Merge pull request #99 from AI-Tournaments/patch

Update external sources protection.

Author: ChrisAcrobat

Dev/index.js

@@ -86,7 +86,8 @@ function a(){
 										if(url && (url[0] === '?' || url[0] === '!')){
 											if(acceptedDev === undefined){
 												const session = GitHubApi.getSessionStorage();
-												acceptedDev = 'I accept unsandboxed sources' === (prompt('By having exclamation (!) and question (?) marks first in the URL you side steps all security features and you do so at your own risk. Only do this to URLs for code that you trust.\n\nWrite "I accept unsandboxed sources" to allow unsandboxed sources.')??'').toLowerCase();
+												const passphrase = 'I accept unsandboxed sources';
+												acceptedDev = (prompt('By having exclamation (!) and question (?) marks first in the URL you side steps all security features and you do so at your own risk. Only do this to URLs for code that you trust.\n\nWrite "'+passphrase+'" to allow unsandboxed sources.')??'').toLowerCase() === passphrase.toLowerCase();
 												session.acceptedDev = acceptedDev;
 												GitHubApi.setSessionStorage(session);
 											}

Replay/index.js

@@ -436,11 +436,12 @@ function a(){
 						}
 						let url = option.value;
 						const session = GitHubApi.getSessionStorage();
-						if(!url.startsWith('https://ai-tournaments.github.io/') && !session?.externalReplaysAccepted){
-							session.externalReplaysAccepted = 'I accept external replay viewers' === (prompt('External replays are by default blocked for security reasons. do so at your own risk. Only do this to URLs for code that you trust.\n\nWrite "I accept external replays" to allow external replay viewers.')??'').toLowerCase();
+						if(!url.startsWith('https://ai-tournaments.github.io/') && url.startsWith('http') && !session?.externalReplaysAccepted){
+							const passphrase = 'I accept external replay viewers';
+							session.externalReplaysAccepted = (prompt('External replays are by default blocked for security reasons, since they are outside of AI-Tournaments control. So use them at your own risk. Only do this to URLs for code that you trust.\n\nWrite "'+passphrase+'" to allow external replay viewers.')??'').toLowerCase() === passphrase.toLowerCase();
 							GitHubApi.setSessionStorage(session);
 						}
-						if(url.startsWith('https://ai-tournaments.github.io/') || session?.externalReplaysAccepted){
+						if(url.startsWith('https://ai-tournaments.github.io/') || session.externalReplaysAccepted){
 							_element_iframe.dataset.arenaResult = JSON.stringify(_replayData.body);
 							_element_iframe.src = url;
 							document.getElementById('open-replay-in-new-tab').addEventListener('click', ()=>{