From e4e95124f211a2dea3c09b9476371e17cb6de3d4 Mon Sep 17 00:00:00 2001
From: Kris Johnson <11083252+KrisXV@users.noreply.github.com>
Date: Tue, 26 Nov 2024 12:37:35 -0700
Subject: [PATCH] News: Add support for minisprites (#2300)

* News: Add support for minisprites

* SANITIZE THE HTML.
---
 play.pokemonshowdown.com/js/client-mainmenu.js | 2 +-
 pokemonshowdown.com/news/manage.php            | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/play.pokemonshowdown.com/js/client-mainmenu.js b/play.pokemonshowdown.com/js/client-mainmenu.js
index 08d9d0580..3106021cd 100644
--- a/play.pokemonshowdown.com/js/client-mainmenu.js
+++ b/play.pokemonshowdown.com/js/client-mainmenu.js
@@ -132,7 +132,7 @@
 			options.noMinimize = options.noMinimize || false;
 
 			this.$pmBox[options.append ? 'append' : 'prepend']('<div class="pm-window ' + options.cssClass + '" ' + options.attributes + '><h3><button class="closebutton" tabindex="-1" aria-label="Close"><i class="fa fa-times-circle"></i></button>' + (!options.noMinimize ? '<button class="minimizebutton" tabindex="-1" aria-label="Minimize"><i class="fa fa-minus-circle"></i></button>' : '') + options.title + '</h3><div class="pm-log" style="overflow:visible;height:' + (typeof options.height === 'number' ? options.height + 'px' : options.height) + ';' + (parseInt(options.height, 10) ? 'max-height:none' : (options.maxHeight ? 'max-height:' + (typeof options.maxHeight === 'number' ? options.maxHeight + 'px' : options.maxHeight) : '')) + '">' +
-				options.html +
+				BattleLog.sanitizeHTML(options.html) +
 				'</div></div>');
 		},
 
diff --git a/pokemonshowdown.com/news/manage.php b/pokemonshowdown.com/news/manage.php
index 883b87506..8e11e0b22 100644
--- a/pokemonshowdown.com/news/manage.php
+++ b/pokemonshowdown.com/news/manage.php
@@ -69,6 +69,8 @@ includeHeader();
 		$summary = str_replace("[/url]", '</a>', $summary);
 		$summary = str_replace("[b]", '<strong>', $summary);
 		$summary = str_replace("[/b]", '</strong>', $summary);
+		$summary = preg_replace('/\[psicon (pokemon|item|type|category)="([^\]]+)"\]/', '<psicon $1="$2" />', $summary);
+		$summary = preg_replace('/\[psicon (pokemon|item|type|category)=([^\]]+)\]/', '<psicon $1="$2" />', $summary);
 		$summary = '<p>'.$summary.'</p>';
 
 		$newsCache[$topic_id]['summary_html'] = $summary;
@@ -88,6 +90,8 @@ includeHeader();
 				$details = str_replace("[/url]", '</a>', $details);
 				$details = str_replace("[b]", '<strong>', $details);
 				$details = str_replace("[/b]", '</strong>', $details);
+				$details = preg_replace('/\[psicon (pokemon|item|type|category)="([^\]]+)"\]/', '<psicon $1="$2" />', $details);
+				$details = preg_replace('/\[psicon (pokemon|item|type|category)=([^\]]+)\]/', '<psicon $1="$2" />', $details);
 				$details = '<p>'.$details.'</p>';
 				$newsCache[$topic_id]['details_html'] = $details;
 			} else {