sl-service-account
commented
8 years ago Kadah Coba commented at 2015-12-06T03:31:50Z, updated at 2015-12-06T04:22:27Z
There is a way around the throttle by using events, but on the Valhalla/CEF viewer, SLURLs are blocked completely it seems.
A SLurl was received from an untrusted browser and has been blocked for your security.
A simple example use of SLURLs on moap would be an interactive in-world map for a set of regions to allow the resident to TP to different parts easily.
Edit: Looks like TP/map SLURLs from 3rd party sites are fine on MOAP but chat ones are blocked.
How would you like the feature to work?
For clarification I'm talking about the viewer URI name space as outlined here: http://wiki.secondlife.com/wiki/Viewer_URI_Name_Space
Gonna update this since all major viewers are on CEF now
Current issues:
Currently all SL URIs are blocked from shared media. This breaks plenty of existing content as many HUDs rely on sending secondlife:/// commands to interact with SL without the need for a third party server.
The Firestorm implementation allows all SLURLs through without filtering. This is a major security issue as prim media can mess with people by using javascript.
There is a 5 sec limit to the SLURLs allowed from a site on Firestorm. This needs to be either removed or significantly reduced.
Proposed fix:
Once a URI is received from a browser (not chat link), show a permission popup with something like: "domain.com wants to run SL URIs on your viewer", [Accept Once, Whitelist, Block].
Remove the 5 sec limit. It would be redundant and break potentially great features that come with valhalla.
Why is this feature important to you? How would it benefit the community?
Say I wanted to create a rhythm game once the project valhalla browser is added to the official viewer. Musical games in SL don't work well due to lag, sounds not loading in time, etc. But with HTML5 you can build the entire game to run on shared media. The actual game would then run clientside and communicate with SL by using the app/chat URI with javascript. This leads to a better experience for the user, and less resources needed by the simulator.
Obviously we still don't have a method of communicating SL->browser by script, but I'll leave that for another JIRA.
Original Jira Fields
| Field | Value | | ------------- | ------------- | | Issue | BUG-10866 | | Summary | The SL URI implementation could use an update | | Type | New Feature Request | | Priority | Unset | | Status | Accepted | | Resolution | Accepted | | Reporter | Jasdac Stockholm (jasdac.stockholm) | | Assignee | Oz Linden (oz.linden) | | Created at | 2015-12-05T12:30:58Z | | Updated at | 2016-03-24T14:14:37Z | ``` { 'Business Unit': ['Platform'], 'Date of First Response': '2015-12-05T21:31:49.802-0600', 'How would you like the feature to work?': 'For clarification I\'m talking about the viewer URI name space as outlined here: http://wiki.secondlife.com/wiki/Viewer_URI_Name_Space\r\n\r\nCurrent issues:\r\n\r\n* Any website can force send a URI to a viewer through javascript. Example: window.location = \'secondlife:///app/agent/cf2625ff-b1e9-4478-8e6b-b954abde056b/mute\'; Would silently mute me for anyone who visited my page with SL running.\r\n* Won\'t that be detected though if you visit without SL running? Well you have the built in SL browser which contains headers. A server side script could check those headers and only include the malicious code whenever you open the site in the built in SL browser. And since the call is silent it would be near impossible for the average user to figure out why they are suddenly muting a bunch of people.\r\n* Currently there\'s a limit of one URI from a browser every 5 or so seconds. But just using a javascript timer you can still cause a lot of harm in the time someone visits a website. In fact, I\'d say the 5 second rule is more detrimental as it blocks a potentially awesome tool. Say I make a WebGL or 2d canvas game once project valhalla rolls out. I could then stick it on a HUD through shared media and have the website send commands through app/chat to make some really cool stuff.\r\n* Currently you have a popup whenever a second life TP link is received. That popup has a "don\'t show me this again" checkbox. If that is checked, you can also teleport an agent around freely when they visit your website.\r\n\r\nProposed fix:\r\n\r\n* Once a URI is received from a browser (not chat link), show a permission popup with something like: "domain.com wants to run SL URIs on your viewer", [Accept Once, Whitelist, Block].\r\n* Remove the 5 sec limit. It would be redundant and break potentially great features that come with valhalla.', 'ReOpened Count': 0.0, 'Severity': 'Unset', 'Target Viewer Version': 'viewer-development', 'Why is this feature important to you? How would it benefit the community?': "Say I wanted to create a rhythm game once the project valhalla browser is added to the official viewer. Musical games in SL don't work well due to lag, sounds not loading in time, etc. But with HTML5 you can build the entire game to run on shared media. The actual game would then run clientside and communicate with SL by using the app/chat URI with javascript. This leads to a better experience for the user, and less resources needed by the simulator.\r\n\r\nObviously we still don't have a method of communicating SL->browser by script, but I'll leave that for another JIRA.", } ```