- Sep 04, 2003
- Sep 03, 2003
-
-
runderwo authored
Fix stupid paren error.
-
rswindell authored
if the length (after stripping invalid chars) is greater than LEN_CODE (8).
-
rswindell authored
codes, then truncates to valid length (8 chars) - use maximum number of chars for increased uniqueness.
-
rswindell authored
imported internal codes by stripping illegal filename chars.
-
runderwo authored
Cleanups; replace access() with fexist() and fix erroneous comparisons.
-
rswindell authored
a few for loops. Requires cvs update in src/xpdev directory.
-
rswindell authored
of FIND/SKIP char/charset macros (for parsing ASCIIZ char* lines).
-
runderwo authored
Changed 'disclaimer' handling to use ftouch() instead.
-
- Sep 02, 2003
-
-
deuce authored
-
deuce authored
-
deuce authored
-
deuce authored
to track down the issue, I finally gave up... as a result, there is a new feature! Linux will no longer completely drop it's root privs (It never really did anyways, and you couldn't possibly make it... but now it does so even less) As a result, Linux can now recycle all servers when running as non-root. From a security standpoint, doing this is more secure than running as root, but less secure than the behaviour on POSIX.4 compliant pthreads. Running the BBS as root means that if a user can create a file with the name of his choice, or pass *any* command through to a shell, that user will get root access to the machine. Using the new behaviour, the user would need to trick the Synchronet binary itself into executing arbitrary and specially crafted code... probobly using the dreaded buffer overflow... of which there are probobly some in the web server code. :-) If the user can do this much more tricky feat, then the user gets root privs. If not, the user will have to find something else to exploit on your system. Knowing that some *BSD users (surely not OpenBSD users though) will want to trade security for convenience, I stole a page out of the Sendmail book and implemented a "DONT_BLAME_SYNCHRONET" make option. Compiling like this: gmake DONT_BLAME_SYNCHRONET=1 Will implement this same behaviour on non-Linux platforms. Allowing this partial security feature.
-
- Aug 30, 2003
-
-
rswindell authored
used.
-
rswindell authored
-
rswindell authored
-
rswindell authored
-
rswindell authored
(doesn't yet work for routing to uplinks).
-
rswindell authored
file (msgdate) so that modules that use date_str.c will not require smblib too.
-
rswindell authored
-
rswindell authored
it would always update the message at index offset 0, thus not correctly marking the sent message as deleted and sending dupes later. This also led to mild mail database corruption (duplicate message numbers and index header offsets).
-
rswindell authored
if the message header is going to be later written to disk.
-
deuce authored
builds to link in the pth lib.
-
rswindell authored
Requires USE_DOSEMU to be predefined.
-
- Aug 29, 2003
- Aug 28, 2003
-
-
rswindell authored
the '+' char (e.g. +0700). Fix for rfc822date(): now correctly parses (theoretical) negative timezone offsets that have a non-zero minutes field (e.g. -0430). Fix for msgdate(): all RFC822 timezones are now represented in numeric offset format (per RFC1123).
-
rswindell authored
by static services to manually manipulate the client table. The add/remove methods automatically adjust the active client counter.
-
rswindell authored
do nothing (don't add the client).
-
rswindell authored
counter directly.
-
rswindell authored
-
rswindell authored
and PREFIX can be defined as a null string now (for /etc/).
-
rswindell authored
server/service.
-