Fix an obscure permissions exploit. Taking items from a friend's prim could

possibly result in a privilege escalation

1 files changed, 4 insertions, 6 deletions

diff --git a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
index 0c51f7f..87fee56 100644
--- a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
+++ b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
@@ -1236,17 +1236,15 @@ namespace OpenSim.Region.Framework.Scenes
                 agentItem.BasePermissions = taskItem.BasePermissions & (taskItem.NextPermissions | (uint)PermissionMask.Move);
                 if (taskItem.InvType == (int)InventoryType.Object)
                 {
-                    uint perms = taskItem.CurrentPermissions;
+                    uint perms = taskItem.BasePermissions & taskItem.NextPermissions;
                     PermissionsUtil.ApplyFoldedPermissions(taskItem.CurrentPermissions, ref perms);
 //                    agentItem.BasePermissions = perms | (uint)PermissionMask.Move;
 //                    agentItem.CurrentPermissions = agentItem.BasePermissions;
-                    agentItem.CurrentPermissions = perms | (uint)PermissionMask.Move;
-                }
-                else
-                {
-                    agentItem.CurrentPermissions = agentItem.BasePermissions & taskItem.CurrentPermissions;
+                    agentItem.BasePermissions = perms | (uint)PermissionMask.Move;
                 }
 
+                agentItem.CurrentPermissions = agentItem.BasePermissions;
+
                 agentItem.Flags |= (uint)InventoryItemFlags.ObjectSlamPerm;
                 agentItem.NextPermissions = taskItem.NextPermissions;
                 agentItem.EveryOnePermissions = taskItem.EveryonePermissions & (taskItem.NextPermissions | (uint)PermissionMask.Move);