diff options
author | Melanie Thielker | 2010-07-15 20:28:18 +0200 |
---|---|---|
committer | Diva Canto | 2010-07-20 14:52:50 -0700 |
commit | 2eadd984ab7faeed12ef142435da349bd7ed4de0 (patch) | |
tree | f38970d98c2fcf52aa37b8681e4e6043887555c3 /OpenSim | |
parent | Fix a few permissions vulnerability. Owners could cause permissions (diff) | |
download | opensim-SC_OLD-2eadd984ab7faeed12ef142435da349bd7ed4de0.zip opensim-SC_OLD-2eadd984ab7faeed12ef142435da349bd7ed4de0.tar.gz opensim-SC_OLD-2eadd984ab7faeed12ef142435da349bd7ed4de0.tar.bz2 opensim-SC_OLD-2eadd984ab7faeed12ef142435da349bd7ed4de0.tar.xz |
prevent hacked viewers from being able to delete arbitrary items from any
prim. Allow friends with perms and shared group members to move or copy
things out of prims
Diffstat (limited to '')
-rw-r--r-- | OpenSim/Region/Framework/Scenes/Scene.Inventory.cs | 21 |
1 files changed, 18 insertions, 3 deletions
diff --git a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs index 5f41f4b..8ec3b81 100644 --- a/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs +++ b/OpenSim/Region/Framework/Scenes/Scene.Inventory.cs | |||
@@ -915,6 +915,9 @@ namespace OpenSim.Region.Framework.Scenes | |||
915 | SceneObjectGroup group = part.ParentGroup; | 915 | SceneObjectGroup group = part.ParentGroup; |
916 | if (group != null) | 916 | if (group != null) |
917 | { | 917 | { |
918 | if (!Permissions.CanEditObjectInventory(part.UUID, remoteClient.AgentId)) | ||
919 | return; | ||
920 | |||
918 | TaskInventoryItem item = group.GetInventoryItem(localID, itemID); | 921 | TaskInventoryItem item = group.GetInventoryItem(localID, itemID); |
919 | if (item == null) | 922 | if (item == null) |
920 | return; | 923 | return; |
@@ -1054,9 +1057,21 @@ namespace OpenSim.Region.Framework.Scenes | |||
1054 | return; | 1057 | return; |
1055 | } | 1058 | } |
1056 | 1059 | ||
1057 | // Only owner can copy | 1060 | TaskInventoryItem item = part.Inventory.GetInventoryItem(itemId); |
1058 | if (remoteClient.AgentId != taskItem.OwnerID) | 1061 | if ((item.CurrentPermissions & (uint)PermissionMask.Copy) == 0) |
1059 | return; | 1062 | { |
1063 | // If the item to be moved is no copy, we need to be able to | ||
1064 | // edit the prim. | ||
1065 | if (!Permissions.CanEditObjectInventory(part.UUID, remoteClient.AgentId)) | ||
1066 | return; | ||
1067 | } | ||
1068 | else | ||
1069 | { | ||
1070 | // If the item is copiable, then we just need to have perms | ||
1071 | // on it. The delete check is a pure rights check | ||
1072 | if (!Permissions.CanDeleteObject(part.UUID, remoteClient.AgentId)) | ||
1073 | return; | ||
1074 | } | ||
1060 | 1075 | ||
1061 | MoveTaskInventoryItem(remoteClient, folderId, part, itemId); | 1076 | MoveTaskInventoryItem(remoteClient, folderId, part, itemId); |
1062 | } | 1077 | } |