[Opensim-dev] Remove check for IsGod in some OSSL functions

[Melanie]

Not so. ESTATE_MANAGER MEANS estate MANAGER. This is intentional. I
reread the code and found that it already allows a comma separated
list notation, so you can use ESTATE_OWNER,ESTATE_MANAGER.

This allows for finer grained control. Please understand that estate
owners may be significantly different from estate managers, for
instance in the case of a mainland. This division is useful and,
again, making changes could cause privilege escalation in some
grids. So, -1. What you want to achieve can already be achieved.

Same, btw, goes for parcels, you can specify
PARCEL_OWNER,PARCEL_GROUP_MEMBER to get the behavior you're looking
for, and/or add the estate management as well.

I would propose to add "GODS" to the list of keywords, since they
can't currently be allowed as a class.

Melanie

On 13/04/2012 15:36, Oren Hurvitz wrote:
> About gods: ok. I don't allow any users to be gods for security reasons,
> but I had assumed that if someone *does* have god permissions then they
> should be able to do anything. Since that is not the case, I won't be
> making any changes related to gods.
> 
> I assume by "-1 on changing existing functions" you mean not to change
> IsAdministrator(). Ok, but that means we still have two methods that do the
> same thing: IsGod() and IsAdministrator(). This doesn't affect what I'm
> doing so I have no reason to push for this change, but it looks like a
> longstanding bug. If anyone is interested in pursuing this, Godspeed :)
> 
> Regarding whether ESTATE_MANAGER includes the estate owner: it doesn't,
> because of this code: "World.RegionInfo.EstateSettings.EstateOwner !=
> ownerID". It explicitly disallows the estate owner, while allowing all the
> other estate managers. That's the code that should be removed.
> 
> Oren
> 
> 
> On Fri, Apr 13, 2012 at 3:56 PM, Melanie-2 [via opensim-dev] <
> ml-node+s2196679n7462585h49 at n2.nabble.com> wrote:
> 
>> First, HARD -1 on allowing gods all of OSSL. I run a grid where
>> certain functions just CANNOT be allowed to run, no way, no how.
>> There must be a way to achieve that, you can't force the
>> availability of OSSL for gods on grids.
>>
>> Also, HARD -1 on changing existing functions, it will break things
>> in too many ways for established users.
>>
>> The check for estate managers already allows estate owners.
>>
>> OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs:377
>>
>> //Only Estate Managers may use the function
>> if(m_FunctionPerms[function].AllowedOwnerClasses.Contains("ESTATE_MANAGER"))
>>
>> {
>>     //Only Estate Managers may use the function
>>     if (World.RegionInfo.EstateSettings.IsEstateManager(ownerID) &&
>> World.RegionInfo.EstateSettings.EstateOwner != ownerID)
>>     {
>>         return;
>>     }
>> }
>>
>> A god check _could_ be added in the parcel owner, parcel group,
>> estate manager and estate owner clauses as it can be assumed that if
>> anyone is allowed to run the function gods should be allowed to run
>> it, too. However, if a function is indeed disabled it must be
>> disabled for gods as well.
>>
>> Melanie
>>
>>
> 
> 
> --
> View this message in context: http://opensim-dev.2196679.n2.nabble.com/Remove-check-for-IsGod-in-some-OSSL-functions-tp7462127p7462694.html
> Sent from the opensim-dev mailing list archive at Nabble.com.
> 
> 
> 
> _______________________________________________
> Opensim-dev mailing list
> Opensim-dev at lists.berlios.de
> https://lists.berlios.de/mailman/listinfo/opensim-dev