From 1e95f7e1a5efa906d79430ada57f387976c1a797 Mon Sep 17 00:00:00 2001
From: KoboldAI Dev <KoboldAIDev@gmail.com>
Date: Wed, 2 Jun 2021 09:01:13 -0400
Subject: [PATCH] Hotfix: HTML escaped story output. Shodan can no longer run
 JS popups in your browser.

---
 aiserver.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/aiserver.py b/aiserver.py
index 639d157b..23229cd0 100644
--- a/aiserver.py
+++ b/aiserver.py
@@ -10,6 +10,7 @@ import tkinter as tk
 from tkinter import messagebox
 import json
 import requests
+import html
 
 # KoboldAI
 import fileops
@@ -1092,7 +1093,7 @@ def applyoutputformatting(txt):
 def refresh_story():
     text_parts = ['<chunk n="0" id="n0">', vars.prompt, '</chunk>']
     for idx, item in enumerate(vars.actions, start=1):
-        text_parts.extend(('<chunk n="', str(idx), '" id="n', str(idx), '">', item, '</chunk>'))
+        text_parts.extend(('<chunk n="', str(idx), '" id="n', str(idx), '">', html.escape(item), '</chunk>'))
     emit('from_server', {'cmd': 'updatescreen', 'data': formatforhtml(''.join(text_parts))})
 
 #==================================================================#