From ea3ed4f319a6da68366b6c50c70ef526a84d32b7 Mon Sep 17 00:00:00 2001
From: Daniel Shiposha <dshiposha@usetech.com>
Date: Wed, 07 Dec 2022 10:57:38 +0000
Subject: [PATCH] fix: deny zero NFT transfer/burn if not owned/allowed


---
--- a/pallets/nonfungible/src/common.rs
+++ b/pallets/nonfungible/src/common.rs
@@ -291,6 +291,7 @@
 				<CommonWeights<T>>::burn_item(),
 			)
 		} else {
+			<Pallet<T>>::check_token_immediate_ownership(self, token, &sender)?;
 			Ok(().into())
 		}
 	}
@@ -320,6 +321,7 @@
 				<CommonWeights<T>>::transfer(),
 			)
 		} else {
+			<Pallet<T>>::check_token_immediate_ownership(self, token, &from)?;
 			Ok(().into())
 		}
 	}
@@ -360,6 +362,8 @@
 				<CommonWeights<T>>::transfer_from(),
 			)
 		} else {
+			<Pallet<T>>::check_allowed(self, &sender, &from, token, nesting_budget)?;
+
 			Ok(().into())
 		}
 	}
@@ -380,6 +384,8 @@
 				<CommonWeights<T>>::burn_from(),
 			)
 		} else {
+			<Pallet<T>>::check_allowed(self, &sender, &from, token, nesting_budget)?;
+
 			Ok(().into())
 		}
 	}
--- a/pallets/nonfungible/src/lib.rs
+++ b/pallets/nonfungible/src/lib.rs
@@ -814,6 +814,20 @@
 		<PalletCommon<T>>::set_property_permission(collection, sender, permission)
 	}
 
+	pub fn check_token_immediate_ownership(
+		collection: &NonfungibleHandle<T>,
+		token: TokenId,
+		possible_owner: &T::CrossAccountId,
+	) -> DispatchResult {
+		let token_data =
+			<TokenData<T>>::get((collection.id, token)).ok_or(<CommonError<T>>::TokenNotFound)?;
+		ensure!(
+			&token_data.owner == possible_owner,
+			<CommonError<T>>::NoPermission
+		);
+		Ok(())
+	}
+
 	/// Transfer NFT token from one account to another.
 	///
 	/// `from` account stops being the owner and `to` account becomes the owner of the token.

-- 
gitstuff