When creating an OAR, optionally exclude objects according to their permissions

2 files changed, 104 insertions, 3 deletions

diff --git a/OpenSim/Region/CoreModules/World/Archiver/ArchiveWriteRequestPreparation.cs b/OpenSim/Region/CoreModules/World/Archiver/ArchiveWriteRequestPreparation.cs
index 10a83ee..b895afe 100644
--- a/OpenSim/Region/CoreModules/World/Archiver/ArchiveWriteRequestPreparation.cs
+++ b/OpenSim/Region/CoreModules/World/Archiver/ArchiveWriteRequestPreparation.cs
@@ -127,6 +127,12 @@ namespace OpenSim.Region.CoreModules.World.Archiver
     
                 EntityBase[] entities = m_scene.GetEntities();
                 List<SceneObjectGroup> sceneObjects = new List<SceneObjectGroup>();
+
+                string checkPermissions = null;
+                int numObjectsSkippedPermissions = 0;
+                Object temp;
+                if (options.TryGetValue("checkPermissions", out temp))
+                    checkPermissions = (string)temp;
          
                 // Filter entities so that we only have scene objects.
                 // FIXME: Would be nicer to have this as a proper list in SceneGraph, since lots of methods
@@ -136,9 +142,19 @@ namespace OpenSim.Region.CoreModules.World.Archiver
                     if (entity is SceneObjectGroup)
                     {
                         SceneObjectGroup sceneObject = (SceneObjectGroup)entity;
-                        
+
                         if (!sceneObject.IsDeleted && !sceneObject.IsAttachment)
-                            sceneObjects.Add((SceneObjectGroup)entity);
+                        {
+                            if (!CanUserArchiveObject(m_scene.RegionInfo.EstateSettings.EstateOwner, sceneObject, checkPermissions))
+                            {
+                                // The user isn't allowed to copy/transfer this object, so it will not be included in the OAR.
+                                ++numObjectsSkippedPermissions;
+                            }
+                            else
+                            {
+                                sceneObjects.Add(sceneObject);
+                            }
+                        }
                     }
                 }
 
@@ -159,7 +175,14 @@ namespace OpenSim.Region.CoreModules.World.Archiver
                 {
                     m_log.DebugFormat("[ARCHIVER]: Not saving assets since --noassets was specified");
                 }
-                
+
+                if (numObjectsSkippedPermissions > 0)
+                {
+                    m_log.DebugFormat(
+                        "[ARCHIVER]: {0} scene objects skipped due to lack of permissions",
+                        numObjectsSkippedPermissions);
+                }
+
                 // Make sure that we also request terrain texture assets
                 RegionSettings regionSettings = m_scene.RegionInfo.RegionSettings;
     
@@ -211,6 +234,83 @@ namespace OpenSim.Region.CoreModules.World.Archiver
         }
 
         /// <summary>
+        /// Checks whether the user has permission to export an object group to an OAR.
+        /// </summary>
+        /// <param name="user">The user</param>
+        /// <param name="objGroup">The object group</param>
+        /// <param name="checkPermissions">Which permissions to check: "C" = Copy, "T" = Transfer</param>
+        /// <returns>Whether the user is allowed to export the object to an OAR</returns>
+        private bool CanUserArchiveObject(UUID user, SceneObjectGroup objGroup, string checkPermissions)
+        {
+            if (checkPermissions == null)
+                return true;
+
+            IPermissionsModule module = m_scene.RequestModuleInterface<IPermissionsModule>();
+            if (module == null)
+                return true;    // this shouldn't happen
+
+            // Check whether the user is permitted to export all of the parts in the SOG. If any
+            // part can't be exported then the entire SOG can't be exported.
+
+            bool permitted = true;
+            //int primNumber = 1;
+
+            foreach (SceneObjectPart obj in objGroup.Parts)
+            {
+                uint perm;
+                PermissionClass permissionClass = module.GetPermissionClass(user, obj);
+                switch (permissionClass)
+                {
+                    case PermissionClass.Owner:
+                        perm = obj.BaseMask;
+                        break;
+                    case PermissionClass.Group:
+                        perm = obj.GroupMask | obj.EveryoneMask;
+                        break;
+                    case PermissionClass.Everyone:
+                    default:
+                        perm = obj.EveryoneMask;
+                        break;
+                }
+
+                bool canCopy = (perm & (uint)PermissionMask.Copy) != 0;
+                bool canTransfer = (perm & (uint)PermissionMask.Transfer) != 0;
+
+                // Special case: if Everyone can copy the object then this implies it can also be
+                // Transferred.
+                // However, if the user is the Owner then we don't check EveryoneMask, because it seems that the mask
+                // always (incorrectly) includes the Copy bit set in this case. But that's a mistake: the viewer
+                // does NOT show that the object has Everyone-Copy permissions, and doesn't allow it to be copied.
+                if (permissionClass != PermissionClass.Owner)
+                {
+                    canTransfer |= (obj.EveryoneMask & (uint)PermissionMask.Copy) != 0;
+                }
+
+
+                bool partPermitted = true;
+                if (checkPermissions.Contains("C") && !canCopy)
+                    partPermitted = false;
+                if (checkPermissions.Contains("T") && !canTransfer)
+                    partPermitted = false;
+
+                //string name = (objGroup.PrimCount == 1) ? objGroup.Name : string.Format("{0} ({1}/{2})", obj.Name, primNumber, objGroup.PrimCount);
+                //m_log.DebugFormat("[ARCHIVER]: Object permissions: {0}: Base={1:X4}, Owner={2:X4}, Everyone={3:X4}, permissionClass={4}, checkPermissions={5}, canCopy={6}, canTransfer={7}, permitted={8}",
+                //    name, obj.BaseMask, obj.OwnerMask, obj.EveryoneMask,
+                //    permissionClass, checkPermissions, canCopy, canTransfer, permitted);
+
+                if (!partPermitted)
+                {
+                    permitted = false;
+                    break;
+                }
+
+                //++primNumber;
+            }
+
+            return permitted;
+        }
+
+        /// <summary>
         /// Create the control file for the most up to date archive
         /// </summary>
         /// <returns></returns>
diff --git a/OpenSim/Region/CoreModules/World/Archiver/ArchiverModule.cs b/OpenSim/Region/CoreModules/World/Archiver/ArchiverModule.cs
index 08eb80c..f44a3ba 100644
--- a/OpenSim/Region/CoreModules/World/Archiver/ArchiverModule.cs
+++ b/OpenSim/Region/CoreModules/World/Archiver/ArchiverModule.cs
@@ -128,6 +128,7 @@ namespace OpenSim.Region.CoreModules.World.Archiver
 //            ops.Add("v|version=", delegate(string v) { options["version"] = v; });
             ops.Add("p|profile=", delegate(string v) { options["profile"] = v; });
             ops.Add("noassets", delegate(string v) { options["noassets"] = v != null; });
+            ops.Add("perm=", delegate(string v) { options["checkPermissions"] = v; });
 
             List<string> mainParams = ops.Parse(cmdparams);