diff --git a/main.js b/main.js index 1d7e9a5..c276252 100644 --- a/main.js +++ b/main.js @@ -79,7 +79,6 @@ logged_in = false; var connection = null; var session_id = null; - // cookies: function get_cookie(cname) { var name = cname + "="; @@ -113,16 +112,16 @@ function check_cookie(cname) { status_message = function(text, blink = true) { - l_status.innerHTML = text; + l_status.innerHTML = encodeHTML(text); if (blink) { - status_container.blink("rgba(126,87,194, 0.5)"); + status_container.blink(theme_color_highlight); } } status_error = function(text, blink=true) { - l_status.innerHTML = text; + l_status.innerHTML = encodeHTML(text); if (blink) { status_container.blink("rgba(128,0,0,0.5"); @@ -131,7 +130,8 @@ status_error = function(text, blink=true) -status_message("select gamemode. click
[here] for the rules!"); +l_status.innerHTML = "select gamemode. click
[here] for the rules!"; +status_container.blink(theme_color_highlight); // global funcs: @@ -213,7 +213,7 @@ login_callback = function() } end_local_game(); - logout_container.update_head("logged in as: " + connection.player.get_name()); + logout_container.update_head("logged in as: " + encodeHTML(connection.player.get_name())); //logout_container.blink("rgba(128,128,128,0.5)"); set_cookie("sessionid", connection.session_id, 30); @@ -314,7 +314,7 @@ show_highscores = function() { name=name.substring(0,10) + "…"; } - new_text += "\#" + (i+1) + ": " + name + " [" + connection.top_elos[i] + "]
"; + new_text += "\#" + (i+1) + ": " + " [" + encodeHTML("" + connection.top_elos[i]) + "]" + encodeHTML(name) + "
"; } l_highscores.innerHTML = new_text; diff --git a/online_match_manager.js b/online_match_manager.js index 4ac0d2f..2b4a066 100644 --- a/online_match_manager.js +++ b/online_match_manager.js @@ -64,7 +64,7 @@ class OnlineMatchManager this.game_server_connection.send_move(sub_x, sub_y, x, y, this.match_id); - this.info_func("waiting for " + this.online_opponent.get_name() + "'s move", false); + this.info_func("waiting for " + encodeHTML(this.online_opponent.get_name()) + "'s move", false); } on_user_close() @@ -113,7 +113,7 @@ class OnlineMatchManager if (this.match_state.active_player == this.local_player.get_name()) { - this.game_server_connection.notify("your turn against " + this.online_opponent.get_name()); + this.game_server_connection.notify("your turn against " + encodeHTML(this.online_opponent.get_name())); } } @@ -214,9 +214,6 @@ class OnlineMatchManager var player_a = this.match_state.player_a; var player_b = this.match_state.player_b; - console.log(game_over); - console.log(current_player); - var FIELD_EMPTY = 0 var FIELD_USER = player_a == this.player_name ? 1 : 2; var FIELD_OPPONENT = player_a == this.player_name ? 2 : 1; @@ -318,13 +315,13 @@ class OnlineMatchManager } else { - this.info_func("waiting for " + this.online_opponent.get_name() + "'s move", false); + this.info_func("waiting for " + encodeHTML(this.online_opponent.get_name()) + "'s move", false); this.control_container.blink(theme_color_highlight); } control_head += "" + current_player_name + "'s move"; - this.control_container.update_head(control_head); + this.control_container.update_head(encodeHTML(control_head)); diff --git a/tools.js b/tools.js index 211df84..36a85cf 100644 --- a/tools.js +++ b/tools.js @@ -10,4 +10,10 @@ function clearInner(node) { while (node.hasChildNodes()) { clear(node.firstChild); } +} + + +// encoding helper (found here: https://stackoverflow.com/a/2794366) +function encodeHTML(s) { + return s.replace(/&/g, '&').replace(/" + this.elos[i] + "", "-"); + var tmp = this.search_container.create_double_button("" + encodeHTML(display_name) + "" + encodeHTML(""+this.elos[i]) + "", "-"); tmp[1].name = this.friends[i]; tmp[2].name = this.friends[i]; @@ -379,7 +379,7 @@ class WebsocketConnection on_elo_update(data) { console.log("received elo update: " + data.elo); - this.logout_container.update_head("logged in as: " + connection.player.get_name() + "
Score: " + data.elo + "
Rank: " + data.rank); + this.logout_container.update_head("logged in as: " + encodeHTML(connection.player.get_name()) + "
Score: " + encodeHTML("" + data.elo) + "
Rank: " + encodeHTML(""+data.rank)); this.top_names = data.top_names; this.top_elos = data.top_elos; this.logout_container.blink(theme_color_highlight);