[#VWR-650] Patch to Address Debit Permission Spoofing

1. Second Life Viewer - VWR

Patch to Address Debit Permission Spoofing

Created: 03/May/07 02:51 PM Updated: 27/Jun/07 10:04 PM

Return to search

Component/s:

Permissions

Affects Version/s:

1.16.0.x, Source code

Fix Version/s:

1.17.1

File Attachments:

3a22ac15-39ac-409c-acec-b08b1b6b689b.tga (4 kB)
2.

debitspoof-screencaps.zip (224 kB)
3.

debitspoof-spec.txt (21 kB)
4.

debitspoof-testplan.txt (28 kB)
5.

debitspoof.patch.txt (31 kB)

Environment:

SL viewer 1.16.0.5 source, modified and build under Visual C++ 2005 on WinXP SP2 (x86)

Issue Links:

Duplicate

This issue is original of duplicate:

~~VWR-767~~ Request Debit Permissions popup should be a different color

Relates

This issue is related to by:

SVC-232 Create a second tier for debit permissions for vendor refunds

~~MISC-228~~ In-World action to steal money from other avatars account with scripted objects

~~MISC-109~~ Fraud using llRequestPermissions(llGetOwner(),PERMISSION_DEBIT);

Source Version:	1.16.0.5
Linden Lab Issue ID:	SL-43710
Patch attached:	Patch attached

Description

« Hide

The purpose of this patch is to alter the client's handling of script permission requests so as to make requests for the debit permission more readily apparent to the user.

Included is a source patch, along with a new viewer texture that the patch requires (the .tga file should go in the ".../skins/textures/" directory).

Also included is a feature spec (with screen caps) for the patch and a test plan.

All

Comments

Change History

Sort Order:

[ Permlink | « Hide ]

able whitman added a comment - 25/May/07 12:50 PM

I am currently working on a patch to address this issue.

[ Permlink | « Hide ]

able whitman added a comment - 30/May/07 10:43 PM

Updating the bug to be more descriptive and to include the patch I've written to address this bug.

[ Permlink | « Hide ]

Torley Linden added a comment - 11/Jun/07 09:51 AM

Thanks for the patch, Zacharie! Soft Linden pointed me here. Linked internally.

[ Permlink | « Hide ]

able whitman added a comment - 11/Jun/07 12:02 PM

Actually, Torley, I was the one who submitted the patch

[ Permlink | « Hide ]

Soft Linden added a comment - 11/Jun/07 02:37 PM

I've made sure the internal JIRA nominates Able for attribution ~ Soft

[ Permlink | « Hide ]

Soft Linden added a comment - 12/Jun/07 02:53 PM

Watch for this in version 1.18.x

Thanks, Able

[ Permlink | « Hide ]

Torley Linden added a comment - 13/Jun/07 07:51 AM

Sorry for miscrediting – kudos to you, Able!

[ Permlink | « Hide ]

Lex Neva added a comment - 22/Jun/07 05:27 PM

Nice work! I'd love to see more user-submitted patches to improve the SL user interface.

[ Permlink | « Hide ]

Torley Linden added a comment - 27/Jun/07 10:00 AM

Fixed in 1.17.1. More info @ http://blog.secondlife.com/2007/06/26/optional-viewer-and-rolling-restart-this-monday-june-25th/

[ Permlink | « Hide ]

nite zelmanov added a comment - 27/Jun/07 10:04 PM

I know this is coming a bit late, but I have a small gripe about the dialog as of 1.17.2. It tells you the Owner of the object requesting permissions, and then goes on to talk about your trust for the Creator. It seems to me that the creator would be more important to show, especially because debit perms can't even be successfully requested by an object you don't own.