03-11-2008, 10:14 AM
gncmatt Wrote:I'll look into swfloader, thx.
I've decided how I'm going to route the sv_downloadurl to a php file so I will probably have that done today.. With it going through php I will be able to have more control such as load balancing and disabling hotlinking and some other stuff...
Yea there are many things I have considered about all the possible abuse that could be done and I've countered most of the ones i thought of (conceptually). The main thing I need to get done is the bsp verifier.. It starts out by (obviously) checking to see if it's bsp (or if it's a bz2 it will decompress and check), then it opens it up and verifies it's a map, for security reasons I won't elaborate on what spesificly it checks for but I just wanted to point out it's not just like ".bsp, PASSED!".
I did already consider the verifying server thing with registration.. I think I posted some notes about it on the site somewhere.. for phase 1 i'm going to have it open to everyone to just upload (at least in the first beta).. after that I was thinking about requiring people to give a server address, and it would check to make sure it exists and require some type of verification of ownership (either ftp info or setting a cvar to a spesified random string if they dont' wanna put in their password).
Oooo I didn't think of a virus scanner.. good idea.. what are the possibilities of viruses in bsp files anyway?
I don't know if the allowed servers idea would work because I don't think the server makes any call to the http server, to my knowledge it just directs the user to the link of the files and direct connect from there but I will play with all the options of that when I get there.
The only leeching that bothers me is people hotlinking from other sites to download it via browser.. I don't really mind if people don't upoad maps because that is one of the benifits of the system.. if you use 20 popular custom maps on your server the chances are they would already be on the server.. I dont' want people uploading just for the sake of uploading...
Something else I went over with someone was to maybe have 2 levels of uploading in final version.. one upload page for non-reg people that can only upload files under a certian size and the map will be deleted if it is not downloaded x amount of times within the first 30 days of upload. And registered accounts that are linked with a game server don't have those restrictions.
Oh and I forgot the email on my forum wasn't working.. I'll manually enable whoever signed up and I'll remove email verification for now...
It is a really good idea and I'm curious to see how it turns out. As for Viruses... You never know now a days.