Mantis Bug Tracker

View Issue Details Jump to Notes ] Issue History ] Print ]
IDProjectCategoryView StatusDate SubmittedLast Update
0008651opensim[GRID] Inventory Servicepublic2020-01-27 05:112020-02-07 04:30
ReporterCasperWarden 
Assigned To 
PrioritynormalSeverityminorReproducibilityalways
StatusnewResolutionopen 
PlatformOSOS Version
Product Version0.9.1.0 
Target VersionFixed in Version 
Summary0008651: Notecard embedded item invalidated when user inventory deleted
DescriptionWhen a user has embedded an inventory item into a notecard, and then deletes the item from their inventory, the notecard's embedded items are invalidated.

This does not occur in Second Life.
Steps To Reproduce1. Create a notecard
2. Embed an inventory item (such as another notecard) to the notecard
3. Save the notecard
4. Delete the inventory item you embedded
5. Empty trash
6. Try to extract the item from the notecard
Additional InformationI'm not sure if this is an intentional difference from SL or not, fixing this could create inventory clutter.

Short of never deleting an inventory item (which I think is the approach that SL takes), a flag could be added to indicate that the item has been embedded, to prevent it from being deleted.
TagsNo tags attached.
Git Revision or version number
Run ModeStandalone (1 Region)
Physics EngineBulletSim
Script EngineXEngine
Environment.NET / Windows64
Mono Version6.x
ViewerN/A
Attached Files

- Relationships

-  Notes
(0036142)
tampa (reporter)
2020-01-27 07:03

When an item is embedded the parent notecard asset id changes.

Deleting and purging the embedded card makes it unavailable: Failed to retrieve item.

The notecard and data still exist in the asset server unless deletion of assets is allowed by configuration parameter.

So yes I can reproduce this and too find it odd. Since the data in them is hashed I can't actually tell whether it may have changed upon deletion and the reference thus gets broken, but I doubt it. So the question is what is actually written in there to reference the notecard, my suspicion is that it is a reference to the users specific inventory and not directly to the asset itself, which I guess might be for security reasons. This would block anyone overwriting the asset with their own data I suppose, though an unlikely scenario.
(0036143)
CasperWarden (reporter)
2020-01-27 07:29

To be clear, it's *inventory* which is embedded in a notecard, not an asset - the viewer tries to fetch the inventory Item ID
(0036144)
tampa (reporter)
2020-01-27 07:48

Purging an inventory item deletes the record from the db so the reference is broken at that point. I suppose SL may keep that stuff around when detecting it is embedded elsewhere still, whether such a check makes sense I am not sure, equally implementing it may not be all that easy and could cause unwanted growth of tables or assets if not set false by default.

So in those terms yes, because purge means delete the inventory entry is removed completely.
(0036158)
UbitUmarov (administrator)
2020-02-05 22:15
edited on: 2020-02-05 22:25

made several changes that extend also to notecards in objects
this will not work on HG without viewers changes
please let us know

(0036159)
aiaustin (developer)
2020-02-06 00:54
edited on: 2020-02-06 01:05

It is surprising that the embedded ID in a notecard is an inventory item. Users can come and go or be deleted, and inventory is especially dynamic. You might have thought that it would be the underlying asset id that was used? That surely would likely be more persistent. Would it even make HG asset fetch easier?

(0036160)
tampa (reporter)
2020-02-06 03:12

I too thought it was a direct asset reference, but I suppose it makes sense to be an inventory item as the reference is local to the user and thus cannot be changed.

If it was an asset reference you could open the notecard on another asset server only to find the asset being not an embedded notecard, but a texture or something. You could alter the asset and thus the embed in all notecards and potentially distribute some nasty things that way. There is a security implication on this being inventory, because to alter the embedded item you need to open the inventory of the user. Then again that is not hard either... Which leaves me to wonder what massive security issue this actually is and how to secure this. Ideally the embedded item would be made part of the notecard it is embedded in so it cannot be altered through changing the external reference?

This would mean changing the notecard handling, it could break existing ones...
(0036161)
UbitUmarov (administrator)
2020-02-06 04:48

it is a asset reference, Can you test please?
and no, No HG
(0036162)
UbitUmarov (administrator)
2020-02-06 04:50

but im actually not sure we should support this
(0036163)
tampa (reporter)
2020-02-06 07:06

I just tried this and even after purging the item from trash it was still able to copy it back into the inventory. Have no tested HG.
(0036164)
UbitUmarov (administrator)
2020-02-06 14:48

added some code to try to improve HG case
(0036165)
UbitUmarov (administrator)
2020-02-06 14:59

osgrid "dev outreach" region can be used as one endpoint for HG testing..
(0036166)
aiaustin (developer)
2020-02-07 01:59

Ailand and Openvue grids also updated to 2020-02-06 22:54 server code.
(0036167)
CasperWarden (reporter)
2020-02-07 04:30

Re: the inventory item being stored instead of the asset, I think the reason is obvious - so that properties such as name, description and inventory item icon can be displayed

- Issue History
Date Modified Username Field Change
2020-01-27 05:11 CasperWarden New Issue
2020-01-27 07:03 tampa Note Added: 0036142
2020-01-27 07:29 CasperWarden Note Added: 0036143
2020-01-27 07:48 tampa Note Added: 0036144
2020-02-05 22:15 UbitUmarov Note Added: 0036158
2020-02-05 22:16 UbitUmarov Note Edited: 0036158 View Revisions
2020-02-05 22:21 UbitUmarov Note Edited: 0036158 View Revisions
2020-02-05 22:24 UbitUmarov Note Edited: 0036158 View Revisions
2020-02-05 22:25 UbitUmarov Note Edited: 0036158 View Revisions
2020-02-06 00:54 aiaustin Note Added: 0036159
2020-02-06 01:05 aiaustin Note Edited: 0036159 View Revisions
2020-02-06 03:12 tampa Note Added: 0036160
2020-02-06 04:48 UbitUmarov Note Added: 0036161
2020-02-06 04:50 UbitUmarov Note Added: 0036162
2020-02-06 07:06 tampa Note Added: 0036163
2020-02-06 14:48 UbitUmarov Note Added: 0036164
2020-02-06 14:59 UbitUmarov Note Added: 0036165
2020-02-07 01:59 aiaustin Note Added: 0036166
2020-02-07 04:30 CasperWarden Note Added: 0036167


Copyright © 2000 - 2012 MantisBT Group
Powered by Mantis Bugtracker