Fixes Mantis #3793 . Committing thomax/Snoopy's patch to allow deeding of objects, with changes:

- Set OwnerID = GroupID for deeded objects.
- Close a security loophole that would have allowed a user with deed rights in a group to deed ANY object to that group, even if it's not owned by them and/or not set to that group
- Set LastOwnerID correctly. Handle objects vs. prims correctly.

3 files changed, 70 insertions, 6 deletions

diff --git a/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs b/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs
index d786df8..380104d 100644
--- a/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs
+++ b/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs
@@ -184,6 +184,7 @@ namespace OpenSim.Region.CoreModules.World.Permissions
             m_scene.Permissions.OnAbandonParcel += CanAbandonParcel;
             m_scene.Permissions.OnReclaimParcel += CanReclaimParcel;
             m_scene.Permissions.OnDeedParcel += CanDeedParcel;
+            m_scene.Permissions.OnDeedObject += CanDeedObject;
             m_scene.Permissions.OnIsGod += IsGod;
             m_scene.Permissions.OnDuplicateObject += CanDuplicateObject;
             m_scene.Permissions.OnDeleteObject += CanDeleteObject; //MAYBE FULLY IMPLEMENTED
@@ -818,6 +819,20 @@ namespace OpenSim.Region.CoreModules.World.Permissions
             return GenericParcelOwnerPermission(user, parcel, (ulong)GroupPowers.LandDeed);
         }
 
+        private bool CanDeedObject(UUID user, UUID group, Scene scene)
+        {
+            DebugPermissionInformation(MethodInfo.GetCurrentMethod().Name);
+            if (m_bypassPermissions) return m_bypassPermissionsValue;
+
+            ScenePresence sp = scene.GetScenePresence(user);
+            IClientAPI client = sp.ControllingClient;
+
+            if((client.GetGroupPowers(group) & (ulong)GroupPowers.DeedObject) == 0)
+                return false;
+
+            return true;
+        }
+
         private bool IsGod(UUID user, Scene scene)
         {
             DebugPermissionInformation(MethodInfo.GetCurrentMethod().Name);
@@ -846,7 +861,7 @@ namespace OpenSim.Region.CoreModules.World.Permissions
 
             if (part.GroupID != UUID.Zero)
             {
-                if ((part.OwnerID == UUID.Zero) && ((owner != part.LastOwnerID) || ((part.GroupMask & PERM_TRANS) == 0)))
+                if ((part.OwnerID == part.GroupID) && ((owner != part.LastOwnerID) || ((part.GroupMask & PERM_TRANS) == 0)))
                     return false;
 
                 if ((part.GroupMask & PERM_COPY) == 0)
diff --git a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
index 8e3c688..1a40a0d 100644
--- a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
+++ b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs
@@ -2682,16 +2682,48 @@ namespace OpenSim.Region.Framework.Scenes
         void ObjectOwner(IClientAPI remoteClient, UUID ownerID, UUID groupID, List<uint> localIDs)
         {
             if (!Permissions.IsGod(remoteClient.AgentId))
-                return;
+            {
+                if (ownerID != UUID.Zero)
+                    return;
+                
+                if (!Permissions.CanDeedObject(remoteClient.AgentId, groupID))
+                    return;
+            }
+
+            List<SceneObjectGroup> groups = new List<SceneObjectGroup>();
 
             foreach (uint localID in localIDs)
             {
                 SceneObjectPart part = GetSceneObjectPart(localID);
-                if (part != null && part.ParentGroup != null)
+                if (!groups.Contains(part.ParentGroup))
+                    groups.Add(part.ParentGroup);
+            }
+
+            foreach (SceneObjectGroup sog in groups)
+            {
+                if (ownerID != null)
                 {
-                    part.ParentGroup.SetOwnerId(ownerID);
-                    part.Inventory.ChangeInventoryOwner(ownerID);
-                    part.ParentGroup.SetGroup(groupID, remoteClient);
+                    sog.SetOwnerId(ownerID);
+                    sog.SetGroup(groupID, remoteClient);
+
+                    foreach (SceneObjectPart child in sog.Children.Values)
+                        child.Inventory.ChangeInventoryOwner(ownerID);
+                }
+                else
+                {
+                    if (!Permissions.CanEditObject(sog.UUID, remoteClient.AgentId))
+                        continue;
+
+                    if (sog.GroupID != groupID)
+                        continue;
+
+                    foreach (SceneObjectPart child in sog.Children.Values)
+                    {
+                        child.LastOwnerID = child.OwnerID;
+                        child.Inventory.ChangeInventoryOwner(groupID);
+                    }
+
+                    sog.SetOwnerId(groupID);
                 }
             }
         }
diff --git a/OpenSim/Region/Framework/Scenes/Scene.Permissions.cs b/OpenSim/Region/Framework/Scenes/Scene.Permissions.cs
index d0da618..226ec15 100644
--- a/OpenSim/Region/Framework/Scenes/Scene.Permissions.cs
+++ b/OpenSim/Region/Framework/Scenes/Scene.Permissions.cs
@@ -69,6 +69,7 @@ namespace OpenSim.Region.Framework.Scenes
     public delegate bool AbandonParcelHandler(UUID user, ILandObject parcel, Scene scene);
     public delegate bool ReclaimParcelHandler(UUID user, ILandObject parcel, Scene scene);
     public delegate bool DeedParcelHandler(UUID user, ILandObject parcel, Scene scene);
+    public delegate bool DeedObjectHandler(UUID user, UUID group, Scene scene);
     public delegate bool BuyLandHandler(UUID user, ILandObject parcel, Scene scene);
     public delegate bool LinkObjectHandler(UUID user, UUID objectID);
     public delegate bool DelinkObjectHandler(UUID user, UUID objectID);
@@ -127,6 +128,7 @@ namespace OpenSim.Region.Framework.Scenes
         public event AbandonParcelHandler OnAbandonParcel;
         public event ReclaimParcelHandler OnReclaimParcel;
         public event DeedParcelHandler OnDeedParcel;
+        public event DeedObjectHandler OnDeedObject;
         public event BuyLandHandler OnBuyLand;
         public event LinkObjectHandler OnLinkObject;
         public event DelinkObjectHandler OnDelinkObject;
@@ -735,6 +737,21 @@ namespace OpenSim.Region.Framework.Scenes
             return true;
         }
 
+        public bool CanDeedObject(UUID user, UUID group)
+        {
+            DeedObjectHandler handler = OnDeedObject;
+            if (handler != null)
+            {
+                Delegate[] list = handler.GetInvocationList();
+                foreach (DeedObjectHandler h in list)
+                {
+                    if (h(user, group, m_scene) == false)
+                        return false;
+                }
+            }
+            return true;
+        }
+
         public bool CanBuyLand(UUID user, ILandObject parcel)
         {
             BuyLandHandler handler = OnBuyLand;