From 936f5d03012479a06d23fbfc769b718cd7aee204 Mon Sep 17 00:00:00 2001
From: GRL78 <80678534+GRL78@users.noreply.github.com>
Date: Tue, 20 Jul 2021 10:28:40 +0200
Subject: [PATCH 1/4] Icon chat not italic or bold (#1296)

---
 front/src/Components/Chat/Chat.svelte | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/front/src/Components/Chat/Chat.svelte b/front/src/Components/Chat/Chat.svelte
index 2eb4f789..e39d1a59 100644
--- a/front/src/Components/Chat/Chat.svelte
+++ b/front/src/Components/Chat/Chat.svelte
@@ -30,7 +30,7 @@
 
 
 <aside class="chatWindow" transition:fly="{{ x: -1000, duration: 500 }}">
-    <i class="close-icon" on:click={closeChat}>&times</i>
+    <p class="close-icon" on:click={closeChat}>&times</p>
     <section class="messagesList" bind:this={listDom}>
         <ul>
             <li><p class="system-text">Here is your chat history: </p></li>
@@ -45,13 +45,12 @@
 </aside>
 
 <style lang="scss">
-    i.close-icon {
+    p.close-icon {
       position: absolute;
       padding: 4px;
       right: 12px;
       font-size: 30px;
       line-height: 25px;
-      font-weight: bold;
       cursor: pointer;
     }
     

From b336e3b08a8ac8823a176a9a8f45de99660ce785 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?gr=C3=A9goire=20parant?= <g.parant@thecodingmachine.com>
Date: Tue, 20 Jul 2021 16:45:24 +0200
Subject: [PATCH 2/4] Delete logo TCM on Error scene (#1297)

---
 front/dist/resources/logos/tcm_full.png           | Bin 300 -> 0 bytes
 front/dist/resources/logos/tcm_short.png          | Bin 216 -> 0 bytes
 front/src/Phaser/Reconnecting/ErrorScene.ts       |   2 +-
 .../src/Phaser/Reconnecting/ReconnectingScene.ts  |   2 +-
 4 files changed, 2 insertions(+), 2 deletions(-)
 delete mode 100644 front/dist/resources/logos/tcm_full.png
 delete mode 100644 front/dist/resources/logos/tcm_short.png

diff --git a/front/dist/resources/logos/tcm_full.png b/front/dist/resources/logos/tcm_full.png
deleted file mode 100644
index 3ea27990a3ca3cfd62f1866b766d92d407709a46..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 300
zcmV+{0n`48P)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F80002;Nkl<ZSV!$v
z(GG+l41@pwXbhK|8Fg&M-9;bpMT5dh*A{CjrIiP-x&dqkA_iK!YP8l``gp(hOP=vt
zdGBeQ7NIVviy{D~s0Ne*Ff8<CMaEblDF9Xr*up2!NCWaA+X7@I$~c;VXra6B-vz+3
zQ8ec1fU)Pm0QQ-&n=T^x(C6u_u+}w2_$vS&5CQjh0JDI?O<r2yg^Q*Z0|#5dM)bQ}
zaM#P3c^?L5DW@%{?S?A1`puq}CjjiPWg|9@SL`@2F!QvvW7)MOS_JQjH*A3yC^MS9
y9~L|<mjLKpM@5!2kWq1V?#_YDz-Hia1`b9Ic@Wh%Bb)#L002ovPDHLkV1fW8BYjH%

diff --git a/front/dist/resources/logos/tcm_short.png b/front/dist/resources/logos/tcm_short.png
deleted file mode 100644
index ed55c836bafc72976b68421456f383193dc116b1..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 216
zcmeAS@N?(olHy`uVBq!ia0vp^3LwnE1|*BCs=ffJxt=bLArbCxrv>sgDDXIM|1Dp|
zmbyeoV8V);i2YXtGwvUAa6OXpc(I5BlZpe=e#L|`)0nGQe!HC7{xdq`c;SNf%l|DR
zO%vl3%D$^I>gH-3kbP*;zq@gog-GzZChK)p7q}jY{C8p4l`AQ+)1LE}UWDR>;!c)b
zJI`-5Qf1)ITE-zS+`tiDcJM^))FyL1*W0XTW;~kO!{X5ZLVQKHxBlLdx_JxGp$wj`
MelF{r5}Fto0L7nB_y7O^

diff --git a/front/src/Phaser/Reconnecting/ErrorScene.ts b/front/src/Phaser/Reconnecting/ErrorScene.ts
index dbde2628..3f53c6fd 100644
--- a/front/src/Phaser/Reconnecting/ErrorScene.ts
+++ b/front/src/Phaser/Reconnecting/ErrorScene.ts
@@ -34,7 +34,7 @@ export class ErrorScene extends Phaser.Scene {
     }
 
     preload() {
-        this.load.image(Textures.icon, "resources/logos/tcm_full.png");
+        this.load.image(Textures.icon, "static/images/favicons/favicon-32x32.png");
         // Note: arcade.png from the Phaser 3 examples at: https://github.com/photonstorm/phaser3-examples/tree/master/public/assets/fonts/bitmap
         this.load.bitmapFont(Textures.mainFont, 'resources/fonts/arcade.png', 'resources/fonts/arcade.xml');
         this.load.spritesheet(
diff --git a/front/src/Phaser/Reconnecting/ReconnectingScene.ts b/front/src/Phaser/Reconnecting/ReconnectingScene.ts
index 9b56dd63..4e49b880 100644
--- a/front/src/Phaser/Reconnecting/ReconnectingScene.ts
+++ b/front/src/Phaser/Reconnecting/ReconnectingScene.ts
@@ -19,7 +19,7 @@ export class ReconnectingScene extends Phaser.Scene {
     }
 
     preload() {
-        this.load.image(ReconnectingTextures.icon, "resources/logos/tcm_full.png");
+        this.load.image(ReconnectingTextures.icon, "static/images/favicons/favicon-32x32.png");
         // Note: arcade.png from the Phaser 3 examples at: https://github.com/photonstorm/phaser3-examples/tree/master/public/assets/fonts/bitmap
         this.load.bitmapFont(ReconnectingTextures.mainFont, 'resources/fonts/arcade.png', 'resources/fonts/arcade.xml');
         this.load.spritesheet(

From 2d55f982d3f1128f3669938938d97e56e46f7337 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20N=C3=A9grier?= <d.negrier@thecodingmachine.com>
Date: Tue, 20 Jul 2021 18:29:41 +0200
Subject: [PATCH 3/4] Removing the 'search' parameters from the room URL sent
 to pusher

---
 front/src/Connexion/Room.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/front/src/Connexion/Room.ts b/front/src/Connexion/Room.ts
index 57d52766..2053911d 100644
--- a/front/src/Connexion/Room.ts
+++ b/front/src/Connexion/Room.ts
@@ -169,6 +169,7 @@ export class Room {
      */
     public get key(): string {
         const newUrl = new URL(this.roomUrl.toString());
+        newUrl.search = "";
         newUrl.hash = "";
         return newUrl.toString();
     }

From 4f513fb1e0fede17358b05611a43468c9ac76044 Mon Sep 17 00:00:00 2001
From: GRL78 <80678534+GRL78@users.noreply.github.com>
Date: Tue, 20 Jul 2021 19:54:45 +0200
Subject: [PATCH 4/4] Fix test Scripting API (#1298)

* fix tests of Scripting API

* Suppression ts-ignore
---
 maps/tests/Metadata/customMenu.html     | 19 +++++++++++------
 maps/tests/Metadata/getCurrentRoom.html | 25 ++++++++++++++--------
 maps/tests/Metadata/getCurrentUser.html | 23 +++++++++++++-------
 maps/tests/Metadata/playerMove.html     | 16 +++++++++-----
 maps/tests/Metadata/setProperty.html    | 17 ++++++++++-----
 maps/tests/Metadata/showHideLayer.html  | 28 +++++++++++++++----------
 maps/tests/index.html                   | 24 +++++++--------------
 7 files changed, 92 insertions(+), 60 deletions(-)

diff --git a/maps/tests/Metadata/customMenu.html b/maps/tests/Metadata/customMenu.html
index a80dca08..404673f3 100644
--- a/maps/tests/Metadata/customMenu.html
+++ b/maps/tests/Metadata/customMenu.html
@@ -1,13 +1,20 @@
 <!doctype html>
 <html lang="en">
     <head>
-        <script src="http://play.workadventure.localhost/iframe_api.js"></script>
-    </head>
-    <body>
-    	<script>
-            WA.ui.registerMenuCommand("test", () => {
-                WA.chat.sendChatMessage("test clicked", "menu cmd")
+        <script>
+            var script = document.createElement('script');
+            // Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
+            // We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
+            script.setAttribute('src', document.referrer + 'iframe_api.js');
+            document.head.appendChild(script);
+            window.addEventListener('load', () => {
+                WA.ui.registerMenuCommand("test", () => {
+                    WA.chat.sendChatMessage("test clicked", "menu cmd")
+                })
             })
         </script>
+    </head>
+    <body>
+        <p>Add a custom menu</p>
     </body>
 </html>
\ No newline at end of file
diff --git a/maps/tests/Metadata/getCurrentRoom.html b/maps/tests/Metadata/getCurrentRoom.html
index 7429b2a8..485f2ac8 100644
--- a/maps/tests/Metadata/getCurrentRoom.html
+++ b/maps/tests/Metadata/getCurrentRoom.html
@@ -1,16 +1,23 @@
 <!doctype html>
 <html lang="en">
     <head>
-        <script src="http://play.workadventure.localhost/iframe_api.js"></script>
+        <script>
+            var script = document.createElement('script');
+            // Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
+            // We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
+            script.setAttribute('src', document.referrer + 'iframe_api.js');
+            document.head.appendChild(script);
+            window.addEventListener('load', () => {
+                WA.room.getCurrentRoom().then((room) => {
+                    console.log('id : ', room.id);
+                    console.log('map : ', room.map);
+                    console.log('mapUrl : ', room.mapUrl);
+                    console.log('startLayer : ', room.startLayer);
+                })
+            })
+        </script>
     </head>
     <body>
-    	<script>
-    		WA.room.getCurrentRoom().then((room) => {
-                console.log('id : ', room.id);
-                console.log('map : ', room.map);
-                console.log('mapUrl : ', room.mapUrl);
-                console.log('startLayer : ', room.startLayer);
-            })
-    	</script>
+        <p>Log in the console the information of the current room</p>
     </body>
 </html>
\ No newline at end of file
diff --git a/maps/tests/Metadata/getCurrentUser.html b/maps/tests/Metadata/getCurrentUser.html
index 4122cc50..da0c3191 100644
--- a/maps/tests/Metadata/getCurrentUser.html
+++ b/maps/tests/Metadata/getCurrentUser.html
@@ -1,15 +1,22 @@
 <!doctype html>
 <html lang="en">
     <head>
-        <script src="http://play.workadventure.localhost/iframe_api.js"></script>
+        <script>
+            var script = document.createElement('script');
+            // Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
+            // We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
+            script.setAttribute('src', document.referrer + 'iframe_api.js');
+            document.head.appendChild(script);
+            window.addEventListener('load', () => {
+                WA.player.getCurrentUser().then((user) => {
+                    console.log('id : ', user.id);
+                    console.log('nickName : ', user.nickName);
+                    console.log('tags : ', user.tags);
+                })
+            })
+        </script>
     </head>
     <body>
-    	<script>
-    		WA.player.getCurrentUser().then((user) => {
-                console.log('id : ', user.id);
-                console.log('nickName : ', user.nickName);
-                console.log('tags : ', user.tags);
-            })
-    	</script>
+        <p>Log  in the console the information of the current player</p>
     </body>
 </html>
\ No newline at end of file
diff --git a/maps/tests/Metadata/playerMove.html b/maps/tests/Metadata/playerMove.html
index 339a3fd2..46a36845 100644
--- a/maps/tests/Metadata/playerMove.html
+++ b/maps/tests/Metadata/playerMove.html
@@ -1,12 +1,18 @@
 <!doctype html>
 <html lang="en">
     <head>
-        <script src="http://play.workadventure.localhost/iframe_api.js"></script>
+        <script>
+            var script = document.createElement('script');
+            // Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
+            // We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
+            script.setAttribute('src', document.referrer + 'iframe_api.js');
+            document.head.appendChild(script);
+            window.addEventListener('load', () => {
+                WA.player.onPlayerMove(console.log);
+            })
+        </script>
     </head>
     <body>
-    	<div id="playerMovement"></div>
-    	<script>
-    		WA.player.onPlayerMove(console.log);
-    	</script>
+        <p>Log in the console the movement of the current player in the zone of the iframe</p>
     </body>
 </html>
\ No newline at end of file
diff --git a/maps/tests/Metadata/setProperty.html b/maps/tests/Metadata/setProperty.html
index 5259ec0a..c61aa5fa 100644
--- a/maps/tests/Metadata/setProperty.html
+++ b/maps/tests/Metadata/setProperty.html
@@ -1,12 +1,19 @@
 <!doctype html>
 <html lang="en">
     <head>
-        <script src="http://play.workadventure.localhost/iframe_api.js"></script>
+        <script>
+            var script = document.createElement('script');
+            // Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
+            // We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
+            script.setAttribute('src', document.referrer + 'iframe_api.js');
+            document.head.appendChild(script);
+            window.addEventListener('load', () => {
+                WA.room.setProperty('iframeTest', 'openWebsite', 'https://www.wikipedia.org/');
+                WA.room.setProperty('metadata', 'openWebsite', 'https://www.wikipedia.org/');
+            })
+        </script>
     </head>
     <body>
-    	<script>
-    		WA.room.setProperty('iframeTest', 'openWebsite', 'https://www.wikipedia.org/');
-    		WA.room.setProperty('metadata', 'openWebsite', 'https://www.wikipedia.org/');
-    	</script>
+        <p>Change the url of this iframe and add the 'openWebsite' property to the red tile layer</p>
     </body>
 </html>
\ No newline at end of file
diff --git a/maps/tests/Metadata/showHideLayer.html b/maps/tests/Metadata/showHideLayer.html
index 4677f9e5..c6103722 100644
--- a/maps/tests/Metadata/showHideLayer.html
+++ b/maps/tests/Metadata/showHideLayer.html
@@ -1,21 +1,27 @@
 <!doctype html>
 <html lang="en">
     <head>
-        <script src="http://play.workadventure.localhost/iframe_api.js"></script>
+        <script>
+            var script = document.createElement('script');
+            // Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
+            // We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
+            script.setAttribute('src', document.referrer + 'iframe_api.js');
+            document.head.appendChild(script);
+            window.addEventListener('load', () => {
+                document.getElementById('show/hideLayer').onclick = () => {
+                    if (document.getElementById('show/hideLayer').checked) {
+                        WA.room.showLayer('crystal');
+                    }
+                    else {
+                        WA.room.hideLayer('crystal');
+                    }
+                }
+            })
+        </script>
     </head>
     <body>
     	<div>
             <label for="show/hideLayer">Crysal Layer : </label><input type="checkbox" id="show/hideLayer" name="visible" value="show" checked>
         </div>
-    	<script>
-    		document.getElementById('show/hideLayer').onclick = () => {
-                if (document.getElementById('show/hideLayer').checked) {
-                    WA.room.showLayer('crystal');
-                }
-                else {
-                    WA.room.hideLayer('crystal');
-                }
-            }
-    	</script>
     </body>
 </html>
\ No newline at end of file
diff --git a/maps/tests/index.html b/maps/tests/index.html
index dba14eec..df305cfa 100644
--- a/maps/tests/index.html
+++ b/maps/tests/index.html
@@ -122,14 +122,6 @@
                     <a href="#" class="testLink" data-testmap="Metadata/customMenu.json" target="_blank">Testing add a custom menu by scripting API</a>
                 </td>
             </tr>
-            <tr>
-                <td>
-                    <input type="radio" name="test-getCurrentRoom"> Success <input type="radio" name="test-getCurrentRoom"> Failure <input type="radio" name="test-getCurrentRoom" checked> Pending
-                </td>
-                <td>
-                    <a href="#" class="testLink" data-testmap="Metadata/getCurrentRoom.json" target="_blank">Testing return current room attributes by Scripting API (Need to test from current user)</a>
-                </td>
-            </tr>
             <tr>
                 <td>
                     <input type="radio" name="test-getCurrentUser"> Success <input type="radio" name="test-getCurrentUser"> Failure <input type="radio" name="test-getCurrentUser" checked> Pending
@@ -138,6 +130,14 @@
                     <a href="#" class="testLink" data-testmap="Metadata/getCurrentUser.json" target="_blank">Testing return current user attributes by Scripting API</a>
                 </td>
             </tr>
+            <tr>
+                <td>
+                    <input type="radio" name="test-getCurrentRoom"> Success <input type="radio" name="test-getCurrentRoom"> Failure <input type="radio" name="test-getCurrentRoom" checked> Pending
+                </td>
+                <td>
+                    <a href="#" class="testLink" data-testmap="Metadata/getCurrentRoom.json" target="_blank">Testing return current room attributes by Scripting API (Need to test from current user)</a>
+                </td>
+            </tr>
             <tr>
                 <td>
                     <input type="radio" name="test-player-move"> Success <input type="radio" name="test-player-move"> Failure <input type="radio" name="test-player-move" checked> Pending
@@ -186,14 +186,6 @@
                     <a href="#" class="testLink" data-testmap="start-tile.json#S2" target="_blank">Test start tile (S2)</a>
                 </td>
             </tr>
-            <tr>
-                <td>
-                    <input type="radio" name="test-cowebsite-allowAPI2"> Success <input type="radio" name="test-cowebsite-allowAPI2"> Failure <input type="radio" name="test-cowebsite-allowAPI2" checked> Pending
-                </td>
-                <td>
-                    <a href="#" class="testLink" data-testmap="Metadata/cowebsiteAllowApi.json" target="_blank">Test cowebsite opened by script is allowed to use IFrame API</a>
-                </td>
-            </tr>
             <tr>
                 <td>
                     <input type="radio" name="test-set-tiles"> Success <input type="radio" name="test-set-tiles"> Failure <input type="radio" name="test-set-tiles" checked> Pending