jonas/ultimate_tictactoe
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

client hardening

Browse Source
This commit is contained in:
Jonas Weinz 2019-03-29 20:41:15 +01:00
parent 2d593e6e66
commit 31260b5304
4 changed files with 21 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
main.js
View File

@ -79,7 +79,6 @@ logged_in = false;
var connection = null;
var session_id = null;
// cookies:
function get_cookie(cname) {
var name = cname + "=";
@ -113,16 +112,16 @@ function check_cookie(cname) {
status_message = function(text, blink = true)
{
l_status.innerHTML = text;
l_status.innerHTML = encodeHTML(text);
if (blink)
{
status_container.blink("rgba(126,87,194, 0.5)");
status_container.blink(theme_color_highlight);
}
}
status_error = function(text, blink=true)
{
l_status.innerHTML = text;
l_status.innerHTML = encodeHTML(text);
if (blink)
{
status_container.blink("rgba(128,0,0,0.5");
@ -131,7 +130,8 @@ status_error = function(text, blink=true)
status_message("select gamemode. click <br> <a href=https://en.wikipedia.org/wiki/Ultimate_tic-tac-toe#Rules>[here]</a> for the rules!");
l_status.innerHTML = "select gamemode. click <br> <a href=https://en.wikipedia.org/wiki/Ultimate_tic-tac-toe#Rules>[here]</a> for the rules!";
status_container.blink(theme_color_highlight);
// global funcs:
@ -213,7 +213,7 @@ login_callback = function()
}
end_local_game();
logout_container.update_head("logged in as: " + connection.player.get_name());
logout_container.update_head("logged in as: " + encodeHTML(connection.player.get_name()));
//logout_container.blink("rgba(128,128,128,0.5)");
set_cookie("sessionid", connection.session_id, 30);
@ -314,7 +314,7 @@ show_highscores = function()
{
name=name.substring(0,10) + "…";
}
new_text += "\#" + (i+1) + ": " + name + " [" + connection.top_elos[i] + "]<br>";
new_text += "\#" + (i+1) + ": " + " [" + encodeHTML("" + connection.top_elos[i]) + "]" + encodeHTML(name) + "<br>";
}
l_highscores.innerHTML = new_text;

11
online_match_manager.js
View File

@ -64,7 +64,7 @@ class OnlineMatchManager
this.game_server_connection.send_move(sub_x, sub_y, x, y, this.match_id);
this.info_func("waiting for " + this.online_opponent.get_name() + "'s move", false);
this.info_func("waiting for " + encodeHTML(this.online_opponent.get_name()) + "'s move", false);
}
on_user_close()
@ -113,7 +113,7 @@ class OnlineMatchManager
if (this.match_state.active_player == this.local_player.get_name())
{
this.game_server_connection.notify("your turn against " + this.online_opponent.get_name());
this.game_server_connection.notify("your turn against " + encodeHTML(this.online_opponent.get_name()));
}
}
@ -214,9 +214,6 @@ class OnlineMatchManager
var player_a = this.match_state.player_a;
var player_b = this.match_state.player_b;
console.log(game_over);
console.log(current_player);
var FIELD_EMPTY = 0
var FIELD_USER = player_a == this.player_name ? 1 : 2;
var FIELD_OPPONENT = player_a == this.player_name ? 2 : 1;
@ -318,13 +315,13 @@ class OnlineMatchManager
}
else
{
this.info_func("waiting for " + this.online_opponent.get_name() + "'s move", false);
this.info_func("waiting for " + encodeHTML(this.online_opponent.get_name()) + "'s move", false);
this.control_container.blink(theme_color_highlight);
}
control_head += "" + current_player_name + "'s move";
this.control_container.update_head(control_head);
this.control_container.update_head(encodeHTML(control_head));

6
tools.js
View File

@ -11,3 +11,9 @@ function clearInner(node) {
clear(node.firstChild);
}
}
// encoding helper (found here: https://stackoverflow.com/a/2794366)
function encodeHTML(s) {
return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/"/g, '&quot;');
}

8
websocket_connection.js
View File

@ -258,7 +258,7 @@ class WebsocketConnection
this.openmatches[id] = new OnlineMatchManager(this.grid, this.info_func, this.matches_container, this.control_container, this.end_button, this, id, match_state, this.player.get_name());
if (match_state.last_move == null)
{
this.notify("new Game against " + this.openmatches[id].online_opponent.get_name());
this.notify("new Game against " + encodeHTML(this.openmatches[id].online_opponent.get_name()));
}
this.matches_container.blink(theme_color_highlight);
}
@ -304,7 +304,7 @@ class WebsocketConnection
}
else
{
this.err_func("could not send request: " + data.msg);
this.err_func("could not send request: " + encodeHTML(data.msg));
}
}
@ -356,7 +356,7 @@ class WebsocketConnection
display_name = display_name.substr(0,8) + "…";
}
var tmp = this.search_container.create_double_button("" + display_name + "<sup><span style=\"font-size: 0.5em\">" + this.elos[i] + "</span></sup>", "-");
var tmp = this.search_container.create_double_button("" + encodeHTML(display_name) + "<sup><span style=\"font-size: 0.5em\">" + encodeHTML(""+this.elos[i]) + "</span></sup>", "-");
tmp[1].name = this.friends[i];
tmp[2].name = this.friends[i];
@ -379,7 +379,7 @@ class WebsocketConnection
on_elo_update(data)
{
console.log("received elo update: " + data.elo);
this.logout_container.update_head("logged in as: " + connection.player.get_name() + "<br>Score: " + data.elo + "<br>Rank: " + data.rank);
this.logout_container.update_head("logged in as: " + encodeHTML(connection.player.get_name()) + "<br>Score: " + encodeHTML("" + data.elo) + "<br>Rank: " + encodeHTML(""+data.rank));
this.top_names = data.top_names;
this.top_elos = data.top_elos;
this.logout_container.blink(theme_color_highlight);