From ce7694c108e8abf2e52a0b0167eab3d550f364ab Mon Sep 17 00:00:00 2001
From: SignpostMarv
Date: Wed, 1 Aug 2012 10:28:58 +0100
Subject: added perms checking, duplicated functionality to methods that do not
 require perms and have higher threat level

---
 .../Shared/Api/Implementation/OSSL_Api.cs          | 70 ++++++++++++++++++++--
 1 file changed, 64 insertions(+), 6 deletions(-)

(limited to 'OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs')

diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs
index 02b97e8..d0db15f 100644
--- a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs
+++ b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs
@@ -3538,7 +3538,7 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
 
             return new LSL_Key(m_host.ParentGroup.FromPartID.ToString());
         }
- 
+
         /// <summary>
         /// Sets the response type for an HTTP request/response
         /// </summary>
@@ -3549,11 +3549,35 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
             if (m_UrlModule != null)
                 m_UrlModule.HttpContentType(new UUID(id),type);
         }
-
-        public void osDropAttachment()
+        /// Shout an error if the object owner did not grant the script the specified permissions.
+        /// </summary>
+        /// <param name="perms"></param>
+        /// <returns>boolean indicating whether an error was shouted.</returns>
+        protected bool ShoutErrorOnLackingOwnerPerms(int perms, string errorPrefix)
         {
             CheckThreatLevel(ThreatLevel.Moderate, "osDropAttachment");
             m_host.AddScriptLPS(1);
+            bool fail = false;
+            if (m_item.PermsGranter != m_host.OwnerID)
+            {
+                fail = true;
+                OSSLShoutError(string.Format("{0}. Permissions not granted to owner.", errorPrefix));
+            }
+            else if ((m_item.PermsMask & perms) == 0)
+            {
+                fail = true;
+                OSSLShoutError(string.Format("{0}. Permissions not granted.", errorPrefix));
+            }
+
+            return fail;
+        }
+
+        protected void DropAttachment(bool checkPerms)
+        {
+            if (checkPerms && ShoutErrorOnLackingOwnerPerms(ScriptBaseClass.PERMISSION_ATTACH, "Cannot drop attachment"))
+            {
+                return;
+            }
 
             IAttachmentsModule attachmentsModule = m_ScriptEngine.World.AttachmentsModule;
             ScenePresence sp = attachmentsModule == null ? null : m_host.ParentGroup.Scene.GetScenePresence(m_host.ParentGroup.OwnerID);
@@ -3564,10 +3588,12 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
             }
         }
 
-        public void osDropAttachmentAt(LSL_Vector pos, LSL_Rotation rot)
+        protected void DropAttachemntAt(bool checkPerms, LSL_Vector pos, LSL_Rotation rot)
         {
-            CheckThreatLevel(ThreatLevel.Moderate, "osDropAttachmentAt");
-            m_host.AddScriptLPS(1);
+            if (checkPerms && ShoutErrorOnLackingOwnerPerms(ScriptBaseClass.PERMISSION_ATTACH, "Cannot drop attachment"))
+            {
+                return;
+            }
 
             IAttachmentsModule attachmentsModule = m_ScriptEngine.World.AttachmentsModule;
             ScenePresence sp = attachmentsModule == null ? null : m_host.ParentGroup.Scene.GetScenePresence(m_host.ParentGroup.OwnerID);
@@ -3579,5 +3605,37 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
                 attachmentsModule.DetachSingleAttachmentToGround(sp, m_host.ParentGroup.LocalId, omvPos, omvRot);
             }
         }
+
+        public void osDropAttachment()
+        {
+            CheckThreatLevel(ThreatLevel.Moderate, "osDropAttachment");
+            m_host.AddScriptLPS(1);
+
+            DropAttachment(true);
+        }
+
+        public void osForceDropAttachment()
+        {
+            CheckThreatLevel(ThreatLevel.High, "osForceDropAttachment");
+            m_host.AddScriptLPS(1);
+
+            DropAttachment(false);
+        }
+
+        public void osDropAttachmentAt(LSL_Vector pos, LSL_Rotation rot)
+        {
+            CheckThreatLevel(ThreatLevel.Moderate, "osDropAttachmentAt");
+            m_host.AddScriptLPS(1);
+
+            DropAttachemntAt(true, pos, rot);
+        }
+
+        public void osForceDropAttachmentAt(LSL_Vector pos, LSL_Rotation rot)
+        {
+            CheckThreatLevel(ThreatLevel.High, "osForceDropAttachmentAt");
+            m_host.AddScriptLPS(1);
+
+            DropAttachemntAt(false, pos, rot);
+        }
     }
 }
\ No newline at end of file
-- 
cgit v1.1