Added 'c' command to show connected clients.

unique application-defined searchable identifier without requring the node
data (or pointer) comparisons. If anyone uses the listAdd* functions,
they'll need to add the additional tag parameter (this ain't C++).
Added support for primitive non-thread-safe list locking and an "isLocked"
query function.

Added menu item for editing modopts.ini.

The attempt list can be view with sbbscon->'a' command or sbbsctrl->view->Login
Attempt List...
Delay/throttle/hacklog/and auto-filter values/thresholds are now configurable
in sbbs.ini.

js.gc_counter, js.gc_last_bytes, js.bytes, and js.max_bytes
Since these properties rely on internal JS context structure offsets, they're
not always compatible with replaced (upgraded or downgraded) JS library
(shared object or DLL) and can cause crashes in some cases. They can be
useful in some debugging cases, so I'm leaving them in the debug build, but
use with caution.

value of js.auto_terminate (e.g. the irc.js could not restore the original
value, thus re-enabling auto-terminate upon exit of the IRC client).

recent), and automatically filter IPs of obvious hackers
(100 consecutive unique failed login attempts).

from the same host (but not necessarily the same connection).
No login retry is allowed for suspected hackers (one authentication attempt per
connection).
New-connections from suspected hack hosts are now delayed increasingly with
the number of failed login attempts.

from the same host (but not necessarily the same connection).
No login retry is allowed for suspected hackers (one authentication attempt per
connection).
Other FTP hack.log entries contain a little more detail about the type of
suspected hack attempt (e.g. "FTP BOUNCE").

JSexec confirm function now prompts user and return value is based on their
response.

especially through SMTP (where these values are exposed via the Originator-info
header field): SENDERUSERID, SENDERSERVER, and SERVERTIME.

especially through SMTP (where these values are exposed via the Originator-info
header field): SENDERUSERID, SENDERSERVER, and SERVERTIME.

Added the "Originator-info" header field for transmitted messages which will
help track the original submission, especially when submitted via protocols
other than SMTP.
The RECIPIENT/To header field for SMTP-submitted msgs now contains the
parsed "To:" name, if possible (instead of the address).
Added security delay to failed SMTP AUTH-MD5 logins.

telnet_gate() now enables the telnet command pass-through after negotiating
necessary options. This doesn't quite fix the problem reported with telgating
to nethack.alt.org, but it's a step in the right direction.

I/O" option to "Standard" for external online progarms (doors).
External editor "Intercept I/O" option display "Standard" instead of "Yes".

not known.

optional rejection message file (text/badpassword.msg) - this file is where the
sysop should add common/obvious passwords like "password".

- added 5 second delay before responding to POP or SMTP
  client regarding invalid username or password attempt (limit number of
  effective brute force hack attempts per minute).
-  increment the user email sent statistics for authenticated SMTP msg recvs
- check the configured max emails per day value (for the user's security level)
  and reject any messages that would exceed this value (exept for 'M'-exempt
  users) - this has been on the todo list for a long time.

unlimited number of emails per day.

but run with a different version of libjs.so.

the RCPT TO user), before checking for the "sub:code" recipient. This allows
SMTP posts (e.g. using the "sub:code" syntax in the ctrl/alias.cfg file) to be
processed by external mail processors before being posted (e.g. to strip HTML).

place (e.g. the file was probably already uploaded to disk).

of configured upload requirements) and exceed the "max files" settings per dir.
Also, directory operators now always have upload permissions.