A bunch of stuff I changed or added this month (will repeat some stuff in earlier posts):

Overall changes:

• Tilemap Town now has the domain https://tilemap.town but https://novasquirrel.com/town/ isn't going away (but there is now a meta tag to point at the canonical URL)
• You can set a user profile and view someone else's; these contain information about you, contact information, and what you're interested in or are looking to do on Tilemap Town
• Profiles can contain arbitrary fields to cover additional kinds of things I didn't account for; if the names of these start with an underscore, they're hidden, with the intention that they hold information that's for machine use
• Updated protocol documentation to be clearer and set expectations better about the intentions behind design choices, what a minimal client needs, and what to expect from server behavior
• Protocol changed so that text escaping (turning < into &lt; and so on) is now the client's responsibility; previously clients just trusted that the server wouldn't send a name that contained HTML tags in it, and it's probably best to be cautious about anything the server sends

Server changes:

• /wa can take an optional parameter (/wa c) to see where people are with coordinates
• Server admin can set a temporary message to show upon logging in, that can optionally have a link to a specific location in the world. This can alert people about events happening, or just suggest hanging out a particular place
• People can be marked as "trusted builders" and continue to be able to build even if building gets locked down with a configuration change

Client changes:

• When repeatedly moving into a sign by holding a key down, only show the message a single time
• Reword the login message to hopefully make it clearer that you should not enter a password if you don't have an account (because I had noticed a lot of login attempts to accounts that don't exist, and if that isn't a bot then that tells me someone won't read or doesn't understand the instructions)
• When attempting to log in with a username but no password, set the username to your display name.
• Fixed several XSS problems where user-provided text received was trusted to be HTML tag-free when it was not, and it was just directly inserted into some HTML
• Don't show a typing notification when typing a command, unless it is /me /ooc or /spoof
• Added a note about needing JavaScript to the web client page, if the user doesn't have it enabled (ideally in the future it could link to a native client or something)
• Animation now actually runs at the intended 0.1 seconds per frame (or multiples of 0.1 seconds) and player animations move at 0.2 seconds per frame
• The chat bar is multi-line now (shift+enter to add a new line) and the client can handle showing multi-line messages
• Don't unintentionally add padding to every BBCode tag
• Add a max width to the chat bar so that it doesn't take up most of the screen width when someone posts a very long word
• Stop putting list bullets off-screen