Leahnaya/pokemon-showdown-client
1
0
Fork 0
mirror of https://github.com/smogon/pokemon-showdown-client.git synced 2026-10-01 07:10:46 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Rename sanitisation and escaping functions

Browse Source 
- `window.sanitize` is now `Tools.escapeHTML`
- `window.unsanitize` is now `Tools.unescapeHTML`
- `window.jsEscape` is now `Tools.escapeQuotes`
- `window.htmlSanitize' is now `Tools.sanitizeHTML`
- `battle.escape` has been eliminated and replaced by calls
   to `Tools.escapeHTML`
This commit is contained in:
Cathy J. Fitzpatrick
2013-04-14 21:49:51 -06:00
parent 56345b89a2
commit d82b5e6b7b
5 changed files with 183 additions and 185 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
js/battle.js
View File

@@ -392,16 +392,16 @@ function Pokemon(species) {
};
this.getName = function () {
if (selfP.side.n === 0) {
return sanitize(selfP.name);
return Tools.escapeHTML(selfP.name);
} else {
return "The foe's " + sanitize(selfP.name);
return "The foe's " + Tools.escapeHTML(selfP.name);
}
};
this.getLowerName = function () {
if (selfP.side.n === 0) {
return sanitize(selfP.name);
return Tools.escapeHTML(selfP.name);
} else {
return "the foe's " + sanitize(selfP.name);
return "the foe's " + Tools.escapeHTML(selfP.name);
}
};
this.getTitle = function () {
@@ -414,7 +414,7 @@ function Pokemon(species) {
return titlestring;
};
this.getFullName = function (plaintext) {
var name = sanitize(selfP.name);
var name = Tools.escapeHTML(selfP.name);
if (selfP.name !== selfP.species) {
if (plaintext) {
name += ' (' + selfP.species + ')';
@@ -1466,10 +1466,10 @@ function Battle(frame, logFrame, noPreload) {
}
pokemonhtml = '<div class="teamicons">' + pokemonhtml + '</div>';
if (selfS.n === 1) {
if (selfS.initialized) self.rightbarElem.html('<div class="trainer"><strong>' + sanitize(selfS.name) + '</strong><div class="trainersprite" style="background-image:url(' + Tools.resourcePrefix + 'sprites/trainers/' + selfS.spriteid + '.png)"></div>' + pokemonhtml + '</div>').find('.trainer').css('opacity',1);
if (selfS.initialized) self.rightbarElem.html('<div class="trainer"><strong>' + Tools.escapeHTML(selfS.name) + '</strong><div class="trainersprite" style="background-image:url(' + Tools.resourcePrefix + 'sprites/trainers/' + selfS.spriteid + '.png)"></div>' + pokemonhtml + '</div>').find('.trainer').css('opacity',1);
else self.rightbarElem.find('.trainer').css('opacity',0.4);
} else {
if (selfS.initialized) self.leftbarElem.html('<div class="trainer"><strong>' + sanitize(selfS.name) + '</strong><div class="trainersprite" style="background-image:url(' + Tools.resourcePrefix + 'sprites/trainers/' + selfS.spriteid + '.png)"></div>' + pokemonhtml + '</div>').find('.trainer').css('opacity',1);
if (selfS.initialized) self.leftbarElem.html('<div class="trainer"><strong>' + Tools.escapeHTML(selfS.name) + '</strong><div class="trainersprite" style="background-image:url(' + Tools.resourcePrefix + 'sprites/trainers/' + selfS.spriteid + '.png)"></div>' + pokemonhtml + '</div>').find('.trainer').css('opacity',1);
else self.leftbarElem.find('.trainer').css('opacity',0.4);
}
};
@@ -1727,7 +1727,7 @@ function Battle(frame, logFrame, noPreload) {
var gender = '';
if (pokemon.gender === 'F') gender = ' <small style="color:#C57575">&#9792;</small>';
if (pokemon.gender === 'M') gender = ' <small style="color:#7575C0">&#9794;</small>';
return '<div class="statbar' + (selfS.n ? ' lstatbar' : ' rstatbar') + '"><strong>' + sanitize(pokemon.name) + gender + (pokemon.level === 100 ? '' : ' <small>L' + pokemon.level + '</small>') + '</strong><div class="hpbar"><div class="hptext"></div><div class="hptextborder"></div><div class="prevhp"><div class="hp"></div></div><div class="status"></div></div>';
return '<div class="statbar' + (selfS.n ? ' lstatbar' : ' rstatbar') + '"><strong>' + Tools.escapeHTML(pokemon.name) + gender + (pokemon.level === 100 ? '' : ' <small>L' + pokemon.level + '</small>') + '</strong><div class="hpbar"><div class="hptext"></div><div class="hptextborder"></div><div class="prevhp"><div class="hp"></div></div><div class="status"></div></div>';
};
this.switchIn = function (pokemon, slot) {
if (slot === undefined) slot = pokemon.slot;
@@ -1743,7 +1743,7 @@ function Battle(frame, logFrame, noPreload) {
if (pokemon.side.n === 0) {
self.message('Go! ' + pokemon.getFullName() + '!');
} else {
self.message('' + sanitize(pokemon.side.name) + ' sent out ' + pokemon.getFullName() + '!');
self.message('' + Tools.escapeHTML(pokemon.side.name) + ' sent out ' + pokemon.getFullName() + '!');
}
pokemon.sprite.animSummon(slot);
@@ -1907,12 +1907,12 @@ function Battle(frame, logFrame, noPreload) {
pokemon.removeVolatile('formechange');
}
if (pokemon.lastmove === 'uturn' || pokemon.lastmove === 'voltswitch') {
self.message('' + pokemon.getName() + ' went back to ' + sanitize(pokemon.side.name) + '!');
self.message('' + pokemon.getName() + ' went back to ' + Tools.escapeHTML(pokemon.side.name) + '!');
} else if (pokemon.lastmove !== 'batonpass') {
if (pokemon.side.n === 0) {
self.message('' + pokemon.getName() + ', come back!');
} else {
self.message('' + sanitize(pokemon.side.name) + ' withdrew ' + pokemon.getFullName() + '!');
self.message('' + Tools.escapeHTML(pokemon.side.name) + ' withdrew ' + pokemon.getFullName() + '!');
}
}
selfS.lastPokemon = pokemon;
@@ -2170,13 +2170,13 @@ function Battle(frame, logFrame, noPreload) {
// activities
//
this.start = function () {
self.log('<div>Battle between ' + sanitize(self.p1.name) + ' and ' + sanitize(self.p2.name) + ' started!</div>');
self.log('<div>Battle between ' + Tools.escapeHTML(self.p1.name) + ' and ' + Tools.escapeHTML(self.p2.name) + ' started!</div>');
if (self.startCallback) self.startCallback(self);
}
this.winner = function (winner) {
if (self.fastForward !== -2) self.fastForwardOff();
if (winner) self.message('' + winner + ' won the battle!');
else self.message('Tie between ' + sanitize(self.p1.name) + ' and ' + sanitize(self.p2.name) + '!');
else self.message('Tie between ' + Tools.escapeHTML(self.p1.name) + ' and ' + Tools.escapeHTML(self.p2.name) + '!');
self.done = 1;
}
this.prematureEnd = function () {
@@ -4164,7 +4164,7 @@ function Battle(frame, logFrame, noPreload) {
break;
case '-message':
actions += self.sanitize(args[1]);
actions += Tools.escapeHTML(args[1]);
break;
case '-anim':
@@ -4448,9 +4448,6 @@ function Battle(frame, logFrame, noPreload) {
self.preemptActivityQueue.push(command);
self.add(command);
}
this.sanitize = function (str) {
return str.replace(/</g, '&lt;').replace(/>/g, '&gt;');
}
this.teamPreview = function (start) {
for (var k = 0; k < 2; k++) {
var teamText = '';
@@ -4480,7 +4477,7 @@ function Battle(frame, logFrame, noPreload) {
self.sides[k].totalPokemon = i;
self.sides[k].updateSidebar();
if (teamText) {
self.log('<div class="chat"><strong>' + self.sanitize(self.sides[k].name) + '\'s team:</strong> <em style="color:#445566;display:block;">' + self.sanitize(teamText) + '</em></div>');
self.log('<div class="chat"><strong>' + Tools.escapeHTML(self.sides[k].name) + '\'s team:</strong> <em style="color:#445566;display:block;">' + Tools.escapeHTML(teamText) + '</em></div>');
}
self.spriteElems[k].html(text);
}
@@ -4501,7 +4498,7 @@ function Battle(frame, logFrame, noPreload) {
case 'tier':
if (!args[1]) args[1] = '';
for (var i in kwargs) args[1] += '['+i+'] '+kwargs[i];
self.log('<div style="padding:5px 0"><small>Format:</small> <br /><strong>' + self.sanitize(args[1]) + '</strong></div>');
self.log('<div style="padding:5px 0"><small>Format:</small> <br /><strong>' + Tools.escapeHTML(args[1]) + '</strong></div>');
self.tier = args[1];
break;
case 'gametype':
@@ -4512,11 +4509,11 @@ function Battle(frame, logFrame, noPreload) {
}
break;
case 'variation':
self.log('<div><small>Variation: <em>' + self.sanitize(args[1]) + '</em></small></div>');
self.log('<div><small>Variation: <em>' + Tools.escapeHTML(args[1]) + '</em></small></div>');
break;
case 'rule':
var ruleArgs = args[1].split(': ');
self.log('<div><small><em>' + self.sanitize(ruleArgs[0]) + (ruleArgs[1]?':':'') + '</em> ' + self.sanitize(ruleArgs[1]||'') + '</div>');
self.log('<div><small><em>' + Tools.escapeHTML(ruleArgs[0]) + (ruleArgs[1]?':':'') + '</em> ' + Tools.escapeHTML(ruleArgs[1]||'') + '</div>');
break;
case 'rated':
self.rated = true;
@@ -4530,9 +4527,9 @@ function Battle(frame, logFrame, noPreload) {
args.shift();
var message = args.join('|');
if (message.substr(0,2) === '//') {
self.log('<div class="chat"><strong style="' + hashColor(toUserid(name)) + '">' + self.sanitize(name) + ':</strong> <em>' + messageSanitize(message.substr(1)) + '</em></div>', preempt);
self.log('<div class="chat"><strong style="' + hashColor(toUserid(name)) + '">' + Tools.escapeHTML(name) + ':</strong> <em>' + messageSanitize(message.substr(1)) + '</em></div>', preempt);
} else if (message.substr(0,4).toLowerCase() === '/me ') {
self.log('<div class="chat"><strong style="' + hashColor(toUserid(name)) + '">&bull;</strong> <em>' + self.sanitize(name) + ' <i>' + messageSanitize(message.substr(4)) + '</i></em></div>', preempt);
self.log('<div class="chat"><strong style="' + hashColor(toUserid(name)) + '">&bull;</strong> <em>' + Tools.escapeHTML(name) + ' <i>' + messageSanitize(message.substr(4)) + '</i></em></div>', preempt);
} else if (message.substr(0,14).toLowerCase() === '/data-pokemon ') {
self.log('<div class="chat"><ul class=\"utilichart\">'+Chart.pokemonRow(Tools.getTemplate(message.substr(14)),'',{})+'<li style=\"clear:both\"></li></ul></div>', preempt);
} else if (message.substr(0,11).toLowerCase() === '/data-item ') {
@@ -4542,47 +4539,47 @@ function Battle(frame, logFrame, noPreload) {
} else if (message.substr(0,11).toLowerCase() === '/data-move ') {
self.log('<div class="chat"><ul class=\"utilichart\">'+Chart.moveRow(Tools.getMove(message.substr(11)),'',{})+'<li style=\"clear:both\"></li></ul></div>', preempt);
} else {
self.log('<div class="chat"><strong style="' + hashColor(toUserid(name)) + '">' + self.sanitize(name) + ':</strong> <em>' + messageSanitize(message) + '</em></div>', preempt);
self.log('<div class="chat"><strong style="' + hashColor(toUserid(name)) + '">' + Tools.escapeHTML(name) + ':</strong> <em>' + messageSanitize(message) + '</em></div>', preempt);
}
break;
case 'chatmsg':
args.shift();
list = args.join('|');
self.log('<div class="chat">' + self.sanitize(list) + '</div>', preempt);
self.log('<div class="chat">' + Tools.escapeHTML(list) + '</div>', preempt);
break;
case 'chatmsg-raw':
case 'raw':
args.shift();
list = args.join('|');
self.log('<div class="chat">' + Tools.htmlSanitize(list) + '</div>', preempt);
self.log('<div class="chat">' + Tools.sanitizeHTML(list) + '</div>', preempt);
break;
case 'pm':
self.log('<div class="chat"><strong>' + self.sanitize(args[1]) + ':</strong> <span class="message-pm"><i style="cursor:pointer" onclick="selectTab(\'lobby\');rooms.lobby.popupOpen(\'' + sanitize(args[2], true) + '\')">(Private to ' + sanitize(args[3]) + ')</i> ' + messageSanitize(args[4]) + '</span>');
self.log('<div class="chat"><strong>' + Tools.escapeHTML(args[1]) + ':</strong> <span class="message-pm"><i style="cursor:pointer" onclick="selectTab(\'lobby\');rooms.lobby.popupOpen(\'' + Tools.escapeHTML(args[2], true) + '\')">(Private to ' + Tools.escapeHTML(args[3]) + ')</i> ' + messageSanitize(args[4]) + '</span>');
break;
case 'askreg':
self.log('<div class="message-register-account"><b>Register an account to protect your ladder rating!</b><br /><button onclick="overlay(\'register\',{ifuserid:\''+sanitize(args[1], true)+'\'});return false"><b>Register</b></button></div>');
self.log('<div class="message-register-account"><b>Register an account to protect your ladder rating!</b><br /><button onclick="overlay(\'register\',{ifuserid:\''+Tools.escapeHTML(args[1], true)+'\'});return false"><b>Register</b></button></div>');
break;
case 'inactive':
self.kickingInactive = true;
args.shift();
list = args.join('|');
self.log('<div class="chat" style="color:#992222">' + self.sanitize(list) + '</div>', preempt);
self.log('<div class="chat" style="color:#992222">' + Tools.escapeHTML(list) + '</div>', preempt);
break;
case 'inactiveoff':
self.kickingInactive = false;
args.shift();
list = args.join('|');
self.log('<div class="chat" style="color:#992222">' + self.sanitize(list) + '</div>', preempt);
self.log('<div class="chat" style="color:#992222">' + Tools.escapeHTML(list) + '</div>', preempt);
break;
case 'join':
case 'j':
case 'J':
self.log('<div class="chat"><small>' + self.sanitize(args[1]) + ' joined.</small></div>', preempt);
self.log('<div class="chat"><small>' + Tools.escapeHTML(args[1]) + ' joined.</small></div>', preempt);
break;
case 'leave':
case 'l':
case 'L':
self.log('<div class="chat"><small>' + self.sanitize(args[1]) + ' left.</small></div>', preempt);
self.log('<div class="chat"><small>' + Tools.escapeHTML(args[1]) + ' left.</small></div>', preempt);
break;
case 'spectator':
case 'spectatorleave':
@@ -4661,7 +4658,7 @@ function Battle(frame, logFrame, noPreload) {
self.cantUseMove(poke, effect, move, kwargs);
break;
case 'message':
self.message(self.sanitize(args[1]));
self.message(Tools.escapeHTML(args[1]));
break;
case 'done':
case '':
@@ -4669,12 +4666,12 @@ function Battle(frame, logFrame, noPreload) {
break;
case 'error':
args.shift();
self.message('<strong>Error:</strong> ' + self.sanitize(args.join('|')));
self.message('<strong>Error:</strong> ' + Tools.escapeHTML(args.join('|')));
self.message('Bug? Report it to <a href="http://www.smogon.com/forums/showthread.php?t=3453192">the replay viewer\'s Smogon thread</a>');
break;
case 'warning':
args.shift();
self.message('<strong>Warning:</strong> ' + self.sanitize(args.join('|')));
self.message('<strong>Warning:</strong> ' + Tools.escapeHTML(args.join('|')));
self.message('Bug? Report it to <a href="http://www.smogon.com/forums/showthread.php?t=3453192">the replay viewer\'s Smogon thread</a>');
self.activityWait(1000);
break;
@@ -4688,11 +4685,11 @@ function Battle(frame, logFrame, noPreload) {
case 'debug':
args.shift();
name = args.join(' ');
self.log('<div class="chat"><small style="color:#999">[DEBUG] ' + self.sanitize(name) + '.</small></div>', preempt);
self.log('<div class="chat"><small style="color:#999">[DEBUG] ' + Tools.escapeHTML(name) + '.</small></div>', preempt);
break;
default:
self.logConsole('unknown command: ' + args[0]);
self.log('<div>Unknown command: ' + self.sanitize(args[0]) + '</div>');
self.log('<div>Unknown command: ' + Tools.escapeHTML(args[0]) + '</div>');
break;
}
};
@@ -4746,17 +4743,17 @@ function Battle(frame, logFrame, noPreload) {
self.runMajor(args, kwargs, preempt);
}
} catch (e) {
self.log('<div class="chat">Error parsing: ' + self.sanitize(str) + '</div>', preempt);
self.log('<div class="chat">Error parsing: ' + Tools.escapeHTML(str) + '</div>', preempt);
if (e.stack) {
var stack = ''+e.stack;
stack = stack.split("\n").slice(0,2).join("\n");
self.log('<div class="chat" style="white-space:pre-wrap">' + self.sanitize(stack) + '</div>', preempt);
self.log('<div class="chat" style="white-space:pre-wrap">' + Tools.escapeHTML(stack) + '</div>', preempt);
} else {
self.log('<div class="chat">Error: ' + self.sanitize(''+e) + '</div>', preempt);
self.log('<div class="chat">Error: ' + Tools.escapeHTML(''+e) + '</div>', preempt);
}
}
} else {
self.log('<div class="chat">' + self.sanitize(str) + '</div>', preempt);
self.log('<div class="chat">' + Tools.escapeHTML(str) + '</div>', preempt);
}
}
this.endPrevAction = function () {

113
js/battledata.js
View File

@@ -125,26 +125,8 @@ function hashColor(name) {
return colorCache[name];
}
// a few library functions
function sanitize(str, jsEscapeToo) {
str = (str?''+str:'');
str = str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
if (jsEscapeToo) str = str.replace(/'/g, '\\\'');
return str;
}
function unsanitize(str) {
str = (str?''+str:'');
return str.replace(/&quot;/g, '"').replace(/&gt;/g, '>').
replace(/&lt;/g, '<').replace(/&amp;/g, '&');
}
function jsEscape(str) {
str = (str?''+str:'');
str = str.replace(/'/g, '\\\'');
return str;
}
function messageSanitize(str) {
str = sanitize(str);
str = Tools.escapeHTML(str);
// Don't format console commands (>>).
if (str.substr(0, 8) === '&gt;&gt;') return str;
// Don't format console results (<<).
@@ -163,18 +145,18 @@ function messageSanitize(str) {
event = 'External link';
} else {
event = 'Interstice link';
fulluri = sanitize(Tools.interstice.getURI(unsanitize(fulluri)));
fulluri = Tools.escapeHTML(Tools.interstice.getURI(Tools.unescapeHTML(fulluri)));
}
return '<a href="' + fulluri +
'" target="_blank" onclick="_gaq.push([\'_trackEvent\', \'' +
event +
'\', \'' + jsEscape(fulluri) + '\']);">' + uri + '</a>';
'\', \'' + Tools.escapeQuotes(fulluri) + '\']);">' + uri + '</a>';
}).
// google [blah]
// google[blah]
// Google search for 'blah'
replace(/(\bgoogle ?\[([^\]<]+)\])/ig, function(p0, p1, p2) {
p2 = sanitize(encodeURIComponent(unsanitize(p2)));
p2 = Tools.escapeHTML(encodeURIComponent(Tools.unescapeHTML(p2)));
return '<a href="http://www.google.com/search?ie=UTF-8&q=' + p2 +
'" target="_blank">' + p1 + '</a>';
}).
@@ -182,21 +164,21 @@ function messageSanitize(str) {
// gl[blah
// Google search for 'blah' and visit the first result ("I'm feeling lucky")
replace(/(\bgl ?\[([^\]<]+)\])/ig, function(p0, p1, p2) {
p2 = sanitize(encodeURIComponent(unsanitize(p2)));
p2 = Tools.escapeHTML(encodeURIComponent(Tools.unescapeHTML(p2)));
return '<a href="http://www.google.com/search?ie=UTF-8&btnI&q=' + p2 +
'" target="_blank">' + p1 + '</a>';
}).
// wiki [blah]
// Search Wikipedia for 'blah' (and visit the article for 'blah' if it exists)
replace(/(\bwiki ?\[([^\]<]+)\])/ig, function(p0, p1, p2) {
p2 = sanitize(encodeURIComponent(unsanitize(p2)));
p2 = Tools.escapeHTML(encodeURIComponent(Tools.unescapeHTML(p2)));
return '<a href="http://en.wikipedia.org/w/index.php?title=Special:Search&search=' +
p2 + '" target="_blank">' + p1 + '</a>';
}).
// [[blah]]
// Short form of gl[[blah]]
replace(/\[\[([^< ]([^<`]*?[^< ])?)\]\]/ig, function(p0, p1) {
var q = sanitize(encodeURIComponent(unsanitize(p1)));
var q = Tools.escapeHTML(encodeURIComponent(Tools.unescapeHTML(p1)));
return '<a href="http://www.google.com/search?ie=UTF-8&btnI&q=' + q +
'" target="_blank">' + p1 +'</a>';
}).
@@ -378,32 +360,26 @@ var Tools = {
return prefix + '//play.pokemonshowdown.com/';
})(),
interstice: (function() {
var patterns = (function(whitelist) {
var patterns = [];
for (var i = 0; i < whitelist.length; ++i) {
patterns.push(new RegExp('https?://([A-Za-z0-9-]*\\.)?' +
whitelist[i] +
'(/.*)?', 'i'));
}
return patterns;
})((Config && Config.whitelist) ? Config.whitelist : []);
return {
isWhitelisted: function(uri) {
for (var i = 0; i < patterns.length; ++i) {
if (patterns[i].test(uri)) {
return true;
}
}
return false;
},
getURI: function(uri) {
return 'http://www.pokemonshowdown.com/interstice?uri=' + encodeURIComponent(uri);
}
};
})(),
escapeHTML: function(str, jsEscapeToo) {
str = (str?''+str:'');
str = str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
if (jsEscapeToo) str = str.replace(/'/g, '\\\'');
return str;
},
htmlSanitize: (function() {
unescapeHTML: function(str) {
str = (str?''+str:'');
return str.replace(/&quot;/g, '"').replace(/&gt;/g, '>').
replace(/&lt;/g, '<').replace(/&amp;/g, '&');
},
escapeQuotes: function(str) {
str = (str?''+str:'');
str = str.replace(/'/g, '\\\'');
return str;
},
sanitizeHTML: (function() {
var uriRewriter = function(uri) {
return uri;
};
@@ -457,7 +433,32 @@ var Tools = {
};
})(),
safeJson: function(f) {
interstice: (function() {
var patterns = (function(whitelist) {
var patterns = [];
for (var i = 0; i < whitelist.length; ++i) {
patterns.push(new RegExp('https?://([A-Za-z0-9-]*\\.)?' +
whitelist[i] +
'(/.*)?', 'i'));
}
return patterns;
})((Config && Config.whitelist) ? Config.whitelist : []);
return {
isWhitelisted: function(uri) {
for (var i = 0; i < patterns.length; ++i) {
if (patterns[i].test(uri)) {
return true;
}
}
return false;
},
getURI: function(uri) {
return 'http://www.pokemonshowdown.com/interstice?uri=' + encodeURIComponent(uri);
}
};
})(),
safeJSON: function(f) {
return function(data) {
if (data.length < 1) return;
if (data[0] == ']') data = data.substr(1);
@@ -525,7 +526,7 @@ var Tools = {
effect.exists = true;
}
if (!effect.id) effect.id = id;
if (!effect.name) effect.name = sanitize(name);
if (!effect.name) effect.name = Tools.escapeHTML(name);
if (!effect.category) effect.category = 'Effect';
if (!effect.effectType) effect.effectType = 'Effect';
}
@@ -546,7 +547,7 @@ var Tools = {
}
if (!move.id) move.id = id;
if (!move.name) move.name = sanitize(name);
if (!move.name) move.name = Tools.escapeHTML(name);
if (!move.critRatio) move.critRatio = 1;
if (!move.baseType) move.baseType = move.type;
@@ -566,7 +567,7 @@ var Tools = {
item = (window.BattleItems && window.BattleItems[id]) || {};
if (item.name) item.exists = true;
if (!item.id) item.id = id;
if (!item.name) item.name = sanitize(name);
if (!item.name) item.name = Tools.escapeHTML(name);
if (!item.category) item.category = 'Effect';
if (!item.effectType) item.effectType = 'Item';
}
@@ -580,7 +581,7 @@ var Tools = {
ability = (window.BattleAbilities && window.BattleAbilities[id]) || {};
if (ability.name) ability.exists = true;
if (!ability.id) ability.id = id;
if (!ability.name) ability.name = sanitize(name);
if (!ability.name) ability.name = Tools.escapeHTML(name);
if (!ability.category) ability.category = 'Effect';
if (!ability.effectType) ability.effectType = 'Ability';
}
@@ -616,7 +617,7 @@ var Tools = {
template.learnset = window.BattleLearnsets[id].learnset;
}
if (!template.id) template.id = id;
if (!template.name) template.name = name = sanitize(name);
if (!template.name) template.name = name = Tools.escapeHTML(name);
if (!template.speciesid) template.speciesid = id;
if (!template.species) template.species = name;
if (!template.baseSpecies) template.baseSpecies = name;

124
js/sim.js
View File

@@ -71,7 +71,7 @@ var me = (function() {
var query = actionphp + '?act=upkeep' +
'&challengekeyid=' + encodeURIComponent(this.challengekeyid) +
'&challenge=' + encodeURIComponent(this.challenge);
$.get(query, Tools.safeJson(function(data) {
$.get(query, Tools.safeJSON(function(data) {
if (!data.username) return;
if (data.loggedin) {
this.registered = {
@@ -520,7 +520,7 @@ function BattleRoom(id, elem) {
this.updateMe = function () {
if (selfR.meIdent.name !== me.name || selfR.meIdent.named !== me.named) {
if (me.named) {
selfR.chatAddElem.html('<form onsubmit="return false" class="chatbox"><label style="' + hashColor(me.userid) + '">' + sanitize(me.name) + ':</label> <textarea class="textbox" type="text" size="70" autocomplete="off" onkeypress="return rooms[\'' + selfR.id + '\'].formKeyPress(event)"></textarea></form>');
selfR.chatAddElem.html('<form onsubmit="return false" class="chatbox"><label style="' + hashColor(me.userid) + '">' + Tools.escapeHTML(me.name) + ':</label> <textarea class="textbox" type="text" size="70" autocomplete="off" onkeypress="return rooms[\'' + selfR.id + '\'].formKeyPress(event)"></textarea></form>');
selfR.chatboxElem = selfR.chatAddElem.find('textarea');
// The keypress event does not capture tab, so use keydown.
selfR.chatboxElem.keydown(rooms['lobby'].formKeyDown);
@@ -667,9 +667,9 @@ function BattleRoom(id, elem) {
if (!pokemon) {
controls += '<button disabled="disabled"></button> ';
} else if (disabled || pokemon.zerohp) {
controls += '<button disabled="disabled"' + tooltipAttrs(pokemon.getIdent(), 'pokemon', true, 'foe') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + sanitize(pokemon.name) + (!pokemon.zerohp?'<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':''):'') +'</button> ';
controls += '<button disabled="disabled"' + tooltipAttrs(pokemon.getIdent(), 'pokemon', true, 'foe') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + Tools.escapeHTML(pokemon.name) + (!pokemon.zerohp?'<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':''):'') +'</button> ';
} else {
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formSelectTarget(' + i + ', false)"' + tooltipAttrs(pokemon.getIdent(), 'pokemon', true, 'foe') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + sanitize(pokemon.name) + '<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':'')+'</button> ';
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formSelectTarget(' + i + ', false)"' + tooltipAttrs(pokemon.getIdent(), 'pokemon', true, 'foe') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + Tools.escapeHTML(pokemon.name) + '<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':'')+'</button> ';
}
}
controls += '<div style="clear:both"></div> </div><div class="switchmenu" style="display:block">';
@@ -687,9 +687,9 @@ function BattleRoom(id, elem) {
if (!pokemon) {
controls += '<button disabled="disabled"></button> ';
} else if (disabled || pokemon.zerohp) {
controls += '<button disabled="disabled"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + sanitize(pokemon.name) + (!pokemon.zerohp?'<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':''):'') +'</button> ';
controls += '<button disabled="disabled"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + Tools.escapeHTML(pokemon.name) + (!pokemon.zerohp?'<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':''):'') +'</button> ';
} else {
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formSelectTarget(' + i + ', true)"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + sanitize(pokemon.name) + '<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':'')+'</button> ';
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formSelectTarget(' + i + ', true)"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + Tools.escapeHTML(pokemon.name) + '<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':'')+'</button> ';
}
}
controls += '</div>';
@@ -700,7 +700,7 @@ function BattleRoom(id, elem) {
// Move chooser
controls += 'What will <strong>' + sanitize(switchables[pos].name) + '</strong> do? '+hpbar+'</div>';
controls += 'What will <strong>' + Tools.escapeHTML(switchables[pos].name) + '</strong> do? '+hpbar+'</div>';
var hasMoves = false;
var hasDisabled = false;
controls += '<div class="movecontrols"><div class="moveselect"><button onclick="rooms[\'' + selfR.id + '\'].formSelectMove()">Attack</button></div><div class="movemenu">';
@@ -751,9 +751,9 @@ function BattleRoom(id, elem) {
var pokemon = switchables[i];
pokemon.name = pokemon.ident.substr(4);
if (pokemon.zerohp || i < selfR.battle.mySide.active.length || selfR.choiceSwitchFlags[i]) {
controls += '<button disabled="disabled"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + sanitize(pokemon.name) + (!pokemon.zerohp?'<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':''):'') +'</button> ';
controls += '<button disabled="disabled"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + Tools.escapeHTML(pokemon.name) + (!pokemon.zerohp?'<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':''):'') +'</button> ';
} else {
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formSwitchTo(' + i + ')"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + sanitize(pokemon.name) + '<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':'')+'</button> ';
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formSwitchTo(' + i + ')"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + Tools.escapeHTML(pokemon.name) + '<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':'')+'</button> ';
}
}
if (selfR.battle.mySide.pokemon.length > 6) {
@@ -779,7 +779,7 @@ function BattleRoom(id, elem) {
if (type === 'switch2') {
controls += '<button onclick="rooms[\'' + selfR.id + '\'].callback(null,\'switch\')">Back</button> ';
}
controls += 'Switch <strong>'+sanitize(switchables[pos].name)+'</strong> to:</div>';
controls += 'Switch <strong>'+Tools.escapeHTML(switchables[pos].name)+'</strong> to:</div>';
controls += '<div class="switchcontrols"><div class="switchselect"><button onclick="rooms[\'' + selfR.id + '\'].formSelectSwitch()">Switch</button></div><div class="switchmenu">';
for (var i = 0; i < switchables.length; i++) {
var pokemon = switchables[i];
@@ -788,9 +788,9 @@ function BattleRoom(id, elem) {
break;
}
if (pokemon.zerohp || i < selfR.battle.mySide.active.length || selfR.choiceSwitchFlags[i]) {
controls += '<button disabled="disabled"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + sanitize(pokemon.name) + (!pokemon.zerohp?'<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':''):'') +'</button> ';
controls += '<button disabled="disabled"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + Tools.escapeHTML(pokemon.name) + (!pokemon.zerohp?'<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':''):'') +'</button> ';
} else {
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formSwitchTo(' + i + ')"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + sanitize(pokemon.name) + '<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':'')+'</button> ';
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formSwitchTo(' + i + ')"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + Tools.escapeHTML(pokemon.name) + '<span class="hpbar' + pokemon.getHPColorClass() + '"><span style="width:'+(Math.round(pokemon.hp*92/pokemon.maxhp)||1)+'px"></span></span>'+(pokemon.status?'<span class="status '+pokemon.status+'"></span>':'')+'</button> ';
}
}
controls += '</div></div></div>';
@@ -817,7 +817,7 @@ function BattleRoom(id, elem) {
if (toId(pokemon.baseAbility) === 'illusion') {
selfR.teamPreviewCount = 6;
}
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formTeamPreviewSelect(' + i + ')"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + sanitize(pokemon.name) + '</button> ';
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formTeamPreviewSelect(' + i + ')"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + Tools.escapeHTML(pokemon.name) + '</button> ';
}
if (selfR.battle.teamPreviewCount) selfR.teamPreviewCount = parseInt(selfR.battle.teamPreviewCount,10);
controls += '</div>';
@@ -830,9 +830,9 @@ function BattleRoom(id, elem) {
break;
}
if (i < selfR.teamPreviewDone) {
controls += '<button disabled="disabled"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + sanitize(pokemon.name) + '</button> ';
controls += '<button disabled="disabled"' + tooltipAttrs(i, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + Tools.escapeHTML(pokemon.name) + '</button> ';
} else {
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formTeamPreviewSelect(' + i + ')"' + tooltipAttrs(selfR.teamPreviewChoice[i]-1, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + sanitize(pokemon.name) + '</button> ';
controls += '<button onclick="rooms[\'' + selfR.id + '\'].formTeamPreviewSelect(' + i + ')"' + tooltipAttrs(selfR.teamPreviewChoice[i]-1, 'sidepokemon') + '><span class="pokemonicon" style="display:inline-block;vertical-align:middle;'+Tools.getIcon(pokemon)+'"></span>' + Tools.escapeHTML(pokemon.name) + '</button> ';
}
}
controls += '</div>';
@@ -1323,7 +1323,7 @@ function Lobby(id, elem) {
case 'ladder':
if (!target) target = me.userid;
var self = this;
$.get(actionphp + '?act=ladderget&user='+encodeURIComponent(target), Tools.safeJson(function(data) {
$.get(actionphp + '?act=ladderget&user='+encodeURIComponent(target), Tools.safeJSON(function(data) {
try {
var buffer = '<div class="ladder"><table>';
buffer += '<tr><td colspan="7">User: <strong>'+target+'</strong></td></tr>';
@@ -1412,7 +1412,7 @@ function Lobby(id, elem) {
var popupListCode = '';
var name;
for (var i = 0; i < me.popups.length - 1; i++) {
name = sanitize(me.users[me.popups[i]] || me.popups[i]);
name = Tools.escapeHTML(me.users[me.popups[i]] || me.popups[i]);
popupListCode += '<h3><button class="closebutton" onclick="rooms[\'' + selfR.id + '\'].popupClose(' + i + ');return false;"><i class="icon-remove-sign"></i></button><a onclick="rooms[\'' + selfR.id + '\'].popupFocus(' + i + ');return false;">' + name + '</a></h3>';
}
if (me.curPopup === me.popups[i]) {
@@ -1421,7 +1421,7 @@ function Lobby(id, elem) {
me.curPopup = me.popups[i];
code += popupListCode;
code += '</div>';
var clickableName = '<a onclick="return rooms.lobby.formChallenge(\'' + me.curPopup + '\');">' + sanitize(me.users[me.curPopup] || me.curPopup) + '</a>';
var clickableName = '<a onclick="return rooms.lobby.formChallenge(\'' + me.curPopup + '\');">' + Tools.escapeHTML(me.users[me.curPopup] || me.curPopup) + '</a>';
code += '<h3><button class="closebutton" onclick="rooms[\'' + selfR.id + '\'].popupClose(' + i + ');return false"><i class="icon-remove-sign"></i></button>' + clickableName + '</h3>';
code += '<div id="' + selfR.id + '-pmlog-frame" class="battle-log" onclick="rooms[\'' + selfR.id + '\'].popupChatboxElem.focus()"><div id="' + selfR.id + '-pmlog" class="inner">' + (me.pm[me.curPopup] || '') + '</div><div class="inner-after"></div></div>';
if (!selfR.popupElem.children('.battle-log-add').length) {
@@ -1616,7 +1616,7 @@ function Lobby(id, elem) {
'join': [],
'leave': []
};
var clickableName = '<span style="cursor:pointer" onclick="return rooms.lobby.formChallenge(\'' + userid + '\');">' + sanitize(log[i].name.substr(1)) + '</span>';
var clickableName = '<span style="cursor:pointer" onclick="return rooms.lobby.formChallenge(\'' + userid + '\');">' + Tools.escapeHTML(log[i].name.substr(1)) + '</span>';
var message = log[i].message;
var isHighlighted = selfR.getHighlight(message);
if (isHighlighted) {
@@ -1628,7 +1628,7 @@ function Lobby(id, elem) {
var highlight = isHighlighted ? ' style="background-color:#FDA;"' : '';
var chatDiv = '<div class="chat"' + highlight + '>';
var timestamp = selfR.getTimestamp(log[i].pm ? 'pms' : 'lobby');
if (log[i].name.substr(0, 1) !== ' ') clickableName = '<small>' + sanitize(log[i].name.substr(0, 1)) + '</small>'+clickableName;
if (log[i].name.substr(0, 1) !== ' ') clickableName = '<small>' + Tools.escapeHTML(log[i].name.substr(0, 1)) + '</small>'+clickableName;
if (log[i].pm) {
var pmuserid = (userid === me.userid ? toUserid(log[i].pm) : userid);
if (!me.pm[pmuserid]) me.pm[pmuserid] = '';
@@ -1650,7 +1650,7 @@ function Lobby(id, elem) {
} else {
selfR.updatePopup();
}
selfR.chatElem.append('<div class="chat">' + timestamp + '<strong style="' + color + '">' + clickableName + ':</strong> <span class="message-pm"><i style="cursor:pointer" onclick="selectTab(\'lobby\');rooms.lobby.popupOpen(\'' + pmuserid + '\')">(Private to ' + sanitize(log[i].pm) + ')</i> ' + messageSanitize(message) + '</span></div>');
selfR.chatElem.append('<div class="chat">' + timestamp + '<strong style="' + color + '">' + clickableName + ':</strong> <span class="message-pm"><i style="cursor:pointer" onclick="selectTab(\'lobby\');rooms.lobby.popupOpen(\'' + pmuserid + '\')">(Private to ' + Tools.escapeHTML(log[i].pm) + ')</i> ' + messageSanitize(message) + '</span></div>');
//} else if (log[i].act) {
// selfR.chatElem.append('<div class="chat"><strong style="' + color + '">&bull;</strong> <em' + (log[i].name.substr(1) === me.name ? ' class="mine"' : '') + '>' + clickableName + ' <i>' + message + '</i></em></div>');
} else if (message.substr(0,2) === '//') {
@@ -1700,11 +1700,11 @@ function Lobby(id, elem) {
battletype = log[i].format + ' battle';
if (log[i].format === 'Random Battle') battletype = 'Random Battle';
}
selfR.chatElem.append('<div class="message"><a href="' + locPrefix+id + '" onclick="selectTab(\'' + id + '\'); return false" class="battle-start">' + battletype + ' started between <strong style="' + hashColor(toUserid(log[i].name)) + '">' + sanitize(log[i].name) + '</strong> and <strong style="' + hashColor(toUserid(log[i].name2)) + '">' + sanitize(log[i].name2) + '</strong>.</a></div>');
selfR.chatElem.append('<div class="message"><a href="' + locPrefix+id + '" onclick="selectTab(\'' + id + '\'); return false" class="battle-start">' + battletype + ' started between <strong style="' + hashColor(toUserid(log[i].name)) + '">' + Tools.escapeHTML(log[i].name) + '</strong> and <strong style="' + hashColor(toUserid(log[i].name2)) + '">' + Tools.escapeHTML(log[i].name2) + '</strong>.</a></div>');
} else if (log[i].message) {
selfR.chatElem.append('<div class="message">' + sanitize(log[i].message) + '</div>');
selfR.chatElem.append('<div class="message">' + Tools.escapeHTML(log[i].message) + '</div>');
} else if (log[i].rawMessage) {
selfR.chatElem.append('<div class="message">' + Tools.htmlSanitize(log[i].rawMessage) + '</div>');
selfR.chatElem.append('<div class="message">' + Tools.sanitizeHTML(log[i].rawMessage) + '</div>');
} else if (log[i].evalRulesRedirect || log[i].evalRawMessage) {
// TODO: This will be removed in due course.
window.location.href = 'http://pokemonshowdown.com/rules';
@@ -1759,7 +1759,7 @@ function Lobby(id, elem) {
message += ', ';
}
}
message += sanitize(list[j]);
message += Tools.escapeHTML(list[j]);
}
message += ' joined';
}
@@ -1788,7 +1788,7 @@ function Lobby(id, elem) {
message += ', ';
}
}
message += sanitize(list[j]);
message += Tools.escapeHTML(list[j]);
}
message += ' left<br />';
}
@@ -1888,12 +1888,12 @@ function Lobby(id, elem) {
var roomData = data.rooms[id];
var matches = selfR.parseBattleID(id);
var format = (matches ? '<small>[' + matches[1] + ']</small><br />' : '');
var roomDesc = format + '<em class="p1">' + sanitize(roomData.p1) + '</em> <small class="vs">vs.</small> <em class="p2">' + sanitize(roomData.p2) + '</em>';
var roomDesc = format + '<em class="p1">' + Tools.escapeHTML(roomData.p1) + '</em> <small class="vs">vs.</small> <em class="p2">' + Tools.escapeHTML(roomData.p2) + '</em>';
if (!roomData.p1) {
matches = id.match(/[^0-9]([0-9]*)$/); // TODO: Fix this
roomDesc = format + 'empty room ' + matches[1];
} else if (!roomData.p2) {
roomDesc = format + '<em class="p1">' + sanitize(roomData.p1) + '</em>';
roomDesc = format + '<em class="p1">' + Tools.escapeHTML(roomData.p1) + '</em>';
}
roomListCode += '<div><a href="' + locPrefix + '' + id + '" onclick="selectTab(\'' + id + '\');return false">' + roomDesc + '</a></div>';
}
@@ -1935,12 +1935,12 @@ function Lobby(id, elem) {
var roomData = data.rooms[id];
var matches = selfR.parseBattleID(id);
var format = (matches ? '<small>[' + matches[1] + ']</small><br />' : '');
var roomDesc = format + '<em class="p1">' + sanitize(roomData.p1) + '</em> <small class="vs">vs.</small> <em class="p2">' + sanitize(roomData.p2) + '</em>';
var roomDesc = format + '<em class="p1">' + Tools.escapeHTML(roomData.p1) + '</em> <small class="vs">vs.</small> <em class="p2">' + Tools.escapeHTML(roomData.p2) + '</em>';
if (!roomData.p1) {
matches = id.match(/[^0-9]([0-9]*)$/);
roomDesc = format + 'empty room ' + matches[1];
} else if (!roomData.p2) {
roomDesc = format + '<em class="p1">' + sanitize(roomData.p1) + '</em>';
roomDesc = format + '<em class="p1">' + Tools.escapeHTML(roomData.p1) + '</em>';
}
roomListCode += '<div><a href="' + locPrefix+id + '" onclick="selectTab(\'' + id + '\');return false">' + roomDesc + '</a></div>';
i++;
@@ -1996,10 +1996,10 @@ function Lobby(id, elem) {
me.lastChallengeNotification = challenge.from;
}
selfR.selectedFormat = toId(challenge.format);
text = '<div class="action-notify"><button class="closebutton" style="float:right;margin:-6px -10px 0 0" onclick="return rooms[\'' + selfR.id + '\'].formRejectChallenge(\'' + sanitize(challenge.from) + '\')"><i class="icon-remove-sign"></i></button>';
text += 'Challenge from: ' + (me.users[challenge.from] || challenge.from) + '<br /><label class="label">Format:</label> ' + sanitize(challenge.format) + '</br >';
text = '<div class="action-notify"><button class="closebutton" style="float:right;margin:-6px -10px 0 0" onclick="return rooms[\'' + selfR.id + '\'].formRejectChallenge(\'' + Tools.escapeHTML(challenge.from) + '\')"><i class="icon-remove-sign"></i></button>';
text += 'Challenge from: ' + (me.users[challenge.from] || challenge.from) + '<br /><label class="label">Format:</label> ' + Tools.escapeHTML(challenge.format) + '</br >';
text += '' + selfR.getTeamSelect(challenge.format) + '<br />';
text += '<button onclick="return rooms[\'' + selfR.id + '\'].formAcceptChallenge(\'' + sanitize(challenge.from) + '\')" id="' + selfR.id + '-gobutton"' + (selfR.goDisabled ? ' disabled="disabled"' : '') + '>Accept</button> <button onclick="return rooms[\'' + selfR.id + '\'].formRejectChallenge(\'' + sanitize(challenge.from) + '\')"><small>Reject</small></button></div>';
text += '<button onclick="return rooms[\'' + selfR.id + '\'].formAcceptChallenge(\'' + Tools.escapeHTML(challenge.from) + '\')" id="' + selfR.id + '-gobutton"' + (selfR.goDisabled ? ' disabled="disabled"' : '') + '>Accept</button> <button onclick="return rooms[\'' + selfR.id + '\'].formRejectChallenge(\'' + Tools.escapeHTML(challenge.from) + '\')"><small>Reject</small></button></div>';
} else if (me.userForm) {
var userid = toUserid(me.userForm);
var name = (me.users[userid] || me.userForm);
@@ -2021,7 +2021,7 @@ function Lobby(id, elem) {
selfR.send('/cmd roomlist');
} else {
text = '<div class="action-form"><button style="float:right;margin:-6px -10px 0 0" class="closebutton" onclick="return rooms[\'' + selfR.id + '\'].formCloseUserForm()"><i class="icon-remove-sign"></i></button>';
text += '<strong>' + sanitize(name) + '</strong><br />';
text += '<strong>' + Tools.escapeHTML(name) + '</strong><br />';
text += '<small>' + (group || '') + '</small><br />';
text += '<div id="' + selfR.id + '-userdetails-' + userid + '" style="height:85px"></div>';
if (userid === me.userid) {
@@ -2031,7 +2031,7 @@ function Lobby(id, elem) {
text += '</div><div class="action-form" style="display:none" id="' + selfR.id + '-challengeform">';
text += selfR.getFormatSelect('challenge') + '<br />';
text += '' + selfR.getTeamSelect(selfR.selectedFormat) + '<br />';
text += '<button onclick="return rooms[\'' + selfR.id + '\'].formMakeChallenge(\'' + sanitize(userid) + '\')" id="' + selfR.id + '-gobutton"' + (selfR.goDisabled ? ' disabled="disabled"' : '') + '><strong>Make challenge</strong></button> <button onclick="$(\'#' + selfR.id + '-challengeform\').hide();return false">Cancel</button></div>';
text += '<button onclick="return rooms[\'' + selfR.id + '\'].formMakeChallenge(\'' + Tools.escapeHTML(userid) + '\')" id="' + selfR.id + '-gobutton"' + (selfR.goDisabled ? ' disabled="disabled"' : '') + '><strong>Make challenge</strong></button> <button onclick="$(\'#' + selfR.id + '-challengeform\').hide();return false">Cancel</button></div>';
}
text += '<div id="' + selfR.id + '-userrooms-' + userid + '"></div>';
selfR.send('/cmd userdetails '+userid);
@@ -2042,7 +2042,7 @@ function Lobby(id, elem) {
var teamname = 'Random team';
if (selectedTeam >= 0) teamname = teams[selectedTeam].name;
text = '<div class="action-waiting">Challenging: ' + (me.users[me.challengeTo.to] || me.challengeTo.to) + '<br />Format: ' + me.challengeTo.format + '<br />Team: ' + teamname + '<br /><button onclick="return rooms[\'' + selfR.id + '\'].formCloseUserForm(\'' + sanitize(me.challengeTo.to) + '\')"><small>Cancel</small></button></div>';
text = '<div class="action-waiting">Challenging: ' + (me.users[me.challengeTo.to] || me.challengeTo.to) + '<br />Format: ' + me.challengeTo.format + '<br />Team: ' + teamname + '<br /><button onclick="return rooms[\'' + selfR.id + '\'].formCloseUserForm(\'' + Tools.escapeHTML(me.challengeTo.to) + '\')"><small>Cancel</small></button></div>';
} else if (selfR.me.searching) {
if (selfR.mainTopState === 'searching') return;
selfR.mainTopState = 'searching';
@@ -2053,7 +2053,7 @@ function Lobby(id, elem) {
for (var i=selfR.rooms.length-1; i>=0; i--) {
var roomData = selfR.rooms[i];
if (!roomListCode) roomListCode += '<h3>Watch battles</h3>';
var roomDesc = '<small>[' + Tools.getEffect(roomData.format).name + ']</small><br /><em class="p1">' + sanitize(roomData.p1) + '</em> <small class="vs">vs.</small> <em class="p2">' + sanitize(roomData.p2) + '</em>';
var roomDesc = '<small>[' + Tools.getEffect(roomData.format).name + ']</small><br /><em class="p1">' + Tools.escapeHTML(roomData.p1) + '</em> <small class="vs">vs.</small> <em class="p2">' + Tools.escapeHTML(roomData.p2) + '</em>';
roomListCode += '<div><a href="' + locPrefix + '' + roomData.id + '" onclick="selectTab(\'' + roomData.id + '\');return false">' + roomDesc + '</a></div>';
}
if (roomListCode) roomListCode += '<button onclick="rooms[\'' + selfR.id + '\'].formChallenge(\'#lobby-rooms\');return false">All battles &rarr;</button>';
@@ -2206,15 +2206,15 @@ function Lobby(id, elem) {
var text = '';
// Sanitising the `userid` here is probably unnecessary, because
// IDs can't contain anything dangerous.
text += '<li' + (me.userForm === userid ? ' class="cur"' : '') + ' id="userlist-user-' + sanitize(userid) + '">';
text += '<button class="userbutton" onclick="return rooms.lobby.userList.buttonOnClick(\'' + sanitize(userid) + '\')">';
text += '<em class="group' + (this.ranks[group]===2 ? ' staffgroup' : '') + '">' + sanitize(group) + '</em>';
text += '<li' + (me.userForm === userid ? ' class="cur"' : '') + ' id="userlist-user-' + Tools.escapeHTML(userid) + '">';
text += '<button class="userbutton" onclick="return rooms.lobby.userList.buttonOnClick(\'' + Tools.escapeHTML(userid) + '\')">';
text += '<em class="group' + (this.ranks[group]===2 ? ' staffgroup' : '') + '">' + Tools.escapeHTML(group) + '</em>';
if (group === '~' || group === '&') {
text += '<strong><em style="' + hashColor(userid) + '">' + sanitize(me.users[userid].substr(1)) + '</em></strong>';
text += '<strong><em style="' + hashColor(userid) + '">' + Tools.escapeHTML(me.users[userid].substr(1)) + '</em></strong>';
} else if (group === '%' || group === '@') {
text += '<strong style="' + hashColor(userid) + '">' + sanitize(me.users[userid].substr(1)) + '</strong>';
text += '<strong style="' + hashColor(userid) + '">' + Tools.escapeHTML(me.users[userid].substr(1)) + '</strong>';
} else {
text += '<span style="' + hashColor(userid) + '">' + sanitize(me.users[userid].substr(1)) + '</span>';
text += '<span style="' + hashColor(userid) + '">' + Tools.escapeHTML(me.users[userid].substr(1)) + '</span>';
}
text += '</button>';
text += '</li>';
@@ -2292,7 +2292,7 @@ function Lobby(id, elem) {
this.updateMe = function () {
if (selfR.meIdent.name !== me.name || selfR.meIdent.named !== me.named) {
if (me.named) {
selfR.chatAddElem.html('<form onsubmit="return false" class="chatbox"><label style="' + hashColor(me.userid) + '">' + sanitize(me.name) + ':</label> <textarea class="textbox" type="text" size="70" autocomplete="off" onkeypress="return rooms[\'' + selfR.id + '\'].formKeyPress(event)"></textarea></form>');
selfR.chatAddElem.html('<form onsubmit="return false" class="chatbox"><label style="' + hashColor(me.userid) + '">' + Tools.escapeHTML(me.name) + ':</label> <textarea class="textbox" type="text" size="70" autocomplete="off" onkeypress="return rooms[\'' + selfR.id + '\'].formKeyPress(event)"></textarea></form>');
selfR.chatboxElem = selfR.chatAddElem.find('textarea');
// The keypress event does not capture tab, so use keydown.
selfR.chatboxElem.keydown(this.formKeyDown);
@@ -2494,11 +2494,11 @@ function Lobby(id, elem) {
}
if (format.section && format.section !== curSection) {
if (curSection) text += '</optgroup>';
text += '<optgroup label="'+sanitize(format.section)+'">';
text += '<optgroup label="'+Tools.escapeHTML(format.section)+'">';
curSection = format.section;
}
if (!format.section && curSection) text += '</optgroup>';
text += '<option value="' + sanitize(i) + '"' + (selected ? ' selected="selected"' : '') + '>' + sanitize(format.name) + details + '</option>';
text += '<option value="' + Tools.escapeHTML(i) + '"' + (selected ? ' selected="selected"' : '') + '>' + Tools.escapeHTML(format.name) + details + '</option>';
}
if (curSection) text += '</optgroup>';
text += '</select>';
@@ -2528,13 +2528,13 @@ function Lobby(id, elem) {
for (var i = 0; i < teams.length; i++) {
var selected = (i === selfR.selectedTeam);
if ((!teams[i].format && !teamFormat) || teams[i].format === teamFormat) {
text += '<option value="' + i + '"' + (selected ? ' selected="selected"' : '') + '>' + sanitize(teams[i].name) + '</option>';
text += '<option value="' + i + '"' + (selected ? ' selected="selected"' : '') + '>' + Tools.escapeHTML(teams[i].name) + '</option>';
}
}
text += '<optgroup label="Other teams">';
for (var i = 0; i < teams.length; i++) {
if ((!teams[i].format && !teamFormat) || teams[i].format === teamFormat) continue;
text += '<option value="' + i + '">' + sanitize(teams[i].name) + '</option>';
text += '<option value="' + i + '">' + Tools.escapeHTML(teams[i].name) + '</option>';
}
text += '</optgroup>';
}
@@ -2604,10 +2604,10 @@ function updateMe() {
//var mutebutton = ' <button onclick="return formMute()" style="height:20px;vertical-align:middle;">' + (me.isMuted() ? '<img src="/fx/mute.png" width="18" height="18" alt="Unmute" />' : '<img src="/fx/sound.png" width="18" height="18" alt="Mute" />') + '</button>';
var buttons = ' <button onclick="overlay(\'options\');return false" style="width:30px;font-size:14px"><i class="icon-cog"></i></button> <button onclick="return formMute()" style="width:30px;font-size:14px">' + (me.isMuted() ? '<i class="icon-volume-off" title="Unmute"></i>' : '<i class="icon-volume-up" title="Mute"></i>') + '</button>';
if (me.named) {
$('#userbar').html(notifybutton + '<i class="icon-user" style="color:#779EC5"></i> ' + sanitize(me.name) + buttons + ' <button onclick="me.logout(); return false;" style="font-size:9pt">Log out</button>');
$('#userbar').html(notifybutton + '<i class="icon-user" style="color:#779EC5"></i> ' + Tools.escapeHTML(me.name) + buttons + ' <button onclick="me.logout(); return false;" style="font-size:9pt">Log out</button>');
me.setPersistentName();
} else {
$('#userbar').html(notifybutton + '<i class="icon-user" style="color:#999"></i> ' + sanitize(me.name) + buttons + ' <button onclick="return rooms[\'lobby\'].formRename()" style="font-size:9pt">Choose name</button>');
$('#userbar').html(notifybutton + '<i class="icon-user" style="color:#999"></i> ' + Tools.escapeHTML(me.name) + buttons + ' <button onclick="return rooms[\'lobby\'].formRename()" style="font-size:9pt">Choose name</button>');
}
$('#userbar').prepend('<small><a href="http://pokemonshowdown.com/" target="_blank">Website</a> &nbsp; <a href="http://pokemonshowdown.com/rules" target="_blank">Rules</a> &nbsp; </small> ');
if (rooms.lobby) {
@@ -2655,14 +2655,14 @@ function updateRoomList() {
if (rooms[id].battle.p1 && rooms[id].battle.p1.initialized) p1 = rooms[id].battle.p1.name;
if (rooms[id].battle.p2 && rooms[id].battle.p2.initialized) p2 = rooms[id].battle.p2.name;
if (p1 && p2) {
roomDesc = '<em class="p1">' + sanitize(p1) + '</em> <small class="vs">vs.</small> <em class="p2">' + sanitize(p2) + '</em>';
roomDesc = '<em class="p1">' + Tools.escapeHTML(p1) + '</em> <small class="vs">vs.</small> <em class="p2">' + Tools.escapeHTML(p2) + '</em>';
closesize = 'close3';
} else if (p1) {
roomDesc = '<em class="p1">' + sanitize(p1) + '</em> <small>(inactive)</small>';
roomDesc = '<em class="p1">' + Tools.escapeHTML(p1) + '</em> <small>(inactive)</small>';
rooms[id].notifying = false;
closesize = 'close0';
} else if (p2) {
roomDesc = '<em class="p1">' + sanitize(p2) + '</em> <small>(inactive)</small>';
roomDesc = '<em class="p1">' + Tools.escapeHTML(p2) + '</em> <small>(inactive)</small>';
rooms[id].notifying = false;
closesize = 'close0';
} else {
@@ -2718,7 +2718,7 @@ function updateResize() {
}
function tooltipAttrs(thing, type, ownHeight, isActive) {
return ' onmouseover="return showTooltip(\'' + sanitize(''+thing, true) + '\',\'' + type + '\', this, ' + (ownHeight ? 'true' : 'false') + ', ' + (isActive ? 'true' : 'false') + ')" onmouseout="return hideTooltip()" onmouseup="hideTooltip()"';
return ' onmouseover="return showTooltip(\'' + Tools.escapeHTML(''+thing, true) + '\',\'' + type + '\', this, ' + (ownHeight ? 'true' : 'false') + ', ' + (isActive ? 'true' : 'false') + ')" onmouseout="return hideTooltip()" onmouseup="hideTooltip()"';
}
function showTooltip(thing, type, elem, ownHeight, isActive) {
@@ -3153,11 +3153,11 @@ function overlay(overlayType, data) {
} else {
contents += '<p>Register an account:</p>';
}
contents += '<p><label class="label">Username:</label> ' + (data.name || me.name) + '<input type="hidden" id="overlay_username" value="' + sanitize(data.name || me.name) + '" /></p>';
contents += '<p><label class="label">Username:</label> ' + (data.name || me.name) + '<input type="hidden" id="overlay_username" value="' + Tools.escapeHTML(data.name || me.name) + '" /></p>';
contents += '<p><label class="label">Password:</label> <input class="textbox" type="password" id="overlay_password" /></p>';
contents += '<p><label class="label">Password (confirm):</label> <input class="textbox" type="password" id="overlay_cpassword" /></p>';
contents += '<p><img src="' + Tools.resourcePrefix + 'sprites/bwani/pikachu.gif" /></p>';
contents += '<p><label class="label">What is this pokemon?</label> <input class="textbox" type="text" id="overlay_captcha" value="' + sanitize(data.captcha) + '" /></p>';
contents += '<p><label class="label">What is this pokemon?</label> <input class="textbox" type="text" id="overlay_captcha" value="' + Tools.escapeHTML(data.captcha) + '" /></p>';
contents += '<p><button type="submit"><strong>Register</strong></button> <button onclick="overlayClose();return false">Cancel</button></p>';
selectElem = '#overlay_password';
break;
@@ -3170,7 +3170,7 @@ function overlay(overlayType, data) {
} else {
contents += '<p>The name you chose is registered.</p>';
}
contents += '<p><label class="label">Username:</label> ' + data.name + '<input type="hidden" id="overlay_username" value="' + sanitize(data.name) + '" /></p>';
contents += '<p><label class="label">Username:</label> ' + data.name + '<input type="hidden" id="overlay_username" value="' + Tools.escapeHTML(data.name) + '" /></p>';
contents += '<p><label class="label">Password: <input class="textbox" type="password" id="overlay_password" /></label></p>';
contents += '<p><button type="submit"><strong>Log in</strong></button> <button onclick="overlayClose();return false">Cancel</button></p>';
selectElem = '#overlay_password';
@@ -3180,7 +3180,7 @@ function overlay(overlayType, data) {
contents += '<p><label class="optlabel"><input type="checkbox" id="pref_noanim"'+(Tools.prefs('noanim')?' checked="checked"':'')+'> Disable animations</label></p>';
contents += '<!--p><label class="label">Ignore list: <input class="textbox" type="text" value="'+sanitize(Object.keys(me.ignore).join(', '))+'" /></label><br /><small>Separate names with commas</small></p-->';
contents += '<!--p><label class="label">Ignore list: <input class="textbox" type="text" value="'+Tools.escapeHTML(Object.keys(me.ignore).join(', '))+'" /></label><br /><small>Separate names with commas</small></p-->';
var timestamps = (Tools.prefs('timestamps') || {});
contents += '<p><label class="optlabel">Timestamps in lobby chat: <select id="pref_timestamps_lobby"><option value="off">Off</option><option value="minutes"'+(timestamps.lobby==='minutes'?' selected="selected"':'')+'>[HH:MM]</option><option value="seconds"'+(timestamps.lobby==='seconds'?' selected="selected"':'')+'>[HH:MM:SS]</option></select></label></p>';
@@ -3230,7 +3230,7 @@ function overlay(overlayType, data) {
} else if (data.reason) {
contents += '<p>' + data.reason + '</p>';
} else {}
contents += '<p><label class="label">Username:</label> <input class="textbox" type="text" id="overlay_username" value="' + sanitize(data.name || '') + '" /></p>';
contents += '<p><label class="label">Username:</label> <input class="textbox" type="text" id="overlay_username" value="' + Tools.escapeHTML(data.name || '') + '" /></p>';
contents += '<p><label class="label">Password:</label> <input class="textbox" type="password" id="overlay_password" /></p>';
contents += '<p><button type="submit"><strong>Log in</strong></button> <button onclick="overlayClose();return false">Cancel</button></p>';
selectElem = '#overlay_username';
@@ -3265,7 +3265,7 @@ function overlay(overlayType, data) {
contents += '</ol>';
}
}
contents += '<p><label class="label">Username:</label> <input class="textbox" type="text" id="overlay_name" value="' + (me.named ? sanitize(me.name) : '') + '" /></p>';
contents += '<p><label class="label">Username:</label> <input class="textbox" type="text" id="overlay_name" value="' + (me.named ? Tools.escapeHTML(me.name) : '') + '" /></p>';
contents += '<p><button type="submit"><strong>Choose name</strong></button> <button onclick="overlayClose();return false">Cancel</button></p>';
selectElem = '#overlay_name';
break;
@@ -3314,7 +3314,7 @@ function overlaySubmit(e, overlayType) {
pass: $('#overlay_password').val(),
challengekeyid: me.challengekeyid,
challenge: me.challenge
}, Tools.safeJson(function (data) {
}, Tools.safeJSON(function (data) {
if (!data) data = {};
var token = data.assertion;
if (data.curuser && data.curuser.loggedin) {
@@ -3378,7 +3378,7 @@ function overlaySubmit(e, overlayType) {
captcha: captcha,
challengekeyid: me.challengekeyid,
challenge: me.challenge
}, Tools.safeJson(function (data) {
}, Tools.safeJSON(function (data) {
if (!data) data = {};
var token = data.assertion;
if (data.curuser && data.curuser.loggedin) {

30
js/teambuilder.js
View File

@@ -80,11 +80,11 @@ function Teambuilder(id, elem)
}
else if (i == selfR.activePokemonIndex)
{
text += '<button disabled="disabled" class="pokemon">'+pokemonicon+sanitize(set.name || '<i class="icon-plus"></i>')+'</button> ';
text += '<button disabled="disabled" class="pokemon">'+pokemonicon+Tools.escapeHTML(set.name || '<i class="icon-plus"></i>')+'</button> ';
}
else
{
text += '<button onclick="rooms[\''+selfR.id+'\'].formSelectPokemon('+i+');return false" class="pokemon">'+pokemonicon+sanitize(set.name)+'</button> ';
text += '<button onclick="rooms[\''+selfR.id+'\'].formSelectPokemon('+i+');return false" class="pokemon">'+pokemonicon+Tools.escapeHTML(set.name)+'</button> ';
}
}
if (selfR.activeTeam.team.length < 6 && !isAdd)
@@ -95,12 +95,12 @@ function Teambuilder(id, elem)
}
else
{
text = '<button onclick="rooms[\''+selfR.id+'\'].formBack(event); return false"><i class="icon-chevron-left"></i> Team List</button> <input class="textbox teamnameedit" type="text" class="teamnameedit" size="30" value="'+sanitize(selfR.activeTeam.name)+'" /> <button onclick="rooms[\''+selfR.id+'\'].formSave(event); return false" class="savebutton"><i class="icon-save"></i> Save</button> <button onclick="rooms[\''+selfR.id+'\'].formToggleExport(event); return false"><i class="icon-upload-alt"></i> Import/Export</button>';
text = '<button onclick="rooms[\''+selfR.id+'\'].formBack(event); return false"><i class="icon-chevron-left"></i> Team List</button> <input class="textbox teamnameedit" type="text" class="teamnameedit" size="30" value="'+Tools.escapeHTML(selfR.activeTeam.name)+'" /> <button onclick="rooms[\''+selfR.id+'\'].formSave(event); return false" class="savebutton"><i class="icon-save"></i> Save</button> <button onclick="rooms[\''+selfR.id+'\'].formToggleExport(event); return false"><i class="icon-upload-alt"></i> Import/Export</button>';
}
if (selfR.exportMode)
{
text += '<textarea class="teamedit" onkeypress="return rooms[\''+selfR.id+'\'].formKeyPress(event)" rows="17">'+sanitize(selfR.toText(selfR.activeTeam.team))+'</textarea>';
text += '<textarea class="teamedit" onkeypress="return rooms[\''+selfR.id+'\'].formKeyPress(event)" rows="17">'+Tools.escapeHTML(selfR.toText(selfR.activeTeam.team))+'</textarea>';
}
else
{
@@ -148,7 +148,7 @@ function Teambuilder(id, elem)
continue;
}
text += '<div class="setchart-nickname">';
text += '<label>Nickname</label><input type="text" value="'+sanitize(set.name||set.species)+'" onchange="rooms[\''+selfR.id+'\'].activeTeam.team['+i+'].name = (this.value||rooms[\''+selfR.id+'\'].activeTeam.team['+i+'].species)" />';
text += '<label>Nickname</label><input type="text" value="'+Tools.escapeHTML(set.name||set.species)+'" onchange="rooms[\''+selfR.id+'\'].activeTeam.team['+i+'].name = (this.value||rooms[\''+selfR.id+'\'].activeTeam.team['+i+'].species)" />';
text += '</div>';
text += '<div class="setchart">';
@@ -159,7 +159,7 @@ function Teambuilder(id, elem)
var item = Tools.getItem(set.item);
itemicon = '<span class="itemicon"'+(selfR.activePokemon?' id="'+selfR.id+'-itemicon"':'')+' style="'+Tools.getItemIcon(item)+'"></span>';
}
text += '<div class="setcol setcol-icon"'+(selfR.activePokemon?' id="'+selfR.id+'-pokemonicon"':'')+' style='+Tools.getTeambuilderSprite(set)+';">'+itemicon+'<div class="setcell setcell-pokemon"><label>Pokemon</label><input type="text" name="pokemon" class="chartinput" value="'+sanitize(set.species)+'" /></div></div>';
text += '<div class="setcol setcol-icon"'+(selfR.activePokemon?' id="'+selfR.id+'-pokemonicon"':'')+' style='+Tools.getTeambuilderSprite(set)+';">'+itemicon+'<div class="setcell setcell-pokemon"><label>Pokemon</label><input type="text" name="pokemon" class="chartinput" value="'+Tools.escapeHTML(set.species)+'" /></div></div>';
// details
text += '<div class="setcol setcol-details"><div class="setrow">';
@@ -177,17 +177,17 @@ function Teambuilder(id, elem)
text += '</button></div>';
text += '</div><div class="setrow">';
text += '<div class="setcell setcell-item"><label>Item</label><input type="text" name="item" class="chartinput" value="'+sanitize(set.item)+'" /></div>';
text += '<div class="setcell setcell-ability"><label>Ability</label><input type="text" name="ability" class="chartinput" value="'+sanitize(set.ability)+'" /></div>';
text += '<div class="setcell setcell-item"><label>Item</label><input type="text" name="item" class="chartinput" value="'+Tools.escapeHTML(set.item)+'" /></div>';
text += '<div class="setcell setcell-ability"><label>Ability</label><input type="text" name="ability" class="chartinput" value="'+Tools.escapeHTML(set.ability)+'" /></div>';
text += '</div></div>';
// moves
if (!set.moves) set.moves = [];
text += '<div class="setcol setcol-moves"><div class="setcell"><label>Moves</label>';
text += '<input type="text" name="move1" class="chartinput" value="'+sanitize(set.moves[0])+'" /></div>';
text += '<div class="setcell"><input type="text" name="move2" class="chartinput" value="'+sanitize(set.moves[1])+'" /></div>';
text += '<div class="setcell"><input type="text" name="move3" class="chartinput" value="'+sanitize(set.moves[2])+'" /></div>';
text += '<div class="setcell"><input type="text" name="move4" class="chartinput" value="'+sanitize(set.moves[3])+'" /></div>';
text += '<input type="text" name="move1" class="chartinput" value="'+Tools.escapeHTML(set.moves[0])+'" /></div>';
text += '<div class="setcell"><input type="text" name="move2" class="chartinput" value="'+Tools.escapeHTML(set.moves[1])+'" /></div>';
text += '<div class="setcell"><input type="text" name="move3" class="chartinput" value="'+Tools.escapeHTML(set.moves[2])+'" /></div>';
text += '<div class="setcell"><input type="text" name="move4" class="chartinput" value="'+Tools.escapeHTML(set.moves[3])+'" /></div>';
text += '</div>';
// stats
@@ -253,7 +253,7 @@ function Teambuilder(id, elem)
else if (selfR.exportAllMode)
{
text = '<button onclick="rooms[\''+selfR.id+'\'].formBack(event); return false"><i class="icon-chevron-left"></i> Team List</button> <button onclick="rooms[\''+selfR.id+'\'].formSave(event); return false" class="savebutton"><i class="icon-save"></i> Save</button>';
text += '<textarea class="teamedit" onkeypress="return rooms[\''+selfR.id+'\'].formKeyPress(event)" rows="17">'+sanitize(selfR.teamsToText())+'</textarea>';
text += '<textarea class="teamedit" onkeypress="return rooms[\''+selfR.id+'\'].formKeyPress(event)" rows="17">'+Tools.escapeHTML(selfR.teamsToText())+'</textarea>';
selfR.teamListElem.html(text);
selfR.teamListElem.show();
@@ -295,11 +295,11 @@ function Teambuilder(id, elem)
formatText = '['+team.format+'] ';
}
text += '<li><button onclick="rooms[\''+selfR.id+'\'].formOpen('+i+'); return false" style="width:400px">'+formatText+'<strong>'+sanitize(team.name)+'</strong><br /><small>';
text += '<li><button onclick="rooms[\''+selfR.id+'\'].formOpen('+i+'); return false" style="width:400px">'+formatText+'<strong>'+Tools.escapeHTML(team.name)+'</strong><br /><small>';
for (var j=0; j<team.team.length; j++)
{
if (j!=0) text += ' / ';
text += ''+sanitize(team.team[j].name);
text += ''+Tools.escapeHTML(team.team[j].name);
}
text += '</small></button> <button onclick="rooms[\''+selfR.id+'\'].formOpen('+i+'); return false"><i class="icon-pencil"></i>Edit</button> <button onclick="rooms[\''+selfR.id+'\'].formDelete('+i+'); return false"><i class="icon-trash"></i>Delete</button></li>';
}

22
js/utilichart.js
View File

@@ -67,11 +67,11 @@ function BattleChart()
}
};
this.pokemonRow = function(pokemon, attrs, match, isFirst) {
var text = '<li class="result'+(isFirst?' firstresult':'')+'"><a'+attrs+' onclick="Chart.select(\''+sanitize(pokemon.species,true)+'\')">';
var text = '<li class="result'+(isFirst?' firstresult':'')+'"><a'+attrs+' onclick="Chart.select(\''+Tools.escapeHTML(pokemon.species,true)+'\')">';
text += '<span class="col numcol">'+(pokemon.num)+'</span> ';
var name = sanitize(pokemon.name);
var name = Tools.escapeHTML(pokemon.name);
if (pokemon.forme && pokemon.baseSpecies) name = pokemon.baseSpecies;
if (match.name)
@@ -157,7 +157,7 @@ function BattleChart()
return text;
};
this.itemRow = function(item, attrs, match, isFirst) {
var text = '<li class="result'+(isFirst?' firstresult':'')+'"><a'+attrs+' onclick="Chart.select(\''+sanitize(item.name,true)+'\')">';
var text = '<li class="result'+(isFirst?' firstresult':'')+'"><a'+attrs+' onclick="Chart.select(\''+Tools.escapeHTML(item.name,true)+'\')">';
var url = item.name.toLowerCase().replace(/ /g, '-').replace(/[^a-z-]+/g, '');
url = '/sprites/itemicons/'+url+'.png';
@@ -166,7 +166,7 @@ function BattleChart()
text += '<span style="'+Tools.getItemIcon(item)+'"></span>';
text += '</span> ';
var name = sanitize(item.name);
var name = Tools.escapeHTML(item.name);
if (match.name)
{
@@ -181,16 +181,16 @@ function BattleChart()
return text;
}
text += '<span class="col itemdesccol">'+sanitize(item.shortDesc || item.desc)+'</span> ';
text += '<span class="col itemdesccol">'+Tools.escapeHTML(item.shortDesc || item.desc)+'</span> ';
text += '</a></li>';
return text;
};
this.abilityRow = function(ability, attrs, match, isFirst) {
var text = '<li class="result'+(isFirst?' firstresult':'')+'"><a'+attrs+' onclick="Chart.select(\''+sanitize(ability.name,true)+'\')">';
var text = '<li class="result'+(isFirst?' firstresult':'')+'"><a'+attrs+' onclick="Chart.select(\''+Tools.escapeHTML(ability.name,true)+'\')">';
var name = sanitize(ability.name);
var name = Tools.escapeHTML(ability.name);
if (match.name)
{
name = name.substr(0, match.name.start)+'<b>'+name.substr(match.name.start, match.name.end-match.name.start)+'</b>'+name.substr(match.name.end);
@@ -204,16 +204,16 @@ function BattleChart()
return text;
}
text += '<span class="col abilitydesccol">'+sanitize(ability.shortDesc || ability.desc)+'</span> ';
text += '<span class="col abilitydesccol">'+Tools.escapeHTML(ability.shortDesc || ability.desc)+'</span> ';
text += '</a></li>';
return text;
};
this.moveRow = function(move, attrs, match, isFirst) {
var text = '<li class="result'+(isFirst?' firstresult':'')+'"><a'+attrs+' onclick="Chart.select(\''+sanitize(move.name,true)+'\')">';
var text = '<li class="result'+(isFirst?' firstresult':'')+'"><a'+attrs+' onclick="Chart.select(\''+Tools.escapeHTML(move.name,true)+'\')">';
var name = sanitize(move.name);
var name = Tools.escapeHTML(move.name);
var hplen = 'Hidden Power'.length;
if (name.substr(0, hplen) === 'Hidden Power') name = 'Hidden Power';
if (match.name)
@@ -249,7 +249,7 @@ function BattleChart()
text += '<span class="col labelcol">'+(move.category!=='Status'?('<em>Power</em><br />'+(move.basePower||'&mdash;')):'')+'</span> ';
text += '<span class="col widelabelcol"><em>Accuracy</em><br />'+(move.accuracy && move.accuracy!==true?move.accuracy+'%':'&mdash;')+'</span> ';
text += '<span class="col movedesccol">'+sanitize(move.shortDesc || move.desc)+'</span> ';
text += '<span class="col movedesccol">'+Tools.escapeHTML(move.shortDesc || move.desc)+'</span> ';
text += '</a></li>';