From 91e24a80ec9d4f6ccd42531bb47fa17227bae346 Mon Sep 17 00:00:00 2001
From: Kitty Barnett <develop@catznip.com>
Date: Sun, 14 Feb 2021 21:41:16 +0100
Subject: [PATCH] [FIXED] llTextBox can be used to bypass @sendchat and
 @sendchannel (leave @sendchannel as-is for now)   -> Reported by Chorazin
 Allen

---
 indra/newview/llnotificationscripthandler.cpp | 22 +++++++++++++++++++
 indra/newview/llviewermessage.cpp             | 14 ++++++++++++
 .../skins/default/xui/en/rlva_strings.xml     |  5 +++++
 3 files changed, 41 insertions(+)

diff --git a/indra/newview/llnotificationscripthandler.cpp b/indra/newview/llnotificationscripthandler.cpp
index ba831ab2ed..149d50c93a 100644
--- a/indra/newview/llnotificationscripthandler.cpp
+++ b/indra/newview/llnotificationscripthandler.cpp
@@ -37,6 +37,10 @@
 #include "llscriptfloater.h"
 #include "llavatarname.h"
 #include "llavatarnamecache.h"
+// [RLVa:KB] - @sendchat and @sendchannel/sendchannelexcept
+#include "rlvactions.h"
+#include "rlvcommon.h"
+// [/RLVa:KB]
 
 using namespace LLNotificationsUI;
 
@@ -112,6 +116,24 @@ bool LLScriptHandler::processNotification(const LLNotificationPtr& notification)
 
 	if(notification->hasFormElements() && !notification->canShowToast())
 	{
+// [RLVa:KB] - @sendchat and @sendchannel/sendchannelexcept
+		if (RlvActions::isRlvEnabled())
+		{
+			const LLSD& sdPayload = notification->getPayload();
+			if (sdPayload.has("chat_channel"))
+			{
+				const S32 nChannel = sdPayload["chat_channel"].asInteger();
+
+				// *TODO-RLVa: it's too late into the release cycle to block all script interactions so just take care of the nearby chat loophole for now
+				bool fBlock = (0 == nChannel) ? RlvActions::hasBehaviour(RLV_BHVR_SENDCHAT) : /*!RlvActions::canSendChannel(nChannel)*/false;
+				if (fBlock)
+				{
+					RlvUtil::notifyBlocked("blocked_scriptdialog");
+					return false;
+				}
+			}
+		}
+// [/RLVa:KB]
 		LLScriptFloaterManager::getInstance()->onAddNotification(notification->getID());
 	}
 	else if (notification->canShowToast())
diff --git a/indra/newview/llviewermessage.cpp b/indra/newview/llviewermessage.cpp
index 68cb7bf963..41c6830c2d 100644
--- a/indra/newview/llviewermessage.cpp
+++ b/indra/newview/llviewermessage.cpp
@@ -6902,6 +6902,20 @@ bool callback_script_dialog(const LLSD& notification, const LLSD& response)
 		}
 	}
 
+// [RLVa:KB] - @sendchat and @sendchannel/sendchannelexcept
+	if ( (RlvActions::isRlvEnabled()) && (0 <= button_idx) )
+	{
+		const S32 nChannel = notification["payload"]["chat_channel"].asInteger();
+
+		// *TODO-RLVa: it's too late into the release cycle to block all script interactions so just take care of the nearby chat loophole for now
+		bool fBlock = (0 == nChannel) ? RlvActions::hasBehaviour(RLV_BHVR_SENDCHAT) : /*!RlvActions::canSendChannel(nChannel)*/false;
+		if (fBlock)
+		{
+			button_idx = -1;
+		}
+	}
+// [/RLVa:KB]
+
 	if (0 <= button_idx)
 	{
 		LLMessageSystem* msg = gMessageSystem;
diff --git a/indra/newview/skins/default/xui/en/rlva_strings.xml b/indra/newview/skins/default/xui/en/rlva_strings.xml
index edd2c2fecd..de0e99d6d0 100644
--- a/indra/newview/skins/default/xui/en/rlva_strings.xml
+++ b/indra/newview/skins/default/xui/en/rlva_strings.xml
@@ -136,6 +136,11 @@
 			<key>value</key>
 			<string>'[OBJECT]' was denied permission to teleport you due to RLV restrictions</string>
 		</map>
+		<key>blocked_scriptdialog</key>
+		<map>
+			<key>value</key>
+			<string>Unable to show script dialog or textbox due to RLV restrictions</string>
+		</map>
 		<key>blocked_startim</key>
 		<map>
 			<key>value</key>