paula/bworld
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Main menu

Browse Source
This commit is contained in:
paula
2026-09-25 16:51:23 -03:00
parent d107405f62
commit c750321ced
11 changed files with 646 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MODS.md
+4 -3
View File
@@ -879,9 +879,10 @@ where the page came from:
- **Page served by the game server** (the default): that server already chose every line of JavaScript on the page, so
running its mods doesn't trust it any more than loading the page did.
- **Page from one origin, game server on another** (`?server=`): mod code from that server runs with _the page's_
origin, including its local storage. The client shows the server's mod list and asks before loading anything, and
remembers the answer per server and mod hash. The server needs CORS headers on `build/mods/`.
- **Page from one origin, game server on another** (a different server typed in the title screen, or `?server=`): mod
code from that server runs with _the page's_ origin, including its local storage. The client shows the server's mod
list and asks before loading anything, and remembers the answer per server and mod hash. The server needs CORS
headers on `build/mods/`.
- The hash check confirms the files are the ones the server listed. It doesn't protect against a malicious server.
**Server scripts.** They run in a worker with **no Deno permissions** (Deno worker permissions; currently needs