Use https to get updates, it helps #2952
Respect g['tmp_path']
Fix #2952, escape necessary chars to avoid xss injection