merge release@56803 release-candidate@56833

17 files changed, 475 insertions, 126 deletions

diff --git a/indra/llmessage/llassetstorage.cpp b/indra/llmessage/llassetstorage.cpp
index b23567288d..e2bfd0496b 100644
--- a/indra/llmessage/llassetstorage.cpp
+++ b/indra/llmessage/llassetstorage.cpp
@@ -465,15 +465,29 @@ void LLAssetStorage::_queueDataRequest(const LLUUID& uuid, LLAssetType::EType at
 }
 
 
-void LLAssetStorage::downloadCompleteCallback(S32 result, void *user_data)
+void LLAssetStorage::downloadCompleteCallback(
+	S32 result,
+	const LLUUID& file_id,
+	LLAssetType::EType file_type,
+	void* user_data)
 {
-	LLAssetRequest* req = (LLAssetRequest *)user_data;
+	lldebugs << "LLAssetStorage::downloadCompleteCallback() for " << file_id
+		 << "," << LLAssetType::lookup(file_type) << llendl;
+	LLAssetRequest* req = (LLAssetRequest*)user_data;
+	if(!req)
+	{
+		llwarns << "LLAssetStorage::downloadCompleteCallback called without"
+			"a valid request." << llendl;
+		return;
+	}
 	if (!gAssetStorage)
 	{
 		llwarns << "LLAssetStorage::downloadCompleteCallback called without any asset system, aborting!" << llendl;
 		return;
 	}
 
+	req->setUUID(file_id);
+	req->setType(file_type);
 	if (LL_ERR_NOERR == result)
 	{
 		// we might have gotten a zero-size file
@@ -601,15 +615,28 @@ void LLAssetStorage::getEstateAsset(const LLHost &object_sim, const LLUUID &agen
 	}
 }
 
-void LLAssetStorage::downloadEstateAssetCompleteCallback(S32 result, void *user_data)
+void LLAssetStorage::downloadEstateAssetCompleteCallback(
+	S32 result,
+	const LLUUID& file_id,
+	LLAssetType::EType file_type,
+	void* user_data)
 {
-	LLEstateAssetRequest *req = (LLEstateAssetRequest *)user_data;
+	LLEstateAssetRequest *req = (LLEstateAssetRequest*)user_data;
+	if(!req)
+	{
+		llwarns << "LLAssetStorage::downloadEstateAssetCompleteCallback called"
+			" without a valid request." << llendl;
+		return;
+	}
 	if (!gAssetStorage)
 	{
-		llwarns << "LLAssetStorage::downloadCompleteCallback called without any asset system, aborting!" << llendl;
+		llwarns << "LLAssetStorage::downloadEstateAssetCompleteCallback called"
+			" without any asset system, aborting!" << llendl;
 		return;
 	}
 
+	req->setUUID(file_id);
+	req->setType(file_type);
 	if (LL_ERR_NOERR == result)
 	{
 		// we might have gotten a zero-size file
@@ -636,29 +663,36 @@ void LLAssetStorage::getInvItemAsset(const LLHost &object_sim, const LLUUID &age
 	//
 	// Probably will get rid of this early out?
 	//
-	if (asset_id.isNull())
+	//if (asset_id.isNull())
+	//{
+	//	// Special case early out for NULL uuid
+	//	if (callback)
+	//	{
+	//		callback(mVFS, asset_id, atype, user_data, LL_ERR_ASSET_REQUEST_NOT_IN_DATABASE);
+	//	}
+	//	return;
+	//}
+
+	bool exists = false; 
+	U32 size = 0;
+
+	if(asset_id.notNull())
 	{
-		// Special case early out for NULL uuid
-		if (callback)
+		exists = mVFS->getExists(asset_id, atype);
+		LLVFile file(mVFS, asset_id, atype);
+		size = exists ? file.getSize() : 0;
+		if(exists && size < 1)
 		{
-			callback(mVFS, asset_id, atype, user_data, LL_ERR_ASSET_REQUEST_NOT_IN_DATABASE);
+			llwarns << "Asset vfile " << asset_id << ":" << atype << " found with bad size " << file.getSize() << ", removing" << llendl;
+			file.remove();
 		}
-		return;
-	}
 
-	BOOL exists = mVFS->getExists(asset_id, atype);
-	LLVFile file(mVFS, asset_id, atype);
-	U32 size = exists ? file.getSize() : 0;
+	}
 
 	if (size < 1)
 	{
-		if (exists)
-		{
-			llwarns << "Asset vfile " << asset_id << ":" << atype << " found with bad size " << file.getSize() << ", removing" << llendl;
-			file.remove();
-		}
-
-		// See whether we should talk to the object's originating sim, or the upstream provider.
+		// See whether we should talk to the object's originating sim,
+		// or the upstream provider.
 		LLHost source_host;
 		if (object_sim.isOk())
 		{
@@ -688,7 +722,9 @@ void LLAssetStorage::getInvItemAsset(const LLHost &object_sim, const LLUUID &age
 			tpvf.setAsset(asset_id, atype);
 			tpvf.setCallback(downloadInvItemCompleteCallback, req);
 
-			llinfos << "Starting transfer for " << asset_id << llendl;
+			llinfos << "Starting transfer for inventory asset "
+				<< item_id << " owned by " << owner_id << "," << task_id
+				<< llendl;
 			LLTransferTargetChannel *ttcp = gTransferManager.getTargetChannel(source_host, LLTCT_ASSET);
 			ttcp->requestTransfer(spi, tpvf, 100.f + (is_priority ? 1.f : 0.f));
 		}
@@ -715,15 +751,27 @@ void LLAssetStorage::getInvItemAsset(const LLHost &object_sim, const LLUUID &age
 }
 
 
-void LLAssetStorage::downloadInvItemCompleteCallback(S32 result, void *user_data)
+void LLAssetStorage::downloadInvItemCompleteCallback(
+	S32 result,
+	const LLUUID& file_id,
+	LLAssetType::EType file_type,
+	void* user_data)
 {
-	LLInvItemRequest *req = (LLInvItemRequest *)user_data;
+	LLInvItemRequest *req = (LLInvItemRequest*)user_data;
+	if(!req)
+	{
+		llwarns << "LLAssetStorage::downloadEstateAssetCompleteCallback called"
+			" without a valid request." << llendl;
+		return;
+	}
 	if (!gAssetStorage)
 	{
 		llwarns << "LLAssetStorage::downloadCompleteCallback called without any asset system, aborting!" << llendl;
 		return;
 	}
 
+	req->setUUID(file_id);
+	req->setType(file_type);
 	if (LL_ERR_NOERR == result)
 	{
 		// we might have gotten a zero-size file
diff --git a/indra/llmessage/llassetstorage.h b/indra/llmessage/llassetstorage.h
index 4ccbb08abd..59baddd69c 100644
--- a/indra/llmessage/llassetstorage.h
+++ b/indra/llmessage/llassetstorage.h
@@ -68,6 +68,10 @@ public:
 	
 	LLUUID getUUID() const					{ return mUUID; }
 	LLAssetType::EType getType() const		{ return mType; }
+
+	void setUUID(const LLUUID& id) { mUUID = id; }
+	void setType(LLAssetType::EType type) { mType = type; }
+
 protected:
 	LLUUID	mUUID;
 	LLAssetType::EType mType;
@@ -97,6 +101,10 @@ public:
 
 	LLUUID getUUID() const					{ return mUUID; }
 	LLAssetType::EType getType() const		{ return mType; }
+
+	void setUUID(const LLUUID& id) { mUUID = id; }
+	void setType(LLAssetType::EType type) { mType = type; }
+
 protected:
 	LLUUID	mUUID;
 	LLAssetType::EType mType;
@@ -122,6 +130,10 @@ public:
 
 	LLUUID getUUID() const					{ return mUUID; }
 	LLAssetType::EType getAType() const		{ return mAType; }
+
+	void setUUID(const LLUUID& id) { mUUID = id; }
+	void setType(LLAssetType::EType type) { mAType = type; }
+
 protected:
 	LLUUID	mUUID;
 	LLAssetType::EType mAType;
@@ -237,9 +249,21 @@ public:
 	LLSD getPendingUploadTypes() const;
 
 	// download process callbacks
-	static void downloadCompleteCallback(const S32 result, void *user_data);
-	static void downloadEstateAssetCompleteCallback(const S32 result, void *user_data);
-	static void downloadInvItemCompleteCallback(const S32 result, void *user_data);
+	static void downloadCompleteCallback(
+		S32 result,
+		const LLUUID& file_id,
+		LLAssetType::EType file_type,
+		void* user_data);
+	static void downloadEstateAssetCompleteCallback(
+		S32 result,
+		const LLUUID& file_id,
+		LLAssetType::EType file_type,
+		void* user_data);
+	static void downloadInvItemCompleteCallback(
+		S32 result,
+		const LLUUID& file_id,
+		LLAssetType::EType file_type,
+		void* user_data);
 
 	// upload process callbacks
 	static void uploadCompleteCallback(const LLUUID&, void *user_data, S32 result);
diff --git a/indra/llmessage/llhttpassetstorage.cpp b/indra/llmessage/llhttpassetstorage.cpp
index 856e79191f..23beeafb13 100644
--- a/indra/llmessage/llhttpassetstorage.cpp
+++ b/indra/llmessage/llhttpassetstorage.cpp
@@ -670,7 +670,11 @@ void LLHTTPAssetStorage::checkForTimeouts()
 
 				// call the static callback for transfer completion
 				// this will cleanup all requests for this asset, including ours
-				downloadCompleteCallback(xfer_result, (void *)req);
+				downloadCompleteCallback(
+					xfer_result,
+					req->getUUID(),
+					req->getType(),
+					(void *)req);
 				// Pending download flag will get cleared when the request is deleted
 			}
 			else
diff --git a/indra/llmessage/llinstantmessage.cpp b/indra/llmessage/llinstantmessage.cpp
index 2bfa82a0ce..10ff8eb88d 100644
--- a/indra/llmessage/llinstantmessage.cpp
+++ b/indra/llmessage/llinstantmessage.cpp
@@ -257,7 +257,7 @@ void LLIMInfo::unpackMessageBlock(LLMessageSystem* msg)
 		msg->getSizeFast(
 			_PREHASH_MessageBlock,
 			_PREHASH_BinaryBucket));
-	if(binary_bucket_size)
+	if(binary_bucket_size > 0)
 	{
 		std::vector<U8> bucket;
 		bucket.resize(binary_bucket_size);
diff --git a/indra/llmessage/llqueryflags.h b/indra/llmessage/llqueryflags.h
index be6c9acf67..064e42bae6 100644
--- a/indra/llmessage/llqueryflags.h
+++ b/indra/llmessage/llqueryflags.h
@@ -12,21 +12,38 @@
 // Binary flags used for Find queries, shared between viewer and dataserver.
 
 // DirFindQuery flags
-const U32 DFQ_PEOPLE			= 0x0001;
-const U32 DFQ_ONLINE			= 0x0002;
-//const U32 DFQ_PLACES			= 0x0004;
-const U32 DFQ_EVENTS			= 0x0008;
-const U32 DFQ_GROUPS			= 0x0010;
-const U32 DFQ_DATE_EVENTS		= 0x0020;
-
-const U32 DFQ_AGENT_OWNED		= 0x0040;
-const U32 DFQ_FOR_SALE			= 0x0080;
-const U32 DFQ_GROUP_OWNED		= 0x0100;
-//const U32 DFQ_AUCTION			= 0x0200;
-const U32 DFQ_DWELL_SORT		= 0x0400;
-const U32 DFQ_PG_SIMS_ONLY		= 0x0800;
-const U32 DFQ_PICTURES_ONLY		= 0x1000;
-const U32 DFQ_PG_EVENTS_ONLY	= 0x2000;
-const U32 DFQ_MATURE_SIMS_ONLY  = 0x4000;
+const U32 DFQ_PEOPLE			= 0x1 << 0;
+const U32 DFQ_ONLINE			= 0x1 << 1;
+//const U32 DFQ_PLACES			= 0x1 << 2;
+const U32 DFQ_EVENTS			= 0x1 << 3;
+const U32 DFQ_GROUPS			= 0x1 << 4;
+const U32 DFQ_DATE_EVENTS		= 0x1 << 5;
+
+const U32 DFQ_AGENT_OWNED		= 0x1 << 6;
+const U32 DFQ_FOR_SALE			= 0x1 << 7;
+const U32 DFQ_GROUP_OWNED		= 0x1 << 8;
+//const U32 DFQ_AUCTION			= 0x1 << 9;
+const U32 DFQ_DWELL_SORT		= 0x1 << 10;
+const U32 DFQ_PG_SIMS_ONLY		= 0x1 << 11;
+const U32 DFQ_PICTURES_ONLY		= 0x1 << 12;
+const U32 DFQ_PG_EVENTS_ONLY	= 0x1 << 13;
+const U32 DFQ_MATURE_SIMS_ONLY  = 0x1 << 14;
+
+const U32 DFQ_SORT_ASC			= 0x1 << 15;
+const U32 DFQ_PRICE_SORT		= 0x1 << 16;
+const U32 DFQ_PER_METER_SORT	= 0x1 << 17;
+const U32 DFQ_AREA_SORT			= 0x1 << 18;
+const U32 DFQ_NAME_SORT			= 0x1 << 19;
+
+const U32 DFQ_LIMIT_BY_PRICE	= 0x1 << 20;
+const U32 DFQ_LIMIT_BY_AREA		= 0x1 << 21;
+
+// Sell Type flags
+const U32 ST_AUCTION	= 0x1 << 1;
+const U32 ST_NEWBIE		= 0x1 << 2;
+const U32 ST_MAINLAND	= 0x1 << 3;
+const U32 ST_ESTATE		= 0x1 << 4;
+
+const U32 ST_ALL		= 0xFFFFFFFF;
 
 #endif
diff --git a/indra/llmessage/llregionflags.h b/indra/llmessage/llregionflags.h
index 3f37c72cee..e7797ea158 100644
--- a/indra/llmessage/llregionflags.h
+++ b/indra/llmessage/llregionflags.h
@@ -66,6 +66,8 @@ const U32 REGION_FLAGS_DENY_TRANSACTED			= (1 << 25);
 
 const U32 REGION_FLAGS_ALLOW_PARCEL_CHANGES		= (1 << 26);
 
+const U32 REGION_FLAGS_ABUSE_EMAIL_TO_ESTATE_OWNER = (1 << 27);
+
 const U32 REGION_FLAGS_NULL_LAYER				= (1 << 9);
 
 const U32 REGION_FLAGS_DEFAULT = REGION_FLAGS_ALLOW_LANDMARK |
diff --git a/indra/llmessage/lltransfermanager.cpp b/indra/llmessage/lltransfermanager.cpp
index 436363672e..34344040b8 100644
--- a/indra/llmessage/lltransfermanager.cpp
+++ b/indra/llmessage/lltransfermanager.cpp
@@ -206,30 +206,43 @@ void LLTransferManager::processTransferRequest(LLMessageSystem *msgp, void **)
 		return;
 	}
 
+	S32 size = msgp->getSize("TransferInfo", "Params");
+	if(size > MAX_PARAMS_SIZE)
+	{
+		llwarns << "LLTransferManager::processTransferRequest params too big."
+			<< llendl;
+		return;
+	}
 
 	//llinfos << transfer_id << ":" << source_type << ":" << channel_type << ":" << priority << llendl;
-	LLTransferSource *tsp = LLTransferSource::createSource(source_type, transfer_id, priority);
-	if (!tsp)
+	LLTransferSource* tsp = LLTransferSource::createSource(
+		source_type,
+		transfer_id,
+		priority);
+	if(!tsp)
 	{
-		llwarns << "LLTransferManager::processTransferRequest couldn't create transfer source!" << llendl;
+		llwarns << "LLTransferManager::processTransferRequest couldn't create"
+			<< " transfer source!" << llendl;
 		return;
 	}
-	tscp->addTransferSource(tsp);
-
 	U8 tmp[MAX_PARAMS_SIZE];
-	S32 size = msgp->getSize("TransferInfo", "Params");
-	gMessageSystem->getBinaryData("TransferInfo", "Params", tmp, size);
+	msgp->getBinaryData("TransferInfo", "Params", tmp, size);
 
 	LLDataPackerBinaryBuffer dpb(tmp, MAX_PARAMS_SIZE);
 	BOOL unpack_ok = tsp->unpackParams(dpb);
 	if (!unpack_ok)
 	{
-		llwarns << "Got bad parameters for a transfer request!" << llendl;
+		// This should only happen if the data is corrupt or
+		// incorrectly packed.
+		// *NOTE: We may want to call abortTransfer().
+		llwarns << "LLTransferManager::processTransferRequest: bad parameters."
+			<< llendl;
+		delete tsp;
+		return;
 	}
 
+	tscp->addTransferSource(tsp);
 	tsp->initTransfer();
-	// Don't use the status code from initTransfer for anything right now, was used before but the logic
-	// changed.
 }
 
 
@@ -277,6 +290,31 @@ void LLTransferManager::processTransferInfo(LLMessageSystem *msgp, void **)
 		return;
 	}
 
+	// unpack the params
+	S32 params_size = msgp->getSize("TransferInfo", "Params");
+	if(params_size > MAX_PARAMS_SIZE)
+	{
+		llwarns << "LLTransferManager::processTransferInfo params too big."
+			<< llendl;
+		return;
+	}
+	else if(params_size > 0)
+	{
+		U8 tmp[MAX_PARAMS_SIZE];
+		msgp->getBinaryData("TransferInfo", "Params", tmp, params_size);
+		LLDataPackerBinaryBuffer dpb(tmp, MAX_PARAMS_SIZE);
+		if (!ttp->unpackParams(dpb))
+		{
+			// This should only happen if the data is corrupt or
+			// incorrectly packed.
+			llwarns << "LLTransferManager::processTransferRequest: bad params."
+				<< llendl;
+			ttp->abortTransfer();
+			ttcp->deleteTransfer(ttp);
+			return;
+		}
+	}
+
 	llinfos << "Receiving " << transfer_id << ", size " << size << " bytes" << llendl;
 	ttp->setSize(size);
 	ttp->setGotInfo(TRUE);
@@ -373,9 +411,9 @@ void LLTransferManager::processTransferPacket(LLMessageSystem *msgp, void **)
 	LLTransferTarget *ttp = ttcp->findTransferTarget(transfer_id);
 	if (!ttp)
 	{
-		llwarns << "Didn't find matching transfer for " << transfer_id << ", aborting!" << llendl;
-		llwarns << "Packet ID: " << packet_id << llendl;
-		llwarns << "Should notify source of this!" << llendl;
+		llwarns << "Didn't find matching transfer for " << transfer_id
+			<< " processing packet " << packet_id
+			<< " from " << msgp->getSender() << llendl;
 		return;
 	}
 
@@ -407,11 +445,29 @@ void LLTransferManager::processTransferPacket(LLMessageSystem *msgp, void **)
 
 	if ((!ttp->gotInfo()) || (ttp->getNextPacketID() != packet_id))
 	{
-
-		llwarns << "Out of order packet in transfer " << transfer_id << ", got " << packet_id << " expecting " << ttp->getNextPacketID() << llendl;
-
 		// Put this on a list of packets to be delivered later.
-		ttp->addDelayedPacket(packet_id, status, tmp_data, size);
+		if(!ttp->addDelayedPacket(packet_id, status, tmp_data, size))
+		{
+			// Whoops - failed to add a delayed packet for some reason.
+			llwarns << "Too many delayed packets processing transfer "
+				<< transfer_id << " from " << msgp->getSender() << llendl;
+			ttp->abortTransfer();
+			ttcp->deleteTransfer(ttp);
+			return;
+		}
+		const S32 LL_TRANSFER_WARN_GAP = 10;
+		if(!ttp->gotInfo())
+		{
+			llwarns << "Got data packet before information in transfer "
+				<< transfer_id << " from " << msgp->getSender()
+				<< ", got " << packet_id << llendl;
+		}
+		else if((packet_id - ttp->getNextPacketID()) > LL_TRANSFER_WARN_GAP)
+		{
+			llwarns << "Out of order packet in transfer " << transfer_id
+				<< " from " << msgp->getSender() << ", got " << packet_id
+				<< " expecting " << ttp->getNextPacketID() << llendl;
+		}
 		return;
 	}
 
@@ -862,13 +918,17 @@ LLTransferTargetChannel::~LLTransferTargetChannel()
 }
 
 
-void LLTransferTargetChannel::requestTransfer(const LLTransferSourceParams &source_params,
-											  const LLTransferTargetParams &target_params,
-											  const F32 priority)
+void LLTransferTargetChannel::requestTransfer(
+	const LLTransferSourceParams& source_params,
+	const LLTransferTargetParams& target_params,
+	const F32 priority)
 {
 	LLUUID id;
 	id.generate();
-	LLTransferTarget *ttp = LLTransferTarget::createTarget(target_params.getType(), id);
+	LLTransferTarget* ttp = LLTransferTarget::createTarget(
+		target_params.getType(),
+		id,
+		source_params.getType());
 	if (!ttp)
 	{
 		llwarns << "LLTransferManager::requestTransfer aborting due to target creation failure!" << llendl;
@@ -988,6 +1048,11 @@ void LLTransferSource::sendTransferStatus(LLTSCode status)
 	gMessageSystem->addS32("ChannelType", mChannelp->getChannelType());
 	gMessageSystem->addS32("Status", status);
 	gMessageSystem->addS32("Size", mSize);
+	U8 tmp[MAX_PARAMS_SIZE];
+	LLDataPackerBinaryBuffer dp(tmp, MAX_PARAMS_SIZE);
+	packParams(dp);
+	S32 len = dp.getCurrentSize();
+	gMessageSystem->addBinaryData("Params", tmp, len);
 	gMessageSystem->sendReliable(mChannelp->getHost());
 
 	// Abort if there was as asset system issue.
@@ -1105,9 +1170,13 @@ LLTransferPacket::~LLTransferPacket()
 // LLTransferTarget implementation
 //
 
-LLTransferTarget::LLTransferTarget(LLTransferTargetType type, const LLUUID &id) :
+LLTransferTarget::LLTransferTarget(
+	LLTransferTargetType type,
+	const LLUUID& transfer_id,
+	LLTransferSourceType source_type) : 
 	mType(type),
-	mID(id),
+	mSourceType(source_type),
+	mID(transfer_id),
 	mGotInfo(FALSE),
 	mSize(0),
 	mLastPacketID(-1)
@@ -1143,27 +1212,48 @@ void LLTransferTarget::abortTransfer()
 	completionCallback(LLTS_ABORT);
 }
 
-void LLTransferTarget::addDelayedPacket(const S32 packet_id, const LLTSCode status, U8 *datap, const S32 size)
+bool LLTransferTarget::addDelayedPacket(
+	const S32 packet_id,
+	const LLTSCode status,
+	U8* datap,
+	const S32 size)
 {
-	LLTransferPacket *tpp = new LLTransferPacket(packet_id, status, datap, size);
+	const transfer_packet_map::size_type LL_MAX_DELAYED_PACKETS = 100;
+	if(mDelayedPacketMap.size() > LL_MAX_DELAYED_PACKETS)
+	{
+		// too many delayed packets
+		return false;
+	}
+
+	LLTransferPacket* tpp = new LLTransferPacket(
+		packet_id,
+		status,
+		datap,
+		size);
+
 #ifdef _DEBUG
 	if (mDelayedPacketMap.find(packet_id) != mDelayedPacketMap.end())
 	{
 		llerrs << "Packet ALREADY in delayed packet map!" << llendl;
 	}
 #endif
+
 	mDelayedPacketMap[packet_id] = tpp;
+	return true;
 }
 
 
-LLTransferTarget *LLTransferTarget::createTarget(const LLTransferTargetType type, const LLUUID &id)
+LLTransferTarget* LLTransferTarget::createTarget(
+	LLTransferTargetType type,
+	const LLUUID& id,
+	LLTransferSourceType source_type)
 {
 	switch (type)
 	{
 	case LLTTT_FILE:
-		return new LLTransferTargetFile(id);
+		return new LLTransferTargetFile(id, source_type);
 	case LLTTT_VFILE:
-		return new LLTransferTargetVFile(id);
+		return new LLTransferTargetVFile(id, source_type);
 	default:
 		llwarns << "Unknown transfer target type: " << type << llendl;
 		return NULL;
@@ -1200,6 +1290,7 @@ void LLTransferSourceParamsInvItem::setAsset(const LLUUID &asset_id, const LLAss
 
 void LLTransferSourceParamsInvItem::packParams(LLDataPacker &dp) const
 {
+	lldebugs << "LLTransferSourceParamsInvItem::packParams()" << llendl;
 	dp.packUUID(mAgentID, "AgentID");
 	dp.packUUID(mSessionID, "SessionID");
 	dp.packUUID(mOwnerID, "OwnerID");
@@ -1252,6 +1343,9 @@ void LLTransferSourceParamsEstate::setAsset(const LLUUID &asset_id, const LLAsse
 void LLTransferSourceParamsEstate::packParams(LLDataPacker &dp) const
 {
 	dp.packUUID(mAgentID, "AgentID");
+	// *NOTE: We do not want to pass the session id from the server to
+	// the client, but I am not sure if anyone expects this value to
+	// be set on the client.
 	dp.packUUID(mSessionID, "SessionID");
 	dp.packS32(mEstateAssetType, "EstateAssetType");
 }
diff --git a/indra/llmessage/lltransfermanager.h b/indra/llmessage/lltransfermanager.h
index 8c4c9f8ba7..d258bd5f92 100644
--- a/indra/llmessage/lltransfermanager.h
+++ b/indra/llmessage/lltransfermanager.h
@@ -288,7 +288,8 @@ protected:
 	// The completionCallback is GUARANTEED to be called before the destructor.
 	virtual void			completionCallback(const LLTSCode status) = 0;
 
-	virtual BOOL			unpackParams(LLDataPacker &dp) = 0;
+	virtual void packParams(LLDataPacker& dp) const = 0;
+	virtual BOOL unpackParams(LLDataPacker& dp) = 0;
 
 	virtual S32				getNextPacketID()						{ return mLastPacketID + 1; }
 	virtual void			setLastPacketID(const S32 packet_id)	{ mLastPacketID = packet_id; }
@@ -353,22 +354,32 @@ protected:
 class LLTransferTarget
 {
 public:
-	LLTransferTarget(LLTransferTargetType target_type, const LLUUID &transfer_id);
+	LLTransferTarget(
+		LLTransferTargetType target_type,
+		const LLUUID& transfer_id,
+		LLTransferSourceType source_type);
 	virtual ~LLTransferTarget();
 
-
 	// Accessors
 	LLUUID					getID() const			{ return mID; }
 	LLTransferTargetType	getType() const			{ return mType; }
 	LLTransferTargetChannel *getChannel() const		{ return mChannelp; }
+	LLTransferSourceType getSourceType() const { return mSourceType; }
+
+	// Static functionality
+	static LLTransferTarget* createTarget(
+		LLTransferTargetType target_type,
+		const LLUUID& request_id,
+		LLTransferSourceType source_type);
 
+	// friends
 	friend class LLTransferManager;
 	friend class LLTransferTargetChannel;
 
-	static LLTransferTarget *createTarget(const LLTransferTargetType type,
-										  const LLUUID &request_id);
 protected:
-	virtual void			applyParams(const LLTransferTargetParams &params) = 0;
+	// Implementation
+	virtual bool unpackParams(LLDataPacker& dp) = 0;
+	virtual void applyParams(const LLTransferTargetParams &params) = 0;
 	virtual LLTSCode		dataCallback(const S32 packet_id, U8 *in_datap, const S32 in_size) = 0;
 
 	// The completionCallback is GUARANTEED to be called before the destructor, so all handling
@@ -383,13 +394,18 @@ protected:
 	void					setGotInfo(const BOOL got_info)			{ mGotInfo = got_info; }
 	BOOL					gotInfo() const							{ return mGotInfo; }
 
-	void addDelayedPacket(const S32 packet_id, const LLTSCode status, U8 *datap, const S32 size);
+	bool addDelayedPacket(
+		const S32 packet_id,
+		const LLTSCode status,
+		U8* datap,
+		const S32 size);
 
 protected:
 	typedef std::map<S32, LLTransferPacket *> transfer_packet_map;
 	typedef std::map<S32, LLTransferPacket *>::iterator tpm_iter;
 
 	LLTransferTargetType	mType;
+	LLTransferSourceType mSourceType;
 	LLUUID					mID;
 	LLTransferTargetChannel *mChannelp;
 	BOOL					mGotInfo;
diff --git a/indra/llmessage/lltransfersourceasset.cpp b/indra/llmessage/lltransfersourceasset.cpp
index f7c6711bd0..635b7cffaf 100644
--- a/indra/llmessage/lltransfersourceasset.cpp
+++ b/indra/llmessage/lltransfersourceasset.cpp
@@ -35,16 +35,9 @@ void LLTransferSourceAsset::initTransfer()
 		// *HACK: asset transfers will only be coming from the viewer
 		// to the simulator. This is subset of assets we allow to be
 		// simply pulled straight from the asset system.
-		// *FIX: Make this list smaller.
 		LLUUID* tidp;
-		switch(mParams.getAssetType())
+		if(is_asset_fetch_by_id_allowed(mParams.getAssetType()))
 		{
-		case LLAssetType::AT_SOUND:
-		case LLAssetType::AT_LANDMARK:
-		case LLAssetType::AT_CLOTHING:
-		case LLAssetType::AT_BODYPART:
-		case LLAssetType::AT_GESTURE:
-		case LLAssetType::AT_ANIMATION:
 			tidp = new LLUUID(getID());
 			gAssetStorage->getAssetData(
 				mParams.getAssetID(),
@@ -52,20 +45,20 @@ void LLTransferSourceAsset::initTransfer()
 				LLTransferSourceAsset::responderCallback,
 				tidp,
 				FALSE);
-			break;
-		default:
-		llwarns << "Attempted to request blocked asset "
-			<< mParams.getAssetID() << ":"
-			<< LLAssetType::lookupHumanReadable(mParams.getAssetType())
-			<< llendl;
+		}
+		else
+		{
+			llwarns << "Attempted to request blocked asset "
+				<< mParams.getAssetID() << ":"
+				<< LLAssetType::lookupHumanReadable(mParams.getAssetType())
+				<< llendl;
 			sendTransferStatus(LLTS_ERROR);
-			break;
 		}
 	}
 	else
 	{
-		llwarns << "Attempted to request asset "
-			<< mParams.getAssetID() << ":" << LLAssetType::lookupHumanReadable(mParams.getAssetType())
+		llwarns << "Attempted to request asset " << mParams.getAssetID()
+			<< ":" << LLAssetType::lookupHumanReadable(mParams.getAssetType())
 			<< " without an asset system!" << llendl;
 		sendTransferStatus(LLTS_ERROR);
 	}
@@ -147,10 +140,15 @@ void LLTransferSourceAsset::completionCallback(const LLTSCode status)
 	// we've got it open.
 }
 
+void LLTransferSourceAsset::packParams(LLDataPacker& dp) const
+{
+	//llinfos << "LLTransferSourceAsset::packParams" << llendl;
+	mParams.packParams(dp);
+}
+
 BOOL LLTransferSourceAsset::unpackParams(LLDataPacker &dp)
 {
 	//llinfos << "LLTransferSourceAsset::unpackParams" << llendl;
-
 	return mParams.unpackParams(dp);
 }
 
@@ -233,3 +231,47 @@ BOOL LLTransferSourceParamsAsset::unpackParams(LLDataPacker &dp)
 	return TRUE;
 }
 
+/**
+ * Helper functions
+ */
+bool is_asset_fetch_by_id_allowed(LLAssetType::EType type)
+{
+	// *FIX: Make this list smaller.
+	bool rv = false;
+	switch(type)
+	{
+	case LLAssetType::AT_SOUND:
+	case LLAssetType::AT_LANDMARK:
+	case LLAssetType::AT_CLOTHING:
+	case LLAssetType::AT_BODYPART:
+	case LLAssetType::AT_ANIMATION:
+	case LLAssetType::AT_GESTURE:
+		rv = true;
+		break;
+	default:
+		break;
+	}
+	return rv;
+}
+
+bool is_asset_id_knowable(LLAssetType::EType type)
+{
+	// *FIX: Make this list smaller.
+	bool rv = false;
+	switch(type)
+	{
+	case LLAssetType::AT_TEXTURE:
+	case LLAssetType::AT_SOUND:
+	case LLAssetType::AT_LANDMARK:
+	case LLAssetType::AT_CLOTHING:
+	case LLAssetType::AT_NOTECARD:
+	case LLAssetType::AT_BODYPART:
+	case LLAssetType::AT_ANIMATION:
+	case LLAssetType::AT_GESTURE:
+		rv = true;
+		break;
+	default:
+		break;
+	}
+	return rv;
+}
diff --git a/indra/llmessage/lltransfersourceasset.h b/indra/llmessage/lltransfersourceasset.h
index 931fc461f9..446c9622b2 100644
--- a/indra/llmessage/lltransfersourceasset.h
+++ b/indra/llmessage/lltransfersourceasset.h
@@ -50,6 +50,7 @@ protected:
 									  BOOL &delete_returned);
 	/*virtual*/ void completionCallback(const LLTSCode status);
 
+	virtual void packParams(LLDataPacker& dp) const;
 	/*virtual*/ BOOL unpackParams(LLDataPacker &dp);
 
 protected:
@@ -59,4 +60,24 @@ protected:
 	S32 mCurPos;
 };
 
+/**
+ * @brief Quick check to see if the asset allows direct download.
+ *
+ * This might not be the right place for this function call, but it
+ * originally started life inside the LLTransferSourceAsset code.
+ * @param type The type of asset.
+ * @return Returns true if the asset can be fetched by id.
+ */
+bool is_asset_fetch_by_id_allowed(LLAssetType::EType type);
+
+/**
+ * @brief Quick check to see if all asset data can be known by the viewer.
+ *
+ * This might not be the right place for this function call, but it
+ * originally started life inside the LLTransferSourceAsset code.
+ * @param type The type of asset.
+ * @return Returns true if the asset id can be transmitted to the viewer.
+ */
+bool is_asset_id_knowable(LLAssetType::EType type);
+
 #endif // LL_LLTRANSFERSOURCEASSET_H
diff --git a/indra/llmessage/lltransfersourcefile.cpp b/indra/llmessage/lltransfersourcefile.cpp
index 45b03d7653..c1df0f25aa 100644
--- a/indra/llmessage/lltransfersourcefile.cpp
+++ b/indra/llmessage/lltransfersourcefile.cpp
@@ -117,10 +117,15 @@ void LLTransferSourceFile::completionCallback(const LLTSCode status)
 	}
 }
 
+void LLTransferSourceFile::packParams(LLDataPacker& dp) const
+{
+	//llinfos << "LLTransferSourceFile::packParams" << llendl;
+	mParams.packParams(dp);
+}
+
 BOOL LLTransferSourceFile::unpackParams(LLDataPacker &dp)
 {
 	//llinfos << "LLTransferSourceFile::unpackParams" << llendl;
-
 	return mParams.unpackParams(dp);
 }
 
diff --git a/indra/llmessage/lltransfersourcefile.h b/indra/llmessage/lltransfersourcefile.h
index ecaa6c908a..fcb5743fb5 100644
--- a/indra/llmessage/lltransfersourcefile.h
+++ b/indra/llmessage/lltransfersourcefile.h
@@ -48,6 +48,7 @@ protected:
 									  BOOL &delete_returned);
 	/*virtual*/ void completionCallback(const LLTSCode status);
 
+	virtual void packParams(LLDataPacker& dp) const;
 	/*virtual*/ BOOL unpackParams(LLDataPacker &dp);
 
 protected:
diff --git a/indra/llmessage/lltransfertargetfile.cpp b/indra/llmessage/lltransfertargetfile.cpp
index 92776e081d..57ce069128 100644
--- a/indra/llmessage/lltransfertargetfile.cpp
+++ b/indra/llmessage/lltransfertargetfile.cpp
@@ -14,8 +14,10 @@
 
 
 
-LLTransferTargetFile::LLTransferTargetFile(const LLUUID &uuid) :
-	LLTransferTarget(LLTTT_FILE, uuid),
+LLTransferTargetFile::LLTransferTargetFile(
+	const LLUUID& uuid,
+	LLTransferSourceType src_type) :
+	LLTransferTarget(LLTTT_FILE, uuid, src_type),
 	mFP(NULL)
 {
 }
@@ -30,6 +32,13 @@ LLTransferTargetFile::~LLTransferTargetFile()
 	}
 }
 
+// virtual
+bool LLTransferTargetFile::unpackParams(LLDataPacker& dp)
+{
+	// we can safely ignore this call
+	return true;
+}
+
 void LLTransferTargetFile::applyParams(const LLTransferTargetParams &params)
 {
 	if (params.getType() != mType)
diff --git a/indra/llmessage/lltransfertargetfile.h b/indra/llmessage/lltransfertargetfile.h
index 63cc21262b..eb000e527e 100644
--- a/indra/llmessage/lltransfertargetfile.h
+++ b/indra/llmessage/lltransfertargetfile.h
@@ -33,7 +33,7 @@ protected:
 class LLTransferTargetFile : public LLTransferTarget
 {
 public:
-	LLTransferTargetFile(const LLUUID &uuid);
+	LLTransferTargetFile(const LLUUID& uuid, LLTransferSourceType src_type);
 	virtual ~LLTransferTargetFile();
 
 	static void requestTransfer(LLTransferTargetChannel *channelp,
@@ -41,6 +41,7 @@ public:
 								const LLTransferSourceParams &source_params,
 								LLTTFCompleteCallback callback);
 protected:
+	virtual bool unpackParams(LLDataPacker& dp);
 	/*virtual*/ void applyParams(const LLTransferTargetParams &params);
 	/*virtual*/ LLTSCode dataCallback(const S32 packet_id, U8 *in_datap, const S32 in_size);
 	/*virtual*/ void completionCallback(const LLTSCode status);
diff --git a/indra/llmessage/lltransfertargetvfile.cpp b/indra/llmessage/lltransfertargetvfile.cpp
index 9e323537d7..b8c138886a 100644
--- a/indra/llmessage/lltransfertargetvfile.cpp
+++ b/indra/llmessage/lltransfertargetvfile.cpp
@@ -9,8 +9,9 @@
 #include "linden_common.h"
 
 #include "lltransfertargetvfile.h"
-#include "llerror.h"
 
+#include "lldatapacker.h"
+#include "llerror.h"
 #include "llvfile.h"
 
 //static
@@ -27,7 +28,11 @@ void LLTransferTargetVFile::updateQueue(bool shutdown)
 		LLVFSThread::status_t s = LLVFile::getVFSThread()->getRequestStatus(params->mHandle);
 		if (s == LLVFSThread::STATUS_COMPLETE || s == LLVFSThread::STATUS_EXPIRED)
 		{
-			params->mCompleteCallback(params->mErrCode, params->mUserDatap);
+			params->mCompleteCallback(
+				params->mErrCode,
+				params->getAssetID(),
+				params->getAssetType(),
+				params->mUserDatap);
 			delete params;
 			iter = sCallbackQueue.erase(curiter);
 		}
@@ -50,7 +55,9 @@ LLTransferTargetParamsVFile::LLTransferTargetParamsVFile() :
 {
 }
 
-void LLTransferTargetParamsVFile::setAsset(const LLUUID &asset_id, const LLAssetType::EType asset_type)
+void LLTransferTargetParamsVFile::setAsset(
+	const LLUUID& asset_id,
+	LLAssetType::EType asset_type)
 {
 	mAssetID = asset_id;
 	mAssetType = asset_type;
@@ -62,9 +69,35 @@ void LLTransferTargetParamsVFile::setCallback(LLTTVFCompleteCallback cb, void *u
 	mUserDatap = user_data;
 }
 
+bool LLTransferTargetParamsVFile::unpackParams(LLDataPacker& dp)
+{
+	// if the source provided a new key, assign that to the asset id.
+	if(dp.hasNext())
+	{
+		LLUUID dummy_id;
+		dp.unpackUUID(dummy_id, "AgentID");
+		dp.unpackUUID(dummy_id, "SessionID");
+		dp.unpackUUID(dummy_id, "OwnerID");
+		dp.unpackUUID(dummy_id, "TaskID");
+		dp.unpackUUID(dummy_id, "ItemID");
+		dp.unpackUUID(mAssetID, "AssetID");
+		S32 dummy_type;
+		dp.unpackS32(dummy_type, "AssetType");
+	}
 
-LLTransferTargetVFile::LLTransferTargetVFile(const LLUUID &uuid) :
-	LLTransferTarget(LLTTT_VFILE, uuid),
+	// if we never got an asset id, this will always fail.
+	if(mAssetID.isNull())
+	{
+		return false;
+	}
+	return true;
+}
+
+
+LLTransferTargetVFile::LLTransferTargetVFile(
+	const LLUUID& uuid,
+	LLTransferSourceType src_type) :
+	LLTransferTarget(LLTTT_VFILE, uuid, src_type),
 	mNeedsCreate(TRUE)
 {
 	mTempID.generate();
@@ -76,6 +109,16 @@ LLTransferTargetVFile::~LLTransferTargetVFile()
 }
 
 
+// virtual
+bool LLTransferTargetVFile::unpackParams(LLDataPacker& dp)
+{
+	if(LLTST_SIM_INV_ITEM == mSourceType)
+	{
+		return mParams.unpackParams(dp);
+	}
+	return true;
+}
+
 void LLTransferTargetVFile::applyParams(const LLTransferTargetParams &params)
 {
 	if (params.getType() != mType)
@@ -132,13 +175,17 @@ void LLTransferTargetVFile::completionCallback(const LLTSCode status)
 	  case LLTS_DONE:
 		if (!mNeedsCreate)
 		{
-			handle = LLVFile::getVFSThread()->rename(gAssetStorage->mVFS,
-													 mTempID, mParams.getAssetType(),
-													 mParams.getAssetID(), mParams.getAssetType(),
-													 LLVFSThread::AUTO_DELETE);
+			handle = LLVFile::getVFSThread()->rename(
+				gAssetStorage->mVFS,
+				mTempID, mParams.getAssetType(),
+				mParams.getAssetID(), mParams.getAssetType(),
+				LLVFSThread::AUTO_DELETE);
 		}
 		err_code = LL_ERR_NOERR;
-		// 		llinfos << "Successful vfile transfer for " << mParams.getAssetID() << llendl;
+		lldebugs << "LLTransferTargetVFile::completionCallback for "
+			 << mParams.getAssetID() << ","
+			 << LLAssetType::lookup(mParams.getAssetType())
+			 << " with temp id " << mTempID << llendl;
 		break;
 	  case LLTS_ERROR:
 	  case LLTS_ABORT:
@@ -181,7 +228,11 @@ void LLTransferTargetVFile::completionCallback(const LLTSCode status)
 		}
 		else
 		{
-			mParams.mCompleteCallback(err_code, mParams.mUserDatap);
+			mParams.mCompleteCallback(
+				err_code,
+				mParams.getAssetID(),
+				mParams.getAssetType(),
+				mParams.mUserDatap);
 		}
 	}
 }
diff --git a/indra/llmessage/lltransfertargetvfile.h b/indra/llmessage/lltransfertargetvfile.h
index 7614021179..57eaeca378 100644
--- a/indra/llmessage/lltransfertargetvfile.h
+++ b/indra/llmessage/lltransfertargetvfile.h
@@ -17,26 +17,32 @@ class LLVFile;
 
 // Lame, an S32 for now until I figure out the deal with how we want to do
 // error codes.
-typedef void (*LLTTVFCompleteCallback)(const S32 status, void *user_data);
+typedef void (*LLTTVFCompleteCallback)(
+	S32 status,
+	const LLUUID& file_id,
+	LLAssetType::EType file_type,
+	void* user_data);
 
 class LLTransferTargetParamsVFile : public LLTransferTargetParams
 {
 public:
 	LLTransferTargetParamsVFile();
-	
-	void setAsset(const LLUUID &asset_id, const LLAssetType::EType asset_type);
-	void setCallback(LLTTVFCompleteCallback cb, void *user_data);
+
+	void setAsset(const LLUUID& asset_id, LLAssetType::EType asset_type);
+	void setCallback(LLTTVFCompleteCallback cb, void* user_data);
 
 	LLUUID getAssetID() const						{ return mAssetID; }
 	LLAssetType::EType getAssetType() const			{ return mAssetType; }
 
 	friend class LLTransferTargetVFile;
 protected:
+	bool unpackParams(LLDataPacker& dp);
+
 	LLUUID				mAssetID;
 	LLAssetType::EType	mAssetType;
 
 	LLTTVFCompleteCallback	mCompleteCallback;
-	void *					mUserDatap;
+	void*					mUserDatap;
 	S32						mErrCode;
 	LLVFSThread::handle_t	mHandle;
 };
@@ -45,18 +51,20 @@ protected:
 class LLTransferTargetVFile : public LLTransferTarget
 {
 public:
-	LLTransferTargetVFile(const LLUUID &uuid);
+	LLTransferTargetVFile(const LLUUID& uuid, LLTransferSourceType src_type);
 	virtual ~LLTransferTargetVFile();
 
-	static void requestTransfer(LLTransferTargetChannel *channelp,
-								const char *local_filename,
-								const LLTransferSourceParams &source_params,
-								LLTTVFCompleteCallback callback);
+	//static void requestTransfer(LLTransferTargetChannel* channelp,
+	//							const char* local_filename,
+	//							const LLTransferSourceParams& source_params,
+	//							LLTTVFCompleteCallback callback);
+
 	static void updateQueue(bool shutdown = false);
 	
 protected:
-	/*virtual*/ void applyParams(const LLTransferTargetParams &params);
-	/*virtual*/ LLTSCode dataCallback(const S32 packet_id, U8 *in_datap, const S32 in_size);
+	virtual bool unpackParams(LLDataPacker& dp);
+	/*virtual*/ void applyParams(const LLTransferTargetParams& params);
+	/*virtual*/ LLTSCode dataCallback(const S32 packet_id, U8* in_datap, const S32 in_size);
 	/*virtual*/ void completionCallback(const LLTSCode status);
 
 	LLTransferTargetParamsVFile mParams;
diff --git a/indra/llmessage/message.cpp b/indra/llmessage/message.cpp
index 99cfc7439b..73cda52fa0 100644
--- a/indra/llmessage/message.cpp
+++ b/indra/llmessage/message.cpp
@@ -4451,7 +4451,13 @@ void process_create_trusted_circuit(LLMessageSystem *msg, void **)
 	}
 
 	char their_digest[MD5HEX_STR_SIZE];
-	msg->getBinaryDataFast(_PREHASH_DataBlock, _PREHASH_Digest, their_digest, 32);
+	S32 size = msg->getSizeFast(_PREHASH_DataBlock, _PREHASH_Digest);
+	if(size != MD5HEX_STR_BYTES)
+	{
+		// ignore requests which pack the wrong amount of data.
+		return;
+	}
+	msg->getBinaryDataFast(_PREHASH_DataBlock, _PREHASH_Digest, their_digest, MD5HEX_STR_BYTES);
 	their_digest[MD5HEX_STR_SIZE - 1] = '\0';
 	if(msg->isMatchingDigestForWindowAndUUIDs(their_digest, TRUST_TIME_WINDOW, local_id, remote_id))
 	{