Also check user authorization if looking to upgrade from a child to a root agent.

Relevant if a child agent has been allowed into the region which should not be upgraded to a root agent.

OpenSim/Region/Framework/Scenes/Scene.cs

@@ -3824,7 +3824,7 @@ namespace OpenSim.Region.Framework.Scenes
     
                     try
                     {
-                        if (!AuthorizeUser(acd, SeeIntoRegion, out reason))
+                        if (!AuthorizeUser(acd, (vialogin ? false : SeeIntoRegion), out reason))
                         {
                             m_authenticateHandler.RemoveCircuit(acd.circuitcode);
                             return false;
@@ -3855,6 +3855,19 @@ namespace OpenSim.Region.Framework.Scenes
                     // Let the SP know how we got here. This has a lot of interesting
                     // uses down the line.
                     sp.TeleportFlags = (TPFlags)teleportFlags;
+
+                    // We must carry out a further authorization check if there's an 
+                    // attempt to make a child agent into a root agent, since SeeIntoRegion may have allowed a child
+                    // agent to login to a region where a full avatar would not be allowed.
+                    //
+                    // We determine whether this is a CreateAgent for a future non-child agent by inspecting 
+                    // TeleportFlags, which will be default for a child connection.  This relies on input from the source
+                    // region.
+                    if (sp.TeleportFlags != TPFlags.Default)
+                    {
+                        if (!AuthorizeUser(acd, false, out reason))
+                            return false;
+                    }
     
                     if (sp.IsChildAgent)
                     {
@@ -5739,9 +5752,13 @@ namespace OpenSim.Region.Framework.Scenes
 
             try
             {
-                if (!AuthorizeUser(aCircuit, false, out reason))
+                // If this is a hypergrid user, then we can't perform a successful groups access check here since this
+                // currently relies on a circuit being present in the AuthenticateHandler to construct a Hypergrid ID.
+                // This is only present in NewUserConnection() which entity transfer calls very soon after QueryAccess().
+                // Therefore, we'll defer to the check in NewUserConnection() instead.
+                if (!AuthorizeUser(aCircuit, !UserManagementModule.IsLocalGridUser(agentID), out reason))
                 {
-                    // m_log.DebugFormat("[SCENE]: Denying access for {0}", agentID);
+                    //m_log.DebugFormat("[SCENE]: Denying access for {0}", agentID);
                     return false;
                 }
             }