Fix: Mantis#2326: Fix: privilege escalation through attach from ground

Fix: objects being duplicated inventory on detach. Fix: Mad jumping around of
attachments while editing. Fix: Attachments being persisted to database on
login. Fix: Attachments being persisted when changed by a script like
invisprim refresh. Fix: Attachpoint set, but not reset correctly. Fix: prevent
spurious full updates while editing attachments. Several other fixes

1 files changed, 12 insertions, 2 deletions

diff --git a/OpenSim/Region/Environment/Scenes/InnerScene.cs b/OpenSim/Region/Environment/Scenes/InnerScene.cs
index f58f334..65fa544 100644
--- a/OpenSim/Region/Environment/Scenes/InnerScene.cs
+++ b/OpenSim/Region/Environment/Scenes/InnerScene.cs
@@ -418,8 +418,18 @@ namespace OpenSim.Region.Environment.Scenes
         /// <param name="rot"></param>
         protected internal void AttachObject(IClientAPI remoteClient, uint objectLocalID, uint AttachmentPt, Quaternion rot)
         {
-            // Calls attach with a Zero position
+            // If we can't take it, we can't attach it!
+            //
+            SceneObjectPart part = m_parentScene.GetSceneObjectPart(objectLocalID);
+            if (part == null)
+                return;
 
+            if (!m_parentScene.ExternalChecks.ExternalChecksCanTakeObject(
+                    part.UUID, remoteClient.AgentId))
+                return;
+
+            // Calls attach with a Zero position
+            //
             AttachObject(remoteClient, objectLocalID, AttachmentPt, rot, Vector3.Zero);
         }
 
@@ -431,6 +441,7 @@ namespace OpenSim.Region.Environment.Scenes
                 (uint)(PermissionMask.Copy | PermissionMask.Move | PermissionMask.Modify | PermissionMask.Transfer),
                 (uint)(PermissionMask.Copy | PermissionMask.Move | PermissionMask.Modify | PermissionMask.Transfer),
                 ItemFlags, false, false, remoteClient.AgentId, true);
+            objatt.SetAttachmentPoint(Convert.ToByte(AttachmentPt));
 
             if (objatt != null)
             {
@@ -514,7 +525,6 @@ namespace OpenSim.Region.Environment.Scenes
                                 UUID newAssetID = m_parentScene.attachObjectAssetStore(remoteClient, group, remoteClient.AgentId);
 
                                 // sets assetID so client can show asset as 'attached' in inventory
-                                group.SetFromAssetID(newAssetID);
                             }
                             group.AttachToAgent(remoteClient.AgentId, AttachmentPt, attachPos);
                             // In case it is later dropped again, don't let