Open Southclaws opened 7 years ago
Paths should not point outside the game directory. For example "../malicious.bat" or "C:\malicious\hacks.exe" are forbidden Resources should be listed like this for example:
"resources": {
"./SAMP/CUSTOM.ide": "http://some-domain.com/CUSTOM.ide",
"./SAMP/custom.img": "http://some-domain.com/custom.img",
"./SAMP/CUSTOM.ipl": "http://some-domain.com/CUSTOM.ipl"
}
or
"resources": [
{
"path": "./SAMP/CUSTOM.ide",
"uri": "http://some-domain.com/CUSTOM.ide"
},
{
"path": "./SAMP/custom.img",
"uri": "http://some-domain.com/custom.img"
},
{
"path": "./SAMP/CUSTOM.ipl",
"uri": "http://some-domain.com/CUSTOM.ipl"
}
]
I could also check against a set of valid extensions, or even (if there are no new files, only replacements) check that the path is present in a list of existing paths. I could also grab some info from VirusTotal too since it accepts URLs, so the actual API server wouldn't need to do any downloading.
I see, I like it, but I feel that only files from the SAMP folder are not enough for such a great feature.
What about:
All those wont be able to be used if you don't enable those types of mods.
I know security is a problem, and it always will be, but don't just cut them out just because of that.
Theres a client like tool called ModLoader that can load into your GTA SA pretty much every modification without replacing any files. Just drop the mod you want to install into the ModLoader's folder and it will install everything to you. Will even merge handling, fxt, gxt, img, and many more files so you dont need to edit any original file. Want to remove a mod? Just delete the folder. It can even refresh the mods on demand (replace a vehicle/skin/effect/animation... model to another, will load, replace it for the client and wont crash).
Just make sure the server owner needs to use this tool and SAMPLauncherNET can install everything.
When the client request to join a server with custom mods SAMPLauncherNET would install:
When the client requests to leave a server SAMPLauncherNET would uninstall:
Locking this to the SAMP or GTA directories sounds fine, however this could still lead to loading a malicious library into the game.
Or, I could just provide a simple API and let the actual launcher decide what's valid.
CSL aka. SAMPLauncherNET can already load ASI plugins, so there is no need to download Silent's ASI loader for that. Additionally CSL could implement features that exists in ModLoader. The plus site of that you don't have to clutter your GTA SA installation with files that have to be replaced to make the game moddable.
To be used in conjunction with https://github.com/Bios-Marcel/ServerBrowser/issues/18
servers/
endpoint so listings can filter by it.