OpenSim
/
OpenSimMirror
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add permissions checks for owned avatars to all other osNpc* functions. 

This is being done outside the npc module since the check is meaningless for region module callers, who can fake any id that they like.
iar_mods
Justin Clark-Casey (justincc) 2012-01-12 19:06:46 +00:00
parent 0a1d61950b
commit ba3491c76e
3 changed files with 52 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
OpenSim/Region/Framework/Interfaces/INPCModule.cs
View File

@ -125,7 +125,7 @@ namespace OpenSim.Region.Framework.Interfaces
/// <param name="agentID">The UUID of the NPC</param>
/// <param name="scene"></param>
/// <returns>True if the operation succeeded, false if there was no such agent or the agent was not an NPC</returns>
bool DeleteNPC(UUID agentID, UUID CallerID, Scene scene);
bool DeleteNPC(UUID agentID, Scene scene);
/// <summary>
/// Get the owner of a NPC

5
OpenSim/Region/OptionalModules/World/NPC/NPCModule.cs
View File

@ -266,16 +266,13 @@ namespace OpenSim.Region.OptionalModules.World.NPC
return UUID.Zero;
}
public bool DeleteNPC(UUID agentID, UUID callerID, Scene scene)
public bool DeleteNPC(UUID agentID, Scene scene)
{
lock (m_avatars)
{
NPCAvatar av;
if (m_avatars.TryGetValue(agentID, out av))
{
if (!CheckPermissions(av, callerID));
return false;
scene.RemoveClient(agentID, false);
m_avatars.Remove(agentID);

70
OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs
View File

@ -2173,6 +2173,9 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
if (!UUID.TryParse(npc.m_string, out npcId))
return;
if (!npcModule.CheckPermissions(npcId, m_host.OwnerID))
return;
string appearanceSerialized = LoadNotecard(notecard);
OSDMap appearanceOsd = (OSDMap)OSDParser.DeserializeLLSDXml(appearanceSerialized);
// OSD a = OSDParser.DeserializeLLSDXml(appearanceSerialized);
@ -2196,7 +2199,7 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
if (!UUID.TryParse(npc.m_string, out npcId))
return new LSL_Vector(0, 0, 0);
if (!npcModule.IsNPC(npcId, m_host.ParentGroup.Scene))
if (!npcModule.CheckPermissions(npcId, m_host.OwnerID))
return new LSL_Vector(0, 0, 0);
Vector3 pos = World.GetScenePresence(npcId).AbsolutePosition;
@ -2217,6 +2220,9 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
if (!UUID.TryParse(npc.m_string, out npcId))
return;
if (!module.CheckPermissions(npcId, m_host.OwnerID))
return;
Vector3 pos = new Vector3((float) position.x, (float) position.y, (float) position.z);
module.MoveToTarget(npcId, World, pos, false, true);
}
@ -2233,6 +2239,9 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
if (!UUID.TryParse(npc.m_string, out npcId))
return;
if (!module.CheckPermissions(npcId, m_host.OwnerID))
return;
Vector3 pos = new Vector3((float)target.x, (float)target.y, (float)target.z);
module.MoveToTarget(
new UUID(npc.m_string),
@ -2254,7 +2263,7 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
if (!UUID.TryParse(npc.m_string, out npcId))
return new LSL_Rotation(Quaternion.Identity.X, Quaternion.Identity.Y, Quaternion.Identity.Z, Quaternion.Identity.W);
if (!npcModule.IsNPC(npcId, m_host.ParentGroup.Scene))
if (!npcModule.CheckPermissions(npcId, m_host.OwnerID))
return new LSL_Rotation(Quaternion.Identity.X, Quaternion.Identity.Y, Quaternion.Identity.Z, Quaternion.Identity.W);
ScenePresence sp = World.GetScenePresence(npcId);
@ -2277,7 +2286,7 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
if (!UUID.TryParse(npc.m_string, out npcId))
return;
if (!npcModule.IsNPC(npcId, m_host.ParentGroup.Scene))
if (!npcModule.CheckPermissions(npcId, m_host.OwnerID))
return;
ScenePresence sp = World.GetScenePresence(npcId);
@ -2291,7 +2300,14 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
INPCModule module = World.RequestModuleInterface<INPCModule>();
if (module != null)
module.StopMoveToTarget(new UUID(npc.m_string), World);
{
UUID npcId = new UUID(npc.m_string);
if (!module.CheckPermissions(npcId, m_host.OwnerID))
return;
module.StopMoveToTarget(npcId, World);
}
}
public void osNpcSay(LSL_Key npc, string message)
@ -2301,7 +2317,12 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
INPCModule module = World.RequestModuleInterface<INPCModule>();
if (module != null)
{
module.Say(new UUID(npc.m_string), World, message);
UUID npcId = new UUID(npc.m_string);
if (!module.CheckPermissions(npcId, m_host.OwnerID))
return;
module.Say(npcId, World, message);
}
}
@ -2312,7 +2333,12 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
INPCModule module = World.RequestModuleInterface<INPCModule>();
if (module != null)
{
module.Sit(new UUID(npc.m_string), new UUID(target.m_string), World);
UUID npcId = new UUID(npc.m_string);
if (!module.CheckPermissions(npcId, m_host.OwnerID))
return;
module.Sit(npcId, new UUID(target.m_string), World);
}
}
@ -2323,7 +2349,12 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
INPCModule module = World.RequestModuleInterface<INPCModule>();
if (module != null)
{
module.Stand(new UUID(npc.m_string), World);
UUID npcId = new UUID(npc.m_string);
if (!module.CheckPermissions(npcId, m_host.OwnerID))
return;
module.Stand(npcId, World);
}
}
@ -2334,7 +2365,12 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
INPCModule module = World.RequestModuleInterface<INPCModule>();
if (module != null)
{
module.DeleteNPC(new UUID(npc.m_string), m_host.OwnerID, World);
UUID npcId = new UUID(npc.m_string);
if (!module.CheckPermissions(npcId, m_host.OwnerID))
return;
module.DeleteNPC(npcId, World);
}
}
@ -2346,12 +2382,9 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
if (module != null)
{
UUID npcID = new UUID(npc.m_string);
if (module.IsNPC(npcID, m_host.ParentGroup.Scene))
{
UUID ownerID = module.GetOwner(npcID);
if (ownerID == UUID.Zero || ownerID == m_host.OwnerID)
AvatarPlayAnimation(npcID.ToString(), animation);
}
if (module.CheckPermissions(npcID, m_host.OwnerID))
AvatarPlayAnimation(npcID.ToString(), animation);
}
}
@ -2363,12 +2396,9 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
if (module != null)
{
UUID npcID = new UUID(npc.m_string);
if (module.IsNPC(npcID, m_host.ParentGroup.Scene))
{
UUID ownerID = module.GetOwner(npcID);
if (ownerID == UUID.Zero || ownerID == m_host.OwnerID)
AvatarStopAnimation(npcID.ToString(), animation);
}
if (module.CheckPermissions(npcID, m_host.OwnerID))
AvatarPlayAnimation(npcID.ToString(), animation);
}
}