As in edit permissions being ability to move the object. I pointed this out a while ago to the devs when I deleted parts of the voice stress test cinema of parts that were not locked (with me having no other permissions than ability to connect) but It may need a re-brought up like many other issues that have been below the surface.
So I will make it public knowledge here exactly what to force the issue (as I reported this back when the stress test started to cait)
Basically right now permissions we have control ones ability to
- Rez temp
- Res permanent
- ability to lock / unlock
Edit.js forexample controls the flag My Entities.canRez() && Entities.canRezTmp() it doesn’t stop you from opening edit entity list from the submenus nor does it stop you from running a script that deletes all entities that are unlocked in the domain or moving them. Meaning if a script doesn’t do a check it will do what they do.
Worse I found this by being tempted to deploy the bomb during the stress test by putting it into a random unlocked entity during the voice tests but decided against it. Because it is just a script that runs on on client side, it would have been nigh impossible to find as there is no identity to who spawned an entity, just who edited one last, meaning if you force everyone to edit that entity, there is no origin to be traced.
It is also why they made the cloneable worklist to make a workaround to make interactable objects from locked objects. (As in make temporary clones) which also is useful
For other stuff. Because if you can’t edit the user data it’s the same as locking it for some scripts.
So I’d suggest for hifi devs to add a new check similar to locking on the server side: that if you have the ability to res permanent you should then be able to edit permanent. If you don’t you can’t do anything with entities that are not temporary. Similarly if you cannot rezTemp, you will not be able to edit temp.
That would create three layers of permissions.
There are also other methods to cause havoc, which I have demonstrated, such as the bomb.