Callback security and usr (#33599)

* Gonna regret writing this one day

* tmp -> temp

* Make PushUsr() a /world proc

* Callbacks now preserve usr

* Fixes PushUsr return value

* Fixes PushUsr invocations

* Update modifyvariables.dm

* Use weakrefs in callback user

* Further fixes

* Whoopsie

code/__HELPERS/unsorted.dm

@@ -1508,6 +1508,14 @@ GLOBAL_DATUM_INIT(dview_mob, /mob/dview, new)
 				return "\[[url_encode(thing.tag)]\]"
 	return "\ref[input]"
 
+// Makes a call in the context of a different usr
+// Use sparingly
+/world/proc/PushUsr(mob/M, datum/callback/CB)
+	var/temp = usr
+	usr = M
+	. = CB.Invoke()
+	usr = temp
+  
 //Returns a list of all servants of Ratvar and observers.
 /proc/servants_and_ghosts()
 	. = list()

code/datums/callback.dm

@@ -48,6 +48,7 @@
 	var/datum/object = GLOBAL_PROC
 	var/delegate
 	var/list/arguments
+	var/datum/weakref/user
 
 /datum/callback/New(thingtocall, proctocall, ...)
 	if (thingtocall)
@@ -55,6 +56,8 @@
 	delegate = proctocall
 	if (length(args) > 2)
 		arguments = args.Copy(3)
+	if(usr)
+		user = WEAKREF(usr)
 
 /world/proc/ImmediateInvokeAsync(thingtocall, proctocall, ...)
 	set waitfor = FALSE
@@ -70,8 +73,16 @@
 		call(thingtocall, proctocall)(arglist(calling_arguments))
 
 /datum/callback/proc/Invoke(...)
+	if(!usr)
+		var/datum/weakref/W = user
+		if(W)
+			var/mob/M = W.resolve()
+			if(M)
+				return world.PushUsr(M, src)
+		
 	if (!object)
 		return
+		
 	var/list/calling_arguments = arguments
 	if (length(args))
 		if (length(arguments))
@@ -87,8 +98,17 @@
 //copy and pasted because fuck proc overhead
 /datum/callback/proc/InvokeAsync(...)
 	set waitfor = FALSE
+
+	if(!usr)
+		var/datum/weakref/W = user
+		if(W)
+			var/mob/M = W.resolve()
+			if(M)
+				return world.PushUsr(M, src)
+	
 	if (!object)
 		return
+		
 	var/list/calling_arguments = arguments
 	if (length(args))
 		if (length(arguments))

code/modules/admin/verbs/modifyvariables.dm

@@ -213,7 +213,9 @@ GLOBAL_PROTECT(VVpixelmovement)
 				.["class"] = null
 				return
 			.["type"] = type
-			.["value"] = new type()
+			var/atom/newguy = new type()
+			newguy.var_edited = TRUE
+			.["value"] = newguy
 
 		if (VV_NEW_DATUM)
 			var/type = pick_closest_path(FALSE, get_fancy_list_of_datum_types())
@@ -221,7 +223,9 @@ GLOBAL_PROTECT(VVpixelmovement)
 				.["class"] = null
 				return
 			.["type"] = type
-			.["value"] = new type()
+			var/datum/newguy = new type()
+			newguy.var_edited = TRUE
+			.["value"] = newguy
 
 		if (VV_NEW_TYPE)
 			var/type = current_value
@@ -237,7 +241,10 @@ GLOBAL_PROTECT(VVpixelmovement)
 				.["class"] = null
 				return
 			.["type"] = type
-			.["value"] = new type()
+			var/datum/newguy = new type()
+			if(istype(newguy))
+				newguy.var_edited = TRUE
+			.["value"] = newguy
 
 
 		if (VV_NEW_LIST)