diff --git a/src/handlers/acct.py b/src/handlers/acct.py
index 2816cfa9..f1247775 100644
--- a/src/handlers/acct.py
+++ b/src/handlers/acct.py
@@ -44,13 +44,18 @@ async def get(self, acct_id):
         ac_pro_cnt = 0
         for pro in prolist:
             pro_id = pro['pro_id']
-            tmp = {'pro_id': pro_id, 'score': -1}
+            tmp = {'pro_id': pro_id, 'score': -1, 'state': None}
             if pro_id in ratemap:
                 tmp['score'] = ratemap[pro_id]['rate']
+                tmp['state'] = ratemap[pro_id]['state']
                 ac_pro_cnt += ratemap[pro_id]['state'] == ChalConst.STATE_AC
 
             prolist2.append(tmp)
 
+        def chunk_list(la, size):
+            for i in range(0, len(la), size):
+                yield la[i: i + size]
+
         rate_data['rate'] = math.floor(rate_data['rate'])
         rate_data['ac_pro_cnt'] = ac_pro_cnt
 
@@ -58,7 +63,7 @@ async def get(self, acct_id):
         acct.photo = re.sub(r'^http://', 'https://', acct.photo)
         acct.cover = re.sub(r'^http://', 'https://', acct.cover)
 
-        await self.render('acct/profile', acct=acct, rate=rate_data, prolist=prolist2)
+        await self.render('acct/profile', acct=acct, rate=rate_data, prolist=chunk_list(prolist2, 10))
 
 
 class AcctConfigHandler(RequestHandler):
@@ -127,6 +132,7 @@ async def post(self):
 
 class AcctProClassHandler(RequestHandler):
     @reqenv
+    @require_permission([UserConst.ACCTTYPE_USER, UserConst.ACCTTYPE_KERNEL])
     async def get(self, acct_id):
         acct_id = int(acct_id)
         try:
@@ -152,6 +158,7 @@ async def get(self, acct_id):
             await self.render('acct/proclass-update', proclass_id=proclass_id, proclass=proclass)
 
     @reqenv
+    @require_permission([UserConst.ACCTTYPE_USER, UserConst.ACCTTYPE_KERNEL])
     async def post(self, acct_id):
         reqtype = self.get_argument('reqtype')
         acct_id = int(acct_id)
diff --git a/src/handlers/base.py b/src/handlers/base.py
index dae5440b..9f35a386 100644
--- a/src/handlers/base.py
+++ b/src/handlers/base.py
@@ -15,7 +15,8 @@
 import utils.htmlgen
 
 TEMPLATE_NAMESPACE = {
-    'set_page_title': utils.htmlgen.set_page_title
+    'set_page_title': utils.htmlgen.set_page_title,
+    'markdown_escape': utils.htmlgen.markdown_escape,
 }
 
 class RequestHandler(tornado.web.RequestHandler):
diff --git a/src/handlers/manage/pro.py b/src/handlers/manage/pro.py
index f07999ac..71ea544d 100644
--- a/src/handlers/manage/pro.py
+++ b/src/handlers/manage/pro.py
@@ -890,54 +890,34 @@ async def post(self, page=None):
                     self.error(err)
                     return
 
-                ALLOW_COMPILERS = ChalConst.ALLOW_COMPILERS
+                ALLOW_COMPILERS = set(list(ChalConst.ALLOW_COMPILERS) + ['default'])
                 if pro['testm_conf']['is_makefile']:
-                    ALLOW_COMPILERS = ['gcc', 'g++', 'clang', 'clang++', 'default']
+                    ALLOW_COMPILERS = {'gcc', 'g++', 'clang', 'clang++', 'default'}
 
-                def _check(comp_type, limit):
-                    if comp_type not in ALLOW_COMPILERS and comp_type != "default":
-                        return False
-
-                    if 'timelimit' not in limit:
-                        return False
+                new_limits = {}
+                for comp_type, limit in limits.items():
+                    if comp_type not in ALLOW_COMPILERS:
+                        continue
                     try:
-                        int(limit['timelimit'])
-                    except ValueError:
-                        return False
-
-                    if 'memlimit' not in limit:
-                        return False
+                        limit['timelimit'] = max(int(limit['timelimit']), 0)
+                        limit['memlimit'] = max(int(limit['memlimit']) * 1024, 0)
+                    except (ValueError, KeyError):
+                        continue
 
-                    try:
-                        int(limit['memlimit'])
-                    except ValueError:
-                        return False
+                    new_limits[comp_type] = limit
 
-                    return True
-
-                limits = { comp_type:limit for comp_type, limit in limits.items() if _check(comp_type, limit) }
-                if 'default' not in limits:
+                if 'default' not in new_limits:
                     self.error('Eparam')
                     return
 
-                for _, limit in limits.items():
-                    limit['timelimit'] = int(limit['timelimit'])
-                    limit['memlimit'] = int(limit['memlimit']) * 1024
-
-                    if limit['timelimit'] < 0:
-                        limit['timelimit'] = 0
-
-                    if limit['memlimit'] < 0:
-                        limit['memlimit'] = 0
-
-                pro['testm_conf']['limit'] = limits
+                pro['testm_conf']['limit'] = new_limits
                 await ProService.inst.update_test_config(pro_id, pro['testm_conf'])
 
                 await LogService.inst.add_log(
                     f"{self.acct.name} has sent a request to update the problem #{pro_id}",
                     'manage.pro.update.limit',
                     {
-                        'limits': limits
+                        'limits': new_limits
                     }
                 )
 
@@ -999,11 +979,14 @@ def _check(comp_type, limit):
                 self.error(err)
                 return
 
+            log_type = ""
             async with self.db.acquire() as con:
                 if is_all_chal:
                     sql = ""
+                    log_type = "manage.chal.rechalall"
                 else:
                     sql = '''AND "challenge_state"."chal_id" IS NULL'''
+                    log_type = "manage.chal.rechal"
                 result = await con.fetch(
                     f'''
                         SELECT "challenge"."chal_id", "challenge"."compiler_type" FROM "challenge"
@@ -1015,7 +998,7 @@ def _check(comp_type, limit):
                 )
             await LogService.inst.add_log(
                 f"{self.acct.name} made a request to rejudge the problem #{pro_id} with {len(result)} chals",
-                'manage.chal.rechal',
+                log_type,
             )
 
             # TODO: send notify to user
diff --git a/src/services/pro.py b/src/services/pro.py
index e9dc06fe..c5edc01f 100644
--- a/src/services/pro.py
+++ b/src/services/pro.py
@@ -339,19 +339,37 @@ async def unpack_pro(self, pro_id, pack_type, pack_token):
 
             check_type = self._get_check_type(conf["check"])
 
-            ALLOW_COMPILERS = list(ChalConst.ALLOW_COMPILERS) + ['default']
+            ALLOW_COMPILERS = set(list(ChalConst.ALLOW_COMPILERS) + ['default'])
             if is_makefile:
-                ALLOW_COMPILERS = ['default', 'gcc', 'g++', 'clang', 'clang++']
+                ALLOW_COMPILERS = {'default', 'gcc', 'g++', 'clang', 'clang++'}
 
             if "limit" in conf:
-                limit = {lang: lim for lang, lim in conf["limit"].items() if lang in ALLOW_COMPILERS}
+                limits = {}
+                for comp_type, limit in conf["limit"].items():
+                    if comp_type not in ALLOW_COMPILERS:
+                        continue
+
+                    try:
+                        limit['timelimit'] = max(int(limit['timelimit']), 0)
+                        limit['memlimit'] = max(int(limit['memlimit']) * 1024, 0)
+                    except (ValueError, KeyError):
+                        continue
+
+                    limits[comp_type] = limit
+
+                if 'default' not in limits:
+                    return "Econf", None
+
             elif 'timelimit' in conf and 'memlimit' in conf:
-                limit = {
-                    'default': {
-                        'timelimit': conf["timelimit"],
-                        'memlimit': conf["memlimit"] * 1024
+                try:
+                    limits = {
+                        'default': {
+                            'timelimit': int(conf["timelimit"]),
+                            'memlimit': int(conf["memlimit"]) * 1024
+                        }
                     }
-                }
+                except ValueError:
+                    return "Econf", None
             else:
                 return "Econf", None
 
@@ -363,7 +381,7 @@ async def unpack_pro(self, pro_id, pack_type, pack_token):
                 await con.execute('DELETE FROM "test_config" WHERE "pro_id" = $1;', int(pro_id))
                 await con.execute(
                     'UPDATE "problem" SET is_makefile = $1, check_type = $2, chalmeta = $3, "limit" = $4 WHERE pro_id = $5',
-                    is_makefile, check_type, json.dumps(chalmeta), json.dumps(limit), pro_id
+                    is_makefile, check_type, json.dumps(chalmeta), json.dumps(limits), pro_id
                 )
 
                 insert_sql = []
diff --git a/src/static/index.js b/src/static/index.js
index 3e693113..dcf39fae 100644
--- a/src/static/index.js
+++ b/src/static/index.js
@@ -368,5 +368,11 @@ var index = new function() {
         }
 	    return new WebSocket(ws_link);
     };
+
+    that.unescape_html = function(html) {
+        const parser = new DOMParser();
+        const doc = parser.parseFromString(text, 'text/html');
+        return doc.documentElement.textContent;
+    };
 };
 
diff --git a/src/static/templ/acct/proclass-update.html b/src/static/templ/acct/proclass-update.html
index 9853aa5d..16e34e4b 100644
--- a/src/static/templ/acct/proclass-update.html
+++ b/src/static/templ/acct/proclass-update.html
@@ -2,7 +2,7 @@
     function init() {
         let j_form = $("#form");
         let re = /[^0-9,\ ]/;
-        j_form.find("#desc").val(`{% raw proclass['desc'].replace('`', '\\`').replace('\\', '\\\\') %}`);
+        j_form.find("#desc").val(index.unescape_html(`{{ markdown_escape(proclass['desc']) }}`));
 
         let desc_textarea = document.getElementById('desc');
         let desc_preview = document.getElementById('descPreviewDialog');
diff --git a/src/static/templ/acct/profile.html b/src/static/templ/acct/profile.html
index d09de566..88392b41 100644
--- a/src/static/templ/acct/profile.html
+++ b/src/static/templ/acct/profile.html
@@ -1,3 +1,4 @@
+{% from services.chal import ChalConst %}
 <style>
     #cover {
         height: 512px;
@@ -124,32 +125,24 @@ <h3>基本情報</h3>
     <div class="col-lg-9">
         <table class="table" style="font-size: 130%;" border="1px" bordercolor="gray">
             <tbody>
-                {% set count = 0 %}
-                {% for pro in prolist%}
-                    {% if count == 10 %}
-                    </tr>
-                    {% set count = 0 %}
-                    {% end %}
-                    {% if count == 0 %}
+                {% for chunk in prolist %}
                     <tr>
+                    {% for cnt, pro in enumerate(chunk, start=1) %}
+                        {% if pro['state'] is None %}
+                            <td class="_state"><a class="_state-4" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
+                        {% elif pro['state'] == ChalConst.STATE_AC %}
+                            <td class="_state"><a class="_state-1" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
+                        {% elif pro['state'] in [ChalConst.STATE_PC, ChalConst.STATE_WA] and pro['score'] > 0 %}
+                            <td class="_state"><a class="_state-2" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
+                        {% else %}
+                            <td class="_state"><a class="_state-3" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
+                        {% end %}
                     {% end %}
-                    {% if pro['score'] == 100 %}
-                    <td class="_state"><a class="_state-1" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
-                    {% elif pro['score'] == -1 %}
-                    <td class="_state"><a class="_state-4" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
-                    {% elif pro['score'] >= 50 %}
-                    <td class="_state"><a class="_state-2" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
-                    {% else %}
-                    <td class="_state"><a class="_state-3" href="/oj/pro/{{pro['pro_id']}}/">{{pro['pro_id']}}</a></td>
+                    </tr>
+                    {% while cnt != 10 %}
+                        <td></td>
+                        {% set cnt = cnt + 1 %}
                     {% end %}
-                {% set count = count + 1 %}
-                {% end %}
-                {%if count != 10%}
-                {% while count != 10 %}
-                    <td></td>
-                    {% set count = count + 1 %}
-                {% end %}
-                </tr>
                 {% end %}
 	        </tbody>
        </table>
diff --git a/src/static/templ/bulletin.html b/src/static/templ/bulletin.html
index ec6a47f3..d9d3a13e 100644
--- a/src/static/templ/bulletin.html
+++ b/src/static/templ/bulletin.html
@@ -1,9 +1,9 @@
 <script>
     function init() {
-        let desc_tex = `{% raw bulletin['content'].replace('\\', '\\\\').replace('`', '\\`') %}`
+        let desc_tex = `{{ markdown_escape(bulletin['content']) }}`;
 
         let descEle = document.getElementById('content');
-        descEle.innerHTML = DOMPurify.sanitize(marked.parse(desc_tex));
+        descEle.innerHTML = DOMPurify.sanitize(marked.parse(index.unescape_html(desc_tex)));
         MathJax.Hub.Queue(["Typeset",MathJax.Hub, descEle]);
     }
 </script>
diff --git a/src/static/templ/challist.html b/src/static/templ/challist.html
index 8d17ba9f..3b99b04a 100644
--- a/src/static/templ/challist.html
+++ b/src/static/templ/challist.html
@@ -209,6 +209,7 @@
     </div>
 
     <div class="col-lg-10 col-12">
+        <div class="table-responsive">
         <table id="challist" class="table table-striped table-hover table-sm table-responsive-sm col mx-lg-3">
             <thead>
                 <tr>
@@ -249,6 +250,7 @@
             {% end %}
             </tbody>
         </table>
+        </div>
 
         {% from tornado.escape import url_escape %}
 
diff --git a/src/static/templ/contests/info.html b/src/static/templ/contests/info.html
index 005cd9cb..3e296daf 100644
--- a/src/static/templ/contests/info.html
+++ b/src/static/templ/contests/info.html
@@ -2,15 +2,15 @@
 <script>
     function init() {
         {% if not contest.is_start() %}
-            let desc_tex = `{% raw contest.desc_before_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
+            let desc_tex = `{{ markdown_escape(contest.desc_before_contest) }}`;
         {% elif contest.is_running() %}
-            let desc_tex = `{% raw contest.desc_during_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
+            let desc_tex = `{{ markdown_escape(contest.desc_during_contest) }}`;
         {% elif contest.is_end() %}
-            let desc_tex = `{% raw contest.desc_after_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
+            let desc_tex = `{{ markdown_escape(contest.desc_after_contest) }}`;
         {% end %}
 
         let descEle = document.getElementById('desc');
-        descEle.innerHTML = DOMPurify.sanitize(marked.parse(desc_tex));
+        descEle.innerHTML = DOMPurify.sanitize(marked.parse(index.unescape_html(desc_tex)));
         MathJax.Hub.Queue(["Typeset",MathJax.Hub, descEle]);
     }
 </script>
diff --git a/src/static/templ/contests/manage/desc-edit.html b/src/static/templ/contests/manage/desc-edit.html
index 825bac2c..b4897d25 100644
--- a/src/static/templ/contests/manage/desc-edit.html
+++ b/src/static/templ/contests/manage/desc-edit.html
@@ -7,9 +7,9 @@
         let desc_preview = document.getElementById('descPreviewDialog');
         let desc_preview_modal = new bootstrap.Modal(desc_preview);
 
-        let desc_before_contest = `{% raw contest.desc_before_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
-        let desc_during_contest = `{% raw contest.desc_during_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
-        let desc_after_contest = `{% raw contest.desc_after_contest.replace('\\', '\\\\').replace('`', '\\`') %}`;
+        let desc_before_contest = index.unescape_html(`{{ markdown_escape(contest.desc_before_contest) }}`);
+        let desc_during_contest = index.unescape_html(`{{ markdown_escape(contest.desc_during_contest) }}`);
+        let desc_after_contest = index.unescape_html(`{{ markdown_escape(contest.desc_after_contest) }}`);
 
         let cur_desc_type = 'before';
         const is_unsaved = () => {
@@ -128,4 +128,4 @@ <h2>Preview Markdown Render</h2>
 </div>
 
 
-{% end %}
\ No newline at end of file
+{% end %}
diff --git a/src/static/templ/index.html b/src/static/templ/index.html
index 3f5b6a52..d1c5ba67 100644
--- a/src/static/templ/index.html
+++ b/src/static/templ/index.html
@@ -20,7 +20,7 @@
     crossorigin="anonymous" referrerpolicy="no-referrer"></script>
   <script src="/oj/index.js"></script>
   <script src="/oj/pack.js"></script>
-  <script src="/oj/third/pdf.min.js" defer=""></script>
+  <script type="module"> import pdfjsDist from 'https://cdn.jsdelivr.net/npm/pdfjs-dist@4.7.76/+esm' </script>
   <script src="/oj/third/mathjax/MathJax.js?config=TeX-AMS-MML_HTMLorMML" async></script>
   <script type="text/x-mathjax-config">
     MathJax.Hub.Config({
diff --git a/src/static/templ/log.html b/src/static/templ/log.html
index 24773275..2aab2716 100644
--- a/src/static/templ/log.html
+++ b/src/static/templ/log.html
@@ -9,4 +9,4 @@
 <p>{{ log['message'] }}</p>
 
 <label for="" class="form-control">Params</label>
-<p style="white-space: pre-wrap;">{% raw log['params'] %}</p>
+<p style="white-space: pre-wrap;">{{ json.dumps(log['params'], indent=4) }}</p>
diff --git a/src/static/templ/manage/bulletin/update.html b/src/static/templ/manage/bulletin/update.html
index 96a2a479..4043fabf 100644
--- a/src/static/templ/manage/bulletin/update.html
+++ b/src/static/templ/manage/bulletin/update.html
@@ -5,7 +5,7 @@
     function init() {
         // TODO: 有更改尚未儲存跳個通知出來
         let j_form = $("#form");
-        j_form.find("#content").val(`{% raw bulletin['content'].replace('`', '\\`').replace('\\', '\\\\') %}`);
+        j_form.find("#content").val(index.unescape_html(`{{ markdown_escape(bulletin['content']) }}`));
 
         let content_textarea = document.getElementById('content');
         let desc_preview = document.getElementById('descPreviewDialog');
diff --git a/src/static/templ/manage/proclass/update.html b/src/static/templ/manage/proclass/update.html
index 279fc8a4..df7bb36a 100644
--- a/src/static/templ/manage/proclass/update.html
+++ b/src/static/templ/manage/proclass/update.html
@@ -6,7 +6,7 @@
         let j_form = $("#form");
         let re = /[^0-9,\ ]/;
 
-        j_form.find("#desc").val(`{% raw proclass['desc'].replace('`', '\\`').replace('\\', '\\\\') %}`);
+        j_form.find("#desc").val(index.unescape_html(`{{ markdown_escape(proclass['desc']) }}`));
 
         let desc_textarea = document.getElementById('desc');
         let desc_preview = document.getElementById('descPreviewDialog');
diff --git a/src/static/templ/pro.html b/src/static/templ/pro.html
index c3dfe126..32519765 100644
--- a/src/static/templ/pro.html
+++ b/src/static/templ/pro.html
@@ -1,4 +1,5 @@
 <link rel="stylesheet" type="text/css" href="/oj/pro.css">
+<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/pdf.js/4.7.76/pdf_viewer.min.css" integrity="sha512-8LkkqbXJPviYJENC5Z8qC2uKz27x0tNgrZbzsAzt7zkw0/2lXtSdrslVhfrkcR+6LRmxjZxlqniSyWXimoaH5g==" crossorigin="anonymous" referrerpolicy="no-referrer" />
 <script type="text/x-mathjax-config">
     MathJax.Hub.Config({
         tex2jax:{
@@ -18,23 +19,8 @@
     {% end %}
 
     function init() {
-        var scriptTag = document.createElement('script');
-        scriptTag.src = 'https://toj.tfcis.org/oj/third/pdf_find_bar.js';
-        document.head.appendChild(scriptTag);
-
-        scriptTag = document.createElement('script');
-        scriptTag.src = 'https://toj.tfcis.org/oj/third/pdf_find_controller.js';
-        document.head.appendChild(scriptTag);
-
-        scriptTag = document.createElement('script');
-        scriptTag.src = 'https://toj.tfcis.org/oj/third/text_layer_builder.js';
-        document.head.appendChild(scriptTag);
-
-        scriptTag = document.createElement('script');
-        scriptTag.src = 'https://toj.tfcis.org/oj/third/ui_utils.js';
-        document.head.appendChild(scriptTag);
-
-        PDFJS.workerSrc = 'https://toj.tfcis.org/oj/third/pdf.worker.js'
+        let PDFJS = pdfjsLib;
+        PDFJS.workerSrc = 'https://cdnjs.cloudflare.com/ajax/libs/pdf.js/4.7.76/pdf.worker.min.mjs';
 
         $('#tags').keydown(function(event) {
             if (event.which == 13) // return
@@ -69,7 +55,7 @@
             downloadLink.click();
         });
 
-        var viewer = 1;
+        let viewer = 1;
         $('#switchviewer').on('click', function() {
             if (viewer == 1) {
                 _load_pdf_embed();
@@ -80,7 +66,7 @@
             }
         });
 
-        var j_cont = $('#cont');
+        let j_cont = $('#cont');
 
         function _load_html() {
             scriptTag = document.createElement('script');
@@ -109,58 +95,50 @@
         }
 
         function _load_pdf_js() {
-            PDFJS.getDocument(pdf_url).then(function(pdf) {
-                var i;
+            PDFJS.getDocument(pdf_url).promise.then(function(pdf) {
                 j_cont.empty();
-                for (i = 1; i <= pdf.numPages; i++) {
-                    var j_page = $('<div id="pdf-page-' + i + '"></div>');
+                for (let i = 1; i <= pdf.numPages; i++) {
+                    let j_page = $('<div id="pdf-page-' + i + '"></div>');
                     j_cont.append(j_page)
                 }
 
-                for (i = 0;i < pdf.numPages; i++) {
+                for (let i = 0; i < pdf.numPages; i++) {
                     pdf.getPage(i + 1).then(function(idx){return function(page) {
-                        var j_page = $('#pdf-page-' + idx);
-                        var j_canvas = $('<canvas style="width:100%; margin-bottom:16px; display:block;"></canvas>');
-                        var j_div = $('<div></div>');
-                        var ctx = j_canvas[0].getContext('2d');
-                        var offset;
-                        var viewport;
+                        let j_page = $('#pdf-page-' + idx);
+                        let j_canvas = $('<canvas style="width:100%; margin: 0; display:block;"></canvas>');
+                        let j_div = $('<div></div>');
+                        let ctx = j_canvas[0].getContext('2d');
+                        let offset = j_canvas[0].getBoundingClientRect();
+                        let viewport;
 
                         j_page.append(j_canvas);
 
-                        offset = j_canvas.offset();
-                        viewport = page.getViewport(
-                            j_canvas.width() / page.getViewport(1.0).width);
+                        scale = j_canvas.width() / page.getViewport({scale: 1}).width;
+                        viewport = page.getViewport({scale: scale});
 
                         j_canvas.attr('width', viewport.width);
                         j_canvas.attr('height', viewport.height);
-
-                        j_div.addClass('textlayer');
-                        j_div.css('width', viewport.width);
-                        j_div.css('height', viewport.height);
-                        j_div.offset({'top':offset.top, 'left':offset.left});
+                        j_div.addClass('textLayer');
+                        j_div.offset({'top': offset.top, 'left': offset.left});
+                        j_div[0].style.setProperty('--scale-factor', viewport.scale);
 
                         j_page.append(j_div);
 
-                        page.getTextContent().then(function(text) {
-                            var textlayer = new TextLayerBuilder({
-                                'textLayerDiv': j_div[0],
-                                'viewport': viewport,
-                                'pageIndex': idx
-                            });
-
-                            textlayer.setTextContent(text);
-
-                            page.render({
-                                'canvasContext': ctx,
-                                'viewport': viewport,
-                                'textLayer': textlayer
+                        page.render({canvasContext: ctx, viewport: viewport}).promise.then(function () {
+                            return page.getTextContent();
+                        }).then(function (text) {
+                            const textLayer = new PDFJS.TextLayer({
+                                textContentSource: text,
+                                container: j_div[0],
+                                viewport: viewport,
                             });
+                            textLayer.render();
                         });
                     };}(i + 1));
                 }
             });
         }
+
         function _load_pdf_embed() {
             j_cont.empty();
             var embed = $(`<embed width="100%" height="100%" src="${pdf_url}" type="application/pdf">`);
diff --git a/src/static/templ/proset.html b/src/static/templ/proset.html
index 75f1e6ec..90caf0f7 100644
--- a/src/static/templ/proset.html
+++ b/src/static/templ/proset.html
@@ -60,12 +60,12 @@
         });
 
         {% if cur_proclass %}
-            let cur_proclass_desc = `{% raw cur_proclass['desc'].replace('`', '\\`').replace('\\', '\\\\') %}`;
+            let cur_proclass_desc = `{{ markdown_escape(cur_proclass['desc']) }}`;
             let info_dialog = document.getElementById('proclassInfoDialog');
             let info_dialog_modal = new bootstrap.Modal(info_dialog);
             $("#infoProClass").on('click', function(e) {
                 let body = info_dialog.querySelector('.modal-body');
-                body.innerHTML = DOMPurify.sanitize(marked.parse(cur_proclass_desc));
+                body.innerHTML = DOMPurify.sanitize(marked.parse(index.unescape_html(cur_proclass_desc)));
 
                 // NOTE: close info dialog before navigating to another page.
                 info_dialog.querySelectorAll('a').forEach(el => {
@@ -320,7 +320,8 @@ <h2>Created By: Official</h2>
     </div>
 
     <div class="col-lg-10 col-12">
-        <table id="prolist" class="table table-striped table-hover table-responsive col mx-lg-3">
+        <div class="table-responsive">
+        <table id="prolist" class="table table-striped table-hover table-responsive-sm col mx-lg-3">
             <thead>
                 <tr>
                     <th scope="col">#</th>
@@ -372,8 +373,8 @@ <h2>Created By: Official</h2>
             {% end %}
             </tbody>
         </table>
+        </div>
 
-        <!-- TODO: Sort By & Problem Selector -->
         {% set postfix = '' %}
         {% if cur_proclass != None %}
         {% set postfix = postfix + '&proclass_id=%s' % cur_proclass['proclass_id'] %}
diff --git a/src/tests/e2e/bulletin.py b/src/tests/e2e/bulletin.py
index 3bf8ffb7..da993a01 100644
--- a/src/tests/e2e/bulletin.py
+++ b/src/tests/e2e/bulletin.py
@@ -1,6 +1,9 @@
 import re
 
 from tornado.websocket import websocket_connect
+from tornado.escape import xhtml_escape
+
+from utils.htmlgen import markdown_escape
 
 from .util import AsyncTest, AccountContext
 
@@ -62,6 +65,32 @@ def _message(msg):
             res = admin_session.get('bulletin/2')
             self.assertEqual(re.findall(r'let desc_tex = `(.*)`', res.text, re.I)[0], 'bulletin 2')
 
+            markdown_content ='''<script>alert(1)</script>
+```cpp
+#include <iostream>
+using namespace std;
+
+int main() {
+    cout << "escape test\\n" << endl;
+    cout << "escape test\\" << endl;
+}
+```
+            '''
+            res = admin_session.post('manage/bulletin/update', data={
+                'reqtype': 'update',
+                'bulletin_id': 2,
+                'title': 'bulletin 2 (pinned) updated',
+                'content': markdown_content,
+                'color': 'red',
+                'pinned': 'true',
+            })
+            self.assertEqual(res.text, 'S')
+
+            html = self.get_html('bulletin/2', admin_session)
+            self.assertEqual(html.select_one('h2').text.strip(), 'bulletin 2 (pinned) updated')
+            res = admin_session.get('bulletin/2')
+            self.assertEqual(re.findall(r'let desc_tex = `(.*)`;', res.text, re.DOTALL)[0].strip(), xhtml_escape(markdown_escape(markdown_content)).strip())
+
             res = admin_session.post('manage/bulletin/update', data={
                 'reqtype': 'remove',
                 'bulletin_id': '2',
diff --git a/src/tests/e2e/contest.py b/src/tests/e2e/contest.py
index aa0904f1..1b4803d5 100644
--- a/src/tests/e2e/contest.py
+++ b/src/tests/e2e/contest.py
@@ -12,7 +12,6 @@
 
 class ContestTest(AsyncTest):
     async def main(self):
-        # TODO: update chal_id counter
         # TOOD: add special score test
         self.signup('contest1', 'contest1@test', 'test')  # acct_id = 4
         self.signup('contest2', 'contest2@test', 'test')
@@ -79,9 +78,9 @@ async def main(self):
             self.assertEqual(res.text, 'S')
 
             res = admin_session.get('contests/1/manage/desc')
-            self.assertEqual(re.findall(r'let desc_before_contest = `(.*)`', res.text, re.I)[0], 'desc before contest')
-            self.assertEqual(re.findall(r'let desc_during_contest = `(.*)`', res.text, re.I)[0], 'desc during contest')
-            self.assertEqual(re.findall(r'let desc_after_contest = `(.*)`', res.text, re.I)[0], 'desc after contest')
+            self.assertEqual(re.findall(r'let desc_before_contest = index\.unescape_html\(`(.*)`\)', res.text, re.I)[0], 'desc before contest')
+            self.assertEqual(re.findall(r'let desc_during_contest = index\.unescape_html\(`(.*)`\)', res.text, re.I)[0], 'desc during contest')
+            self.assertEqual(re.findall(r'let desc_after_contest = index\.unescape_html\(`(.*)`\)', res.text, re.I)[0], 'desc after contest')
 
             res = admin_session.get('contests/1')
             self.assertEqual(re.findall(r'let desc_tex = `(.*)`', res.text, re.I)[0], 'desc before contest')
diff --git a/src/tests/e2e/proclass.py b/src/tests/e2e/proclass.py
index fb931a88..996eb264 100644
--- a/src/tests/e2e/proclass.py
+++ b/src/tests/e2e/proclass.py
@@ -22,7 +22,7 @@ async def main(self):
             self.assertEqual(html.select_one('input#list').attrs.get('value'), '1')
             self.assertIsNotNone(html.select('select#type > option')[1].attrs.get('selected'))
             res = admin_session.get('manage/proclass/update?proclassid=1')
-            self.assertEqual(re.findall(r'j_form\.find\("#desc"\)\.val\(`(.*)`\);', res.text, re.I)[0], 'desc')
+            self.assertEqual(re.findall(r'j_form\.find\("#desc"\)\.val\(index\.unescape_html\(`(.*)`\)\);', res.text, re.I)[0], 'desc')
 
             html = self.get_html('proset?proclass_id=1', admin_session)
             trs = html.select('#prolist > tbody > tr')
@@ -78,7 +78,7 @@ async def main(self):
             self.assertEqual(html.select_one('input#list').attrs.get('value'), '1, 2')
             self.assertIsNotNone(html.select('select#type > option')[0].attrs.get('selected'))
             res = admin_session.get('manage/proclass/update?proclassid=1')
-            self.assertEqual(re.findall(r'j_form\.find\("#desc"\)\.val\(`(.*)`\);', res.text, re.I)[0], 'desc desc')
+            self.assertEqual(re.findall(r'j_form\.find\("#desc"\)\.val\(index\.unescape_html\(`(.*)`\)\);', res.text, re.I)[0], 'desc desc')
 
             html = self.get_html('proset?proclass_id=1', admin_session)
             trs = html.select('#prolist > tbody > tr')
@@ -204,7 +204,7 @@ async def main(self):
             self.assertEqual(html.select_one('input#list').attrs.get('value'), '1')
             self.assertIsNotNone(html.select('select#type > option')[0].attrs.get('selected'))
             res = admin_session.get('acct/proclass/1?page=update&proclassid=2')
-            self.assertEqual(re.findall(r'j_form\.find\("#desc"\)\.val\(`(.*)`\);', res.text, re.I)[0], 'desc desc')
+            self.assertEqual(re.findall(r'j_form\.find\("#desc"\)\.val\(index\.unescape_html\(`(.*)`\)\);', res.text, re.I)[0], 'desc desc')
 
             with AccountContext('test1@test', 'test') as user_session:
                 res = user_session.get('proset?proclass_id=2')
diff --git a/src/utils/htmlgen.py b/src/utils/htmlgen.py
index e176404f..e54dc657 100644
--- a/src/utils/htmlgen.py
+++ b/src/utils/htmlgen.py
@@ -15,3 +15,6 @@ def set_page_title(title: str, site_title: str = None):
         document.title = "{t}";
     </script>
     """
+
+def markdown_escape(code: str) -> str:
+    return code.replace('`', '\\`').replace('\\', '\\\\')