aboutsummaryrefslogtreecommitdiffstatshomepage
diff options
context:
space:
mode:
authorMelanie Thielker2010-05-30 13:46:05 +0200
committerMelanie2010-05-30 12:45:16 +0100
commitbfcac0ede824ead5b6809f03eab73450f48075db (patch)
tree403cb164209f6e937bcf5e4b71fc84880d517965
parentGet the user's DOB back from the server response properly. (diff)
downloadopensim-SC_OLD-bfcac0ede824ead5b6809f03eab73450f48075db.zip
opensim-SC_OLD-bfcac0ede824ead5b6809f03eab73450f48075db.tar.gz
opensim-SC_OLD-bfcac0ede824ead5b6809f03eab73450f48075db.tar.bz2
opensim-SC_OLD-bfcac0ede824ead5b6809f03eab73450f48075db.tar.xz
Changes OSSL Api permissions for the case of UUID list. In 0.6.9, the UUIDs
would be the IDs of the prim owners in whose prims these functions would run. This changes it so the UUID is the SCRIPT CREATOR instead. Further, osfunctions limited by uuid will not run if the creator and owner differ and the owner has mod rights on the script. There is still a danger in passing moodifiable scripts to others, as they can insert a harmful function, then remove the mod rights to make it runnable. As before, care needs to be taken, but where it was modable prims that were the risk before, modable scripts are the weak spot now. In cases where prim owner == script creator == script owner, nothing will change.
-rw-r--r--OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs21
1 files changed, 18 insertions, 3 deletions
diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs
index 15469db..5b634e0 100644
--- a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs
+++ b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs
@@ -278,10 +278,25 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
278 { 278 {
279 if (!m_FunctionPerms[function].Contains(UUID.Zero)) 279 if (!m_FunctionPerms[function].Contains(UUID.Zero))
280 { 280 {
281 if (!m_FunctionPerms[function].Contains(m_host.OwnerID)) 281 TaskInventoryItem ti = m_host.Inventory.GetInventoryItem(m_itemID);
282 if (ti == null)
283 {
284 OSSLError(
285 String.Format("{0} permission error. Can't find script in prim inventory.",
286 function));
287 }
288 if (!m_FunctionPerms[function].Contains(ti.CreatorID))
282 OSSLError( 289 OSSLError(
283 String.Format("{0} permission denied. Prim owner is not in the list of users allowed to execute this function.", 290 String.Format("{0} permission denied. Script creator is not in the list of users allowed to execute this function.",
284 function)); 291 function));
292 if (ti.CreatorID != ti.OwnerID)
293 {
294 if ((ti.CurrentPermissions & (uint)PermissionMask.Modify) != 0)
295 OSSLError(
296 String.Format("{0} permission denied. Script permissions error.",
297 function));
298
299 }
285 } 300 }
286 } 301 }
287 } 302 }
@@ -2137,4 +2152,4 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
2137 } 2152 }
2138 } 2153 }
2139 } 2154 }
2140} \ No newline at end of file 2155}