Feature: open URL in browser from AGS

[ericoporto]

Describe the problem People want to have links from their games to their webpages, a demo game may have a link to the full game on Steam or other platforms.

Currently, this is done using the shell plugin. But this plugin can be used for anything, and it have access to do anything in the user computer - even though most of the usage is just for opening an URL.

Suggested change I propose a System.OpenURL (or System.AppOpenURL to avoid mistaking with curl like functionality) method that uses SDL_OpenURL behind the scenes.

• I know in Love case they hand implemented their own because they added before SDL 2.0.14, when it was added. We could just add a version check and do nothing if SDL is lower than this version.
• Game maker has url_open and url_open_ext, where the last one is mainly for the web port of theirs, so you can choose if the link opens in the same tab or a new tab or window.
• in Unity there's a note recommending people never pass user modifiable strings, for security reasons. Perhaps we could make the method only work with const strings? Not sure that is possible.
• Unreal names their function LaunchURL, but has no specific remarks.
• Godot names their method OS.shell_open but it appears to just be the same as SDL.

There's a chance people may want to disable this or we may decide that anything beyond http is not allowed.

In any case, for the time being I plan to make a plugin because people are using my agsshell plugin, but the nice thing of being in engine would be working cross-platform easily - it's specially nice to have in the webport.

Additional Context In the meantime, I started a plugin implementation, just to reduce agsshell usage, as that one could do unlimited things in the user computer. ericoporto/agsappopenurl

If it's alright I would like to add a stub for it's method in the engine, so at least it can be used instead of agsshell and if someone doesn't want it, they can remove it and still play the game. (https://github.com/ericoporto/ags/tree/add-agsappopenurl-stubs)

[messengerbag]

It sounds like a sensible idea, but in this case I would suggest adding an engine configuration setting to permit or block such outside calls.

While I generally think configuration options should be kept to a minimum, this is something that could be abused, and some way for players to prevent that would be required, I think. (Though to be entirely safe you would also need to prevent the game script from modifying the configuration setting, which might be a bit tricky, since in other cases you want to be able to change configuration settings in-game.)

[ericoporto]

We could borrow a bit from a "permission system", where there are three settings: allow, ask, block, and then we could default to ask - if such config is not set in acsetup or something. The idea is ask gives the player a question box of "this game wants to open urls using your system - allow once, allow, deny".

Or just never use files/config and always ask on each playthrough, once the method is invoked - and make sure method is considered blocking.

The only problem is such box would look super ugly in commercial games, where my guess people expect clicking to just load the browser.

There is another strategy that is adding a new type of button in the GUI system (say link_button), and make sure it can only be activated by actually clicking in it, so links have to be done using such button - and not through scripting.