From e4f09d0a079d1b2e6e5aed7eb364941d8245a911 Mon Sep 17 00:00:00 2001
From: Kris Johnson <11083252+KrisXV@users.noreply.github.com>
Date: Sat, 23 Nov 2024 21:12:51 -0700
Subject: [PATCH 1/2] News: Add support for minisprites

---
 pokemonshowdown.com/news/manage.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pokemonshowdown.com/news/manage.php b/pokemonshowdown.com/news/manage.php
index 883b875068..8e11e0b222 100644
--- a/pokemonshowdown.com/news/manage.php
+++ b/pokemonshowdown.com/news/manage.php
@@ -69,6 +69,8 @@ function saveNews() {
 		$summary = str_replace("[/url]", '</a>', $summary);
 		$summary = str_replace("[b]", '<strong>', $summary);
 		$summary = str_replace("[/b]", '</strong>', $summary);
+		$summary = preg_replace('/\[psicon (pokemon|item|type|category)="([^\]]+)"\]/', '<psicon $1="$2" />', $summary);
+		$summary = preg_replace('/\[psicon (pokemon|item|type|category)=([^\]]+)\]/', '<psicon $1="$2" />', $summary);
 		$summary = '<p>'.$summary.'</p>';
 
 		$newsCache[$topic_id]['summary_html'] = $summary;
@@ -88,6 +90,8 @@ function saveNews() {
 				$details = str_replace("[/url]", '</a>', $details);
 				$details = str_replace("[b]", '<strong>', $details);
 				$details = str_replace("[/b]", '</strong>', $details);
+				$details = preg_replace('/\[psicon (pokemon|item|type|category)="([^\]]+)"\]/', '<psicon $1="$2" />', $details);
+				$details = preg_replace('/\[psicon (pokemon|item|type|category)=([^\]]+)\]/', '<psicon $1="$2" />', $details);
 				$details = '<p>'.$details.'</p>';
 				$newsCache[$topic_id]['details_html'] = $details;
 			} else {

From 6d72d55ed9425a088f30dcef2bbd1673cbf7dc48 Mon Sep 17 00:00:00 2001
From: Kris Johnson <11083252+KrisXV@users.noreply.github.com>
Date: Sun, 24 Nov 2024 16:33:56 -0700
Subject: [PATCH 2/2] SANITIZE THE HTML.

---
 play.pokemonshowdown.com/js/client-mainmenu.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/play.pokemonshowdown.com/js/client-mainmenu.js b/play.pokemonshowdown.com/js/client-mainmenu.js
index 08d9d05809..3106021cd6 100644
--- a/play.pokemonshowdown.com/js/client-mainmenu.js
+++ b/play.pokemonshowdown.com/js/client-mainmenu.js
@@ -132,7 +132,7 @@
 			options.noMinimize = options.noMinimize || false;
 
 			this.$pmBox[options.append ? 'append' : 'prepend']('<div class="pm-window ' + options.cssClass + '" ' + options.attributes + '><h3><button class="closebutton" tabindex="-1" aria-label="Close"><i class="fa fa-times-circle"></i></button>' + (!options.noMinimize ? '<button class="minimizebutton" tabindex="-1" aria-label="Minimize"><i class="fa fa-minus-circle"></i></button>' : '') + options.title + '</h3><div class="pm-log" style="overflow:visible;height:' + (typeof options.height === 'number' ? options.height + 'px' : options.height) + ';' + (parseInt(options.height, 10) ? 'max-height:none' : (options.maxHeight ? 'max-height:' + (typeof options.maxHeight === 'number' ? options.maxHeight + 'px' : options.maxHeight) : '')) + '">' +
-				options.html +
+				BattleLog.sanitizeHTML(options.html) +
 				'</div></div>');
 		},