unmojang / drasl

Yggdrasil-compatible API server for Minecraft
GNU General Public License v3.0
120 stars 21 forks source link

Make specifying skins and capes from URLs opt-in #117

Closed evan-goode closed 3 days ago

evan-goode commented 1 week ago

Adds the AllowTextureFromURL config option and makes it false by default. Admins can still set skins and capes by URL, via the front end or the API, regardless of this setting. Allowing users to specify textures via URL is a possible security concern and doesn't really improve the UX that much, so we should make it opt-in.

Resolves https://github.com/unmojang/drasl/issues/116.