From df55e5295fe029a9a7d23f71263cbf72c8921884 Mon Sep 17 00:00:00 2001
From: Melanie Thielker
Date: Thu, 15 Jul 2010 20:03:08 +0200
Subject: Fix a few permissions vulnerability. Owners could cause permissions
 escalation on items contained in prims using a hacked viewer

---
 OpenSim/Region/Framework/Scenes/Scene.Inventory.cs | 35 ++++++++++++++++++++--
 OpenSim/Region/Framework/Scenes/SceneObjectPart.cs |  7 +++++
 .../Framework/Scenes/SceneObjectPartInventory.cs   | 10 +++----
 3 files changed, 44 insertions(+), 8 deletions(-)

(limited to 'OpenSim')

diff --git a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
index 96a9d97..5f41f4b 100644
--- a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
+++ b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
@@ -1339,16 +1339,45 @@ namespace OpenSim.Region.Framework.Scenes
                     {
                         agentTransactions.HandleTaskItemUpdateFromTransaction(
                             remoteClient, part, transactionID, currentItem);
-                    }
-                    if (part.Inventory.UpdateInventoryItem(itemInfo))
-                    {
+
                         if ((InventoryType)itemInfo.InvType == InventoryType.Notecard) 
                             remoteClient.SendAgentAlertMessage("Notecard saved", false);
                         else if ((InventoryType)itemInfo.InvType == InventoryType.LSL)
                             remoteClient.SendAgentAlertMessage("Script saved", false);
                         else
                             remoteClient.SendAgentAlertMessage("Item saved", false);
+                    }
 
+                    // Check if we're allowed to mess with permissions
+                    if (!Permissions.IsGod(remoteClient.AgentId)) // Not a god
+                    {
+                        if (remoteClient.AgentId != part.OwnerID) // Not owner
+                        {
+                            // Friends and group members can't change any perms
+                            itemInfo.BasePermissions = currentItem.BasePermissions;
+                            itemInfo.EveryonePermissions = currentItem.EveryonePermissions;
+                            itemInfo.GroupPermissions = currentItem.GroupPermissions;
+                            itemInfo.NextPermissions = currentItem.NextPermissions;
+                            itemInfo.CurrentPermissions = currentItem.CurrentPermissions;
+                        }
+                        else
+                        {
+                            // Owner can't change base, and can change other
+                            // only up to base
+                            // Base ALWAYS has move
+                            currentItem.BasePermissions |= (uint)PermissionMask.Move;
+                            itemInfo.BasePermissions = currentItem.BasePermissions;
+                            itemInfo.EveryonePermissions &= currentItem.BasePermissions;
+                            itemInfo.GroupPermissions &= currentItem.BasePermissions;
+                            itemInfo.CurrentPermissions &= currentItem.BasePermissions;
+                            itemInfo.NextPermissions &= currentItem.BasePermissions;
+                            // Next ALWAYS has move
+                            itemInfo.NextPermissions |= (uint)PermissionMask.Move;
+                        }
+
+                    }
+                    if (part.Inventory.UpdateInventoryItem(itemInfo))
+                    {
                         part.GetProperties(remoteClient);
                     }
                 }
diff --git a/OpenSim/Region/Framework/Scenes/SceneObjectPart.cs b/OpenSim/Region/Framework/Scenes/SceneObjectPart.cs
index 59fd805..6e29312 100644
--- a/OpenSim/Region/Framework/Scenes/SceneObjectPart.cs
+++ b/OpenSim/Region/Framework/Scenes/SceneObjectPart.cs
@@ -4137,6 +4137,13 @@ namespace OpenSim.Region.Framework.Scenes
                     case 16:
                         _nextOwnerMask = ApplyMask(_nextOwnerMask, set, mask) &
                                 baseMask;
+                        // Prevent the client from creating no mod, no copy
+                        // objects
+                        if ((_nextOwnerMask & (uint)PermissionMask.Copy) == 0)
+                            _nextOwnerMask |= (uint)PermissionMask.Transfer;
+
+                        _nextOwnerMask |= (uint)PermissionMask.Move;
+
                         break;
                 }
                 SendFullUpdateToAllClients();
diff --git a/OpenSim/Region/Framework/Scenes/SceneObjectPartInventory.cs b/OpenSim/Region/Framework/Scenes/SceneObjectPartInventory.cs
index 20d5486..0ec15c1 100644
--- a/OpenSim/Region/Framework/Scenes/SceneObjectPartInventory.cs
+++ b/OpenSim/Region/Framework/Scenes/SceneObjectPartInventory.cs
@@ -600,12 +600,12 @@ namespace OpenSim.Region.Framework.Scenes
                     item.GroupID = m_part.GroupID;
                         
                 if (item.AssetID == UUID.Zero)
-                    item.AssetID = it.AssetID;
-
-                lock (m_items)
                 {
-                    m_items[item.ItemID] = item;
-                    m_inventorySerial++;
+                    item.AssetID = m_items[item.ItemID].AssetID;
+                }
+                else if ((InventoryType)item.Type == InventoryType.Notecard)
+                {
+                    ScenePresence presence = m_part.ParentGroup.Scene.GetScenePresence(item.OwnerID);
                 }
 
                 if (fireScriptEvents)
-- 
cgit v1.1