8 files changed, 139 insertions, 44 deletions

diff --git a/OpenSim/Region/CoreModules/Avatar/Attachments/AttachmentsModule.cs b/OpenSim/Region/CoreModules/Avatar/Attachments/AttachmentsModule.cs
index f073c4a..31e8a2e 100644
--- a/OpenSim/Region/CoreModules/Avatar/Attachments/AttachmentsModule.cs
+++ b/OpenSim/Region/CoreModules/Avatar/Attachments/AttachmentsModule.cs
@@ -28,6 +28,7 @@
 using System;
 using System.Collections.Generic;
 using System.Reflection;
+using System.IO;
 using System.Xml;
 using log4net;
 using Mono.Addins;
@@ -248,7 +249,7 @@ namespace OpenSim.Region.CoreModules.Avatar.Attachments
             }
         }
 
-        public void DeRezAttachments(IScenePresence sp, bool saveChanged, bool saveAllScripted)
+        public void DeRezAttachments(IScenePresence sp)
         {
             if (!Enabled)
                 return;
@@ -259,18 +260,7 @@ namespace OpenSim.Region.CoreModules.Avatar.Attachments
             {
                 foreach (SceneObjectGroup so in sp.GetAttachments())
                 {
-                    // We can only remove the script instances from the script engine after we've retrieved their xml state
-                    // when we update the attachment item.
-                    m_scene.DeleteSceneObject(so, false, false);
-    
-                    if (saveChanged || saveAllScripted)
-                    {
-                        so.IsAttachment = false;
-                        so.AbsolutePosition = so.RootPart.AttachedPos;
-                        UpdateKnownItem(sp, so, saveAllScripted);
-                    }
-
-                    so.RemoveScriptInstances(true);
+                    UpdateDetachedObject(sp, so);
                 }
     
                 sp.ClearAttachments();
@@ -597,7 +587,7 @@ namespace OpenSim.Region.CoreModules.Avatar.Attachments
         /// <param name="sp"></param>
         /// <param name="grp"></param>
         /// <param name="saveAllScripted"></param>
-        private void UpdateKnownItem(IScenePresence sp, SceneObjectGroup grp, bool saveAllScripted)
+        private void UpdateKnownItem(IScenePresence sp, SceneObjectGroup grp, string scriptedState)
         {
             // Saving attachments for NPCs messes them up for the real owner!
             INPCModule module = m_scene.RequestModuleInterface<INPCModule>();
@@ -607,13 +597,13 @@ namespace OpenSim.Region.CoreModules.Avatar.Attachments
                     return;
             }
 
-            if (grp.HasGroupChanged || (saveAllScripted && grp.ContainsScripts()))
+            if (grp.HasGroupChanged)
             {
 //                m_log.DebugFormat(
 //                    "[ATTACHMENTS MODULE]: Updating asset for attachment {0}, attachpoint {1}",
 //                    grp.UUID, grp.AttachmentPoint);
 
-                string sceneObjectXml = SceneObjectSerializer.ToOriginalXmlFormat(grp);
+                string sceneObjectXml = SceneObjectSerializer.ToOriginalXmlFormat(grp, scriptedState);
 
                 InventoryItemBase item = new InventoryItemBase(grp.FromItemID, sp.UUID);
                 item = m_scene.InventoryService.GetItem(item);
@@ -750,29 +740,68 @@ namespace OpenSim.Region.CoreModules.Avatar.Attachments
             return newItem;
         }
 
-        private void DetachSingleAttachmentToInvInternal(IScenePresence sp, SceneObjectGroup so)
+        private string GetObjectScriptStates(SceneObjectGroup grp)
         {
-            //            m_log.DebugFormat("[ATTACHMENTS MODULE]: Detaching item {0} to inventory for {1}", itemID, sp.Name);
+            using (StringWriter sw = new StringWriter())
+            {
+                using (XmlTextWriter writer = new XmlTextWriter(sw))
+                {
+                    grp.SaveScriptedState(writer);
+                }
 
-            m_scene.EventManager.TriggerOnAttach(so.LocalId, so.FromItemID, UUID.Zero);
-            sp.RemoveAttachment(so);
+                return sw.ToString();
+            }
+        }
+
+        private void UpdateDetachedObject(IScenePresence sp, SceneObjectGroup so)
+        {
+            // Don't save attachments for HG visitors, it
+            // messes up their inventory. When a HG visitor logs
+            // out on a foreign grid, their attachments will be
+            // reloaded in the state they were in when they left
+            // the home grid. This is best anyway as the visited
+            // grid may use an incompatible script engine.
+            bool saveChanged
+                    = sp.PresenceType != PresenceType.Npc
+                    && (m_scene.UserManagementModule == null
+                    || m_scene.UserManagementModule.IsLocalGridUser(sp.UUID));
+
+            // Scripts MUST be snapshotted before the object is
+            // removed from the scene because doing otherwise will
+            // clobber the run flag
+            string scriptedState = GetObjectScriptStates(so);
+
+            // Remove the object from the scene so no more updates
+            // are sent. Doing this before the below changes will ensure
+            // updates can't cause "HUD artefacts"
+            m_scene.DeleteSceneObject(so, false, false);
 
             // Prepare sog for storage
             so.AttachedAvatar = UUID.Zero;
             so.RootPart.SetParentLocalId(0);
             so.IsAttachment = false;
 
-            // We cannot use AbsolutePosition here because that would
-            // attempt to cross the prim as it is detached
-            so.ForEachPart(x => { x.GroupPosition = so.RootPart.AttachedPos; });
+            if (saveChanged)
+            {
+                // We cannot use AbsolutePosition here because that would
+                // attempt to cross the prim as it is detached
+                so.ForEachPart(x => { x.GroupPosition = so.RootPart.AttachedPos; });
+
+                UpdateKnownItem(sp, so, scriptedState);
+            }
+
+            // Now, remove the scripts
+            so.RemoveScriptInstances(true);
+        }
 
-            UpdateKnownItem(sp, so, true);
+        private void DetachSingleAttachmentToInvInternal(IScenePresence sp, SceneObjectGroup so)
+        {
+            //            m_log.DebugFormat("[ATTACHMENTS MODULE]: Detaching item {0} to inventory for {1}", itemID, sp.Name);
+
+            m_scene.EventManager.TriggerOnAttach(so.LocalId, so.FromItemID, UUID.Zero);
+            sp.RemoveAttachment(so);
 
-            // This MUST happen AFTER serialization because it will
-            // either stop or remove the scripts. Both will cause scripts
-            // to be serialized in a stopped state with the true run
-            // state already lost.
-            m_scene.DeleteSceneObject(so, false, true);
+            UpdateDetachedObject(sp, so);
         }
 
         protected SceneObjectGroup RezSingleAttachmentFromInventoryInternal(
diff --git a/OpenSim/Region/CoreModules/Avatar/Inventory/Archiver/InventoryArchiverModule.cs b/OpenSim/Region/CoreModules/Avatar/Inventory/Archiver/InventoryArchiverModule.cs
index cf87010..7d1fe68 100644
--- a/OpenSim/Region/CoreModules/Avatar/Inventory/Archiver/InventoryArchiverModule.cs
+++ b/OpenSim/Region/CoreModules/Avatar/Inventory/Archiver/InventoryArchiverModule.cs
@@ -492,6 +492,8 @@ namespace OpenSim.Region.CoreModules.Avatar.Inventory.Archiver
                 return null;
             }
 
+            return account;
+            /*
             try
             {
                 string encpass = Util.Md5Hash(pass);
@@ -512,6 +514,7 @@ namespace OpenSim.Region.CoreModules.Avatar.Inventory.Archiver
                 m_log.ErrorFormat("[INVENTORY ARCHIVER]: Could not authenticate password, {0}", e.Message);
                 return null;
             }
+            */
         }
 
         /// <summary>
diff --git a/OpenSim/Region/Framework/Interfaces/IAttachmentsModule.cs b/OpenSim/Region/Framework/Interfaces/IAttachmentsModule.cs
index 410eda0..11a13e1 100644
--- a/OpenSim/Region/Framework/Interfaces/IAttachmentsModule.cs
+++ b/OpenSim/Region/Framework/Interfaces/IAttachmentsModule.cs
@@ -66,7 +66,7 @@ namespace OpenSim.Region.Framework.Interfaces
         /// <param name="sp">The presence closing</param>
         /// <param name="saveChanged">Save changed attachments.</param>
         /// <param name="saveAllScripted">Save attachments with scripts even if they haven't changed.</para>
-        void DeRezAttachments(IScenePresence sp, bool saveChanged, bool saveAllScripted);
+        void DeRezAttachments(IScenePresence sp);
 
         /// <summary>
         /// Delete all the presence's attachments from the scene
diff --git a/OpenSim/Region/Framework/Interfaces/IScenePresence.cs b/OpenSim/Region/Framework/Interfaces/IScenePresence.cs
index e6b926c..3f68ee0 100644
--- a/OpenSim/Region/Framework/Interfaces/IScenePresence.cs
+++ b/OpenSim/Region/Framework/Interfaces/IScenePresence.cs
@@ -40,6 +40,8 @@ namespace OpenSim.Region.Framework.Interfaces
     /// </remarks>
     public interface IScenePresence : ISceneAgent
     {
+        PresenceType PresenceType { get; }
+
         /// <summary>
         /// Copy of the script states while the agent is in transit. This state may
         /// need to be placed back in case of transfer fail.
@@ -83,4 +85,4 @@ namespace OpenSim.Region.Framework.Interfaces
         void RemoveAttachment(SceneObjectGroup gobj);
         void ClearAttachments();
     }
-}
\ No newline at end of file
+}
diff --git a/OpenSim/Region/Framework/Scenes/Scene.cs b/OpenSim/Region/Framework/Scenes/Scene.cs
index f501828..ad9e91d 100644
--- a/OpenSim/Region/Framework/Scenes/Scene.cs
+++ b/OpenSim/Region/Framework/Scenes/Scene.cs
@@ -3461,17 +3461,7 @@ namespace OpenSim.Region.Framework.Scenes
                 {
                     if (AttachmentsModule != null)
                     {
-                        // Don't save attachments for HG visitors, it
-                        // messes up their inventory. When a HG visitor logs
-                        // out on a foreign grid, their attachments will be
-                        // reloaded in the state they were in when they left
-                        // the home grid. This is best anyway as the visited
-                        // grid may use an incompatible script engine.
-                        bool saveChanged
-                            = avatar.PresenceType != PresenceType.Npc
-                                && (UserManagementModule == null || UserManagementModule.IsLocalGridUser(avatar.UUID));
-
-                        AttachmentsModule.DeRezAttachments(avatar, saveChanged, false);
+                        AttachmentsModule.DeRezAttachments(avatar);
                     }
 
                     ForEachClient(
diff --git a/OpenSim/Region/Framework/Scenes/Serialization/SceneObjectSerializer.cs b/OpenSim/Region/Framework/Scenes/Serialization/SceneObjectSerializer.cs
index 2372d6b..0d292e7 100644
--- a/OpenSim/Region/Framework/Scenes/Serialization/SceneObjectSerializer.cs
+++ b/OpenSim/Region/Framework/Scenes/Serialization/SceneObjectSerializer.cs
@@ -151,6 +151,24 @@ namespace OpenSim.Region.Framework.Scenes.Serialization
             ToOriginalXmlFormat(sceneObject, writer, doScriptStates, false);
         }
         
+        public static string ToOriginalXmlFormat(SceneObjectGroup sceneObject, string scriptedState)
+        {
+            using (StringWriter sw = new StringWriter())
+            {
+                using (XmlTextWriter writer = new XmlTextWriter(sw))
+                {
+                    writer.WriteStartElement(String.Empty, "SceneObjectGroup", String.Empty);
+
+                    ToOriginalXmlFormat(sceneObject, writer, false, true);
+
+                    writer.WriteRaw(scriptedState);
+
+                    writer.WriteEndElement();
+                }
+                return sw.ToString();
+            }
+        }
+
         /// <summary>
         /// Serialize a scene object to the original xml format
         /// </summary>
diff --git a/OpenSim/Region/Physics/UbitOdePlugin/OdeScene.cs b/OpenSim/Region/Physics/UbitOdePlugin/OdeScene.cs
index a554897..f3ac3ca 100644
--- a/OpenSim/Region/Physics/UbitOdePlugin/OdeScene.cs
+++ b/OpenSim/Region/Physics/UbitOdePlugin/OdeScene.cs
@@ -1027,7 +1027,7 @@ namespace OpenSim.Region.Physics.OdePlugin
                                     {
                                         d.AABB aabb;
                                         d.GeomGetAABB(g2, out aabb);
-                                        float tmp = vtmp.Z - sz * .25f;
+                                        float tmp = vtmp.Z - sz * .18f;
 
                                         if (aabb.MaxZ < tmp)
                                         {
@@ -1057,7 +1057,7 @@ namespace OpenSim.Region.Physics.OdePlugin
                                     {
                                         d.AABB aabb;
                                         d.GeomGetAABB(g1, out aabb);
-                                        float tmp = vtmp.Z - sz * .25f;
+                                        float tmp = vtmp.Z - sz * .18f;
 
                                         if (aabb.MaxZ < tmp)
                                         {
diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs
index 977f39e..2425646 100644
--- a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs
+++ b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs
@@ -11471,6 +11471,59 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
             if (userAgent != null)
                 httpHeaders["User-Agent"] = userAgent;
 
+            // See if the URL contains any header hacks
+            string[] urlParts = url.Split(new char[] {'\n'});
+            if (urlParts.Length > 1)
+            {
+                // Iterate the passed headers and parse them
+                for (int i = 1 ; i < urlParts.Length ; i++ )
+                {
+                    // The rest of those would be added to the body in SL.
+                    // Let's not do that.
+                    if (urlParts[i] == String.Empty)
+                        break;
+
+                    // See if this could be a valid header
+                    string[] headerParts = urlParts[i].Split(new char[] {':'}, 2);
+                    if (headerParts.Length != 2)
+                        continue;
+
+                    string headerName = headerParts[0].Trim();
+                    string headerValue = headerParts[1].Trim();
+
+                    // Filter out headers that could be used to abuse
+                    // another system or cloak the request
+                    if (headerName.ToLower() == "x-secondlife-shard" ||
+                        headerName.ToLower() == "x-secondlife-object-name" ||
+                        headerName.ToLower() == "x-secondlife-object-key" ||
+                        headerName.ToLower() == "x-secondlife-region" ||
+                        headerName.ToLower() == "x-secondlife-local-position" ||
+                        headerName.ToLower() == "x-secondlife-local-velocity" ||
+                        headerName.ToLower() == "x-secondlife-local-rotation" ||
+                        headerName.ToLower() == "x-secondlife-owner-name" ||
+                        headerName.ToLower() == "x-secondlife-owner-key" ||
+                        headerName.ToLower() == "connection" ||
+                        headerName.ToLower() == "content-length" ||
+                        headerName.ToLower() == "from" ||
+                        headerName.ToLower() == "host" ||
+                        headerName.ToLower() == "proxy-authorization" ||
+                        headerName.ToLower() == "referer" ||
+                        headerName.ToLower() == "trailer" ||
+                        headerName.ToLower() == "transfer-encoding" ||
+                        headerName.ToLower() == "via" ||
+                        headerName.ToLower() == "authorization")
+                        continue;
+
+                    httpHeaders[headerName] = headerValue;
+                }
+
+                // Finally, strip any protocol specifier from the URL
+                url = urlParts[0].Trim();
+                int idx = url.IndexOf(" HTTP/");
+                if (idx != -1)
+                    url = url.Substring(0, idx);
+            }
+
             string authregex = @"^(https?:\/\/)(\w+):(\w+)@(.*)$";
             Regex r = new Regex(authregex);
             int[] gnums = r.GetGroupNumbers();