despite them being manditory in the SSHv2 spec.

Version 1.04: Internal change only (no change in behavior for the user) - Updated the way AddAdditionalQuitKeys() is called in the DDLightbarMenu objects, due to the change in dd_lightbar_menu.js

AddAdditionalSelectItemKeys() now takes a string specifying additional keys rather than an array of strings.  For instance, if you want both lowercase 'e' and uppercase 'E' to allow selecting an item, the call would look like this (assuming lbMenu is the menu object):
lbMenu.AddAdditionalSelectItemKeys("eE");

Also, changed AddAdditionalQuitKeys() to work the same way.

Note: If you are using SlyVote, you will need to also update SlyVote, since SlyVote has also been updated to call AddAdditionalQuitKeys() this way.

New function: AddAdditionalSelectItemKeys(), which adds additional keys that can be used to select any item (in addition to Enter).  This function takes an array, and the keys are case-sensitive.  For example, to add the key E to select any item (assuming the menu object is lbMenu):
lbMenu.AddAdditionalSelectItemKeys(["E"]);
To make a case-insensitive verison, both the uppercase and lowercase letter would need to be added, as in the following example for E:
lbMenu.AddAdditionalSelectItemKeys(["E", "e"]);

Also, after showing the menu & getting a value from the user (using the GetVal() function), the lastUserInput property will have the user's last keypress.

base.put_msg_header(). I just happened to notice this while making the last
fix committed. I'm guessing this particular code path hasn't been tested (?)

disabled since the header may later be written back to disk. Should fix
error reported by Ragnarok (DOCKSUD):
imapservice.js line 1763: Error: Message header has 'expanded fields'

As reported by Ragnarok (DOCKSUD)

(said port 0) since the port had not been bound yet.
So fix the display order of that msg (after listen() is called)
and lower the log level to debug.

sbbs have their capabilities set correctly with this setup.

This fixes the error seen on old browsers using
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA after a DHE GCM fallure.

Thanks for all your help wkitty42!

We don't need PCI DSS compliance I hope, we just want people doing things.

Unbreak it.
While we're here, prefer ECDH so we get an 'A' from ssllabs.

only (you can still use them from JS etc).

they're enabled even if there is no usable oracle (ie: ssllabs.com).

This is easier than explaining to everyone who worries about it.  Hopefully
there's nothing left that requires TLS_RSA suites from the client.

Areafix requests to unlink a node from an area would corrupt the list of
linked nodes: the *last* listed node would always be removed. If this was
not the node that submitted the areafix request, then 2 nodes would be
removed from the list of linked-nodes for an echo.
To simplify this, we're just going to not write the removed node back to
the area file, but leave it in the in-memory list. So technically, the node
won't be unlinked until the next run of SBBSecho when the area file is
re-parsed. If that's a problem, we can always add run-time removal from
the in-memory list later. Reported by Alterego (ALTERANT).

specified on the command-line (-n option). This also would have fixed
Nelgin's issue with this script.

to and from extension header fields were being set (for the mail base) even
when the to or from name was not a valid local user name (thus an extension
value of "0" was being stored in the header) - causing netmail imported with
postmsg.js to never get exported.

*.msg).

Reported by Belthesar... a real JSDoor user who was not paid to be in this commercial.

finger service at vert.synchro.net), report that error instead of
TypeError: finger_result.join is not a function
(reported by Nelgin)

non-deleted and active user records.
Renamed the old "User List" menu option: "List All User Records"
The online help probably needs fixing now: TODO

Also warn if the default "My Brand-new BBS" is still set.

SBBSCTRL env var isn't set (defualts to "/sbbs/ctrl" instead, like the other
utils).

This allows redirect targets from paths that don't exist.  Required to
implement hard-coded API endpoints via ssjs.

not set (or blank), use the default ("/sbbs/ctrl") and print a warning to
stderr. This resolves a FAQ for sysops that struggle with setting the SBBSCTRL
env var, but do have sbbs install in /sbbs or a symlink from /sbbs to where
sbbs is actually installed.

Note: this function is different than the one previously defined in getctrl.c
but never used. If/when we ever really need to support PREFIX, then perhaps
we'll use that one (which copies a string to a buffer).

-r    = display raw message body text (not MIME-decoded)

 replace the recursive binary-search scanDictionary method with a linear search function to avoid infinite recursion