From 88f4e5eed92b90e4c7b266b26677ebdabe40360a Mon Sep 17 00:00:00 2001
From: UbitUmarov <ajlduarte@sapo.pt>
Date: Fri, 23 Sep 2022 19:26:38 +0100
Subject: [PATCH] do not let *createlink run on attachments or link nonmod
 objects

---
 .../Shared/Api/Implementation/LSL_Api.cs      | 30 +++++++++++++------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs
index 8054850d4a..ce721f1626 100644
--- a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs
+++ b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs
@@ -4446,34 +4446,43 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
             if (!UUID.TryParse(target, out UUID targetID) || targetID.IsZero())
                 return;
 
+            SceneObjectGroup hostgroup = m_host.ParentGroup;
+            if (hostgroup.AttachmentPoint != 0)
+                return; // Fail silently if attached
+            if ((hostgroup.RootPart.OwnerMask & (uint)PermissionMask.Modify) == 0)
+                return;
+
             SceneObjectPart targetPart = World.GetSceneObjectPart(targetID);
             if (targetPart == null)
                 return;
 
-            if (targetPart.ParentGroup.AttachmentPoint != 0)
-                return; // Fail silently if attached
+            SceneObjectGroup targetgrp = targetPart.ParentGroup;
 
-            if (targetPart.ParentGroup.RootPart.OwnerID.NotEqual(m_host.ParentGroup.RootPart.OwnerID))
+            if (targetgrp == null || targetgrp.OwnerID.NotEqual(hostgroup.OwnerID))
+                return;
+
+            if (targetgrp.AttachmentPoint != 0)
+                return; // Fail silently if attached
+            if ((targetgrp.RootPart.OwnerMask & (uint)PermissionMask.Modify) == 0)
                 return;
 
             SceneObjectGroup parentPrim = null, childPrim = null;
 
             if (parent != 0)
             {
-                parentPrim = m_host.ParentGroup;
-                childPrim = targetPart.ParentGroup;
+                parentPrim = hostgroup;
+                childPrim = targetgrp;
             }
             else
             {
-                parentPrim = targetPart.ParentGroup;
-                childPrim = m_host.ParentGroup;
+                parentPrim = targetgrp;
+                childPrim = hostgroup;
             }
 
             // Required for linking
             childPrim.RootPart.ClearUpdateSchedule();
             parentPrim.LinkToGroup(childPrim, true);
 
-
             parentPrim.TriggerScriptChangedEvent(Changed.LINK);
             parentPrim.RootPart.CreateSelected = false;
             parentPrim.HasGroupChanged = true;
@@ -4492,7 +4501,6 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
 
         public void llBreakLink(int linknum)
         {
-
             if ((m_item.PermsMask & ScriptBaseClass.PERMISSION_CHANGE_LINKS) == 0
                 && !m_automaticLinkPermission)
             {
@@ -4512,6 +4520,10 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api
 
             if (parentSOG.AttachmentPoint != 0)
                 return; // Fail silently if attached
+
+            if ((parentSOG.RootPart.OwnerMask & (uint)PermissionMask.Modify) == 0)
+                return;
+
             SceneObjectPart childPrim = null;
 
             switch (linknum)