From ba2ecbc808a0e8b67d6865adf375485db4d69b6b Mon Sep 17 00:00:00 2001
From: Fantastic-Fanta <mobulamantyke@gmail.com>
Date: Thu, 7 May 2026 22:51:12 +0800
Subject: [PATCH] Remove frame-bust, inject testclient flag for iframe
 embedding

---
 play.pokemonshowdown.com/index.template.html | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/play.pokemonshowdown.com/index.template.html b/play.pokemonshowdown.com/index.template.html
index b830c2a6e..e4d8a8bf6 100644
--- a/play.pokemonshowdown.com/index.template.html
+++ b/play.pokemonshowdown.com/index.template.html
@@ -38,6 +38,7 @@ https://psim.us/dev
 <!--[if lte IE 8]><script>document.location.replace('http://pokemonshowdown.com/autodownload/win');</script><![endif]-->
 
 <!-- head custom -->
+<script>var Config = {testclient: true};</script>
 
 <div id="header" class="header">
 	<img class="logo" src="//play.pokemonshowdown.com/pokemonshowdownbeta.png" srcset="//play.pokemonshowdown.com/pokemonshowdownbeta@2x.png 2x" alt="Pok&eacute;mon Showdown! (beta)" width="146" height="44" /><div class="maintabbarbottom"></div>
@@ -110,15 +111,7 @@ https://psim.us/dev
 <script src="//play.pokemonshowdown.com/data/graphics.js?"></script>
 
 <script>
-	// framebust - see https://owasp.org/www-pdf-archive/OWASP_AppSec_Research_2010_Busting_Frame_Busting_by_Rydstedt.pdf
-	// should be robust against reflective XSS filters and navigation interception
-	var app;
-	if (self === top) {
-		app = new App();
-	} else {
-		LM.innerHTML += ' IN FRAME<br />Please visit Showdown directly.';
-		top.location = self.location;
-	}
+	var app = new App();
 </script>
 
 <script src="//play.pokemonshowdown.com/data/pokedex.js?"></script>