From 14259b5f995da0b87190d873d1e5dc7a94606445 Mon Sep 17 00:00:00 2001
From: Melanie Thielker
Date: Thu, 16 Oct 2014 03:53:56 +0200
Subject: Fix an obscure permissions exploit. Taking items from a friend's prim
 could possibly result in a privilege escalation

---
 OpenSim/Region/Framework/Scenes/Scene.Inventory.cs | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

(limited to 'OpenSim/Region/Framework/Scenes')

diff --git a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
index 0c51f7f..87fee56 100644
--- a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
+++ b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
@@ -1236,17 +1236,15 @@ namespace OpenSim.Region.Framework.Scenes
                 agentItem.BasePermissions = taskItem.BasePermissions & (taskItem.NextPermissions | (uint)PermissionMask.Move);
                 if (taskItem.InvType == (int)InventoryType.Object)
                 {
-                    uint perms = taskItem.CurrentPermissions;
+                    uint perms = taskItem.BasePermissions & taskItem.NextPermissions;
                     PermissionsUtil.ApplyFoldedPermissions(taskItem.CurrentPermissions, ref perms);
 //                    agentItem.BasePermissions = perms | (uint)PermissionMask.Move;
 //                    agentItem.CurrentPermissions = agentItem.BasePermissions;
-                    agentItem.CurrentPermissions = perms | (uint)PermissionMask.Move;
-                }
-                else
-                {
-                    agentItem.CurrentPermissions = agentItem.BasePermissions & taskItem.CurrentPermissions;
+                    agentItem.BasePermissions = perms | (uint)PermissionMask.Move;
                 }
 
+                agentItem.CurrentPermissions = agentItem.BasePermissions;
+
                 agentItem.Flags |= (uint)InventoryItemFlags.ObjectSlamPerm;
                 agentItem.NextPermissions = taskItem.NextPermissions;
                 agentItem.EveryOnePermissions = taskItem.EveryonePermissions & (taskItem.NextPermissions | (uint)PermissionMask.Move);
-- 
cgit v1.1