ensure that both cape and skin are downloaded via https (#4006)

This commit is contained in:
timoreo 2025-07-30 06:51:16 +02:00 committed by GitHub
commit b5c86ffee6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 5 additions and 0 deletions

View File

@ -180,6 +180,7 @@ MinecraftProfile profileFromJSONV3(const QJsonObject& parent, const char* tokenN
}
out.skin.id = idV.toString();
out.skin.url = urlV.toString();
out.skin.url.replace("http://textures.minecraft.net", "https://textures.minecraft.net");
out.skin.variant = variantV.toString();
// data for skin is optional
@ -216,6 +217,7 @@ MinecraftProfile profileFromJSONV3(const QJsonObject& parent, const char* tokenN
Cape cape;
cape.id = idV.toString();
cape.url = urlV.toString();
cape.url.replace("http://textures.minecraft.net", "https://textures.minecraft.net");
cape.alias = aliasV.toString();
// data for cape is optional.

View File

@ -207,6 +207,7 @@ bool parseMinecraftProfile(QByteArray& data, MinecraftProfile& output)
if (!getString(capeObj.value("url"), capeOut.url)) {
continue;
}
capeOut.url.replace("http://textures.minecraft.net", "https://textures.minecraft.net");
if (!getString(capeObj.value("alias"), capeOut.alias)) {
continue;
}
@ -358,6 +359,7 @@ bool parseMinecraftProfileMojang(QByteArray& data, MinecraftProfile& output)
qWarning() << "Skin url is not a string";
return false;
}
skinOut.url.replace("http://textures.minecraft.net", "https://textures.minecraft.net");
auto maybeMeta = skin.find("metadata");
if (maybeMeta != skin.end() && maybeMeta->isObject()) {
@ -371,6 +373,7 @@ bool parseMinecraftProfileMojang(QByteArray& data, MinecraftProfile& output)
qWarning() << "Cape url is not a string";
return false;
}
capeOut.url.replace("http://textures.minecraft.net", "https://textures.minecraft.net");
// we don't know the cape ID as it is not returned from the session server
// so just fake it - changing capes is probably locked anyway :(