fixing about/terms/rules pages

views/about.html

@@ -9,11 +9,28 @@
       (function() {
         var raw = document.getElementById('about-raw-data');
         var el  = document.getElementById('about-dynamic-content');
+        function escapeHtml(str) {
+          return str.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
+        }
         function render() {
           if (raw && el && typeof marked !== 'undefined') {
             var bytes = Uint8Array.from(atob(raw.textContent.trim()), function(c) { return c.charCodeAt(0); });
             var text = new TextDecoder('utf-8').decode(bytes);
-            el.innerHTML = marked.parse(text, { gfm: true, breaks: true });
+            var renderer = new marked.Renderer();
+            renderer.code = function(code, lang) {
+              var escaped = escapeHtml(typeof code === 'object' ? (code.text || '') : code);
+              var langAttr = (typeof code === 'object' ? code.lang : lang) || '';
+              return '<pre><code' + (langAttr ? ' class="language-' + escapeHtml(langAttr) + '"' : '') + '>' + escaped + '</code></pre>';
+            };
+            renderer.codespan = function(code) {
+              var escaped = escapeHtml(typeof code === 'object' ? (code.text || '') : code);
+              return '<code>' + escaped + '</code>';
+            };
+            renderer.html = function(html) {
+              var content = typeof html === 'object' ? (html.text || '') : html;
+              return escapeHtml(content);
+            };
+            el.innerHTML = marked.parse(text, { gfm: true, breaks: true, renderer: renderer });
           }
         }
         if (typeof marked !== 'undefined') {

views/admin/about.html

@@ -10,7 +10,8 @@
                 <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                 <div style="margin-bottom: 20px;">
                     <label for="about-text" style="display: block; margin-bottom: 8px; color: var(--accent);">About Page Content (Markdown supported)</label>
-                    <textarea id="about-text" name="about_text" style="width: 100%; min-height: 300px; background: rgba(0,0,0,0.3); border: 1px solid rgba(255,255,255,0.1); color: #fff; padding: 15px; border-radius: 4px; font-family: inherit; font-size: 1.1em; resize: vertical;">{!! about_text !!}</textarea>
+                    <textarea id="about-text" name="about_text" style="width: 100%; min-height: 300px; background: rgba(0,0,0,0.3); border: 1px solid rgba(255,255,255,0.1); color: #fff; padding: 15px; border-radius: 4px; font-family: inherit; font-size: 1.1em; resize: vertical;"></textarea>
+                    <script>document.getElementById('about-text').value = atob('{{ about_text_b64 }}');</script>
                 </div>
 
                 <div style="display: flex; gap: 10px; align-items: center;">

views/admin/rules.html

@@ -10,7 +10,8 @@
                 <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                 <div style="margin-bottom: 20px;">
                     <label for="rules-text" style="display: block; margin-bottom: 8px; color: var(--accent);">Rules Page Content (Markdown supported)</label>
-                    <textarea id="rules-text" name="rules_text" style="width: 100%; min-height: 300px; background: rgba(0,0,0,0.3); border: 1px solid rgba(255,255,255,0.1); color: #fff; padding: 15px; border-radius: 4px; font-family: inherit; font-size: 1.1em; resize: vertical;">{!! rules_text !!}</textarea>
+                    <textarea id="rules-text" name="rules_text" style="width: 100%; min-height: 300px; background: rgba(0,0,0,0.3); border: 1px solid rgba(255,255,255,0.1); color: #fff; padding: 15px; border-radius: 4px; font-family: inherit; font-size: 1.1em; resize: vertical;"></textarea>
+                    <script>document.getElementById('rules-text').value = atob('{{ rules_text_b64 }}');</script>
                 </div>
 
                 <div style="display: flex; gap: 10px; align-items: center;">

views/admin/terms.html

@@ -10,7 +10,8 @@
                 <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                 <div style="margin-bottom: 20px;">
                     <label for="terms-text" style="display: block; margin-bottom: 8px; color: var(--accent);">Terms Page Content (Markdown supported)</label>
-                    <textarea id="terms-text" name="terms_text" style="width: 100%; min-height: 300px; background: rgba(0,0,0,0.3); border: 1px solid rgba(255,255,255,0.1); color: #fff; padding: 15px; border-radius: 4px; font-family: inherit; font-size: 1.1em; resize: vertical;">{!! terms_text !!}</textarea>
+                    <textarea id="terms-text" name="terms_text" style="width: 100%; min-height: 300px; background: rgba(0,0,0,0.3); border: 1px solid rgba(255,255,255,0.1); color: #fff; padding: 15px; border-radius: 4px; font-family: inherit; font-size: 1.1em; resize: vertical;"></textarea>
+                    <script>document.getElementById('terms-text').value = atob('{{ terms_text_b64 }}');</script>
                 </div>
 
                 <div style="display: flex; gap: 10px; align-items: center;">

views/rules.html

@@ -9,11 +9,28 @@
       (function() {
         var raw = document.getElementById('rules-raw-data');
         var el  = document.getElementById('rules-dynamic-content');
+        function escapeHtml(str) {
+          return str.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
+        }
         function render() {
           if (raw && el && typeof marked !== 'undefined') {
             var bytes = Uint8Array.from(atob(raw.textContent.trim()), function(c) { return c.charCodeAt(0); });
             var text = new TextDecoder('utf-8').decode(bytes);
-            el.innerHTML = marked.parse(text, { gfm: true, breaks: true });
+            var renderer = new marked.Renderer();
+            renderer.code = function(code, lang) {
+              var escaped = escapeHtml(typeof code === 'object' ? (code.text || '') : code);
+              var langAttr = (typeof code === 'object' ? code.lang : lang) || '';
+              return '<pre><code' + (langAttr ? ' class="language-' + escapeHtml(langAttr) + '"' : '') + '>' + escaped + '</code></pre>';
+            };
+            renderer.codespan = function(code) {
+              var escaped = escapeHtml(typeof code === 'object' ? (code.text || '') : code);
+              return '<code>' + escaped + '</code>';
+            };
+            renderer.html = function(html) {
+              var content = typeof html === 'object' ? (html.text || '') : html;
+              return escapeHtml(content);
+            };
+            el.innerHTML = marked.parse(text, { gfm: true, breaks: true, renderer: renderer });
           }
         }
         if (typeof marked !== 'undefined') {

views/terms.html

@@ -9,11 +9,28 @@
       (function() {
         var raw = document.getElementById('terms-raw-data');
         var el  = document.getElementById('terms-dynamic-content');
+        function escapeHtml(str) {
+          return str.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
+        }
         function render() {
           if (raw && el && typeof marked !== 'undefined') {
             var bytes = Uint8Array.from(atob(raw.textContent.trim()), function(c) { return c.charCodeAt(0); });
             var text = new TextDecoder('utf-8').decode(bytes);
-            el.innerHTML = marked.parse(text, { gfm: true, breaks: true });
+            var renderer = new marked.Renderer();
+            renderer.code = function(code, lang) {
+              var escaped = escapeHtml(typeof code === 'object' ? (code.text || '') : code);
+              var langAttr = (typeof code === 'object' ? code.lang : lang) || '';
+              return '<pre><code' + (langAttr ? ' class="language-' + escapeHtml(langAttr) + '"' : '') + '>' + escaped + '</code></pre>';
+            };
+            renderer.codespan = function(code) {
+              var escaped = escapeHtml(typeof code === 'object' ? (code.text || '') : code);
+              return '<code>' + escaped + '</code>';
+            };
+            renderer.html = function(html) {
+              var content = typeof html === 'object' ? (html.text || '') : html;
+              return escapeHtml(content);
+            };
+            el.innerHTML = marked.parse(text, { gfm: true, breaks: true, renderer: renderer });
           }
         }
         if (typeof marked !== 'undefined') {