Teleport with URI NameSpace

[Miranda Umino]

I am using the documentation from http://wiki.secondlife.com/wiki/Viewer_URI_Name_Space

 

Inside the viewer , when i build one URI with the teleport action , it works

I ve used a media on prim with a page with links who pints to these URI

 

For mostly any URI , the media on prim works correctly .... except ... for TP ..

 

This is a sample script i use :

 

show(string html)
{
    html = "data:text/html," + llEscapeURL(html);
    llSetPrimMediaParams(0,                  // Side to display the media on.
            [PRIM_MEDIA_AUTO_PLAY,TRUE,      // Show this page immediately
             PRIM_MEDIA_CURRENT_URL,html,    // The url currently showing
             PRIM_MEDIA_HOME_URL,html,       // The url if they hit 'home'
             PRIM_MEDIA_HEIGHT_PIXELS,512,   // Height/width of media texture will be
             PRIM_MEDIA_WIDTH_PIXELS,512]);  //   rounded up to nearest power of 2.
}
 

 
default
{
    state_entry()
    {
        llRequestURL();
    }
 
    http_request(key id, string method, string body)
    {
        if (method == URL_REQUEST_GRANTED)
        {
            show("<h1>Go TO :<br>"+
            "<a href='secondlife:///app/teleport/BlueSteel%20Sandbox%201/60/131/23'>TP</a><br>"+
            "<a href='secondlife:///app/inventory/show'>Inventory</a><br>"+
            "<a href='secondlife:///app/worldmap/BlueSteel%20Sandbox%201/60/131/23'>show map</a>"+
            "</h1>");
        }
        else if (method == "GET")
        {
            llOwnerSay("get");
        }
    }
}

 

To display the world map , there is no problems .

To open Inventory ( just for the exemple ), no problems too.

But to TP , it fails and displays

 A SLurl was received from an untrusted browser and has been blocked for your security.

- Firstly it doesn t reassure about the fiability of the internal viewer

- Secondly, it s weird that it s blocked inside SL but not blocked when we use the URI with chrome or internet viewer .

I suspect a bug with viewer

 

Has anybody  got one idea to fix this  ?

[Void Singer]

a few of those app paths are purposely prevented from activation by web, to prevent forced teleports for example. they'll only work from inworld UI elements (like chat history)

[Rufus Darkfold]

Does RLV allow my objects to teleport me?

If so, can I use RLV without getting caught up in any S&M games by not enabling any relays?

 

[Void Singer]

---

Rufus Darkfold wrote:

Does RLV allow my objects to teleport me?

If so, can I use RLV without getting caught up in any S&M games by not enabling any relays?

---

it's possible to trigger a teleport via RLV, yes

yes, only those you give permission to will be able to trigger any effects RLV is capable of, so for instance, you could allow yourself and then any object you own could be set up to trigger such effects while you are using an RLV compatible client.

[Miranda Umino]

I understand this sentence wroten at http://wiki.secondlife.com/wiki/Viewer_URI_Name_Space about the need to block other browsers

 

"Most secondlife:///app URLs only work from browser instances running inside Second Life because of a denial-of-service attack using secondlife:///app/teleport links to force repeated teleports."

 

If i call a page by the internal browser , i pass through the SL Server proxy who overwrites the headers and who knows if i am calling the page in-world or by an external browser

But why does the internal browser is considered as an external browser ?

 

[Void Singer]

it's not, but it's considered an unsecure source because ANY page could be brought up within it... there are ui elements like search that only travel in their own set pages though, and so those are considered secure, because they can only access LL controlled sources.

[Innula Zenovka]

If you only want your objects to be able to teleport you using RLV then you don't need to worry.    The objects will work by executing llOwnerSay("@tpto:<X>/<Y>/<Z>=force"), so you don't need to wear any special relays.   That way, nothing you don't own can use RLV on you.

If you want other people's teleporters to work on you, then you will need a relay to pick up their commands and turn them into llOwnerSay, but, as Void says, you can adjust the settings on your relay to have it check before executing commands (or, with some relays, to check if the object owner isn't on a trusted list and so one).   

In practice, though, I think there's little danger of having RLV used on you unexpectedly.   I've been wandering round SL with a relay -- normally set to ask me before doing anything -- for the last two or three years, and it very rarely receives commands when I'm not expecting them.    When it does, if I'm not in the mood I can, because of the relay's settings, simply decline them, as I decline unwanted offers of LMs and notecards in shops.