[Feature Request] Upload skins to the server
SandFoll opened this issue · 11 comments
Is your feature request related to a problem? Please describe.
Changing skins for NPCs is a bit difficult at the moment. I want the NPCs I set to have different professions, and accordingly they should have skins corresponding to the professions. I hope that a function to add skins to the server can be added, so that other players can also see it after changing the skin.
Describe the solution you'd like
Currently, custom skins can be uploaded in the local skin presets, but the server does not have this folder. I hope it can be uploaded on the server.
The current skin change requires a corresponding player name, but this will duplicate the player's skin. I don’t know how to change the URL skin.
I haven't integrated any client -> server upload functionality for security reasons.
Allowing users to uploading files to the server could lead to security issues and spreading infected files with players.
For this reason you have the following options:
- Sharing the
config/easy_npc/skin
folder directly or over a mod pack with the players. - Using a remote skin URL from a skin page like skindex, novaskin or self hosted server.
In most cases a mod pack is needed anyways to join a modded server, so sharing your config/easy_npc
folder over a mod pack should be the easiest option.
If they are enough requests I'm happy to integrate a resource pack support, if the mod pack option is not enough.
Sorry, maybe I'm too stupid. I don't understand how to operate the first method you provided. I once tried to send the local skin to my friend, but I couldn't see it after he set the skin. After I set the skin, he saw it. No, but both of us have the skin files in our local skin folders.
For testing it should work the following:
Your side:
- You open the corresponding texture folder and place your skin next to the "..._example.png" or "..._template.png" skin.
- You spawn an NPC,
Reload Texture
which should show up your texture and you assign the custom skin to the NPC. - You send the whole config directory (or the specific skin) to your friend.
Your friends side:
- Your friend copy the config directory or the corresponding skin (to the correct folder, with the same name) to his config directory, before starting the game.
- Your friend joins the server and your friend should see the NPC with the corresponding skin.
Troubleshooting:
Each skin gets an unique ID based on the name, so the ID in the "Custom Skin" overview on your side, should have the same ID on your friends side.
If this is still not working try to assign the "..._example.png" or "..._template.png" skin to see if this is working as expected.
Thank you for your patient guidance. I put the custom skin into this folder, and then I sent the entire config folder to my friend and asked him to overwrite the folder. This will have to wait for testing tomorrow, because my friends All fell asleep.
I'm not sure whether it will work, because I sent him the skin I needed before, and he also put the skin file into this folder according to my instructions, but he couldn't see it.
I think skin is a very important point of this module, but there are indeed barriers to changing skins. For our players, they cannot log in to these skin sites, so they cannot load skins through URLs. We cannot access these websites, so it is relatively simple. The best way is to upload in the server background. This is just a suggestion from me hahaha. Relatively speaking, the security may be good, because the administrator has the permission to upload files after the server background.
@MarkusBordihn
Thank you for your patience in listening to my suggestions, I will test the game later. If this function is added, only the server administrator has the authority to upload skins in the server background.
Thanks for providing the additional context.
I will take a look into a way for the server administrator to upload skins to the server.
However I will add a config setting for the users to disable such server-downloads, just to make sure all use-cases are covered.
After my test, I still cannot see the local skin of the NPC when I send the config folder to my friend. I hope you can add a way to upload the skin to the server. Thank you very much! ! ! @MarkusBordihn
@MarkusBordihn Hi, as an idea for this problem, why not just telling where to put custom skins without providing an uploading button.
That way, server admin can upload the skins themself, but other peoples can't upload dangerous stuff, and we avoid issues like "npc skin's website is currently down", or "is now preventing downloading via another way than browser" or "having to explain to players that they have to download and setup thousands of skins, and probably get spoiled on server's story".
Call me stupid but how is this a security issue? Let's say there is a folder config/easy_npc/server_skins. Only highest level admins have access to the file system of the server, so only they can put files in this folder. And if there is so little trust to the administration, you believe they can put malware in this folder to somehow run out of .png file, there are greater issues: The server is already running a modified core, Forge in this case, and can be even altered by owner without anybody knowing. There are also other mods installed already, which directly execute code, without the need to invent hacks using .png files.
If the server owner is such a shitbag to execute malicious code on the server, they can do it by using custom mods on server side and clients will never know about it. Plus, it's not like you're just joining a random shady server, when we're talking about modpacks - these are small communities due to modern servers not being able to handle lots of players at once. And if we're talking about a mod like "Custom NPCs", then it's even more niche mod for custom modpacks for specific communities or even single player/co-op worlds but clearly not for mass public.
So, in my opinion, there is really no harm in skins being stored on server side and pulled by clients on demand. Just like chunks are stored for the map. Admins have access to them too but it's not a problem, right?
Thank you for your detailed thoughts on this feature request. I appreciate the time you’ve taken to lay out your reasoning, and I’d like to clarify a few points from the development and security perspective.
The original request for the feature "Upload skins to the server" was intended to allow users to upload skins directly from their client files to the server. This is different from merely loading existing skins from the server, which could already be achieved by placing custom skins in the config folder on both the server and client.
Having previously worked as a System Security Analyzer, I want to emphasize that the primary concern isn’t the files themselves, but rather the processing of potentially manipulated files. Maliciously crafted files could exploit vulnerabilities, potentially taking over the server or causing other serious issues. While client-side security is often reinforced with virus scanners that detect such threats, servers generally lack these protections. Many servers do not have virus scanners in place or fail to keep their corresponding libraries up-to-date, which significantly increases the risk.
If your request is simply to enable the server to send images from a designated folder (e.g., config/easy_npc/server_skins) to the client—similar to how resource packs work—this does present a lower security risk. However, it is still a concern, albeit less severe than allowing users to upload arbitrary files to the server, which would then be shared with all users.
To move forward, if you would like support for this type of functionality, I suggest opening a separate feature request. Please include details on how you envision this working—whether it would involve specific commands like skin reload, and whether it should support resource packs or be limited to files from specific folders like config/easy_npc or server_skins.
Your input is invaluable, and I’m looking forward to hearing more about how we can make this work securely.