From 4e64bf9360604ea30d2d1c5389dd2d36aa93d6ff Mon Sep 17 00:00:00 2001 From: Melanie Thielker Date: Sun, 24 May 2009 17:29:40 +0000 Subject: [PATCH] Prevent group deeded objects from being returned by the group return option unless the user has that permission through the group. --- .../World/Permissions/PermissionsModule.cs | 24 +++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs b/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs index ff5719272f..1987bb9a34 100644 --- a/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs +++ b/OpenSim/Region/CoreModules/World/Permissions/PermissionsModule.cs @@ -1551,8 +1551,28 @@ namespace OpenSim.Region.CoreModules.World.Permissions } break; case (uint)ObjectReturnType.Group: - if ((powers & (long)GroupPowers.ReturnGroupSet) != 0) - return true; + if (parcel.landData.OwnerID != client.AgentId) + { + // If permissionis granted through a group... + // + if ((powers & (long)GroupPowers.ReturnGroupSet) != 0) + { + foreach (SceneObjectGroup g in new List(retlist)) + { + // check for and remove group owned objects unless + // the user also has permissions to return those + // + if (g.OwnerID == g.GroupID && + ((powers & (long)GroupPowers.ReturnGroupOwned) == 0)) + { + retlist.Remove(g); + } + } + // And allow the operation + // + return true; + } + } break; case (uint)ObjectReturnType.Other: if ((powers & (long)GroupPowers.ReturnNonGroup) != 0)