cinderblocks / radegast

Lightweight client for connecting to Second Life and OpenSim based virtual worlds
http://radegast.life/
GNU Lesser General Public License v3.0
65 stars 24 forks source link

[WIP] Remove LSLHelper commands dealing with money #5

Closed nooperation closed 6 years ago

nooperation commented 6 years ago

While the intention is good, send_money is a massive security risk for existing users of LSLHelper. You can't just have critical permissions like this sneak into an existing system. It also opens up the possibility of exploitation via potential flaws in future code and through means of social engineering. There's already existing functionality with a permissions system in LSL for sending money via http://wiki.secondlife.com/wiki/LlTransferLindenDollars

tell_balance - I'm not too sure about what use this would have without the send_money command and am kind of on the fence about if it should be removed. While very mild, this command may reveal information existing users of LSLHelper may not want to expose

cinderblocks commented 6 years ago

Agreed.