From 70ec6d53488f3526b52aca17885a360304cd9e0f Mon Sep 17 00:00:00 2001
From: SirStendec <sir@stendec.me>
Date: Wed, 7 Dec 2016 17:58:05 -0500
Subject: [PATCH] 3.5.393. Added api.room_add_user_badge and
 api.room_remove_user_badge for adding room-specific badges to users. Also,
 support elsewhere in the script to make that work.

---
 changelog.html        | 32 +++++++++++++++-----------------
 old_changes.html      | 17 +++++++++++++++++
 src/badges.js         | 34 ++++++++++++++++++++++------------
 src/ember/chatview.js |  8 ++++----
 src/ember/room.js     | 24 +++++++++++++++++++++---
 src/emoticons.js      |  5 +++--
 src/ext/api.js        | 25 +++++++++++++++++++++++++
 src/ext/betterttv.js  |  1 +
 src/main.js           |  2 +-
 src/tokenize.js       | 10 +++++-----
 10 files changed, 114 insertions(+), 44 deletions(-)

diff --git a/changelog.html b/changelog.html
index fe4d3968..365a335f 100644
--- a/changelog.html
+++ b/changelog.html
@@ -1,3 +1,18 @@
+<div class="list-header">3.5.393 <time datetime="2016-12-07">(2016-12-07)</time></div>
+<ul class="chat-menu-content menu-side-padding">
+	<li>API Added: <code>api.room_add_user_badge</code> and <code>api.room_remove_user_badge</code> methods for adding and removing room-specific badges from a user. Note: These methods only function when the associated room is loaded.</li>
+</ul>
+
+<div class="list-header">3.5.392 <time datetime="2016-12-07">(2016-12-07)</time></div>
+<ul class="chat-menu-content menu-side-padding">
+	<li>Fixed: Not sanitizing emoticon names in tooltips.</li>
+</ul>
+
+<div class="list-header">3.5.391 <time datetime="2016-12-07">(2016-12-07)</time></div>
+<ul class="chat-menu-content menu-side-padding">
+	<li>Fixed: Security issue.</li>
+</ul>
+
 <div class="list-header">3.5.390 <time datetime="2016-12-06">(2016-12-06)</time></div>
 <ul class="chat-menu-content menu-side-padding">
 	<li>Fixed: Dark theme CSS tweaks.</li>
@@ -42,22 +57,5 @@
 	<li>Fixed: Update moderation card after Twitch made some changes.</li>
 </ul>
 
-<div class="list-header">3.5.382 <time datetime="2016-11-28">(2016-11-28)</time></div>
-<ul class="chat-menu-content menu-side-padding">
-	<li>Fixed: Bits breaking chat.</li>
-</ul>
-
-<div class="list-header">3.5.381 <time datetime="2016-11-28">(2016-11-28)</time></div>
-<ul class="chat-menu-content menu-side-padding">
-	<li>Added: Setting to make mentions clickable. They open moderation cards. (Note: Only at signs (<code>@</code>) followed by usernames are clickable. Localized display names will not work.)</li>
-	<li>Fixed: Typo in new scrolling logic making it not scroll down to the video on channel pages.</li>
-</ul>
-
-<div class="list-header">3.5.380 <time datetime="2016-11-27">(2016-11-27)</time></div>
-<ul class="chat-menu-content menu-side-padding">
-	<li>Fixed: Lazy load bits rendering information to avoid a race condition.</li>
-	<li>Fixed: Hook the new scrolling logic in the Ember service layout.</li>
-</ul>
-
 <div class="list-header" id="ffz-old-news-button"><a href="#">View Older</a></div>
 <div id="ffz-old-news"></div>
\ No newline at end of file
diff --git a/old_changes.html b/old_changes.html
index 0883fd76..d991c8be 100644
--- a/old_changes.html
+++ b/old_changes.html
@@ -1,3 +1,20 @@
+<div class="list-header">3.5.382 <time datetime="2016-11-28">(2016-11-28)</time></div>
+<ul class="chat-menu-content menu-side-padding">
+	<li>Fixed: Bits breaking chat.</li>
+</ul>
+
+<div class="list-header">3.5.381 <time datetime="2016-11-28">(2016-11-28)</time></div>
+<ul class="chat-menu-content menu-side-padding">
+	<li>Added: Setting to make mentions clickable. They open moderation cards. (Note: Only at signs (<code>@</code>) followed by usernames are clickable. Localized display names will not work.)</li>
+	<li>Fixed: Typo in new scrolling logic making it not scroll down to the video on channel pages.</li>
+</ul>
+
+<div class="list-header">3.5.380 <time datetime="2016-11-27">(2016-11-27)</time></div>
+<ul class="chat-menu-content menu-side-padding">
+	<li>Fixed: Lazy load bits rendering information to avoid a race condition.</li>
+	<li>Fixed: Hook the new scrolling logic in the Ember service layout.</li>
+</ul>
+
 <div class="list-header">3.5.379 <time datetime="2016-11-23">(2016-11-23)</time></div>
 <ul class="chat-menu-content menu-side-padding">
 	<li>Changed: Minor refactor to bits rendering.</li>
diff --git a/src/badges.js b/src/badges.js
index d11427ef..dd3f937b 100644
--- a/src/badges.js
+++ b/src/badges.js
@@ -361,14 +361,20 @@ FFZ.ws_commands.set_badge = function(data) {
 
 FFZ.prototype.get_badges = function(user, room_id, badges, msg) {
 	var data = this.users[user],
-		hidden_badges = this.settings.hidden_badges;
+		room = this.rooms[room_id],
+		room_data = room && room.users && room.users[user],
+		hidden_badges = this.settings.hidden_badges,
+		badge_data = data && data.badges || {};
 
-	if ( ! data || ! data.badges || ! this.settings.show_badges )
+	if ( room_data && room_data.badges )
+		badge_data = _.extend({}, badge_data, room_data.badges);
+
+	if ( ! badge_data || ! this.settings.show_badges )
 		return badges;
 
-	for(var slot in data.badges) {
-		var badge = data.badges[slot];
-		if ( ! data.badges.hasOwnProperty(slot) || ! badge )
+	for(var slot in badge_data) {
+		var badge = badge_data[slot];
+		if ( ! badge_data.hasOwnProperty(slot) || ! badge )
 			continue;
 
 		var full_badge = this.badges[badge.id] || {},
@@ -583,13 +589,14 @@ FFZ.prototype.bttv_badges = function(data) {
 
 	var user_id = data.sender,
 		user = this.users[user_id],
+		room = this.rooms[data.room],
+		room_data = room && room.users && room.users[user_id],
 		badges_out = [],
 		insert_at = -1,
 
 		hidden_badges = this.settings.hidden_badges,
 		alpha = BetterTTV.settings.get('alphaTags');
 
-
 	if ( ! data.badges )
 		data.badges = [];
 
@@ -621,15 +628,18 @@ FFZ.prototype.bttv_badges = function(data) {
 			insert_at = i;
 	}
 
+	var badge_data = user && user.badges || {};
+	if ( room_data && room_data.badges )
+		badge_data = _.extend({}, badge_data, room_data.badges);
+
 	// If there's no user, we're done now.
-	if ( ! user || ! user.badges )
+	if ( ! badge_data )
 		return;
 
-
 	// We have a user. Start replacing badges.
-	for (var slot in user.badges) {
-		var badge = user.badges[slot];
-		if ( ! user.badges.hasOwnProperty(slot) || ! badge )
+	for (var slot in badge_data) {
+		var badge = badge_data[slot];
+		if ( ! badge_data.hasOwnProperty(slot) || ! badge )
 			continue;
 
 		var full_badge = this.badges[badge.id] || {},
@@ -644,7 +654,7 @@ FFZ.prototype.bttv_badges = function(data) {
 		if ( full_badge.visible !== undefined ) {
 			var visible = full_badge.visible;
 			if ( typeof visible === "function" )
-				visible = visible.call(this, null, user_id);
+				visible = visible.call(this, data.room, user_id);
 
 			if ( ! visible )
 				continue;
diff --git a/src/ember/chatview.js b/src/ember/chatview.js
index febb18a4..6959be0c 100644
--- a/src/ember/chatview.js
+++ b/src/ember/chatview.js
@@ -983,7 +983,7 @@ FFZ.prototype.modify_chat_room_manager = function(component) {
 				name = room.get('channel.display_name') || room.get('tmiRoom.displayName') || (group ? room.get('tmiRoom.name') : FFZ.get_capitalization(room_id, function(name) {
 					var active_channel = room === controller.get('currentRoom');
 					unread = utils.format_unread(active_channel ? 0 : room.get('unreadCount'));
-					var results = group ? [name, undefined] : f.format_display_name(name, room_id, true);
+					var results = group ? [utils.sanitize(name), undefined] : f.format_display_name(name, room_id, true);
 					name_el.innerHTML = results[0] + ' <span>' + unread + '</span>';
 					if ( results[1] )
 						row.title += '<br>' + results[1];
@@ -1011,7 +1011,7 @@ FFZ.prototype.modify_chat_room_manager = function(component) {
 
 			name_el.className = 'ffz-room';
 
-			var results = group ? [name, undefined] : f.format_display_name(name, room_id, true);
+			var results = group ? [utils.sanitize(name), undefined] : f.format_display_name(name, room_id, true);
 			name_el.innerHTML = results[0] + ' <span>' + unread + '</span>';
 			if ( results[1] )
 				row.title += '<br>' + results[1];
@@ -1206,7 +1206,7 @@ FFZ.prototype.modify_chat_room_manager = function(component) {
 			name = room.get('channel.display_name') || room.get('tmiRoom.displayName') || (group ? room.get('tmiRoom.name') : FFZ.get_capitalization(room_id, function(name) {
 				var active_channel = room === controller.get('currentRoom');
 				unread = utils.format_unread(active_channel ? 0 : room.get('unreadCount'));
-				var results = group ? [name, undefined] : f.format_display_name(name, room_id, true, true);
+				var results = group ? [utils.sanitize(name), undefined] : f.format_display_name(name, room_id, true, true);
 				tab.innerHTML = icon + results[0] + '<span>' + unread + '</span>';
 				if ( results[1] )
 					tab.title += '<br>' + results[1];
@@ -1223,7 +1223,7 @@ FFZ.prototype.modify_chat_room_manager = function(component) {
 			else
 				tab.title = "Pinned Channel";
 
-			var results = group ? [name, undefined] : f.format_display_name(name, room_id, true, true);
+			var results = group ? [utils.sanitize(name), undefined] : f.format_display_name(name, room_id, true, true);
 			tab.innerHTML = icon + results[0] + '<span>' + unread + '</span>';
 			if ( results[1] )
 				tab.title += '<br>' + results[1];
diff --git a/src/ember/room.js b/src/ember/room.js
index 31ca59b9..8811eaa4 100644
--- a/src/ember/room.js
+++ b/src/ember/room.js
@@ -973,7 +973,14 @@ FFZ.prototype.add_room = function(room_id, room) {
 	this.log("Adding Room: " + room_id);
 
 	// Create a basic data table for this room.
-	var data = this.rooms[room_id] = {id: room_id, room: room, sets: [], ext_sets: [], css: null, needs_history: false};
+	var data = this.rooms[room_id] = {
+		id: room_id,
+		room: room,
+		users: {},
+		sets: [],
+		ext_sets: [],
+		css: null,
+		needs_history: false};
 
 	if ( this.follow_sets && this.follow_sets[room_id] ) {
 		data.extra_sets = this.follow_sets[room_id];
@@ -1103,9 +1110,20 @@ FFZ.prototype._load_room_json = function(room_id, callback, data) {
 	var model = this.rooms[room_id] = this.rooms[room_id] || {};
 
 	for(var key in data)
-		if ( key !== 'room' && data.hasOwnProperty(key) )
+		if ( key !== 'users' && key !== 'room' && data.hasOwnProperty(key) )
 			model[key] = data[key];
 
+	// Merge the user data.
+	for(var user_id in data.users) {
+		var original = model.users[user_id] || {},
+			new_data = data.users[user_id] || {};
+
+		model.users[user_id] = {
+			sets: _.uniq((original.sets || []).concat(new_data.sets || [])),
+			badges: _.extend(original.badges || {}, new_data.badges || {})
+		}
+	}
+
 	// Preserve the pointer to the Room instance.
 	/*if ( this.rooms[room_id] )
 		data.room = this.rooms[room_id].room;
@@ -1120,7 +1138,7 @@ FFZ.prototype._load_room_json = function(room_id, callback, data) {
 
 	this.rooms[room_id] = data;*/
 
-	if ( model.css || model.moderator_badge )
+	if ( model.css || model.mod_urls )
 		utils.update_css(this._room_style, room_id, moderator_css(model) + (model.css || ""));
 
 	if ( ! this.emote_sets.hasOwnProperty(model.set) )
diff --git a/src/emoticons.js b/src/emoticons.js
index 1ca13844..cd91ef0b 100644
--- a/src/emoticons.js
+++ b/src/emoticons.js
@@ -175,9 +175,10 @@ FFZ.prototype.check_twitch_emotes = function() {
 
 FFZ.prototype.getEmotes = function(user_id, room_id) {
 	var user = this.users && this.users[user_id],
-		room = this.rooms && this.rooms[room_id];
+		room = this.rooms && this.rooms[room_id],
+		room_user = room && room.users && room.users[user_id];
 
-	return _.union(user && user.sets || [], room && room.set && [room.set] || [], room && room.extra_sets || [], room && room.ext_sets || [], this.default_sets);
+	return _.union(user && user.sets || [], room_user && room_user.sets || [], room && room.set && [room.set] || [], room && room.extra_sets || [], room && room.ext_sets || [], this.default_sets);
 }
 
 
diff --git a/src/ext/api.js b/src/ext/api.js
index 87fef76b..751b9679 100644
--- a/src/ext/api.js
+++ b/src/ext/api.js
@@ -497,6 +497,31 @@ API.prototype.user_remove_badge = function(username, slot) {
 }
 
 
+API.prototype.room_add_user_badge = function(room_name, username, slot, badge_id) {
+	var ffz_room_users = this.ffz.rooms[room_name] && this.ffz.rooms[room_name].users;
+	if ( ! ffz_room_users )
+		return;
+
+	var ffz_user = ffz_room_users[username] = ffz_room_users[username] || {badges: {}, sets: []},
+		ffz_badges = ffz_user && ffz_user.badges,
+
+		exact_id = this.name_key + '-' + badge_id,
+		badge = {id: exact_id};
+
+	ffz_badges[slot] = badge;
+}
+
+
+API.prototype.room_remove_user_badge = function(room_name, username, slot) {
+	var ffz_room_users = this.ffz.rooms[room_name] && this.ffz.rooms[room_name].users,
+		ffz_user = ffz_room_users && ffz_room_users[username],
+		ffz_badges = ffz_user && ffz_user.badges;
+
+	if ( ffz_badges )
+		ffz_badges[slot] = null;
+}
+
+
 API.prototype.user_add_set = function(username, set_id) {
 	var user = this.users[username] = this.users[username] || {},
 		ffz_user = this.ffz.users[username] = this.ffz.users[username] || {},
diff --git a/src/ext/betterttv.js b/src/ext/betterttv.js
index 1e83cbb2..ed6225b7 100644
--- a/src/ext/betterttv.js
+++ b/src/ext/betterttv.js
@@ -163,6 +163,7 @@ FFZ.prototype.setup_bttv = function(delay) {
 			opts = opts || {};
 
 			// Handle badges.
+			data.room = data.room || received_room;
 			f.bttv_badges(data);
 
 			// Now, do everything else manually because things are hard-coded.
diff --git a/src/main.js b/src/main.js
index 1045281c..9a0aa370 100644
--- a/src/main.js
+++ b/src/main.js
@@ -61,7 +61,7 @@ FFZ.channel_metadata = {};
 
 // Version
 var VER = FFZ.version_info = {
-	major: 3, minor: 5, revision: 390,
+	major: 3, minor: 5, revision: 393,
 	toString: function() {
 		return [VER.major, VER.minor, VER.revision].join(".") + (VER.extra || "");
 	}
diff --git a/src/tokenize.js b/src/tokenize.js
index e918ed4a..94193315 100644
--- a/src/tokenize.js
+++ b/src/tokenize.js
@@ -425,7 +425,7 @@ FFZ.prototype.render_tooltip = function(el) {
 					mod_text = '<hr>' + _.map(JSON.parse(modifiers), function(m) {
 						emote_set = f.emote_sets[m[0]];
 						emote = emote_set && emote_set.emoticons[m[1]];
-						return emote ? f.render_token(true, true, true, emote.token) + ' - ' + (emote.hidden ? '???' : emote.name) : '';
+						return emote ? f.render_token(true, true, true, emote.token) + ' - ' + (emote.hidden ? '???' : utils.sanitize(emote.name)) : '';
 					}).join('<br>');
 				}
 
@@ -463,7 +463,7 @@ FFZ.prototype.render_tooltip = function(el) {
 
 						//image = preview_url ? `<img style="height:${height}px" class="emoticon ffz-image-hover" src="${preview_url}?_=preview">` : '';
 						image = preview_url ? '<img style="height:' + height + 'px" class="emoticon ffz-image-hover" src="' + preview_url + '"?_=preview">' : '';
-						return image + 'Emoticon: ' + (emote.hidden ? '???' : emote.name) + '<br>' + source_line + (owner ? '<br>By: ' + owner.display_name : '') + mod_text;
+						return image + 'Emoticon: ' + (emote.hidden ? '???' : utils.sanitize(emote.name)) + '<br>' + source_line + (owner ? '<br>By: ' + utils.sanitize(owner.display_name) : '') + mod_text;
 
 						//return `${image}Emoticon: ${emote.hidden ? '???' : emote.name}<br>${source} ${title}${owner ? '<br>By: ' + owner.display_name : ""}`;
 					}
@@ -492,9 +492,9 @@ FFZ.prototype.render_tooltip = function(el) {
 					}
 
 					if ( this.classList.contains('ffz-tooltip-no-credit') )
-						return image + this.alt + mod_text;
+						return image + utils.sanitize(this.alt) + mod_text;
 					else
-						return image + 'Emoticon: ' + this.alt + '<br>' + (set_type ? set_type + ': ' : '') + emote_set + mod_text;
+						return image + 'Emoticon: ' + utils.sanitize(this.alt) + '<br>' + (set_type ? set_type + ': ' : '') + emote_set + mod_text;
 						//return `${image}Emoticon: ${this.alt}<br>${set_type ? set_type + ": " : ""}${emote_set}`;
 				}
 
@@ -544,7 +544,7 @@ FFZ.prototype.render_tooltip = function(el) {
 
 				// If it's not a deleted link, don't waste time showing the URL in the tooltip.
 				if ( this.classList.contains('deleted-link') )
-					text = url;
+					text = utils.sanitize(url);
 
 				if ( this.classList.contains('warn-link') )
 					text += EXPLANATION_WARN;