2 files changed, 60 insertions, 1 deletions

diff --git a/OpenSim/Region/ClientStack/LindenUDP/LLClientView.cs b/OpenSim/Region/ClientStack/LindenUDP/LLClientView.cs
index 8293319..7f95ddd 100644
--- a/OpenSim/Region/ClientStack/LindenUDP/LLClientView.cs
+++ b/OpenSim/Region/ClientStack/LindenUDP/LLClientView.cs
@@ -5110,6 +5110,65 @@ namespace OpenSim.Region.ClientStack.LindenUDP
                     case PacketType.TransferRequest:
                         //Console.WriteLine("ClientView.ProcessPackets.cs:ProcessInPacket() - Got transfer request");
                         TransferRequestPacket transfer = (TransferRequestPacket)Pack;
+                        // Validate inventory transfers
+                        // Has to be done here, because AssetCache can't do it
+                        //
+                        if (transfer.TransferInfo.SourceType == 3)
+                        {
+                            LLUUID taskID = null;
+                            LLUUID itemID = null;
+                            LLUUID requestID = null;
+                            taskID = new LLUUID(transfer.TransferInfo.Params, 48);
+                            itemID = new LLUUID(transfer.TransferInfo.Params, 64);
+                            requestID = new LLUUID(transfer.TransferInfo.Params, 80);
+                            if (!(((Scene)m_scene).ExternalChecks.ExternalChecksBypassPermissions()))
+                            {
+                                if(taskID != LLUUID.Zero) // Prim
+                                {
+                                    SceneObjectPart part = ((Scene)m_scene).GetSceneObjectPart(taskID);
+                                    if(part == null)
+                                        break;
+
+                                    if(part.OwnerID != AgentId)
+                                        break;
+
+                                    if((part.OwnerMask & (uint)PermissionMask.Modify) == 0)
+                                        break;
+
+                                    TaskInventoryItem ti = part.GetInventoryItem(itemID);
+                                    if(ti == null)
+                                        break;
+
+                                    if(ti.OwnerID != AgentId)
+                                        break;
+
+                                    if((ti.OwnerMask & ((uint)PermissionMask.Modify| (uint)PermissionMask.Copy | (uint)PermissionMask.Transfer)) != ((uint)PermissionMask.Modify| (uint)PermissionMask.Copy | (uint)PermissionMask.Transfer))
+                                        break;
+
+                                    if(ti.AssetID != requestID)
+                                        break;
+                                }
+                                else // Agent
+                                {
+                                    CachedUserInfo userInfo = ((Scene)m_scene).CommsManager.UserProfileCacheService.GetUserDetails(AgentId);
+                                    if(userInfo == null)
+                                        break;
+
+                                    if(userInfo.RootFolder == null)
+                                        break;
+
+                                    InventoryItemBase assetRequestItem = userInfo.RootFolder.FindItem(itemID);
+                                    if(assetRequestItem == null)
+                                        return;
+
+                                    if((assetRequestItem.CurrentPermissions & ((uint)PermissionMask.Modify| (uint)PermissionMask.Copy | (uint)PermissionMask.Transfer)) != ((uint)PermissionMask.Modify| (uint)PermissionMask.Copy | (uint)PermissionMask.Transfer))
+                                        break;
+                                    if(assetRequestItem.AssetID != requestID)
+                                        break;
+                                }
+                            }
+                        }
+
                         m_assetCache.AddAssetRequest(this, transfer);
                         /* RequestAsset = OnRequestAsset;
                          if (RequestAsset != null)
diff --git a/OpenSim/Region/Environment/Modules/World/Permissions/PermissionsModule.cs b/OpenSim/Region/Environment/Modules/World/Permissions/PermissionsModule.cs
index f571408..41bb610 100644
--- a/OpenSim/Region/Environment/Modules/World/Permissions/PermissionsModule.cs
+++ b/OpenSim/Region/Environment/Modules/World/Permissions/PermissionsModule.cs
@@ -602,7 +602,7 @@ namespace OpenSim.Region.Environment.Modules.World.Permissions
                 DebugPermissionInformation(MethodInfo.GetCurrentMethod().Name);
                 if (m_bypassPermissions) return m_bypassPermissionsValue;
 
-                return true;
+                return false;
             }
 
             private bool CanEditNotecard(LLUUID notecard, LLUUID objectID, LLUUID user, Scene scene)