Security vulnerability brought by non-check inventory service - Revision history

http://opensimulator.org/index.php?action=history&feed=atom&title=Security_vulnerability_brought_by_non-check_inventory_service Security vulnerability brought by non-check inventory service - Revision history 2026-05-12T01:02:03Z Revision history for this page on the wiki MediaWiki 1.19.9 http://opensimulator.org/index.php?title=Security_vulnerability_brought_by_non-check_inventory_service&diff=28480&oldid=prev MakoBot: Robot: Cosmetic changes 2012-03-04T04:11:01Z

<p>Robot: Cosmetic changes</p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr valign='top'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 04:11, 4 March 2012</td> </tr><tr><td colspan="2" class="diff-lineno">Line 10:</td> <td colspan="2" class="diff-lineno">Line 10:</td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>Simply describe in the following figure:</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>Simply describe in the following figure:</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>*InventoryServer is a normal http server, the normal way to use it is:</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>* InventoryServer is a normal http server, the normal way to use it is:</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>**user get the authentication from UserServer</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>** user get the authentication from UserServer</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>**user control its inventory through RegionServer</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>** user control its inventory through RegionServer</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>*But since the InventoryServer accepts any request without check if the user is authenticated, or, even it does not check if the request is from a RegionServer.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>* But since the InventoryServer accepts any request without check if the user is authenticated, or, even it does not check if the request is from a RegionServer.</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>*So, if you know other users' UUID, you can send CRUD http requests directly to the InventoryServer without login.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>* So, if you know other users' UUID, you can send CRUD http requests directly to the InventoryServer without login.</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>[[Image:secure_inventory_1.PNG]]</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>[[Image:secure_inventory_1.PNG]]</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>And [[<del class="diffchange diffchange-inline">Avatar_portability_version_2</del>|AvatarPortability]] needs a public inventory server,</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>And [[<ins class="diffchange diffchange-inline">Avatar portability version 2</ins>|AvatarPortability]] needs a public inventory server,</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>so we have to make a secure one.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>so we have to make a secure one.</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td colspan="2" class="diff-lineno">Line 27:</td> <td colspan="2" class="diff-lineno">Line 27:</td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>[[Image:secure_inventory_2.PNG]]</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>[[Image:secure_inventory_2.PNG]]</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* "session_id" is a important information, that is(should be) only transfered in a login session.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* "session_id" is a important information, that is(should be) only transfered in a login session.</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>**"expect_user" transfer "session_id" from UserServer to RegionServer only when the authentication is OK, so "expect_user" is safe.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>** "expect_user" transfer "session_id" from UserServer to RegionServer only when the authentication is OK, so "expect_user" is safe.</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>**method, such like "get_agent_by_uuid" is very dangerous.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>** method, such like "get_agent_by_uuid" is very dangerous.</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Configuration ==</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Configuration ==</div></td></tr> </table>

MakoBot http://opensimulator.org/index.php?title=Security_vulnerability_brought_by_non-check_inventory_service&diff=23635&oldid=prev MakoBot: Removed 'Template:' prefix from template includings and/or changed external-link into internal-link 2011-06-10T23:39:58Z

<p>Removed 'Template:' prefix from template includings and/or changed external-link into internal-link</p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr valign='top'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 23:39, 10 June 2011</td> </tr><tr><td colspan="2" class="diff-lineno">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>__NOTOC__</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>__NOTOC__</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>{{<del class="diffchange diffchange-inline">Template:</del>Quicklinks}}</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>{{Quicklinks}}</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div><br /></div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div><br /></div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> </table>

MakoBot http://opensimulator.org/index.php?title=Security_vulnerability_brought_by_non-check_inventory_service&diff=18296&oldid=prev WhiteStar: Undo revision 18293 by Waexu66 (Talk) SPAM 2010-07-31T16:09:52Z

<p>Undo revision 18293 by <a href="/wiki/Special:Contributions/Waexu66" title="Special:Contributions/Waexu66">Waexu66</a> (<a href="/index.php?title=User_talk:Waexu66&action=edit&redlink=1" class="new" title="User talk:Waexu66 (page does not exist)">Talk</a>) SPAM</p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr valign='top'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 16:09, 31 July 2010</td> </tr><tr><td colspan="2" class="diff-lineno">Line 51:</td> <td colspan="2" class="diff-lineno">Line 51:</td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* Regardless of whether '''session_lookup''' is true or false, '''new inventory server''' requires a session_id in every inventory request. If you want your region server to connect to a '''new inventory server''', you should always set '''secure_inventory_server = true''' in OpenSim.ini.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* Regardless of whether '''session_lookup''' is true or false, '''new inventory server''' requires a session_id in every inventory request. If you want your region server to connect to a '''new inventory server''', you should always set '''secure_inventory_server = true''' in OpenSim.ini.</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>** Here '''new inventory server''' means inventory server after SVN revision 5600.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>** Here '''new inventory server''' means inventory server after SVN revision 5600.</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;"></del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;">[http://www.resumesplanet.com resume writing service]</del></div></td><td colspan="2"> </td></tr> </table>

WhiteStar http://opensimulator.org/index.php?title=Security_vulnerability_brought_by_non-check_inventory_service&diff=18293&oldid=prev Waexu66 at 15:42, 31 July 2010 2010-07-31T15:42:39Z

<p></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr valign='top'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 15:42, 31 July 2010</td> </tr><tr><td colspan="2" class="diff-lineno">Line 51:</td> <td colspan="2" class="diff-lineno">Line 51:</td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* Regardless of whether '''session_lookup''' is true or false, '''new inventory server''' requires a session_id in every inventory request. If you want your region server to connect to a '''new inventory server''', you should always set '''secure_inventory_server = true''' in OpenSim.ini.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* Regardless of whether '''session_lookup''' is true or false, '''new inventory server''' requires a session_id in every inventory request. If you want your region server to connect to a '''new inventory server''', you should always set '''secure_inventory_server = true''' in OpenSim.ini.</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>** Here '''new inventory server''' means inventory server after SVN revision 5600.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>** Here '''new inventory server''' means inventory server after SVN revision 5600.</div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">[http://www.resumesplanet.com resume writing service]</ins></div></td></tr> </table>

Waexu66 http://opensimulator.org/index.php?title=Security_vulnerability_brought_by_non-check_inventory_service&diff=13394&oldid=prev Ideia Boa at 00:12, 22 May 2009 2009-05-22T00:12:58Z

<p></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr valign='top'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 00:12, 22 May 2009</td> </tr><tr><td colspan="2" class="diff-lineno">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">__NOTOC__</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">{{Template:Quicklinks}}</ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;"><br /></ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Problem ==</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Problem ==</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> </table>

Ideia Boa http://opensimulator.org/index.php?title=Security_vulnerability_brought_by_non-check_inventory_service&diff=7153&oldid=prev Mikem: /* *NOTE* */ 2008-08-12T06:57:03Z

<p>‎<span dir="auto"><span class="autocomment">*NOTE*</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr valign='top'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 06:57, 12 August 2008</td> </tr><tr><td colspan="2" class="diff-lineno">Line 45:</td> <td colspan="2" class="diff-lineno">Line 45:</td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>=== *NOTE* ===</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>=== *NOTE* ===</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>* <del class="diffchange diffchange-inline">no matter </del>'''session_lookup''' is true or false, '''new <del class="diffchange diffchange-inline">inventoryserver</del>''' requires session_id in every inventory request. <del class="diffchange diffchange-inline">if </del>you want your <del class="diffchange diffchange-inline">regionserver </del>to connect to a '''new <del class="diffchange diffchange-inline">inventoryserver</del>''', you should always set '''secure_inventory_server = true''' in OpenSim.ini.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>* <ins class="diffchange diffchange-inline">Regardless of whether </ins>'''session_lookup''' is true or false, '''new <ins class="diffchange diffchange-inline">inventory server</ins>''' requires <ins class="diffchange diffchange-inline">a </ins>session_id in every inventory request. <ins class="diffchange diffchange-inline">If </ins>you want your <ins class="diffchange diffchange-inline">region server </ins>to connect to a '''new <ins class="diffchange diffchange-inline">inventory server</ins>''', you should always set '''secure_inventory_server = true''' in OpenSim.ini.</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>* <del class="diffchange diffchange-inline">here </del>'''new <del class="diffchange diffchange-inline">inventoryserver</del>''' means <del class="diffchange diffchange-inline">inventoryserver </del>after <del class="diffchange diffchange-inline">svn </del>revision 5600.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>*<ins class="diffchange diffchange-inline">* Here </ins>'''new <ins class="diffchange diffchange-inline">inventory server</ins>''' means <ins class="diffchange diffchange-inline">inventory server </ins>after <ins class="diffchange diffchange-inline">SVN </ins>revision 5600.</div></td></tr> </table>

Mikem http://opensimulator.org/index.php?title=Security_vulnerability_brought_by_non-check_inventory_service&diff=7152&oldid=prev Mikem: /* InventoryServer side */ 2008-08-12T06:54:30Z

<p>‎<span dir="auto"><span class="autocomment">InventoryServer side</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr valign='top'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 06:54, 12 August 2008</td> </tr><tr><td colspan="2" class="diff-lineno">Line 39:</td> <td colspan="2" class="diff-lineno">Line 39:</td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* in InventoryServer_Config.xml,</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* in InventoryServer_Config.xml,</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>  '''session_lookup''' = true / false</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>  '''session_lookup''' = true / false</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>  (* for <del class="diffchange diffchange-inline">the </del>session_lookup please also refer the <del class="diffchange diffchange-inline">above </del>picture<del class="diffchange diffchange-inline">.</del>)</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>  (* for session_lookup please also refer the picture <ins class="diffchange diffchange-inline">above</ins>)</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>* if you want inventory server to validate <del class="diffchange diffchange-inline">the </del>incoming session_id, set session_lookup = true</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>* if you want <ins class="diffchange diffchange-inline">the </ins>inventory server to validate <ins class="diffchange diffchange-inline">each </ins>incoming <ins class="diffchange diffchange-inline">inventory request by </ins>session_id, set session_lookup = true</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* else, set session_lookup = false</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* else, set session_lookup = false</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>** <del class="diffchange diffchange-inline">this </del>makes inventory server accept any request<del class="diffchange diffchange-inline">, just like before</del>.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>** <ins class="diffchange diffchange-inline">Setting session_lookup to false </ins>makes inventory server accept any request <ins class="diffchange diffchange-inline">from any client</ins>.</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>=== *NOTE* ===</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>=== *NOTE* ===</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* no matter '''session_lookup''' is true or false, '''new inventoryserver''' requires session_id in every inventory request. if you want your regionserver to connect to a '''new inventoryserver''', you should always set '''secure_inventory_server = true''' in OpenSim.ini.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* no matter '''session_lookup''' is true or false, '''new inventoryserver''' requires session_id in every inventory request. if you want your regionserver to connect to a '''new inventoryserver''', you should always set '''secure_inventory_server = true''' in OpenSim.ini.</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* here '''new inventoryserver''' means inventoryserver after svn revision 5600.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* here '''new inventoryserver''' means inventoryserver after svn revision 5600.</div></td></tr> </table>

Mikem http://opensimulator.org/index.php?title=Security_vulnerability_brought_by_non-check_inventory_service&diff=7151&oldid=prev Mikem: /* RegionServer side */ 2008-08-12T06:52:42Z

<p>‎<span dir="auto"><span class="autocomment">RegionServer side</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr valign='top'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 06:52, 12 August 2008</td> </tr><tr><td colspan="2" class="diff-lineno">Line 32:</td> <td colspan="2" class="diff-lineno">Line 32:</td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>  inventory_server_url = http://127.0.0.1:8004</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>  inventory_server_url = http://127.0.0.1:8004</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>  '''secure_inventory_server''' = true / false</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>  '''secure_inventory_server''' = true / false</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>* if the inventory server specified by "inventory_server_url" is a "secure" inventory server,set "secure_inventory_server = true", <del class="diffchange diffchange-inline">then </del>inventory <del class="diffchange diffchange-inline">request </del>from the <del class="diffchange diffchange-inline">regionserver </del>will <del class="diffchange diffchange-inline">be attached a </del>session_id</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>* if the inventory server specified by "inventory_server_url" is a "secure" inventory server, set "secure_inventory_server = true"<ins class="diffchange diffchange-inline">. Then</ins>, inventory <ins class="diffchange diffchange-inline">requests </ins>from the <ins class="diffchange diffchange-inline">region server </ins>will <ins class="diffchange diffchange-inline">have the user's </ins>session_id <ins class="diffchange diffchange-inline">attached</ins></div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>* else, set secure_inventory_server = false<del class="diffchange diffchange-inline">, in </del>this case, session_id is not attached <del class="diffchange diffchange-inline">with every </del>inventory <del class="diffchange diffchange-inline">request</del>.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>* else, set <ins class="diffchange diffchange-inline">"</ins>secure_inventory_server = false<ins class="diffchange diffchange-inline">". In </ins>this case, session_id is not attached <ins class="diffchange diffchange-inline">to </ins>inventory <ins class="diffchange diffchange-inline">requests</ins>.</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>** <del class="diffchange diffchange-inline">This option </del>is only useful when you want your <del class="diffchange diffchange-inline">regionserver </del>to connect to <del class="diffchange diffchange-inline">a </del>'''old <del class="diffchange diffchange-inline">inventoryserver</del>''' <del class="diffchange diffchange-inline">- an inventory server do </del>not expect a session_id.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>** <ins class="diffchange diffchange-inline">Setting secure_inventory_server to false </ins>is only useful when you want your <ins class="diffchange diffchange-inline">region server </ins>to connect to <ins class="diffchange diffchange-inline">an </ins>'''old <ins class="diffchange diffchange-inline">inventory server</ins>''' <ins class="diffchange diffchange-inline">which does </ins>not expect a session_id.</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>=== InventoryServer side ===</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>=== InventoryServer side ===</div></td></tr> </table>

Mikem http://opensimulator.org/index.php?title=Security_vulnerability_brought_by_non-check_inventory_service&diff=7150&oldid=prev Lulurun: /* RegionServer side */ 2008-08-12T06:47:46Z

<p>‎<span dir="auto"><span class="autocomment">RegionServer side</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr valign='top'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 06:47, 12 August 2008</td> </tr><tr><td colspan="2" class="diff-lineno">Line 32:</td> <td colspan="2" class="diff-lineno">Line 32:</td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>  inventory_server_url = http://127.0.0.1:8004</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>  inventory_server_url = http://127.0.0.1:8004</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>  '''secure_inventory_server''' = true / false</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>  '''secure_inventory_server''' = true / false</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>* if the inventory server specified by "inventory_server_url" is a "secure" inventory server,set "secure_inventory_server = true", then inventory request from the regionserver will <del class="diffchange diffchange-inline">not </del>be attached a session_id</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>* if the inventory server specified by "inventory_server_url" is a "secure" inventory server,set "secure_inventory_server = true", then inventory request from the regionserver will be attached a session_id</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>* else, set secure_inventory_server = false, in this case, session_id is attached with every inventory request.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>* else, set secure_inventory_server = false, in this case, session_id is <ins class="diffchange diffchange-inline">not </ins>attached with every inventory request.</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>** This option is only useful when you want your regionserver to connect to a '''old inventoryserver''' - an inventory server do not expect a session_id.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>** This option is only useful when you want your regionserver to connect to a '''old inventoryserver''' - an inventory server do not expect a session_id.</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> </table>

Lulurun http://opensimulator.org/index.php?title=Security_vulnerability_brought_by_non-check_inventory_service&diff=7149&oldid=prev Lulurun at 06:44, 12 August 2008 2008-08-12T06:44:04Z

<p></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr valign='top'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 06:44, 12 August 2008</td> </tr><tr><td colspan="2" class="diff-lineno">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;">[[User:Lulurun]]</del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;"></del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;">== Agenda ==</del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;"></del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;">To enable user avatar travel from a grid service to another grid service,</del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;">There are 3 problems to be considered:</del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;"># How to enable foreign user login - [[OpenID for data portability in virtual world|Authentication]]</del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;"># (If a foreign user can login)[[Avatar_portability_version_2|How to get a foreign user's belongings]](including appearance, inventory)</del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;"># '''Security'''</del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;">#* '''This is discussed in this page'''</del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;"></del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;">To achieve the 1st, client side changes are needed. SO, so far, I have</del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;">only implemented the 2nd and the 3rd, and would like to explan my idea:</del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;"></del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Problem ==</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Problem ==</div></td></tr> <tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> </table>

Lulurun