From ec2ed1cfbbaa71be0b05ebd4d8b0205f6e08f496 Mon Sep 17 00:00:00 2001
From: NovaBot <154629622+NovaBot13@users.noreply.github.com>
Date: Wed, 17 Apr 2024 22:42:02 -0400
Subject: [PATCH] [MIRROR] Fixes netpod href exploit (#2045)

* Fixes netpod href exploit (#82698)

## About The Pull Request
Can't have fits in detroit
## Why It's Good For The Game
Fixes #81616
## Changelog
:cl:
fix: Netpods have had their security against exploits increased.
/:cl:

---------

Co-authored-by: Kapu1178 <75460809+Kapu1178@users.noreply.github.com>

* Fixes netpod href exploit

---------

Co-authored-by: Jeremiah <42397676+jlsnow301@users.noreply.github.com>
Co-authored-by: Kapu1178 <75460809+Kapu1178@users.noreply.github.com>
---
 code/modules/bitrunning/objects/netpod.dm | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/code/modules/bitrunning/objects/netpod.dm b/code/modules/bitrunning/objects/netpod.dm
index 07b5506bb0e..a1a681cab05 100644
--- a/code/modules/bitrunning/objects/netpod.dm
+++ b/code/modules/bitrunning/objects/netpod.dm
@@ -438,8 +438,16 @@
 /// Resolves a path to an outfit.
 /obj/machinery/netpod/proc/resolve_outfit(text)
 	var/path = text2path(text)
-	if(ispath(path, /datum/outfit))
-		return path
+	if(!ispath(path, /datum/outfit))
+		return
+
+	for(var/wardrobe in cached_outfits)
+		for(var/outfit in wardrobe["outfits"])
+			if(path == outfit["path"])
+				return path
+
+	message_admins("[usr]:[usr.ckey] attempted to select an unavailable outfit from a netpod")
+	return
 
 /// Severs the connection with the current avatar
 /obj/machinery/netpod/proc/sever_connection()