From 2e445b6e1211ca1c198dc453eee2a55b6be415f5 Mon Sep 17 00:00:00 2001
From: "Cathy J. Fitzpatrick" <cathy@cathyjf.com>
Date: Fri, 5 Apr 2013 18:50:39 -0600
Subject: [PATCH] Add some missing sanitisation

---
 js/battle.js | 14 +++-----------
 js/sim.js    |  8 +-------
 2 files changed, 4 insertions(+), 18 deletions(-)

diff --git a/js/battle.js b/js/battle.js
index baabd4623..34fcf7b74 100644
--- a/js/battle.js
+++ b/js/battle.js
@@ -4466,21 +4466,13 @@ function Battle(frame, logFrame, noPreload) {
 		case 'raw':
 			args.shift();
 			list = args.join('|');
-			var m = /<div style="background-color:#6688AA;color:white;padding:2px 4px"><b>Register an account to protect your ladder rating!<\/b><br \/><button onclick="overlay\('register',{ifuserid:'[a-z0-9]*'}\);return false"><b>Register<\/b><\/button><\/div>/.exec(list);
-			if (m) {
-				// This is a temporary hack so that this keeps working for old servers.
-				// This check can be removed later.
-				self.log('<div class="chat">' + m[0] + '</div>');
-			} else {
-				// TODO: Sanitise for safe URIs only, after we bring in the safe URI list.
-				self.log('<div class="chat">' + Tools.htmlSanitize(list) + '</div>', preempt);
-			}
+			self.log('<div class="chat">' + Tools.htmlSanitize(list) + '</div>', preempt);
 			break;
 		case 'pm':
-			self.log('<div class="chat"><strong>' + sanitize(args[1]) + ':</strong> <span class="message-pm"><i style="cursor:pointer" onclick="selectTab(\'lobby\');rooms.lobby.popupOpen(\'' + args[2] + '\')">(Private to ' + sanitize(args[3]) + ')</i> ' + messageSanitize(args[4]) + '</span>');
+			self.log('<div class="chat"><strong>' + self.sanitize(args[1]) + ':</strong> <span class="message-pm"><i style="cursor:pointer" onclick="selectTab(\'lobby\');rooms.lobby.popupOpen(\'' + sanitize(args[2], true) + '\')">(Private to ' + sanitize(args[3]) + ')</i> ' + messageSanitize(args[4]) + '</span>');
 			break;
 		case 'askreg':
-			self.log('<div class="message-register-account"><b>Register an account to protect your ladder rating!</b><br /><button onclick="overlay(\'register\',{ifuserid:\''+args[1]+'\'});return false"><b>Register</b></button></div>');
+			self.log('<div class="message-register-account"><b>Register an account to protect your ladder rating!</b><br /><button onclick="overlay(\'register\',{ifuserid:\''+sanitize(args[1], true)+'\'});return false"><b>Register</b></button></div>');
 			break;
 		case 'inactive':
 			self.kickingInactive = true;
diff --git a/js/sim.js b/js/sim.js
index af21fe8ee..ab9723ca4 100644
--- a/js/sim.js
+++ b/js/sim.js
@@ -1618,13 +1618,7 @@ function Lobby(id, elem) {
 			} else if (log[i].message) {
 				selfR.chatElem.append('<div class="message">' + sanitize(log[i].message) + '</div>');
 			} else if (log[i].rawMessage) {
-				// This is so that the register link continues to work on old servers.
-				// It can be removed later.
-				if (log[i].rawMessage === '<div style="background-color:#6688AA;color:white;padding:2px 4px"><b>Register an account to protect your ladder rating!</b><br /><button onclick="overlay(\'register\',{ifuserid:\''+me.userid+'\'});return false"><b>Register</b></button></div>') {
-					selfR.chatElem.append('<div class="message">' + log[i].rawMessage + '</div>');
-				} else {
-					selfR.chatElem.append('<div class="message">' + Tools.htmlSanitize(log[i].rawMessage) + '</div>');
-				}
+				selfR.chatElem.append('<div class="message">' + Tools.htmlSanitize(log[i].rawMessage) + '</div>');
 			} else if (log[i].evalRulesRedirect || log[i].evalRawMessage) {
 				// TODO: This will be removed in due course.
 				window.location.href = 'http://pokemonshowdown.com/rules';