*Patch as supplied in Mantis #0001705 by melanie. Fixes: Locked prims allow *any avatar* to deposit scripts in them, regardless of permissions

2 files changed, 30 insertions, 18 deletions

diff --git a/OpenSim/Region/Environment/Scenes/Scene.Inventory.cs b/OpenSim/Region/Environment/Scenes/Scene.Inventory.cs
index b0e4a87..704ca5d 100644
--- a/OpenSim/Region/Environment/Scenes/Scene.Inventory.cs
+++ b/OpenSim/Region/Environment/Scenes/Scene.Inventory.cs
@@ -1166,6 +1166,12 @@ namespace OpenSim.Region.Environment.Scenes
 
             if (part != null)
             {
+                if (part.OwnerID != remoteClient.AgentId)
+                    return;
+
+                if ((part.OwnerMask & (uint)PermissionMask.Modify) == 0)
+                    return;
+
                 TaskInventoryItem currentItem = part.GetInventoryItem(itemID);
 
                 if (currentItem == null)
@@ -1256,17 +1262,20 @@ namespace OpenSim.Region.Environment.Scenes
                         SceneObjectPart part = GetSceneObjectPart(localID);
                         if (part != null)
                         {
-                            if (ExternalChecks.ExternalChecksCanRunScript(item.ID, part.UUID, remoteClient.AgentId))
-                            {
-                                part.ParentGroup.AddInventoryItem(remoteClient, localID, item, copyID);
-                                // TODO: set this to "true" when scripts in inventory have persistent state to fire on_rez
-                                part.CreateScriptInstance(copyID, 0, false);
-                                part.GetProperties(remoteClient);
+                            if (part.OwnerID != remoteClient.AgentId)
+                                return;
 
-                                //                        m_log.InfoFormat("[PRIMINVENTORY]: " +
-                                //                                         "Rezzed script {0} into prim local ID {1} for user {2}",
-                                //                                         item.inventoryName, localID, remoteClient.Name);
-                            }
+                            if ((part.OwnerMask & (uint)PermissionMask.Modify) == 0)
+                                return;
+
+                            part.ParentGroup.AddInventoryItem(remoteClient, localID, item, copyID);
+                            // TODO: set this to "true" when scripts in inventory have persistent state to fire on_rez
+                            part.CreateScriptInstance(copyID, 0, false);
+
+                            //                        m_log.InfoFormat("[PRIMINVENTORY]: " +
+                            //                                         "Rezzed script {0} into prim local ID {1} for user {2}",
+                            //                                         item.inventoryName, localID, remoteClient.Name);
+                            part.GetProperties(remoteClient);
                         }
                         else
                         {
@@ -1291,6 +1300,12 @@ namespace OpenSim.Region.Environment.Scenes
                 if (part == null)
                     return;
 
+                if (part.OwnerID != remoteClient.AgentId)
+                    return;
+
+                if ((part.OwnerMask & (uint)PermissionMask.Modify) == 0)
+                    return;
+
                 AssetBase asset = CreateAsset(itemBase.Name, itemBase.Description, (sbyte)itemBase.AssetType, Encoding.ASCII.GetBytes("default\n{\n    state_entry()\n    {\n        llSay(0, \"Script running\");\n    }\n}"));
                 AssetCache.AddAsset(asset);
 
@@ -1319,10 +1334,7 @@ namespace OpenSim.Region.Environment.Scenes
                 part.AddInventoryItem(taskItem);
                 part.GetProperties(remoteClient);
                 
-                if (ExternalChecks.ExternalChecksCanRunScript(taskItem.AssetID, part.UUID, remoteClient.AgentId))
-                {
-                    part.CreateScriptInstance(taskItem, 0, false);
-                }
+                part.CreateScriptInstance(taskItem, 0, false);
             }
         }
 
@@ -1418,10 +1430,7 @@ namespace OpenSim.Region.Environment.Scenes
 
             if (running > 0)
             {
-                if (ExternalChecks.ExternalChecksCanRunScript(destTaskItem.AssetID, destPart.UUID, destPart.OwnerID))
-                {
-                    destPart.CreateScriptInstance(destTaskItem, 0, false);
-                }
+                destPart.CreateScriptInstance(destTaskItem, 0, false);
             }
             
             ScenePresence avatar;
diff --git a/OpenSim/Region/Environment/Scenes/SceneObjectPart.Inventory.cs b/OpenSim/Region/Environment/Scenes/SceneObjectPart.Inventory.cs
index 3975b25..0b48464 100644
--- a/OpenSim/Region/Environment/Scenes/SceneObjectPart.Inventory.cs
+++ b/OpenSim/Region/Environment/Scenes/SceneObjectPart.Inventory.cs
@@ -162,6 +162,9 @@ namespace OpenSim.Region.Environment.Scenes
             //                "[PRIM INVENTORY]: " +
             //                "Starting script {0}, {1} in prim {2}, {3}",
             //                item.Name, item.ItemID, Name, UUID);
+            if (!m_parentGroup.Scene.ExternalChecks.ExternalChecksCanRunScript(item.ItemID, UUID, item.OwnerID))
+                return;
+
             AddFlag(LLObject.ObjectFlags.Scripted);
 
             if (!((m_parentGroup.Scene.RegionInfo.EstateSettings.regionFlags & Simulator.RegionFlags.SkipScripts) == Simulator.RegionFlags.SkipScripts))