https://gitlab.synchro.net/main/sbbs/-/commit/87e5d349ce31d2419bea793e
Modified Files:
docs/v322_new.md src/sbbs3/js_user.cpp userdat.c
Log Message:
GUEST ARS keyword and user.is_guest now match a not-logged-in user
user_is_guest() returns true for user number 0 as well as for an account
with the 'G' restriction. A NULL user (no user context, e.g. jsexec)
is still not a guest.
An unauthenticated web server request is evaluated as user number 0,
which has no restrictions, so an access requirement of "NOT GUEST" on a
file library or directory was satisfied without a login: the directory
was listed and served under the web file vpath (e.g. /files/) and no
HTTP authentication was requested. Such a request now fails "NOT GUEST"
and gets a 401.
Co-Authored-By: Claude Fable 5.2 <
noreply@anthropic.com>
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net