From 5c02fb435db171daf6d1ef360340137b3b0fd467 Mon Sep 17 00:00:00 2001
From: Melanie Thielker <melanie@t-data.com>
Date: Tue, 22 Jun 2010 17:35:00 +0200
Subject: [PATCH] Security fix: Allow only textures to be fetched using HTTP
 texture cap

---
 .../CoreModules/Avatar/Assets/GetTextureModule.cs    | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/OpenSim/Region/CoreModules/Avatar/Assets/GetTextureModule.cs b/OpenSim/Region/CoreModules/Avatar/Assets/GetTextureModule.cs
index f8e3d595c9..75efb799c1 100644
--- a/OpenSim/Region/CoreModules/Avatar/Assets/GetTextureModule.cs
+++ b/OpenSim/Region/CoreModules/Avatar/Assets/GetTextureModule.cs
@@ -131,6 +131,12 @@ namespace OpenSim.Region.CoreModules.Avatar.ObjectCaps
 
                     if (texture != null)
                     {
+                        if (texture.Type != (sbyte)AssetType.Texture)
+                        {
+                            httpResponse.StatusCode = (int)System.Net.HttpStatusCode.NotFound;
+                            httpResponse.Send();
+                            return null;
+                        }
                         SendTexture(httpRequest, httpResponse, texture);
                     }
                     else
@@ -147,6 +153,12 @@ namespace OpenSim.Region.CoreModules.Avatar.ObjectCaps
 
                     if (texture != null)
                     {
+                        if (texture.Type != (sbyte)AssetType.Texture)
+                        {
+                            httpResponse.StatusCode = (int)System.Net.HttpStatusCode.NotFound;
+                            httpResponse.Send();
+                            return null;
+                        }
                         SendTexture(httpRequest, httpResponse, texture);
                     }
                     else