From 3ff28e7a8f6a7816dd76307c36153ba8f393dea1 Mon Sep 17 00:00:00 2001 From: CasperW Date: Mon, 18 Jan 2010 17:56:27 +0100 Subject: [PATCH] Fix a major security problem with osSetDynamicTexture which allowed the deletion of /any/ asset. --- .../DynamicTexture/DynamicTextureModule.cs | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/OpenSim/Region/CoreModules/Scripting/DynamicTexture/DynamicTextureModule.cs b/OpenSim/Region/CoreModules/Scripting/DynamicTexture/DynamicTextureModule.cs index f51d0c2464..679c871441 100644 --- a/OpenSim/Region/CoreModules/Scripting/DynamicTexture/DynamicTextureModule.cs +++ b/OpenSim/Region/CoreModules/Scripting/DynamicTexture/DynamicTextureModule.cs @@ -358,11 +358,18 @@ namespace OpenSim.Region.CoreModules.Scripting.DynamicTexture // tmptex.DefaultTexture.Fullbright = true; part.UpdateTexture(tmptex); - } - - if (oldID != UUID.Zero && ((Disp & DISP_EXPIRE) != 0)) - { - scene.AssetService.Delete(oldID.ToString()); + } + + if (oldID != UUID.Zero && ((Disp & DISP_EXPIRE) != 0)) + { + if (oldAsset == null) oldAsset = scene.AssetService.Get(oldID.ToString()); + if (oldAsset != null) + { + if (oldAsset.Temporary == true) + { + scene.AssetService.Delete(oldID.ToString()); + } + } } }