Leahnaya/pokemon-showdown-client
1
0
Fork 0
mirror of https://github.com/smogon/pokemon-showdown-client.git synced 2026-09-30 23:01:05 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add some missing sanitisation

Browse Source
This commit is contained in:
Cathy J. Fitzpatrick
2013-04-05 18:50:39 -06:00
parent 67fb5d52dd
commit 2e445b6e12
2 changed files with 4 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
js/battle.js
View File

@@ -4466,21 +4466,13 @@ function Battle(frame, logFrame, noPreload) {
case 'raw':
args.shift();
list = args.join('|');
var m = /<div style="background-color:#6688AA;color:white;padding:2px 4px"><b>Register an account to protect your ladder rating!<\/b><br \/><button onclick="overlay\('register',{ifuserid:'[a-z0-9]*'}\);return false"><b>Register<\/b><\/button><\/div>/.exec(list);
if (m) {
// This is a temporary hack so that this keeps working for old servers.
// This check can be removed later.
self.log('<div class="chat">' + m[0] + '</div>');
} else {
// TODO: Sanitise for safe URIs only, after we bring in the safe URI list.
self.log('<div class="chat">' + Tools.htmlSanitize(list) + '</div>', preempt);
}
self.log('<div class="chat">' + Tools.htmlSanitize(list) + '</div>', preempt);
break;
case 'pm':
self.log('<div class="chat"><strong>' + sanitize(args[1]) + ':</strong> <span class="message-pm"><i style="cursor:pointer" onclick="selectTab(\'lobby\');rooms.lobby.popupOpen(\'' + args[2] + '\')">(Private to ' + sanitize(args[3]) + ')</i> ' + messageSanitize(args[4]) + '</span>');
self.log('<div class="chat"><strong>' + self.sanitize(args[1]) + ':</strong> <span class="message-pm"><i style="cursor:pointer" onclick="selectTab(\'lobby\');rooms.lobby.popupOpen(\'' + sanitize(args[2], true) + '\')">(Private to ' + sanitize(args[3]) + ')</i> ' + messageSanitize(args[4]) + '</span>');
break;
case 'askreg':
self.log('<div class="message-register-account"><b>Register an account to protect your ladder rating!</b><br /><button onclick="overlay(\'register\',{ifuserid:\''+args[1]+'\'});return false"><b>Register</b></button></div>');
self.log('<div class="message-register-account"><b>Register an account to protect your ladder rating!</b><br /><button onclick="overlay(\'register\',{ifuserid:\''+sanitize(args[1], true)+'\'});return false"><b>Register</b></button></div>');
break;
case 'inactive':
self.kickingInactive = true;

8
js/sim.js
View File

@@ -1618,13 +1618,7 @@ function Lobby(id, elem) {
} else if (log[i].message) {
selfR.chatElem.append('<div class="message">' + sanitize(log[i].message) + '</div>');
} else if (log[i].rawMessage) {
// This is so that the register link continues to work on old servers.
// It can be removed later.
if (log[i].rawMessage === '<div style="background-color:#6688AA;color:white;padding:2px 4px"><b>Register an account to protect your ladder rating!</b><br /><button onclick="overlay(\'register\',{ifuserid:\''+me.userid+'\'});return false"><b>Register</b></button></div>') {
selfR.chatElem.append('<div class="message">' + log[i].rawMessage + '</div>');
} else {
selfR.chatElem.append('<div class="message">' + Tools.htmlSanitize(log[i].rawMessage) + '</div>');
}
selfR.chatElem.append('<div class="message">' + Tools.htmlSanitize(log[i].rawMessage) + '</div>');
} else if (log[i].evalRulesRedirect || log[i].evalRawMessage) {
// TODO: This will be removed in due course.
window.location.href = 'http://pokemonshowdown.com/rules';