• All submissions to this site are governed by Second Life Project Contribution Agreement. By submitting patches and other information using this site, you acknowledge that you have read, understood, and agreed to those terms.
Issue Details (XML | Word | Printable)

Key: SVC-3626
Type: Bug Bug
Status: Open Open
Priority: Normal Normal
Assignee: Unassigned
Reporter: Robin Cornelius
Votes: 0
Watchers: 1
Operations

If you were logged in you would be able to see more operations.
2. Second Life Service - SVC

BuyObjectInventory and CreateInventoryFolder messages do not check parent UUID

Created: 06/Jan/09 03:12 PM   Updated: 11/Sep/09 09:12 AM
Return to search
Component/s: Inventory
Affects Version/s: 1.24 Server
Fix Version/s: None

File Attachments: 1. Text File inventorytest2.cs (2 kB)
2. Text File Program.cs (2 kB)

Environment: N/A
Issue Links:
Relates

Last Triaged: 08/Jan/09 02:08 PM
Linden Lab Issue ID: DEV-25866


 Description  « Hide
As with discussions via SLDEV and Rob's hours regarding the server inventory handling, it should not be possible to do a number of things. One such example is it is possible to create new top level folders along side My Inventory and Library by simply buying the contents of an object and sending a Zero UUID for the target folder.

This shows there is no protection over the value of the target folder so this could if corrupt lead to inventory loss and top level folders are not suspose to exist and could have other side effects.

To make reproduction easier I am attaching a simple libsl (libomv) script that can be used to generate repros.

To repro.

1. Create a new prim with some contents.
2. Set the prim to for sale for 0$L and type of sale to Contents
3. Get the UUID/Key of the prim (a touch script with llSay(0,llGetKey())) for example
4. Use the attached libsl script (program.cs) to log in, changing of cause the key, the usernames and password
5. Log back in with a viewer and observe a new top level inventory folder

To build and run the test script, install libsl 0.5, use Visual Studio C#2008, import the code to a project and remember to set the libsecondlife reference.

Example 2 (InventoryTest2.cs)

Using CreateInventoryFolder
.1 Just set the login details in InventoryTest2.cs and run the libsl script, it will create a new top level folder

MoveInventoryFolder and MoveInventoryItem did not appear to be effected in my testing but instead of creating a top level folder it just removed the folder from my (visible anyway) inventory. I have not checked the message log to see if there is a folder that either libomv/libls or the SL viewer is not parsing and displaying.



 All   Comments   Change History      Sort Order: Ascending order - Click to sort in descending order
Ellla McMahon added a comment - 09/Feb/09 03:47 PM
This may explain issue VWR-8438 and some of the linked issues.