3 files changed, 45 insertions, 18 deletions

diff --git a/OpenSim/Region/Framework/Interfaces/INPCModule.cs b/OpenSim/Region/Framework/Interfaces/INPCModule.cs
index cac8479..3ec1bda 100644
--- a/OpenSim/Region/Framework/Interfaces/INPCModule.cs
+++ b/OpenSim/Region/Framework/Interfaces/INPCModule.cs
@@ -53,6 +53,14 @@ namespace OpenSim.Region.Framework.Interfaces
         bool IsNPC(UUID agentID, Scene scene);
 
         /// <summary>
+        /// Check if the caller has permission to manipulate the given NPC.
+        /// </summary>
+        /// <param name="npcID"></param>
+        /// <param name="callerID"></param>
+        /// <returns>true if they do, false if they don't or if there's no NPC with the given ID.</returns>
+        bool CheckPermissions(UUID npcID, UUID callerID);
+
+        /// <summary>
         /// Set the appearance for an NPC.
         /// </summary>
         /// <param name="agentID"></param>
diff --git a/OpenSim/Region/OptionalModules/World/NPC/NPCModule.cs b/OpenSim/Region/OptionalModules/World/NPC/NPCModule.cs
index e874417..8f9b513 100644
--- a/OpenSim/Region/OptionalModules/World/NPC/NPCModule.cs
+++ b/OpenSim/Region/OptionalModules/World/NPC/NPCModule.cs
@@ -56,6 +56,24 @@ namespace OpenSim.Region.OptionalModules.World.NPC
             }
         }
 
+        public void PostInitialise()
+        {
+        }
+
+        public void Close()
+        {
+        }
+
+        public string Name
+        {
+            get { return "NPCModule"; }
+        }
+
+        public bool IsSharedModule
+        {
+            get { return true; }
+        }
+
         public bool IsNPC(UUID agentId, Scene scene)
         {
             // FIXME: This implementation could not just use the ScenePresence.PresenceType (and callers could inspect
@@ -255,7 +273,7 @@ namespace OpenSim.Region.OptionalModules.World.NPC
                 NPCAvatar av;
                 if (m_avatars.TryGetValue(agentID, out av))
                 {
-                    if (av.OwnerID != UUID.Zero && callerID != UUID.Zero && av.OwnerID != callerID)
+                    if (!CheckPermissions(av, callerID));
                         return false;
 
                     scene.RemoveClient(agentID, false);
@@ -268,22 +286,27 @@ namespace OpenSim.Region.OptionalModules.World.NPC
             return false;
         }
 
-        public void PostInitialise()
-        {
-        }
-
-        public void Close()
-        {
-        }
-
-        public string Name
+        public bool CheckPermissions(UUID npcID, UUID callerID)
         {
-            get { return "NPCModule"; }
+            lock (m_avatars)
+            {
+                NPCAvatar av;
+                if (m_avatars.TryGetValue(npcID, out av))
+                    return CheckPermissions(av, callerID);
+                else
+                    return false;
+            }
         }
 
-        public bool IsSharedModule
+        /// <summary>
+        /// Check if the caller has permission to manipulate the given NPC.
+        /// </summary>
+        /// <param name="av"></param>
+        /// <param name="callerID"></param>
+        /// <returns>true if they do, false if they don't.</returns>
+        private bool CheckPermissions(NPCAvatar av, UUID callerID)
         {
-            get { return true; }
+            return callerID == UUID.Zero || av.OwnerID == UUID.Zero || av.OwnerID == callerID;
         }
     }
 }
diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs
index e2a045b..1d7a210 100644
--- a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs
+++ b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs
@@ -2152,11 +2152,7 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
                 if (!UUID.TryParse(npc.m_string, out npcId))
                     return new LSL_Key(UUID.Zero.ToString());
 
-                if (!npcModule.IsNPC(npcId, m_host.ParentGroup.Scene))
-                    return new LSL_Key(UUID.Zero.ToString());
-
-                UUID ownerID = npcModule.GetOwner(npcId);
-                if (ownerID != UUID.Zero && ownerID != m_host.OwnerID)
+                if (!npcModule.CheckPermissions(npcId, m_host.OwnerID))
                     return new LSL_Key(UUID.Zero.ToString());
 
                 return SaveAppearanceToNotecard(npcId, notecard);