Merging various security fixes from Branch_1-24-Server.
Related to RequestXfer exploit:
* DEV-21706 (SEC-188): llParticleSystem can be used to obtain asset id.
* DEV-21767: Migrate RequestXfer to TCP-only
* DEV-21765: Fix RequestXfer traversal exploit
* DEV-21775: LLXferManager::processFileRequest() still has file vulnerabilities
Various fixes:
* fix for VFS memory corruption in llvfs.
* Bump server version to 1.24.9.
Landstore fixes:
* Passing locale to fulfill-order-item from region reservation fulfillment.
Merging fixes from 1.24 Server.
From vcr-maint-2:
* QAR-856: viewer crash log analyzer updates.
From direct-slurl-1:
* login.cgi: simplification of the way start-locations are chosen and the new-user browser tutorial is shown.
* No longer fake ever-logged-in flag
* support for dataservice query string encryption
from maint-server-4:
* DEV-19961: llInstantMessages of length N fail.
from landstore-v2-01-merge:
* DEV-12330: Allow Neighbors & Tweaks.
* DEV-14126: Re-order items on Region Detail page.
* DEV-14064: Add "Delete" order buttons in the View Cart area.
* DEV-15026: Indicate in the Event Log whether purchase is a Openspace or regular region.
* DEV-15242: disable checkout button after first click.
* DEV-15285: Region Names in cart or fulfilled should expire after 30 min or when delivered.
* DEV-14018: No currency listed for land prices
* DEV-1688: Tool: Ability to view and clear Allowed Neighbors from a region.
* DEV-17199: Fatal error when adding your login name to your allowed neighbors list.
* DEV-17251: Deleting an unavailable item from the shopping cart causes a fatal error.
* DEV-17291: Fatal error occurs when performing various activities.
* DEV-17177: Typo on Land store 2.01 checkout page.
From 1.24:
* DEV-19865 (SVC-2927): Abandoning land changes land name and description even when done by an Estate Manager.
* DEV-19916 (SVC-2938): bug fix for llGetNextEmail() failure.
* DEV-19936 (SVC-2962): adding a value to a list also modifies the list in place.
* SVC-2750, SVC-2958, SVC-2973: Changed LSL scheduler logic to yield if finished and no state change is pending.
* indra/lib/python/indra/agent/auth.py no longer assumes there is a critical message, and checks credential as specified by OGP rev3.
* DEV-20051: Added defensive checks on script rez path.
* Improvements to scripts/make_deploy_group.py.
* DEV-18897: llScriptReset wasn't resetting events for LSL scripts.
* DEV-20127: Fix for stl misuse in newsim/llsimparcel.cpp.
* DEV-18897: Mono Beta - LSL attach() event survives reset.
* DEV-20212 (VWR-9026): String fix - Attempting to teleport to "Help Island" produces a dialog referencing "Orientation Island"
* DEV-20164: llListen caching indefinitely across states.
* DEV-19950: timer() event triggers before on_rez(), & state_entry()
* DEV-19712 (SVC-2908): C# error messages with Mono Compiled scripts
* Fixes for chat service unit tests.
* DEV-19106: (SVC-1571): Rezzing a coalesced objects with 1024 scripted prims fails.
Related Jiras:
1. DEV-17797 New Top Causes of Inventory Loss is Attachments with null folder_id
2. DEV-17937 null asset id not handled correctly in ais inventory fetch
3. OPSRT-1097 Update python-indra package on the system images
4. DEV-20505 QAR-751: Banning Cap "FetchLibDescendents" results in error in viewer log.
5. DEV-20328 QAR-751 Excessive log spam when using ais viewer against ais sim
6. DEV-20335 QAR-751 AIS bans are missing from message.xml
svn merge -r95983:96590 svn+ssh://svn/svn/linden/branches/ais-for-merge-qar-751 .
Miscellaneous commit:
1. Fixed silly bug in llsd-rest that broke connects to https on a non-standard port
svn merge -r95983:96590 svn+ssh://svn/svn/linden/branches/ais-for-merge-qar-751 .
Related Jiras:
1. DEV-17797 New Top Causes of Inventory Loss is Attachments with null folder_id
2. DEV-17937 null asset id not handled correctly in ais inventory fetch
3. OPSRT-1097 Update python-indra package on the system images
4. DEV-20505 QAR-751: Banning Cap "FetchLibDescendents" results in error in viewer log.
5. DEV-20328 QAR-751 Excessive log spam when using ais viewer against ais sim
6. DEV-20335 QAR-751 AIS bans are missing from message.xml
svn merge -r95983:96590 svn+ssh://svn/svn/linden/branches/ais-for-merge-qar-751 .
Miscellaneous commit:
1. Fixed silly bug in llsd-rest that broke connects to https on a non-standard port
Reverting my changes to the package target. It subtly broke the windows build in a way I didn't want to try to fix in release. Will fix in another branch.
this is a combined mergeback of the following branches as per QAR-841:
maint-server/maint-server-1 (absorbed by maint-server-2)
maint-server/maint-server-2
maint-server/maint-server-3
havok4/havok4-8
havok4/havok4-9
yes dataserver-is-deprecated
svn+ssh://svn.lindenlab.com/svn/linden/branches/package-target-not-optional
--> release
Always add the package target, but do not include it when selecting
"Build Solution". Reviewed by james.
Merging various fixes from 1.24 Server.
From 1.23:
* DEV-18957: SCUT: Enable test.py to run tests agains a grid database
From 1.24, the UPCOMING production branch:
* DEV-18934 VWR-8519: 1.21 nightly: World > Region/Estate > Debug > Get Top Scripts crashes viewer
* Sanity checking build settings before packaging binaries
* DEV-19810 Updated libmono on linux with support for signal chaining
* Remove gdb references to gPumpFile and gPumpLine in crash_reporter.py
* DEV-19397: Changed the signature for remote_data to for Mono scripts
* DEV-19396: Steal signal handlers back from Mono on error.
* DEV-19396: attach mono thread if necessary during writeState
* DEV-19396: Allow mono to handle managed SEGV signals during emergency save
* DEV-19396: Disable GC while writing the simstate during a crash
* DEV-19550: Make viewer crash reporter handle different binary debug file names
* Defensively protect against responders not being in list and give a warning rather than crash.
* Fix simulator crash in shutdown error handling that also causes error stacks to go unreported
* DEV-19752 QAR-834 Remove Community Standards window from startup. Set the "critical message" name on agni to NULL.
* Minor traceback fixes in backbone for multiagentchat
* Removed some mono debug spam
* DEV-19239: Group members receives an error upon opening group chat if join group chat was disabled then reenabled.
* DEV-19809 Harden llGetNextEmail to bad params
* DEV-17967 fixed null string and keys passing to lib funcs
* Several small fixes for farm deploy tools and automated build system
* Sync indra/agent/auth.py with interop-5 branch, and update status codes
Merging revisions 95145-95146,95281-95282 of svn+ssh://svn.lindenlab.com/svn/linden/branches/maint-viewer/maint-viewer-10 into E:\release, respecting ancestry
- file lists in assemblies/3rd_party_libs (used for updating lib tarfiles) updated as per above
- new config files created for 'glib' library; glib files removed from gtk-atk-pango-glib filelist. glib can be decoupled from mono, when appropriate.
- package.py help dialogue and error reporting updated for clarity.
- install.py will now output list of files installed for a package with command-line option
Kyle Ambroff