From e7a97c6117048d13ac819fe8607d0c626c33f945 Mon Sep 17 00:00:00 2001
From: David Rowe <david@ctrlaltstudio.com>
Date: Mon, 1 Mar 2021 21:23:50 +1300
Subject: [PATCH] Don't accept avatar entity data in message mixer if no rez
 permissions

---
 assignment-client/src/avatars/AvatarMixerClientData.cpp | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/assignment-client/src/avatars/AvatarMixerClientData.cpp b/assignment-client/src/avatars/AvatarMixerClientData.cpp
index f86dc7f766..6c666c6698 100644
--- a/assignment-client/src/avatars/AvatarMixerClientData.cpp
+++ b/assignment-client/src/avatars/AvatarMixerClientData.cpp
@@ -269,7 +269,13 @@ void AvatarMixerClientData::processSetTraitsMessage(ReceivedMessage& message,
                         // the avatar mixer uses the negative value of the sent version
                         instanceVersionRef = -packetTraitVersion;
                     } else {
-                        _avatar->processTraitInstance(traitType, instanceID, message.read(traitSize));
+                        // Don't accept avatar entity data for distribution unless sender has rez permissions on the domain.
+                        if (sendingNode.getCanRezAvatarEntities()) {
+                            _avatar->processTraitInstance(traitType, instanceID, message.read(traitSize));
+                        } else {
+                            message.read(traitSize);
+                        }
+                        
                         instanceVersionRef = packetTraitVersion;
                     }