thanks lulurun for a security patch that blocks unathorized access to the inventory server (see http://opensimulator.org/wiki/Security_vulnerability_brought_by_non-check_inventory_service)

1 files changed, 17 insertions, 7 deletions

diff --git a/OpenSim/Framework/Communications/Cache/CachedUserInfo.cs b/OpenSim/Framework/Communications/Cache/CachedUserInfo.cs
index 4e57ead..c125976 100644
--- a/OpenSim/Framework/Communications/Cache/CachedUserInfo.cs
+++ b/OpenSim/Framework/Communications/Cache/CachedUserInfo.cs
@@ -87,6 +87,9 @@ namespace OpenSim.Framework.Communications.Cache
         private IDictionary<LLUUID, IList<InventoryFolderImpl>> pendingCategorizationFolders
             = new Dictionary<LLUUID, IList<InventoryFolderImpl>>();
 
+        private LLUUID m_session_id = LLUUID.Zero;
+        public LLUUID SessionID { get { return m_session_id; } }
+        
         /// <summary>
         /// Constructor
         /// </summary>
@@ -98,6 +101,13 @@ namespace OpenSim.Framework.Communications.Cache
             m_userProfile = userProfile;
         }
 
+        public CachedUserInfo(CommunicationsManager commsManager, UserProfileData userProfile, IClientAPI remoteClient)
+        {
+            m_commsManager = commsManager;
+            m_userProfile = userProfile;
+            m_session_id = remoteClient.SessionId;
+        }
+
         /// <summary>
         /// This allows a request to be added to be processed once we receive a user's inventory
         /// from the inventory service.  If we already have the inventory, the request
@@ -325,7 +335,7 @@ namespace OpenSim.Framework.Communications.Cache
                     createdBaseFolder.Type = createdFolder.Type;
                     createdBaseFolder.Version = createdFolder.Version;
 
-                    m_commsManager.InventoryService.AddFolder(createdBaseFolder);
+                    m_commsManager.SecureInventoryService.AddFolder(createdBaseFolder, m_session_id);
 
                     return true;
                 }
@@ -379,7 +389,7 @@ namespace OpenSim.Framework.Communications.Cache
                 baseFolder.Type = (short)type;
                 baseFolder.Version = RootFolder.Version;
 
-                m_commsManager.InventoryService.UpdateFolder(baseFolder);
+                m_commsManager.SecureInventoryService.UpdateFolder(baseFolder, m_session_id);
 
                 InventoryFolderImpl folder = RootFolder.FindFolder(folderID);
                 if (folder != null)
@@ -421,7 +431,7 @@ namespace OpenSim.Framework.Communications.Cache
                 baseFolder.ID = folderID;
                 baseFolder.ParentID = parentID;
 
-                m_commsManager.InventoryService.MoveFolder(baseFolder);
+                m_commsManager.SecureInventoryService.MoveFolder(baseFolder, m_session_id);
 
                 InventoryFolderImpl folder = RootFolder.FindFolder(folderID);
                 if (folder != null)
@@ -468,7 +478,7 @@ namespace OpenSim.Framework.Communications.Cache
                     purgedBaseFolder.Type = purgedFolder.Type;
                     purgedBaseFolder.Version = purgedFolder.Version;
 
-                    m_commsManager.InventoryService.PurgeFolder(purgedBaseFolder);
+                    m_commsManager.SecureInventoryService.PurgeFolder(purgedBaseFolder, m_session_id);
 
                     purgedFolder.Purge();
 
@@ -505,7 +515,7 @@ namespace OpenSim.Framework.Communications.Cache
                         item.Folder = RootFolder.ID;
                 }
                 ItemReceive(item);
-                m_commsManager.InventoryService.AddItem(item);
+                m_commsManager.SecureInventoryService.AddItem(item, m_session_id);
             }
             else
             {
@@ -525,7 +535,7 @@ namespace OpenSim.Framework.Communications.Cache
         {
             if (HasInventory)
             {
-                m_commsManager.InventoryService.UpdateItem(item);
+                m_commsManager.SecureInventoryService.UpdateItem(item, m_session_id);
             }
             else
             {
@@ -564,7 +574,7 @@ namespace OpenSim.Framework.Communications.Cache
 
                 if (RootFolder.DeleteItem(item.ID))
                 {
-                    return m_commsManager.InventoryService.DeleteItem(item);
+                    return m_commsManager.SecureInventoryService.DeleteItem(item, m_session_id);
                 }
             }
             else