: [href]") + return TRUE + log_admin_private("[key_name(usr)] clicked an href with [msg] authorization key! [href]") + /datum/admins/Topic(href, href_list) ..() @@ -5,6 +18,10 @@ message_admins("[usr.key] has attempted to override the admin panel!") log_admin("[key_name(usr)] tried to use the admin panel without authorization.") return + + if(!CheckAdminHref(href, href_list)) + return + if(href_list["ahelp"]) if(!check_rights(R_ADMIN, TRUE)) return diff --git a/code/modules/admin/verbs/SDQL2/SDQL_2.dm b/code/modules/admin/verbs/SDQL2/SDQL_2.dm index 5d4e0dc29a..eaa98934d5 100644 --- a/code/modules/admin/verbs/SDQL2/SDQL_2.dm +++ b/code/modules/admin/verbs/SDQL2/SDQL_2.dm @@ -122,7 +122,7 @@ /proc/SDQL_gen_vv_href(t) var/text = "" - text += "\ref[t]" + text += "\ref[t]" if(istype(t, /atom)) var/atom/a = t var/turf/T = a.loc diff --git a/code/modules/admin/verbs/adminhelp.dm b/code/modules/admin/verbs/adminhelp.dm index d593973188..c1c1894184 100644 --- a/code/modules/admin/verbs/adminhelp.dm +++ b/code/modules/admin/verbs/adminhelp.dm @@ -80,10 +80,10 @@ GLOBAL_DATUM_INIT(ahelp_tickets, /datum/admin_help_tickets, new) if(!l2b) return var/list/dat = list("[title]") - dat += "Refresh

    " + dat += "Refresh

    " for(var/I in l2b) var/datum/admin_help/AH = I - dat += "Ticket #[AH.id]: [AH.initiator_key_name]: [AH.name]
    " + dat += "Ticket #[AH.id]: [AH.initiator_key_name]: [AH.name]
    " usr << browse(dat.Join(), "window=ahelp_list[state];size=600x480") @@ -228,22 +228,22 @@ GLOBAL_DATUM_INIT(ahelp_tickets, /datum/admin_help_tickets, new) /datum/admin_help/proc/ClosureLinks(ref_src) if(!ref_src) ref_src = "\ref[src]" - . = " (REJT)" - . += " (IC)" - . += " (CLOSE)" - . += " (RSLVE)" + . = " (REJT)" + . += " (IC)" + . += " (CLOSE)" + . += " (RSLVE)" //private /datum/admin_help/proc/LinkedReplyName(ref_src) if(!ref_src) ref_src = "\ref[src]" - return "[initiator_key_name]" + return "[initiator_key_name]" //private /datum/admin_help/proc/TicketHref(msg, ref_src, action = "ticket") if(!ref_src) ref_src = "\ref[src]" - return "[msg]" + return "[msg]" //message from the initiator without a target, all admins will see this //won't bug irc @@ -675,7 +675,7 @@ GLOBAL_DATUM_INIT(ahelp_tickets, /datum/admin_help_tickets, new) if(found.mind && found.mind.special_role) is_antag = 1 founds += "Name: [found.name]([found.real_name]) Ckey: [found.ckey] [is_antag ? "(Antag)" : null] " - msg += "[original_word](?|F) " + msg += "[original_word](?|F) " continue msg += "[original_word] " if(irc) diff --git a/code/modules/admin/verbs/adminsay.dm b/code/modules/admin/verbs/adminsay.dm index 707a76854f..8e543c8a73 100644 --- a/code/modules/admin/verbs/adminsay.dm +++ b/code/modules/admin/verbs/adminsay.dm @@ -12,7 +12,7 @@ log_talk(mob,"[key_name(src)] : [msg]",LOGASAY) msg = keywords_lookup(msg) if(check_rights(R_ADMIN,0)) - msg = "ADMIN: [key_name(usr, 1)] (FLW): [msg]" + msg = "ADMIN: [key_name(usr, 1)] [ADMIN_FLW(mob)]: [msg]" to_chat(GLOB.admins, msg) else msg = "ADMIN: [key_name(usr, 1)]: [msg]" diff --git a/code/modules/admin/verbs/individual_logging.dm b/code/modules/admin/verbs/individual_logging.dm index ca84d5d759..cd3feed5d0 100644 --- a/code/modules/admin/verbs/individual_logging.dm +++ b/code/modules/admin/verbs/individual_logging.dm @@ -1,12 +1,12 @@ /proc/show_individual_logging_panel(mob/M, type = INDIVIDUAL_ATTACK_LOG) if(!M || !ismob(M)) return - var/dat = "
    Attack log | " - dat += "Say log | " - dat += "Emote log | " - dat += "OOC log | " - dat += "Show all | " - dat += "Refresh
    " + var/dat = "
    Attack log | " + dat += "Say log | " + dat += "Emote log | " + dat += "OOC log | " + dat += "Show all | " + dat += "Refresh
    " dat += "
    " diff --git a/code/modules/admin/verbs/one_click_antag.dm b/code/modules/admin/verbs/one_click_antag.dm index c8df7f56f1..398965e74d 100644 --- a/code/modules/admin/verbs/one_click_antag.dm +++ b/code/modules/admin/verbs/one_click_antag.dm @@ -11,6 +11,7 @@ /datum/admins/proc/one_click_antag() var/dat = {" +<<<<<<< HEAD Make Traitors
    Make Changelings
    Make Revs
    @@ -23,6 +24,19 @@ Make CentCom Response Team (Requires Ghosts)
    Make Abductor Team (Requires Ghosts)
    Make Revenant (Requires Ghost)
    +======= + Make Traitors
    + Make Changelings
    + Make Revs
    + Make Cult
    + Make Clockwork Cult
    + Make Blob
    + Make Wizard (Requires Ghosts)
    + Make Nuke Team (Requires Ghosts)
    + Make CentCom Response Team (Requires Ghosts)
    + Make Abductor Team (Requires Ghosts)
    + Make Revenant (Requires Ghost)
    +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839) "} var/datum/browser/popup = new(usr, "oneclickantag", "Quick-Create Antagonist", 400, 400) diff --git a/code/modules/admin/verbs/randomverbs.dm b/code/modules/admin/verbs/randomverbs.dm index 62f3cab1d1..cb27d019ce 100644 --- a/code/modules/admin/verbs/randomverbs.dm +++ b/code/modules/admin/verbs/randomverbs.dm @@ -1147,8 +1147,8 @@ GLOBAL_LIST_EMPTY(custom_outfits) //Admin created outfits /datum/admins/proc/modify_goals() var/dat = "" for(var/datum/station_goal/S in SSticker.mode.station_goals) - dat += "[S.name] - Announce | Remove
    " - dat += "
    Add New Goal" + dat += "[S.name] - Announce | Remove
    " + dat += "
    Add New Goal" usr << browse(dat, "window=goals;size=400x400") @@ -1219,7 +1219,7 @@ GLOBAL_LIST_EMPTY(custom_outfits) //Admin created outfits var/list/msg = list() msg += "Playtime ReportPlaytime:
    " src << browse(msg.Join(), "window=Player_playtime_check") @@ -1233,7 +1233,7 @@ GLOBAL_LIST_EMPTY(custom_outfits) //Admin created outfits var/list/body = list() body += "Playtime for [C.key]
    Playtime:" body += C.get_exp_report() - body += "Toggle Exempt status" + body += "Toggle Exempt status" body += "" usr << browse(body.Join(), "window=playerplaytime[C.ckey];size=550x615") diff --git a/code/modules/error_handler/error_viewer.dm b/code/modules/error_handler/error_viewer.dm index eee95fe0af..dddff75bb2 100644 --- a/code/modules/error_handler/error_viewer.dm +++ b/code/modules/error_handler/error_viewer.dm @@ -71,7 +71,7 @@ GLOBAL_DATUM(error_cache, /datum/error_viewer/error_cache) if (linear) back_to_param += ";viewruntime_linear=1" - return "[linktext]" + return "[linktext]" /datum/error_viewer/error_cache var/list/errors = list() @@ -181,12 +181,12 @@ GLOBAL_DATUM(error_cache, /datum/error_viewer/error_cache) var/html = build_header(back_to, linear) html += "[name]
    [desc]
    " if (usr_ref) - html += "
    usr: VV" - html += " PP" - html += " Follow" + html += "
    usr: VV" + html += " PP" + html += " Follow" if (istype(usr_loc)) - html += "
    usr.loc: VV" - html += " JMP" + html += "
    usr.loc: VV" + html += " JMP" browse_to(user, html) diff --git a/code/modules/events/spacevine.dm b/code/modules/events/spacevine.dm index 1feb7aa116..5ea8c20e32 100644 --- a/code/modules/events/spacevine.dm +++ b/code/modules/events/spacevine.dm @@ -390,10 +390,10 @@ /datum/spacevine_controller/vv_get_dropdown() . = ..() . += "---" - .["Delete Vines"] = "?_src_=\ref[src];purge_vines=1" + .["Delete Vines"] = "?_src_=\ref[src];[HrefToken()];purge_vines=1" /datum/spacevine_controller/Topic(href, href_list) - if(..() || !check_rights(R_ADMIN, FALSE)) + if(..() || !check_rights(R_ADMIN, FALSE) || !usr.client.holder.CheckAdminHref(href, href_list)) return if(href_list["purge_vines"]) diff --git a/code/modules/mob/living/carbon/carbon.dm b/code/modules/mob/living/carbon/carbon.dm index 84ff0c2ef2..717c5478a5 100644 --- a/code/modules/mob/living/carbon/carbon.dm +++ b/code/modules/mob/living/carbon/carbon.dm @@ -860,7 +860,7 @@ /mob/living/carbon/vv_get_dropdown() . = ..() . += "---" - .["Make AI"] = "?_src_=vars;makeai=\ref[src]" - .["Modify bodypart"] = "?_src_=vars;editbodypart=\ref[src]" - .["Modify organs"] = "?_src_=vars;editorgans=\ref[src]" - .["Hallucinate"] = "?_src_=vars;hallucinate=\ref[src]" + .["Make AI"] = "?_src_=vars;[HrefToken()];makeai=\ref[src]" + .["Modify bodypart"] = "?_src_=vars;[HrefToken()];editbodypart=\ref[src]" + .["Modify organs"] = "?_src_=vars;[HrefToken()];editorgans=\ref[src]" + .["Hallucinate"] = "?_src_=vars;[HrefToken()];hallucinate=\ref[src]" diff --git a/code/modules/mob/living/carbon/human/human.dm b/code/modules/mob/living/carbon/human/human.dm index 304a745220..069dcb8ab5 100644 --- a/code/modules/mob/living/carbon/human/human.dm +++ b/code/modules/mob/living/carbon/human/human.dm @@ -906,12 +906,12 @@ INITIALIZE_IMMEDIATE(/mob/living/carbon/human/dummy) /mob/living/carbon/human/vv_get_dropdown() . = ..() . += "---" - .["Make monkey"] = "?_src_=vars;makemonkey=\ref[src]" - .["Set Species"] = "?_src_=vars;setspecies=\ref[src]" - .["Make cyborg"] = "?_src_=vars;makerobot=\ref[src]" - .["Make alien"] = "?_src_=vars;makealien=\ref[src]" - .["Make slime"] = "?_src_=vars;makeslime=\ref[src]" - .["Toggle Purrbation"] = "?_src_=vars;purrbation=\ref[src]" + .["Make monkey"] = "?_src_=vars;[HrefToken()];makemonkey=\ref[src]" + .["Set Species"] = "?_src_=vars;[HrefToken()];setspecies=\ref[src]" + .["Make cyborg"] = "?_src_=vars;[HrefToken()];makerobot=\ref[src]" + .["Make alien"] = "?_src_=vars;[HrefToken()];makealien=\ref[src]" + .["Make slime"] = "?_src_=vars;[HrefToken()];makeslime=\ref[src]" + .["Toggle Purrbation"] = "?_src_=vars;[HrefToken()];purrbation=\ref[src]" /mob/living/carbon/human/MouseDrop_T(mob/living/target, mob/living/user) if((target != pulling) || (grab_state < GRAB_AGGRESSIVE) || (user != target) || !isliving(user) || stat || user.stat)//Get consent first :^) diff --git a/code/modules/mob/mob.dm b/code/modules/mob/mob.dm index 76553d17fd..1ef1d9df25 100644 --- a/code/modules/mob/mob.dm +++ b/code/modules/mob/mob.dm @@ -950,18 +950,18 @@ /mob/vv_get_dropdown() . = ..() . += "---" - .["Gib"] = "?_src_=vars;gib=\ref[src]" - .["Give Spell"] = "?_src_=vars;give_spell=\ref[src]" - .["Remove Spell"] = "?_src_=vars;remove_spell=\ref[src]" - .["Give Disease"] = "?_src_=vars;give_disease=\ref[src]" - .["Toggle Godmode"] = "?_src_=vars;godmode=\ref[src]" - .["Drop Everything"] = "?_src_=vars;drop_everything=\ref[src]" - .["Regenerate Icons"] = "?_src_=vars;regenerateicons=\ref[src]" - .["Make Space Ninja"] = "?_src_=vars;ninja=\ref[src]" - .["Show player panel"] = "?_src_=vars;mob_player_panel=\ref[src]" - .["Toggle Build Mode"] = "?_src_=vars;build_mode=\ref[src]" - .["Assume Direct Control"] = "?_src_=vars;direct_control=\ref[src]" - .["Offer Control to Ghosts"] = "?_src_=vars;offer_control=\ref[src]" + .["Gib"] = "?_src_=vars;[HrefToken()];gib=\ref[src]" + .["Give Spell"] = "?_src_=vars;[HrefToken()];give_spell=\ref[src]" + .["Remove Spell"] = "?_src_=vars;[HrefToken()];remove_spell=\ref[src]" + .["Give Disease"] = "?_src_=vars;[HrefToken()];give_disease=\ref[src]" + .["Toggle Godmode"] = "?_src_=vars;[HrefToken()];godmode=\ref[src]" + .["Drop Everything"] = "?_src_=vars;[HrefToken()];drop_everything=\ref[src]" + .["Regenerate Icons"] = "?_src_=vars;[HrefToken()];regenerateicons=\ref[src]" + .["Make Space Ninja"] = "?_src_=vars;[HrefToken()];ninja=\ref[src]" + .["Show player panel"] = "?_src_=vars;[HrefToken()];mob_player_panel=\ref[src]" + .["Toggle Build Mode"] = "?_src_=vars;[HrefToken()];build_mode=\ref[src]" + .["Assume Direct Control"] = "?_src_=vars;[HrefToken()];direct_control=\ref[src]" + .["Offer Control to Ghosts"] = "?_src_=vars;[HrefToken()];offer_control=\ref[src]" /mob/vv_get_var(var_name) switch(var_name) diff --git a/code/modules/station_goals/station_goal.dm b/code/modules/station_goals/station_goal.dm index 4a9bc42438..98ec01f641 100644 --- a/code/modules/station_goals/station_goal.dm +++ b/code/modules/station_goals/station_goal.dm @@ -39,7 +39,7 @@ /datum/station_goal/Topic(href, href_list) ..() - if(!check_rights(R_ADMIN)) + if(!check_rights(R_ADMIN) || !usr.client.holder.CheckAdminHref(href, href_list)) return if(href_list["announce"]) diff --git a/config/config.txt b/config/config.txt index ae2cc1e43a..7073d7e33c 100644 --- a/config/config.txt +++ b/config/config.txt @@ -329,3 +329,9 @@ MINUTE_TOPIC_LIMIT 100 ## Send a message to IRC when starting a new game #IRC_ANNOUNCE_NEW_GAME +<<<<<<< HEAD +======= + +## Allow admin hrefs that don't use the new token system, will eventually be removed +DEBUG_ADMIN_HREFS +>>>>>>> 84b1e3d... [s] Adds a security token to all admin hrefs (#29839)