*remove conflicts

16 files changed, 446 insertions, 73 deletions

diff --git a/OpenSim/Region/OptionalModules/Agent/InternetRelayClientView/Server/IRCClientView.cs b/OpenSim/Region/OptionalModules/Agent/InternetRelayClientView/Server/IRCClientView.cs
index 08fc61f..4a2d7b5 100644
--- a/OpenSim/Region/OptionalModules/Agent/InternetRelayClientView/Server/IRCClientView.cs
+++ b/OpenSim/Region/OptionalModules/Agent/InternetRelayClientView/Server/IRCClientView.cs
@@ -634,7 +634,7 @@ namespace OpenSim.Region.OptionalModules.Agent.InternetRelayClientView.Server
         {
             get { return (uint)Util.RandomClass.Next(0,int.MaxValue); }
         }
-
+#pragma warning disable 67
         public event GenericMessage OnGenericMessage;
         public event ImprovedInstantMessage OnInstantMessage;
         public event ChatMessage OnChatFromClient;
@@ -686,6 +686,7 @@ namespace OpenSim.Region.OptionalModules.Agent.InternetRelayClientView.Server
         public event SpinStop OnSpinStop;
         public event UpdateShape OnUpdatePrimShape;
         public event ObjectExtraParams OnUpdateExtraParams;
+        public event ObjectRequest OnObjectRequest;
         public event ObjectSelect OnObjectSelect;
         public event ObjectDeselect OnObjectDeselect;
         public event GenericCall7 OnObjectDescription;
@@ -825,6 +826,7 @@ namespace OpenSim.Region.OptionalModules.Agent.InternetRelayClientView.Server
         public event AvatarNotesUpdate OnAvatarNotesUpdate;
         public event MuteListRequest OnMuteListRequest;
         public event PlacesQuery OnPlacesQuery;
+#pragma warning restore 67
 
         public void SetDebugPacketLevel(int newDebug)
         {
diff --git a/OpenSim/Region/OptionalModules/Avatar/Chat/ChannelState.cs b/OpenSim/Region/OptionalModules/Avatar/Chat/ChannelState.cs
index f03e5fc..b61959f 100644
--- a/OpenSim/Region/OptionalModules/Avatar/Chat/ChannelState.cs
+++ b/OpenSim/Region/OptionalModules/Avatar/Chat/ChannelState.cs
@@ -83,6 +83,7 @@ namespace OpenSim.Region.OptionalModules.Avatar.Chat
 
         internal string _accessPassword      = String.Empty;
         internal Regex  AccessPasswordRegex  = null;
+        internal List<string> ExcludeList    = new List<string>();
         internal string AccessPassword
         {
             get { return _accessPassword; }
@@ -210,8 +211,13 @@ namespace OpenSim.Region.OptionalModules.Avatar.Chat
             m_log.DebugFormat("[IRC-Channel-{0}] PingDelay : <{1}>", cs.idn, cs.PingDelay);
             cs.AccessPassword = Substitute(rs, config.GetString("access_password", cs.AccessPassword));
             m_log.DebugFormat("[IRC-Channel-{0}] AccessPassword : <{1}>", cs.idn, cs.AccessPassword);
-
-
+            string[] excludes = config.GetString("exclude_list", "").Trim().Split(new Char[] { ',' });
+            cs.ExcludeList = new List<string>(excludes.Length);
+            foreach(string name in excludes)
+            {
+                cs.ExcludeList.Add(name.Trim().ToLower());
+            }
+            
             // Fail if fundamental information is still missing
 
             if (cs.Server == null || cs.IrcChannel == null || cs.BaseNickname == null || cs.User == null)
diff --git a/OpenSim/Region/OptionalModules/Avatar/Chat/RegionState.cs b/OpenSim/Region/OptionalModules/Avatar/Chat/RegionState.cs
index 203948e..c49d942 100644
--- a/OpenSim/Region/OptionalModules/Avatar/Chat/RegionState.cs
+++ b/OpenSim/Region/OptionalModules/Avatar/Chat/RegionState.cs
@@ -145,7 +145,11 @@ namespace OpenSim.Region.OptionalModules.Avatar.Chat
                     if (enabled && (cs.irc.Enabled) && (cs.irc.Connected) && (cs.ClientReporting)) 
                     {
                         m_log.InfoFormat("[IRC-Region {0}]: {1} has left", Region, client.Name);
-                        cs.irc.PrivMsg(cs.NoticeMessageFormat, cs.irc.Nick, Region, String.Format("{0} has left", client.Name));
+                        //Check if this person is excluded from IRC
+                        if (!cs.ExcludeList.Contains(client.Name.ToLower()))
+                        {
+                            cs.irc.PrivMsg(cs.NoticeMessageFormat, cs.irc.Nick, Region, String.Format("{0} has left", client.Name));
+                        }
                     }
                     client.OnLogout           -= OnClientLoggedOut;
                     client.OnConnectionClosed -= OnClientLoggedOut;
@@ -209,7 +213,11 @@ namespace OpenSim.Region.OptionalModules.Avatar.Chat
                     {
                         string clientName = String.Format("{0} {1}", presence.Firstname, presence.Lastname);
                         m_log.DebugFormat("[IRC-Region {0}] {1} has arrived", Region, clientName);
-                        cs.irc.PrivMsg(cs.NoticeMessageFormat, cs.irc.Nick, Region, String.Format("{0} has arrived", clientName));
+                        //Check if this person is excluded from IRC
+                        if (!cs.ExcludeList.Contains(clientName.ToLower()))
+                        {
+                            cs.irc.PrivMsg(cs.NoticeMessageFormat, cs.irc.Nick, Region, String.Format("{0} has arrived", clientName));
+                        }
                     }
                 }
             }
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/ISecurityCredential.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/ISecurityCredential.cs
new file mode 100644
index 0000000..533d176
--- /dev/null
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/ISecurityCredential.cs
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) Contributors, http://opensimulator.org/
+ * See CONTRIBUTORS.TXT for a full list of copyright holders.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the OpenSimulator Project nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
+{
+    public interface ISecurityCredential
+    {
+        ISocialEntity owner { get; }
+        bool CanEditObject(IObject target);
+        bool CanEditTerrain(int x, int y);
+    }
+}
\ No newline at end of file
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/Interfaces/IAvatar.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/Interfaces/IAvatar.cs
index 849e3ca..03c1e95 100644
--- a/OpenSim/Region/OptionalModules/Scripting/Minimodule/Interfaces/IAvatar.cs
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/Interfaces/IAvatar.cs
@@ -32,19 +32,6 @@ using OpenMetaverse;
 
 namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
 {
-    public interface IAvatarAttachment
-    {
-        //// <value>
-        /// Describes where on the avatar the attachment is located
-        /// </value>
-        int Location { get ; }
-        
-        //// <value>
-        /// Accessor to the rez'ed asset, representing the attachment
-        /// </value>
-        IObject Asset { get; }
-    }
-
     public interface IAvatar : IEntity
     {
         //// <value>
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/Interfaces/IAvatarAttachment.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/Interfaces/IAvatarAttachment.cs
new file mode 100644
index 0000000..1993948
--- /dev/null
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/Interfaces/IAvatarAttachment.cs
@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) Contributors, http://opensimulator.org/
+ * See CONTRIBUTORS.TXT for a full list of copyright holders.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the OpenSimulator Project nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
+{
+    public interface IAvatarAttachment
+    {
+        //// <value>
+        /// Describes where on the avatar the attachment is located
+        /// </value>
+        int Location { get ; }
+        
+        //// <value>
+        /// Accessor to the rez'ed asset, representing the attachment
+        /// </value>
+        IObject Asset { get; }
+    }
+}
\ No newline at end of file
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/Interfaces/IObject.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/Interfaces/IObject.cs
index 6415250..19f7210 100644
--- a/OpenSim/Region/OptionalModules/Scripting/Minimodule/Interfaces/IObject.cs
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/Interfaces/IObject.cs
@@ -212,6 +212,6 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         bool Bright { get; set; } // SetPrimParms(FULLBRIGHT)
         double Bloom { get; set; } // SetPrimParms(GLOW)
         bool Shiny { get; set; } // SetPrimParms(SHINY)
-        bool BumpMap { get; set; } // SetPrimParms(BUMPMAP) [DEPRECIATE IN FAVOUR OF UUID?]
+        bool BumpMap { get; set; } // SetPrimParms(BUMPMAP) [DEPRECATE IN FAVOUR OF UUID?]
     }
 }
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/MRMModule.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/MRMModule.cs
index 5ed9af3..bf523dd 100644
--- a/OpenSim/Region/OptionalModules/Scripting/Minimodule/MRMModule.cs
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/MRMModule.cs
@@ -27,9 +27,14 @@
 
 using System;
 using System.CodeDom.Compiler;
+using System.Collections;
 using System.Collections.Generic;
+using System.Diagnostics;
 using System.IO;
 using System.Reflection;
+using System.Security;
+using System.Security.Permissions;
+using System.Security.Policy;
 using System.Text;
 using log4net;
 using Microsoft.CSharp;
@@ -54,6 +59,9 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
 
         private readonly MicroScheduler m_microthreads = new MicroScheduler();
 
+
+        private IConfig m_config;
+
         public void RegisterExtension<T>(T instance)
         {
             m_extensions[typeof (T)] = instance;
@@ -63,6 +71,8 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         {
             if (source.Configs["MRM"] != null)
             {
+                m_config = source.Configs["MRM"];
+
                 if (source.Configs["MRM"].GetBoolean("Enabled", false))
                 {
                     m_log.Info("[MRM] Enabling MRM Module");
@@ -112,25 +122,128 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             return script;
         }
 
+        /// <summary>
+        /// Create an AppDomain that contains policy restricting code to execute
+        /// with only the permissions granted by a named permission set
+        /// </summary>
+        /// <param name="permissionSetName">name of the permission set to restrict to</param>
+        /// <param name="appDomainName">'friendly' name of the appdomain to be created</param>
+        /// <exception cref="ArgumentNullException">
+        /// if <paramref name="permissionSetName"/> is null
+        /// </exception>
+        /// <exception cref="ArgumentOutOfRangeException">
+        /// if <paramref name="permissionSetName"/> is empty
+        /// </exception>
+        /// <returns>AppDomain with a restricted security policy</returns>
+        /// <remarks>Substantial portions of this function from: http://blogs.msdn.com/shawnfa/archive/2004/10/25/247379.aspx
+        /// Valid permissionSetName values are:     
+        /// * FullTrust
+        /// * SkipVerification
+        /// * Execution
+        /// * Nothing
+        /// * LocalIntranet
+        /// * Internet
+        /// * Everything
+        /// </remarks>
+        public static AppDomain CreateRestrictedDomain(string permissionSetName, string appDomainName)
+        {
+            if (permissionSetName == null)
+                throw new ArgumentNullException("permissionSetName");
+            if (permissionSetName.Length == 0)
+                throw new ArgumentOutOfRangeException("permissionSetName", permissionSetName,
+                                                      "Cannot have an empty permission set name");
+
+            // Default to all code getting nothing
+            PolicyStatement emptyPolicy = new PolicyStatement(new PermissionSet(PermissionState.None));
+            UnionCodeGroup policyRoot = new UnionCodeGroup(new AllMembershipCondition(), emptyPolicy);
+
+            bool foundName = false;
+            PermissionSet setIntersection = new PermissionSet(PermissionState.Unrestricted);
+
+            // iterate over each policy level
+            IEnumerator levelEnumerator = SecurityManager.PolicyHierarchy();
+            while (levelEnumerator.MoveNext())
+            {
+                PolicyLevel level = levelEnumerator.Current as PolicyLevel;
+
+                // if this level has defined a named permission set with the
+                // given name, then intersect it with what we've retrieved
+                // from all the previous levels
+                if (level != null)
+                {
+                    PermissionSet levelSet = level.GetNamedPermissionSet(permissionSetName);
+                    if (levelSet != null)
+                    {
+                        foundName = true;
+                        if (setIntersection != null)
+                            setIntersection = setIntersection.Intersect(levelSet);
+                    }
+                }
+            }
+
+            // Intersect() can return null for an empty set, so convert that
+            // to an empty set object. Also return an empty set if we didn't find
+            // the named permission set we were looking for
+            if (setIntersection == null || !foundName)
+                setIntersection = new PermissionSet(PermissionState.None);
+            else
+                setIntersection = new NamedPermissionSet(permissionSetName, setIntersection);
+
+            // if no named permission sets were found, return an empty set,
+            // otherwise return the set that was found
+            PolicyStatement permissions = new PolicyStatement(setIntersection);
+            policyRoot.AddChild(new UnionCodeGroup(new AllMembershipCondition(), permissions));
+
+            // create an AppDomain policy level for the policy tree
+            PolicyLevel appDomainLevel = PolicyLevel.CreateAppDomainLevel();
+            appDomainLevel.RootCodeGroup = policyRoot;
+
+            // create an AppDomain where this policy will be in effect
+            string domainName = appDomainName;
+            AppDomain restrictedDomain = AppDomain.CreateDomain(domainName);
+            restrictedDomain.SetAppDomainPolicy(appDomainLevel);
+
+            return restrictedDomain;
+        }
+
+
         void EventManager_OnRezScript(uint localID, UUID itemID, string script, int startParam, bool postOnRez, string engine, int stateSource)
         {
             if (script.StartsWith("//MRM:C#"))
             {
-                if (m_scene.GetSceneObjectPart(localID).OwnerID != m_scene.RegionInfo.MasterAvatarAssignedUUID
-                    ||
-                    m_scene.GetSceneObjectPart(localID).CreatorID != m_scene.RegionInfo.MasterAvatarAssignedUUID)
-                    return;
+                if (m_config.GetBoolean("OwnerOnly", true))
+                    if (m_scene.GetSceneObjectPart(localID).OwnerID != m_scene.RegionInfo.MasterAvatarAssignedUUID
+                        || m_scene.GetSceneObjectPart(localID).CreatorID != m_scene.RegionInfo.MasterAvatarAssignedUUID)
+                        return;
 
                 script = ConvertMRMKeywords(script);
 
                 try
                 {
-                    m_log.Info("[MRM] Found C# MRM");
+                    AppDomain target;
+                    if (m_config.GetBoolean("Sandboxed", true))
+                    {
+                        m_log.Info("[MRM] Found C# MRM - Starting in AppDomain with " +
+                                   m_config.GetString("SandboxLevel", "Internet") + "-level security.");
+
+                        string domainName = UUID.Random().ToString();
+                        target = CreateRestrictedDomain(m_config.GetString("SandboxLevel", "Internet"),
+                                                                  domainName);
+                    }
+                    else
+                    {
+                        m_log.Info("[MRM] Found C# MRM - Starting in current AppDomain");
+                        m_log.Warn(
+                            "[MRM] Security Risk: AppDomain is run in current context. Use only in trusted environments.");
+                        target = AppDomain.CurrentDomain;
+                    }
 
-                    MRMBase mmb = (MRMBase)AppDomain.CurrentDomain.CreateInstanceFromAndUnwrap(
+                    m_log.Info("[MRM] Unwrapping into target AppDomain");
+                    MRMBase mmb = (MRMBase) target.CreateInstanceFromAndUnwrap(
                                                 CompileFromDotNetText(script, itemID.ToString()),
                                                 "OpenSim.MiniModule");
 
+                    m_log.Info("[MRM] Initialising MRM Globals");
                     InitializeMRM(mmb, localID, itemID);
 
                     m_scripts[itemID] = mmb;
@@ -166,8 +279,14 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
 
         public void GetGlobalEnvironment(uint localID, out IWorld world, out IHost host)
         {
-            world = new World(m_scene);
-            host = new Host(new SOPObject(m_scene, localID), m_scene, new ExtensionHandler(m_extensions), m_microthreads);
+            // UUID should be changed to object owner.
+            UUID owner = m_scene.RegionInfo.MasterAvatarAssignedUUID;
+            SEUser securityUser = new SEUser(owner, "Name Unassigned");
+            SecurityCredential creds = new SecurityCredential(securityUser, m_scene);
+
+            world = new World(m_scene, creds);
+            host = new Host(new SOPObject(m_scene, localID, creds), m_scene, new ExtensionHandler(m_extensions),
+                            m_microthreads);
         }
 
         public void InitializeMRM(MRMBase mmb, uint localID, UUID itemID)
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/ObjectAccessor.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/ObjectAccessor.cs
index 4638ad0..6ba5ccf 100644
--- a/OpenSim/Region/OptionalModules/Scripting/Minimodule/ObjectAccessor.cs
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/ObjectAccessor.cs
@@ -40,10 +40,12 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
     {
         private readonly Scene m_scene;
         private readonly IEnumerator<EntityBase> m_sogEnum;
+        private readonly ISecurityCredential m_security;
 
-        public IObjEnum(Scene scene)
+        public IObjEnum(Scene scene, ISecurityCredential security)
         {
             m_scene = scene;
+            m_security = security;
             m_sogEnum = m_scene.Entities.GetAllByType<SceneObjectGroup>().GetEnumerator();
         }
 
@@ -66,7 +68,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         {
             get
             {
-                return new SOPObject(m_scene, m_sogEnum.Current.LocalId);
+                return new SOPObject(m_scene, m_sogEnum.Current.LocalId, m_security);
             }
         }
 
@@ -79,17 +81,19 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
     public class ObjectAccessor : System.MarshalByRefObject, IObjectAccessor
     {
         private readonly Scene m_scene;
+        private readonly ISecurityCredential m_security;
 
-        public ObjectAccessor(Scene scene)
+        public ObjectAccessor(Scene scene, ISecurityCredential security)
         {
             m_scene = scene;
+            m_security = security;
         }
 
         public IObject this[int index]
         {
             get
             {
-                return new SOPObject(m_scene, m_scene.Entities[(uint)index].LocalId);
+                return new SOPObject(m_scene, m_scene.Entities[(uint)index].LocalId, m_security);
             }
         }
 
@@ -97,7 +101,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         {
             get
             {
-                return new SOPObject(m_scene, m_scene.Entities[index].LocalId);
+                return new SOPObject(m_scene, m_scene.Entities[index].LocalId, m_security);
             }
         }
 
@@ -105,7 +109,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         {
             get
             {
-                return new SOPObject(m_scene, m_scene.Entities[index].LocalId);
+                return new SOPObject(m_scene, m_scene.Entities[index].LocalId, m_security);
             }
         }
 
@@ -117,20 +121,20 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         public IObject Create(Vector3 position, Quaternion rotation)
         {
 
-            SceneObjectGroup sog = m_scene.AddNewPrim(m_scene.RegionInfo.MasterAvatarAssignedUUID,
+            SceneObjectGroup sog = m_scene.AddNewPrim(m_security.owner.GlobalID,
                                                       UUID.Zero,
                                                       position,
                                                       rotation,
                                                       PrimitiveBaseShape.CreateBox());
 
-            IObject ret = new SOPObject(m_scene, sog.LocalId);
+            IObject ret = new SOPObject(m_scene, sog.LocalId, m_security);
 
             return ret;
         }
 
         public IEnumerator<IObject> GetEnumerator()
         {
-            return new IObjEnum(m_scene);
+            return new IObjEnum(m_scene, m_security);
         }
 
         IEnumerator IEnumerable.GetEnumerator()
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/SOPObject.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/SOPObject.cs
index bc26389..292e345 100644
--- a/OpenSim/Region/OptionalModules/Scripting/Minimodule/SOPObject.cs
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/SOPObject.cs
@@ -27,6 +27,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Security;
 using OpenMetaverse;
 using OpenMetaverse.Packets;
 using OpenSim.Framework;
@@ -42,13 +43,22 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
     {
         private readonly Scene m_rootScene;
         private readonly uint m_localID;
+        private readonly ISecurityCredential m_security;
 
+        [Obsolete("Replace with 'credential' constructor [security]")]
         public SOPObject(Scene rootScene, uint localID)
         {
             m_rootScene = rootScene;
             m_localID = localID;
         }
 
+        public SOPObject(Scene rootScene, uint localID, ISecurityCredential credential)
+        {
+            m_rootScene = rootScene;
+            m_localID = localID;
+            m_security = credential;
+        }
+
         /// <summary>
         /// This needs to run very, very quickly.
         /// It is utilized in nearly every property and method.
@@ -59,6 +69,15 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             return m_rootScene.GetSceneObjectPart(m_localID);
         }
 
+        private bool CanEdit()
+        {
+            if (!m_security.CanEditObject(this))
+            {
+                throw new SecurityException("Insufficient Permission to edit object with UUID [" + GetSOP().UUID + "]");
+            }
+            return true;
+        }
+
         #region OnTouch
 
         private event OnTouchDelegate _OnTouch;
@@ -68,14 +87,17 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         {
             add
             {
-                if (!_OnTouchActive)
+                if (CanEdit())
                 {
-                    GetSOP().Flags |= PrimFlags.Touch;
-                    _OnTouchActive = true;
-                    m_rootScene.EventManager.OnObjectGrab += EventManager_OnObjectGrab;
+                    if (!_OnTouchActive)
+                    {
+                        GetSOP().Flags |= PrimFlags.Touch;
+                        _OnTouchActive = true;
+                        m_rootScene.EventManager.OnObjectGrab += EventManager_OnObjectGrab;
+                    }
+
+                    _OnTouch += value;
                 }
-
-                _OnTouch += value;
             }
             remove
             {
@@ -95,7 +117,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             if (_OnTouchActive && m_localID == localID)
             {
                 TouchEventArgs e = new TouchEventArgs();
-                e.Avatar = new SPAvatar(m_rootScene, remoteClient.AgentId);
+                e.Avatar = new SPAvatar(m_rootScene, remoteClient.AgentId, m_security);
                 e.TouchBiNormal = surfaceArgs.Binormal;
                 e.TouchMaterialIndex = surfaceArgs.FaceIndex;
                 e.TouchNormal = surfaceArgs.Normal;
@@ -130,13 +152,21 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         public string Name
         {
             get { return GetSOP().Name; }
-            set { GetSOP().Name = value; }
+            set
+            {
+                if (CanEdit())
+                    GetSOP().Name = value;
+            }
         }
 
         public string Description
         {
             get { return GetSOP().Description; }
-            set { GetSOP().Description = value; }
+            set
+            {
+                if (CanEdit()) 
+                    GetSOP().Description = value;
+            }
         }
 
         public IObject[] Children
@@ -151,7 +181,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
                 int i = 0;
                 foreach (KeyValuePair<UUID, SceneObjectPart> pair in my.ParentGroup.Children)
                 {
-                    rets[i++] = new SOPObject(m_rootScene, pair.Value.LocalId);
+                    rets[i++] = new SOPObject(m_rootScene, pair.Value.LocalId, m_security);
                 }
 
                 return rets;
@@ -160,7 +190,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
 
         public IObject Root
         {
-            get { return new SOPObject(m_rootScene, GetSOP().ParentGroup.RootPart.LocalId); }
+            get { return new SOPObject(m_rootScene, GetSOP().ParentGroup.RootPart.LocalId, m_security); }
         }
 
         public IObjectMaterial[] Materials
@@ -182,7 +212,11 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         public Vector3 Scale
         {
             get { return GetSOP().Scale; }
-            set { GetSOP().Scale = value; }
+            set
+            {
+                if (CanEdit())
+                    GetSOP().Scale = value;
+            }
         }
 
         public Quaternion WorldRotation
@@ -202,15 +236,24 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             get { return GetSOP().AbsolutePosition; }
             set
             {
-                SceneObjectPart pos = GetSOP();
-                pos.UpdateOffSet(value - pos.AbsolutePosition);
+                if (CanEdit())
+                {
+                    SceneObjectPart pos = GetSOP();
+                    pos.UpdateOffSet(value - pos.AbsolutePosition);
+                }
             }
         }
 
         public Vector3 OffsetPosition
         {
             get { return GetSOP().OffsetPosition; }
-            set { GetSOP().OffsetPosition = value; }
+            set
+            {
+                if (CanEdit())
+                {
+                    GetSOP().OffsetPosition = value;
+                }
+            }
         }
 
         public Vector3 SitTarget
@@ -310,8 +353,10 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
 
         public void Say(string msg)
         {
-            SceneObjectPart sop = GetSOP();
+            if (!CanEdit())
+                return;
 
+            SceneObjectPart sop = GetSOP();
             m_rootScene.SimChat(msg, ChatTypeEnum.Say, sop.AbsolutePosition, sop.Name, sop.UUID, false);
         }
 
@@ -503,6 +548,9 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             }
             set
             {
+                if (!CanEdit())
+                    return;
+
                 GetSOP().PhysActor.RotationalVelocity = new PhysicsVector(value.X, value.Y, value.Z);
             }
         }
@@ -516,6 +564,9 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             }
             set
             {
+                if (!CanEdit())
+                    return;
+
                 GetSOP().PhysActor.Velocity = new PhysicsVector(value.X, value.Y, value.Z);
             }
         }
@@ -529,6 +580,9 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             }
             set
             {
+                if (!CanEdit())
+                    return;
+
                 GetSOP().PhysActor.Torque = new PhysicsVector(value.X, value.Y, value.Z);
             }
         }
@@ -551,27 +605,44 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             }
             set
             {
+                if (!CanEdit())
+                    return;
+
                 GetSOP().PhysActor.Force = new PhysicsVector(value.X, value.Y, value.Z);
             }
         }
 
         public bool FloatOnWater
         {
-            set { GetSOP().PhysActor.FloatOnWater = value; }
+            set
+            {
+                if (!CanEdit())
+                    return;
+                GetSOP().PhysActor.FloatOnWater = value;
+            }
         }
 
         public void AddForce(Vector3 force, bool pushforce)
         {
+            if (!CanEdit())
+                return;
+
             GetSOP().PhysActor.AddForce(new PhysicsVector(force.X, force.Y, force.Z), pushforce);
         }
 
         public void AddAngularForce(Vector3 force, bool pushforce)
         {
+            if (!CanEdit())
+                return;
+
             GetSOP().PhysActor.AddAngularForce(new PhysicsVector(force.X, force.Y, force.Z), pushforce);
         }
 
         public void SetMomentum(Vector3 momentum)
         {
+            if (!CanEdit())
+                return;
+
             GetSOP().PhysActor.SetMomentum(new PhysicsVector(momentum.X, momentum.Y, momentum.Z));
         }
 
@@ -586,6 +657,9 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             get { return m_sculptMap; }
             set
             {
+                if (!CanEdit())
+                    return;
+
                 m_sculptMap = value;
                 SetPrimitiveSculpted(SculptMap, (byte) SculptType);
             }
@@ -598,6 +672,9 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             get { return m_sculptType; }
             set
             {
+                if (!CanEdit())
+                    return;
+
                 m_sculptType = value;
                 SetPrimitiveSculpted(SculptMap, (byte) SculptType);
             }
@@ -654,6 +731,9 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
 
         public void Play(UUID asset, double volume)
         {
+            if (!CanEdit())
+                return;
+
             GetSOP().SendSound(asset.ToString(), volume, true, 0);
         }
 
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/SOPObjectMaterial.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/SOPObjectMaterial.cs
index 68f2f52..0cba6af 100644
--- a/OpenSim/Region/OptionalModules/Scripting/Minimodule/SOPObjectMaterial.cs
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/SOPObjectMaterial.cs
@@ -91,24 +91,45 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         public bool Bright
         {
             get { return GetTexface().Fullbright; }
-            set { throw new System.NotImplementedException(); }
+            set
+            {
+                Primitive.TextureEntry tex = m_parent.Shape.Textures;
+                Primitive.TextureEntryFace texface = tex.CreateFace((uint)m_face);
+                texface.Fullbright = value;
+                tex.FaceTextures[m_face] = texface;
+                m_parent.UpdateTexture(tex);
+            }
         }
 
         public double Bloom
         {
             get { return GetTexface().Glow; }
-            set { throw new System.NotImplementedException(); }
+            set
+            {
+                Primitive.TextureEntry tex = m_parent.Shape.Textures;
+                Primitive.TextureEntryFace texface = tex.CreateFace((uint)m_face);
+                texface.Glow = (float) value;
+                tex.FaceTextures[m_face] = texface;
+                m_parent.UpdateTexture(tex);
+            }
         }
 
         public bool Shiny
         {
             get { return GetTexface().Shiny != Shininess.None; }
-            set { throw new System.NotImplementedException(); }
+            set
+            {
+                Primitive.TextureEntry tex = m_parent.Shape.Textures;
+                Primitive.TextureEntryFace texface = tex.CreateFace((uint)m_face);
+                texface.Shiny = value ? Shininess.High : Shininess.None;
+                tex.FaceTextures[m_face] = texface;
+                m_parent.UpdateTexture(tex);
+            }
         }
 
         public bool BumpMap
         {
-            get { throw new System.NotImplementedException(); }
+            get { return GetTexface().Bump == Bumpiness.None; }
             set { throw new System.NotImplementedException(); }
         }
     }
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/SPAvatar.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/SPAvatar.cs
index ce2d339..4427426 100644
--- a/OpenSim/Region/OptionalModules/Scripting/Minimodule/SPAvatar.cs
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/SPAvatar.cs
@@ -25,28 +25,26 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-using System;
-using System.Reflection;
 using System.Collections;
 using System.Collections.Generic;
-
+using System.Security;
 using OpenMetaverse;
 using OpenSim.Region.Framework.Scenes;
 using OpenSim.Region.Framework.Interfaces;
 
-using log4net;
-
 namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
 {
     class SPAvatar : System.MarshalByRefObject, IAvatar
     {
         private readonly Scene m_rootScene;
         private readonly UUID m_ID;
+        private readonly ISecurityCredential m_security;
         //private static readonly ILog m_log = LogManager.GetLogger(MethodBase.GetCurrentMethod().DeclaringType);
 
-        public SPAvatar(Scene scene, UUID ID)
+        public SPAvatar(Scene scene, UUID ID, ISecurityCredential security)
         {
             m_rootScene = scene;
+            m_security = security;
             m_ID = ID;
         }
 
@@ -58,7 +56,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         public string Name
         {
             get { return GetSP().Name; }
-            set { throw new InvalidOperationException("Avatar Names are a read-only property."); }
+            set { throw new SecurityException("Avatar Names are a read-only property."); }
         }
 
         public UUID GlobalID
@@ -84,7 +82,9 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
                     foreach (DictionaryEntry element in internalAttachments)
                     {
                         Hashtable attachInfo = (Hashtable)element.Value;
-                        attachments.Add(new SPAvatarAttachment(m_rootScene, this, (int)element.Key, new UUID((string)attachInfo["item"]), new UUID((string)attachInfo["asset"])));
+                        attachments.Add(new SPAvatarAttachment(m_rootScene, this, (int) element.Key,
+                                                               new UUID((string) attachInfo["item"]),
+                                                               new UUID((string) attachInfo["asset"]), m_security));
                     }
                 }
                 
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/SPAvatarAttachment.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/SPAvatarAttachment.cs
index 9b684fe..570459a 100644
--- a/OpenSim/Region/OptionalModules/Scripting/Minimodule/SPAvatarAttachment.cs
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/SPAvatarAttachment.cs
@@ -39,10 +39,13 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         private readonly int m_location;
         //private readonly UUID m_itemId;
         private readonly UUID m_assetId;
+
+        private readonly ISecurityCredential m_security;
         
-        public SPAvatarAttachment(Scene rootScene, IAvatar self, int location, UUID itemId, UUID assetId)
+        public SPAvatarAttachment(Scene rootScene, IAvatar self, int location, UUID itemId, UUID assetId, ISecurityCredential security)
         {
             m_rootScene = rootScene;
+            m_security = security;
             //m_parent = self;
             m_location = location;
             //m_itemId = itemId;
@@ -55,7 +58,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
         {
             get
             {
-                return new SOPObject(m_rootScene, m_rootScene.GetSceneObjectPart(m_assetId).LocalId);
+                return new SOPObject(m_rootScene, m_rootScene.GetSceneObjectPart(m_assetId).LocalId, m_security);
             }
         }
     }
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/SecurityCredential.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/SecurityCredential.cs
new file mode 100644
index 0000000..bc7f6cb
--- /dev/null
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/SecurityCredential.cs
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) Contributors, http://opensimulator.org/
+ * See CONTRIBUTORS.TXT for a full list of copyright holders.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the OpenSimulator Project nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Text;
+using OpenMetaverse;
+using OpenSim.Region.Framework.Scenes;
+
+namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
+{
+    class SecurityCredential : ISecurityCredential
+    {
+        private readonly ISocialEntity m_owner;
+        private readonly Scene m_scene;
+
+        public SecurityCredential(ISocialEntity m_owner, Scene m_scene)
+        {
+            this.m_owner = m_owner;
+            this.m_scene = m_scene;
+        }
+
+        public ISocialEntity owner
+        {
+            get { return m_owner; }
+        }
+
+        public bool CanEditObject(IObject target)
+        {
+            return m_scene.Permissions.CanEditObject(target.GlobalID, m_owner.GlobalID);
+        }
+
+        public bool CanEditTerrain(int x, int y)
+        {
+            return m_scene.Permissions.CanTerraformLand(m_owner.GlobalID, new Vector3(x, y, 0));
+        }
+    }
+}
diff --git a/OpenSim/Region/OptionalModules/Scripting/Minimodule/World.cs b/OpenSim/Region/OptionalModules/Scripting/Minimodule/World.cs
index 1ec4a33..da5ea0d 100644
--- a/OpenSim/Region/OptionalModules/Scripting/Minimodule/World.cs
+++ b/OpenSim/Region/OptionalModules/Scripting/Minimodule/World.cs
@@ -37,15 +37,17 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
     public class World : System.MarshalByRefObject, IWorld, IWorldAudio 
     {
         private readonly Scene m_internalScene;
+        private readonly ISecurityCredential m_security;
         private readonly Heightmap m_heights;
 
         private readonly ObjectAccessor m_objs;
 
-        public World(Scene internalScene)
+        public World(Scene internalScene, ISecurityCredential securityCredential)
         {
+            m_security = securityCredential;
             m_internalScene = internalScene;
             m_heights = new Heightmap(m_internalScene);
-            m_objs = new ObjectAccessor(m_internalScene);
+            m_objs = new ObjectAccessor(m_internalScene, securityCredential);
         }
 
         #region Events
@@ -84,7 +86,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             if (_OnNewUser != null)
             {
                 NewUserEventArgs e = new NewUserEventArgs();
-                e.Avatar = new SPAvatar(m_internalScene, presence.UUID);
+                e.Avatar = new SPAvatar(m_internalScene, presence.UUID, m_security);
                 _OnNewUser(this, e);
             }
         }
@@ -144,7 +146,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             if (chat.Sender == null && chat.SenderObject != null)
             {
                 ChatEventArgs e = new ChatEventArgs();
-                e.Sender = new SOPObject(m_internalScene, ((SceneObjectPart) chat.SenderObject).LocalId);
+                e.Sender = new SOPObject(m_internalScene, ((SceneObjectPart) chat.SenderObject).LocalId, m_security);
                 e.Text = chat.Message;
 
                 _OnChat(this, e);
@@ -154,7 +156,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
             if (chat.Sender != null && chat.SenderObject == null)
             {
                 ChatEventArgs e = new ChatEventArgs();
-                e.Sender = new SPAvatar(m_internalScene, chat.SenderUUID);
+                e.Sender = new SPAvatar(m_internalScene, chat.SenderUUID, m_security);
                 e.Text = chat.Message;
 
                 _OnChat(this, e);
@@ -207,7 +209,7 @@ namespace OpenSim.Region.OptionalModules.Scripting.Minimodule
                 for (int i = 0; i < ents.Count; i++)
                 {
                     EntityBase ent = ents[i];
-                    rets[i] = new SPAvatar(m_internalScene, ent.UUID);
+                    rets[i] = new SPAvatar(m_internalScene, ent.UUID, m_security);
                 }
 
                 return rets;
diff --git a/OpenSim/Region/OptionalModules/World/NPC/NPCAvatar.cs b/OpenSim/Region/OptionalModules/World/NPC/NPCAvatar.cs
index 4a8ba8c..f0bdf3b 100644
--- a/OpenSim/Region/OptionalModules/World/NPC/NPCAvatar.cs
+++ b/OpenSim/Region/OptionalModules/World/NPC/NPCAvatar.cs
@@ -213,6 +213,7 @@ namespace OpenSim.Region.OptionalModules.World.NPC
         public event UpdateShape OnUpdatePrimShape;
         public event ObjectExtraParams OnUpdateExtraParams;
         public event RequestObjectPropertiesFamily OnRequestObjectPropertiesFamily;
+        public event ObjectRequest OnObjectRequest;
         public event ObjectSelect OnObjectSelect;
         public event GenericCall7 OnObjectDescription;
         public event GenericCall7 OnObjectName;