[Zarel*]

Originally Posted by Fat Pocket

aesoft, I think the Haxorus sprite is broken (turn 8)
http://pokemon.aesoft.org/replay-Esp...12--2011-10-11

Originally Posted by Fat whitefag

It seems atributes aren't filtered, so it's possible to insert js code to Original Replay (I have no idea how to abuse it though...).
http://pokemon.aesoft.org/uploads/Fe...-at-22h20.html

Original replay files aren't filtered at all.

This could be used to extract cookies, though, which would be bad if I ever moved it onto the Showdown domain. I guess the solution would be to either prevent replay files from being viewable, or start filtering them.

I'll do one of those when I ever move domains. :/

Originally Posted by Fat whitefag

And what if I upload replay with filename equal to already existing upload? Can't I replace some featured replay with mine?

Yeah, I wanted to have a feature that let you edit replays, but there wasn't any good way to confirm you were the person who uploaded the original replay.

Oh, well, it's disabled now.