search

eternalcodes / EternalJK

Effort to maintain and improve OpenJK
GNU General Public License v2.0
63 stars 23 forks source link

HTTP Auto download feature #25

Open videoP opened 6 years ago

videoP commented 6 years ago

Seen here: https://github.com/mvdevs/jk2mv/commit/1214cef23aa673ba1ec227e02586bab8ba03b42c

I know lots of people want this.

CansecoDev commented 4 years ago

I'm looking forward for this. It's been some time, if no one is into this I could give a try to implement this.

CansecoDev commented 2 years ago

Just a note to add that JK2MV already implements this here:

https://github.com/mvdevs/jk2mv/blob/master/src/qcommon/net_http.cpp

eternalcodes commented 2 years ago

This seems like a bad idea in terms of security. This is using the mongoose embedded web server. By using this you open yourself up to potential vulnerabilities if you don't keep the library up to date with upstream. It would be better if we could hand off http downloads to a web server that we know will be kept updated and secure.

Bucky21659 commented 2 years ago

The only reason the JK2MV autodownload works so well is because JK2MV was adopted pretty much globally by the community, the same will likely never happen with JKA unless it's implemented into OpenJK. Eternal is right in regards to security, unlike JK2, JKA loads native libraries out of pk3 files, so a malicious server could easily backdoor clients with a custom ui & a conveniently named PK3 file. I know that NewJK/NewMod has an autodownload system, but I haven't looked into it too closely to see how they handled these issues.

The approach I've always wanted to take would be to make use of JKHub as a CDN (see here: https://github.com/jampio/jkpak ) but that brings it's own issues like needing to manually curate a list of map names and their respective downloads. I did talk to Caelum about exposing the information a system like this would need a few years back, but I don't think he ever got to doing it.