IVAR glTF Viewer v0.1.3

0.1.3 is a security and robustness update. Everyone on 0.1.2 or earlier should upgrade by running the new installer over the old one; settings are kept.

Security

• A crafted .gltf could point at a file on a network share chosen by the file's author, which made Windows connect to that server with your sign-in credentials. The viewer now reads a model's buffers and textures only from the same drive or network share as the model itself.
• At most six files are read into memory at once, only existing paths can be opened, and the viewer page gets only the permissions it actually uses.

Fixes

• "Start with Windows" survives upgrades. Earlier upgrades silently turned it off and asked the first-run question again.
• Validation runs in the background, so files up to 64 MB no longer freeze the window for seconds.
• The model stays sharp after the window moves to a monitor with different display scaling, and stays lit after a graphics driver reset.
• Holding an arrow key no longer starts dozens of file loads, and animations no longer jump after the viewer was closed for a while.
• Opening files quickly while the viewer was starting could leave a window that never closed, or make the viewer disappear while in use.
• The viewer stops rendering while it is closed, and file names that are not valid Unicode no longer crash the app.

The installer is not code-signed yet, so SmartScreen will warn; see the README. SHA256SUMS.txt has the checksum.

IVAR glTF Viewer v0.1.2

0.1.2: the clip and playback-speed dropdowns in the animation bar now render dark with readable text (they showed light text on a white popup).

Includes the 0.1.1 deadlock fix (#17) and the review-pass changes. The installer is not code-signed yet, so SmartScreen will warn; SHA256SUMS.txt has the checksum.

IVAR glTF Viewer v0.1.1

First public release of IVAR glTF Viewer.

0.1.1 fixes a deadlock that froze the tray instance when a file was opened by double-click or "Open with" while the app was already running (#17). It also contains everything from the review pass: hardened model protocol, first-run autostart prompt, uninstall cleanup, hook self-healing, WebGL fallback, third-party notices, MIT license.

The installer is not code-signed yet, so SmartScreen will warn; see the README. SHA256SUMS.txt has the checksum.