jonas/ultimate_tictactoe
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

client hardening

Browse Source
This commit is contained in:
Jonas Weinz 2019-03-29 20:41:15 +01:00
parent 2d593e6e66
commit 31260b5304
4 changed files with 21 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
main.js
View File

@ -79,7 +79,6 @@ logged_in = false;
var connection = null; var connection = null;
var session_id = null; var session_id = null;
// cookies: // cookies:
function get_cookie(cname) { function get_cookie(cname) {
var name = cname + "="; var name = cname + "=";
@ -113,16 +112,16 @@ function check_cookie(cname) {
status_message = function(text, blink = true) status_message = function(text, blink = true)
{ {
l_status.innerHTML = text; l_status.innerHTML = encodeHTML(text);
if (blink) if (blink)
{ {
status_container.blink("rgba(126,87,194, 0.5)"); status_container.blink(theme_color_highlight);
} }
} }
status_error = function(text, blink=true) status_error = function(text, blink=true)
{ {
l_status.innerHTML = text; l_status.innerHTML = encodeHTML(text);
if (blink) if (blink)
{ {
status_container.blink("rgba(128,0,0,0.5"); status_container.blink("rgba(128,0,0,0.5");
@ -131,7 +130,8 @@ status_error = function(text, blink=true)
status_message("select gamemode. click <br> <a href=https://en.wikipedia.org/wiki/Ultimate_tic-tac-toe#Rules>[here]</a> for the rules!"); l_status.innerHTML = "select gamemode. click <br> <a href=https://en.wikipedia.org/wiki/Ultimate_tic-tac-toe#Rules>[here]</a> for the rules!";
status_container.blink(theme_color_highlight);
// global funcs: // global funcs:
@ -213,7 +213,7 @@ login_callback = function()
} }
end_local_game(); end_local_game();
logout_container.update_head("logged in as: " + connection.player.get_name()); logout_container.update_head("logged in as: " + encodeHTML(connection.player.get_name()));
//logout_container.blink("rgba(128,128,128,0.5)"); //logout_container.blink("rgba(128,128,128,0.5)");
set_cookie("sessionid", connection.session_id, 30); set_cookie("sessionid", connection.session_id, 30);
@ -314,7 +314,7 @@ show_highscores = function()
{ {
name=name.substring(0,10) + "…"; name=name.substring(0,10) + "…";
} }
new_text += "\#" + (i+1) + ": " + name + " [" + connection.top_elos[i] + "]<br>"; new_text += "\#" + (i+1) + ": " + " [" + encodeHTML("" + connection.top_elos[i]) + "]" + encodeHTML(name) + "<br>";
} }
l_highscores.innerHTML = new_text; l_highscores.innerHTML = new_text;

11
online_match_manager.js
View File

@ -64,7 +64,7 @@ class OnlineMatchManager
this.game_server_connection.send_move(sub_x, sub_y, x, y, this.match_id); this.game_server_connection.send_move(sub_x, sub_y, x, y, this.match_id);
this.info_func("waiting for " + this.online_opponent.get_name() + "'s move", false); this.info_func("waiting for " + encodeHTML(this.online_opponent.get_name()) + "'s move", false);
} }
on_user_close() on_user_close()
@ -113,7 +113,7 @@ class OnlineMatchManager
if (this.match_state.active_player == this.local_player.get_name()) if (this.match_state.active_player == this.local_player.get_name())
{ {
this.game_server_connection.notify("your turn against " + this.online_opponent.get_name()); this.game_server_connection.notify("your turn against " + encodeHTML(this.online_opponent.get_name()));
} }
} }
@ -214,9 +214,6 @@ class OnlineMatchManager
var player_a = this.match_state.player_a; var player_a = this.match_state.player_a;
var player_b = this.match_state.player_b; var player_b = this.match_state.player_b;
console.log(game_over);
console.log(current_player);
var FIELD_EMPTY = 0 var FIELD_EMPTY = 0
var FIELD_USER = player_a == this.player_name ? 1 : 2; var FIELD_USER = player_a == this.player_name ? 1 : 2;
var FIELD_OPPONENT = player_a == this.player_name ? 2 : 1; var FIELD_OPPONENT = player_a == this.player_name ? 2 : 1;
@ -318,13 +315,13 @@ class OnlineMatchManager
} }
else else
{ {
this.info_func("waiting for " + this.online_opponent.get_name() + "'s move", false); this.info_func("waiting for " + encodeHTML(this.online_opponent.get_name()) + "'s move", false);
this.control_container.blink(theme_color_highlight); this.control_container.blink(theme_color_highlight);
} }
control_head += "" + current_player_name + "'s move"; control_head += "" + current_player_name + "'s move";
this.control_container.update_head(control_head); this.control_container.update_head(encodeHTML(control_head));

6
tools.js
View File

@ -10,4 +10,10 @@ function clearInner(node) {
while (node.hasChildNodes()) { while (node.hasChildNodes()) {
clear(node.firstChild); clear(node.firstChild);
} }
}
// encoding helper (found here: https://stackoverflow.com/a/2794366)
function encodeHTML(s) {
return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/"/g, '&quot;');
} }

8
websocket_connection.js
View File

@ -258,7 +258,7 @@ class WebsocketConnection
this.openmatches[id] = new OnlineMatchManager(this.grid, this.info_func, this.matches_container, this.control_container, this.end_button, this, id, match_state, this.player.get_name()); this.openmatches[id] = new OnlineMatchManager(this.grid, this.info_func, this.matches_container, this.control_container, this.end_button, this, id, match_state, this.player.get_name());
if (match_state.last_move == null) if (match_state.last_move == null)
{ {
this.notify("new Game against " + this.openmatches[id].online_opponent.get_name()); this.notify("new Game against " + encodeHTML(this.openmatches[id].online_opponent.get_name()));
} }
this.matches_container.blink(theme_color_highlight); this.matches_container.blink(theme_color_highlight);
} }
@ -304,7 +304,7 @@ class WebsocketConnection
} }
else else
{ {
this.err_func("could not send request: " + data.msg); this.err_func("could not send request: " + encodeHTML(data.msg));
} }
} }
@ -356,7 +356,7 @@ class WebsocketConnection
display_name = display_name.substr(0,8) + "…"; display_name = display_name.substr(0,8) + "…";
} }
var tmp = this.search_container.create_double_button("" + display_name + "<sup><span style=\"font-size: 0.5em\">" + this.elos[i] + "</span></sup>", "-"); var tmp = this.search_container.create_double_button("" + encodeHTML(display_name) + "<sup><span style=\"font-size: 0.5em\">" + encodeHTML(""+this.elos[i]) + "</span></sup>", "-");
tmp[1].name = this.friends[i]; tmp[1].name = this.friends[i];
tmp[2].name = this.friends[i]; tmp[2].name = this.friends[i];
@ -379,7 +379,7 @@ class WebsocketConnection
on_elo_update(data) on_elo_update(data)
{ {
console.log("received elo update: " + data.elo); console.log("received elo update: " + data.elo);
this.logout_container.update_head("logged in as: " + connection.player.get_name() + "<br>Score: " + data.elo + "<br>Rank: " + data.rank); this.logout_container.update_head("logged in as: " + encodeHTML(connection.player.get_name()) + "<br>Score: " + encodeHTML("" + data.elo) + "<br>Rank: " + encodeHTML(""+data.rank));
this.top_names = data.top_names; this.top_names = data.top_names;
this.top_elos = data.top_elos; this.top_elos = data.top_elos;
this.logout_container.blink(theme_color_highlight); this.logout_container.blink(theme_color_highlight);