From d9c48e70a9a01f56135ede2cef9ec45c7dddf567 Mon Sep 17 00:00:00 2001
From: CasperW
Date: Mon, 18 Jan 2010 17:56:27 +0100
Subject: Fix a major security problem with osSetDynamicTexture which allowed
 the deletion of /any/ asset.

---
 .../Scripting/DynamicTexture/DynamicTextureModule.cs    | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

(limited to 'OpenSim')

diff --git a/OpenSim/Region/CoreModules/Scripting/DynamicTexture/DynamicTextureModule.cs b/OpenSim/Region/CoreModules/Scripting/DynamicTexture/DynamicTextureModule.cs
index f51d0c2..679c871 100644
--- a/OpenSim/Region/CoreModules/Scripting/DynamicTexture/DynamicTextureModule.cs
+++ b/OpenSim/Region/CoreModules/Scripting/DynamicTexture/DynamicTextureModule.cs
@@ -358,11 +358,18 @@ namespace OpenSim.Region.CoreModules.Scripting.DynamicTexture
                     // tmptex.DefaultTexture.Fullbright = true;
 
                     part.UpdateTexture(tmptex);
-                }
-
-                if (oldID != UUID.Zero && ((Disp & DISP_EXPIRE) != 0))
-                {
-                    scene.AssetService.Delete(oldID.ToString());
+                }
+
+                if (oldID != UUID.Zero && ((Disp & DISP_EXPIRE) != 0))
+                {
+                    if (oldAsset == null) oldAsset = scene.AssetService.Get(oldID.ToString());
+                    if (oldAsset != null)
+                    {
+                        if (oldAsset.Temporary == true)
+                        {
+                            scene.AssetService.Delete(oldID.ToString());
+                        }
+                    }
                 }
             }
 
-- 
cgit v1.1