Fix link security issue

7 files changed, 70 insertions, 43 deletions

diff --git a/OpenSim/Framework/IClientAPI.cs b/OpenSim/Framework/IClientAPI.cs
index af88c4a..01daeb1 100644
--- a/OpenSim/Framework/IClientAPI.cs
+++ b/OpenSim/Framework/IClientAPI.cs
@@ -73,7 +73,7 @@ namespace OpenSim.Framework
 
     public delegate void LinkObjects(IClientAPI remoteClient, uint parent, List<uint> children);
 
-    public delegate void DelinkObjects(List<uint> primIds);
+    public delegate void DelinkObjects(List<uint> primIds, IClientAPI client);
 
     public delegate void RequestMapBlocks(IClientAPI remoteClient, int minX, int minY, int maxX, int maxY, uint flag);
 
diff --git a/OpenSim/Region/ClientStack/LindenUDP/LLClientView.cs b/OpenSim/Region/ClientStack/LindenUDP/LLClientView.cs
index d7120a5..1f3582c 100644
--- a/OpenSim/Region/ClientStack/LindenUDP/LLClientView.cs
+++ b/OpenSim/Region/ClientStack/LindenUDP/LLClientView.cs
@@ -6151,7 +6151,7 @@ namespace OpenSim.Region.ClientStack.LindenUDP
             DelinkObjects handlerDelinkObjects = OnDelinkObjects;
             if (handlerDelinkObjects != null)
             {
-                handlerDelinkObjects(prims);
+                handlerDelinkObjects(prims, this);
             }
 
             return true;
@@ -11820,4 +11820,4 @@ namespace OpenSim.Region.ClientStack.LindenUDP
             OutPacket(dialog, ThrottleOutPacketType.Task);
         }
     }
-}
\ No newline at end of file
+}
diff --git a/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs b/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs
index 01359f0..f6bb3fe 100644
--- a/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs
+++ b/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs
@@ -1721,7 +1721,7 @@ namespace OpenSim.Region.CoreModules.World.Permissions
             DebugPermissionInformation(MethodInfo.GetCurrentMethod().Name);
             if (m_bypassPermissions) return m_bypassPermissionsValue;
 
-            return true;
+            return GenericObjectPermission(editorID, objectID, false);
         }
 
         private bool CanDelinkObject(UUID userID, UUID objectID)
@@ -1729,7 +1729,7 @@ namespace OpenSim.Region.CoreModules.World.Permissions
             DebugPermissionInformation(MethodInfo.GetCurrentMethod().Name);
             if (m_bypassPermissions) return m_bypassPermissionsValue;
 
-            return true;
+            return GenericObjectPermission(editorID, objectID, false);
         }
 
         private bool CanBuyLand(UUID userID, ILandObject parcel, Scene scene)
@@ -1894,4 +1894,4 @@ namespace OpenSim.Region.CoreModules.World.Permissions
             return(false);
         }
     }
-}
\ No newline at end of file
+}
diff --git a/OpenSim/Region/DataSnapshot/ObjectSnapshot.cs b/OpenSim/Region/DataSnapshot/ObjectSnapshot.cs
index f441aa9..6e69902 100644
--- a/OpenSim/Region/DataSnapshot/ObjectSnapshot.cs
+++ b/OpenSim/Region/DataSnapshot/ObjectSnapshot.cs
@@ -69,7 +69,7 @@ namespace OpenSim.Region.DataSnapshot.Providers
                 byte RayEndIsIntersection) { this.Stale = true; };
             client.OnLinkObjects += delegate (IClientAPI remoteClient, uint parent, List<uint> children)
                 { this.Stale = true; };
-            client.OnDelinkObjects += delegate(List<uint> primIds) { this.Stale = true; };
+            client.OnDelinkObjects += delegate(List<uint> primIds, IClientAPI clientApi) { this.Stale = true; };
             client.OnGrabUpdate += delegate(UUID objectID, Vector3 offset, Vector3 grapPos,
                 IClientAPI remoteClient, List<SurfaceTouchEventArgs> surfaceArgs) { this.Stale = true; };
             client.OnObjectAttach += delegate(IClientAPI remoteClient, uint objectLocalID, uint AttachmentPt,
diff --git a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
index 15b5230..6ebfd31 100644
--- a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
+++ b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
@@ -1941,5 +1941,55 @@ namespace OpenSim.Region.Framework.Scenes
                 part.GetProperties(remoteClient);
             }
         }
+
+        public void DelinkObjects(List<uint> primIds, IClientAPI client)
+        {
+            List<SceneObjectPart> parts = new List<SceneObjectPart>();
+
+            foreach (uint localID in primIds)
+            {
+                SceneObjectPart part = GetSceneObjectPart(localID);
+
+                if (part == null)
+                    continue;
+
+                if (Permissions.CanDelinkObject(client.AgentId, part.ParentGroup.RootPart.UUID))
+                    parts.Add(part);
+            }
+
+            m_sceneGraph.DelinkObjects(parts);
+        }
+
+        public void LinkObjects(IClientAPI client, uint parentPrimId, List<uint> childPrimIds)
+        {
+            List<UUID> owners = new List<UUID>();
+
+            List<SceneObjectPart> children = new List<SceneObjectPart>();
+            SceneObjectPart root = GetSceneObjectPart(parentPrimId);
+
+            if (Permissions.CanLinkObject(client.AgentId, root.ParentGroup.RootPart.UUID))
+                return;
+
+            foreach (uint localID in childPrimIds)
+            {
+                SceneObjectPart part = GetSceneObjectPart(localID);
+
+                if (part == null)
+                    continue;
+
+                if (!owners.Contains(part.OwnerID))
+                    owners.Add(part.OwnerID);
+
+                if (Permissions.CanLinkObject(client.AgentId, part.ParentGroup.RootPart.UUID))
+                    children.Add(part);
+            }
+
+            // Must be all one owner
+            //
+            if (owners.Count > 1)
+                return;
+
+            m_sceneGraph.LinkObjects(root, children);
+        }
     }
 }
diff --git a/OpenSim/Region/Framework/Scenes/Scene.cs b/OpenSim/Region/Framework/Scenes/Scene.cs
index 57587be..61a2956 100644
--- a/OpenSim/Region/Framework/Scenes/Scene.cs
+++ b/OpenSim/Region/Framework/Scenes/Scene.cs
@@ -2721,8 +2721,8 @@ namespace OpenSim.Region.Framework.Scenes
             client.OnObjectName += m_sceneGraph.PrimName;
             client.OnObjectClickAction += m_sceneGraph.PrimClickAction;
             client.OnObjectMaterial += m_sceneGraph.PrimMaterial;
-            client.OnLinkObjects += m_sceneGraph.LinkObjects;
-            client.OnDelinkObjects += m_sceneGraph.DelinkObjects;
+            client.OnLinkObjects += LinkObjects;
+            client.OnDelinkObjects += DelinkObjects;
             client.OnObjectDuplicate += m_sceneGraph.DuplicateObject;
             client.OnObjectDuplicateOnRay += doObjectDuplicateOnRay;
             client.OnUpdatePrimFlags += m_sceneGraph.UpdatePrimFlags;
@@ -2878,8 +2878,8 @@ namespace OpenSim.Region.Framework.Scenes
             client.OnObjectName -= m_sceneGraph.PrimName;
             client.OnObjectClickAction -= m_sceneGraph.PrimClickAction;
             client.OnObjectMaterial -= m_sceneGraph.PrimMaterial;
-            client.OnLinkObjects -= m_sceneGraph.LinkObjects;
-            client.OnDelinkObjects -= m_sceneGraph.DelinkObjects;
+            client.OnLinkObjects -= LinkObjects;
+            client.OnDelinkObjects -= DelinkObjects;
             client.OnObjectDuplicate -= m_sceneGraph.DuplicateObject;
             client.OnObjectDuplicateOnRay -= doObjectDuplicateOnRay;
             client.OnUpdatePrimFlags -= m_sceneGraph.UpdatePrimFlags;
diff --git a/OpenSim/Region/Framework/Scenes/SceneGraph.cs b/OpenSim/Region/Framework/Scenes/SceneGraph.cs
index 1421d0e..ce11267 100644
--- a/OpenSim/Region/Framework/Scenes/SceneGraph.cs
+++ b/OpenSim/Region/Framework/Scenes/SceneGraph.cs
@@ -1463,20 +1463,21 @@ namespace OpenSim.Region.Framework.Scenes
         /// <param name="client"></param>
         /// <param name="parentPrim"></param>
         /// <param name="childPrims"></param>
-        protected internal void LinkObjects(IClientAPI client, uint parentPrimId, List<uint> childPrimIds)
+        protected internal void LinkObjects(SceneObjectPart root, List<SceneObjectPart> children)
         {
             Monitor.Enter(m_updateLock);
             try
             {
-                SceneObjectGroup parentGroup = GetGroupByPrim(parentPrimId);
+                SceneObjectGroup parentGroup = root.ParentGroup;
 
                 List<SceneObjectGroup> childGroups = new List<SceneObjectGroup>();
                 if (parentGroup != null)
                 {
                     // We do this in reverse to get the link order of the prims correct
-                    for (int i = childPrimIds.Count - 1; i >= 0; i--)
+                    for (int i = children.Count - 1; i >= 0; i--)
                     {
-                        SceneObjectGroup child = GetGroupByPrim(childPrimIds[i]);
+                        SceneObjectGroup child = children[i].ParentGroup;
+
                         if (child != null)
                         {
                             // Make sure no child prim is set for sale
@@ -1509,17 +1510,6 @@ namespace OpenSim.Region.Framework.Scenes
                 parentGroup.HasGroupChanged = true;
                 parentGroup.ScheduleGroupForFullUpdate();
                 
-//                if (client != null)
-//                {
-//                    parentGroup.GetProperties(client);
-//                }
-//                else
-//                {
-//                    foreach (ScenePresence p in GetScenePresences())
-//                    {
-//                        parentGroup.GetProperties(p.ControllingClient);
-//                    }
-//                }
             }
             finally
             {
@@ -1531,12 +1521,7 @@ namespace OpenSim.Region.Framework.Scenes
         /// Delink a linkset
         /// </summary>
         /// <param name="prims"></param>
-        protected internal void DelinkObjects(List<uint> primIds)
-        {
-            DelinkObjects(primIds, true);
-        }
-
-        protected internal void DelinkObjects(List<uint> primIds, bool sendEvents)
+        protected internal void DelinkObjects(List<SceneObjectPart> prims)
         {
             Monitor.Enter(m_updateLock);
             try
@@ -1546,9 +1531,8 @@ namespace OpenSim.Region.Framework.Scenes
                 List<SceneObjectGroup> affectedGroups = new List<SceneObjectGroup>();
                 // Look them all up in one go, since that is comparatively expensive
                 //
-                foreach (uint primID in primIds)
+                foreach (SceneObjectPart part in prims)
                 {
-                    SceneObjectPart part = m_parentScene.GetSceneObjectPart(primID);
                     if (part != null)
                     {
                         if (part.ParentGroup.Children.Count != 1) // Skip single
@@ -1563,17 +1547,13 @@ namespace OpenSim.Region.Framework.Scenes
                                 affectedGroups.Add(group);
                         }
                     }
-                    else
-                    {
-                        m_log.ErrorFormat("Viewer requested unlink of nonexistent part {0}", primID);
-                    }
                 }
 
                 foreach (SceneObjectPart child in childParts)
                 {
                     // Unlink all child parts from their groups
                     //
-                    child.ParentGroup.DelinkFromGroup(child, sendEvents);
+                    child.ParentGroup.DelinkFromGroup(child, true);
                 }
 
                 foreach (SceneObjectPart root in rootParts)
@@ -1628,12 +1608,9 @@ namespace OpenSim.Region.Framework.Scenes
                             List<uint> linkIDs = new List<uint>();
 
                             foreach (SceneObjectPart newChild in newSet)
-                            {
                                 newChild.UpdateFlag = 0;
-                                linkIDs.Add(newChild.LocalId);
-                            }
 
-                            LinkObjects(null, newRoot.LocalId, linkIDs);
+                            LinkObjects(newRoot, newSet);
                             if (!affectedGroups.Contains(newRoot.ParentGroup))
                                 affectedGroups.Add(newRoot.ParentGroup);
                         }