SANITIZE THE HTML.

smogon · Nov 24, 2024 · 6d72d55 · 6d72d55
1 parent e4f09d0
commit 6d72d55
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/play.pokemonshowdown.com/js/client-mainmenu.js b/play.pokemonshowdown.com/js/client-mainmenu.js
@@ -132,7 +132,7 @@
 			options.noMinimize = options.noMinimize || false;
 
 			this.$pmBox[options.append ? 'append' : 'prepend']('<div class="pm-window ' + options.cssClass + '" ' + options.attributes + '><h3><button class="closebutton" tabindex="-1" aria-label="Close"><i class="fa fa-times-circle"></i></button>' + (!options.noMinimize ? '<button class="minimizebutton" tabindex="-1" aria-label="Minimize"><i class="fa fa-minus-circle"></i></button>' : '') + options.title + '</h3><div class="pm-log" style="overflow:visible;height:' + (typeof options.height === 'number' ? options.height + 'px' : options.height) + ';' + (parseInt(options.height, 10) ? 'max-height:none' : (options.maxHeight ? 'max-height:' + (typeof options.maxHeight === 'number' ? options.maxHeight + 'px' : options.maxHeight) : '')) + '">' +
-				options.html +
+				BattleLog.sanitizeHTML(options.html) +
 				'</div></div>');
 		},