Second Life viewer sources 1.21.5-RC

1 files changed, 5 insertions, 0 deletions

diff --git a/linden/indra/newview/llviewermessage.cpp b/linden/indra/newview/llviewermessage.cpp
index f6cefce..0e39026 100644
--- a/linden/indra/newview/llviewermessage.cpp
+++ b/linden/indra/newview/llviewermessage.cpp
@@ -5159,6 +5159,11 @@ void process_initiate_download(LLMessageSystem* msg, void**)
         msg->getString("FileData", "SimFilename", sim_filename);
         msg->getString("FileData", "ViewerFilename", viewer_filename);
 
+        if (!gXferManager->validateFileForRequest(viewer_filename))
+        {
+                llwarns << "SECURITY: Unauthorized download to local file " << viewer_filename << llendl;
+                return;
+        }
         gXferManager->requestFile(viewer_filename,
                 sim_filename,
                 LL_PATH_NONE,