Download system differences and plans?

[ghost]

Hi @ensiform, can you please explain the differences between the current ETe download system, the Q3e download system and the ioquake3 download system, or any changes you may probably introduce while working on this: #17
I have zero experience with this piece of code, I was just warned by a few guys that auto downloads should be off for security reasons. The only project that should be less risky is Chomenor's new filesystem project: https://github.com/Chomenor/ioq3_new_filesystem#download-directory-support, it's used by tremulous now, afaik.
Do you know how to circumvent the risk(s) of enabling auto downloads? What are your plans with this?
Thanks in advance!

[ensiform]

Quake3e just added extra client download url (defaults to worldspawn) and commands that don't require a URL from server, still uses curl in basically the same way as ioquake3. Has more checks to verify the package is actually a pk3 and contains proper pk3 header during the download phase.

Vanilla ET also has "wwwdl" code which does use curl for the actual downloads, however, the server sends the url and redirect fallbacks via the UDP download code and isn't compatible with the other systems because the URL is not transmitted via serverinfo but part of an actual download packet which signifies that user requests wwwdl over UDP.

As far as security is concerned, yes there's plenty of issues and have discussed possible ideas with others in other tech3 forks in the past. But I have no time to dedicate to creating such a system that works for most to remain supportive without breaking a ton of stuff. Mainly, blocking use of download which contains "dll" files.