This is really just an optimization (I think), so we don't call time() for every parse/getuserdat() call, but only when the user has a non-zero daily reset field.
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net
From Rob Swindell (on Windows 11)@VERT to Git commit to main/sbbs/master on Mon Aug 11 15:51:59 2025
I suspect this function has been failing on Vertrauen under heavy (Guest login/out) load, but there was no actual error reporting from this function which opens, locks, read and writes the user.tab file 4 times (!) for every user logout.
Ideally:
- this function would return more error details than simply success/failure
- this function would only open/lock/read/write the user.tab file only once
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net
From Rob Swindell (on Windows 11)@VERT to Git commit to main/sbbs/master on Wed Dec 17 19:09:19 2025
Bug introduced in commit 8deac23222b3a3db (copy/paste/typo)
Caught during manual code review.
When a user has any amount of free credits, but the amount being subtracted
was greater than their free credits available, the underflow was supposed to
be deducted from their regular credits. Instead, the underflow was (attempted) to be deducted from their free credits, which were alreay zeroed.
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net
From Rob Swindell (on Windows 11)@VERT to Git commit to main/sbbs/master on Sat Dec 20 04:34:42 2025
- detect/reject strings with control characters
- detect/reject strings with non-ASCII character
(when configured to do so by the sysop)
Since the newuser.cpp already disallows this illegal input for new user values this likely only really makes a difference for any JS code that uses system.check_name() or system.check_realname() which is probably none.
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net
From Rob Swindell (on Windows 11)@VERT to Git commit to main/sbbs/master on Sat Dec 20 04:34:42 2025
The name of the external program was pulled from the user record which in this case would always be the last program executed by (any) Guest. Instead, use
the (slightly more ambiguous) node.aux field for external program being executed by Guest users or upon any failure to read the user record.
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net
From Rob Swindell (on Windows 11)@VERT to Git commit to main/sbbs/master on Wed Mar 11 00:14:47 2026
When the xtrn prog code is valid, we include the program's full name in the status string and don't need the "external program" designation that was added in commit cc4fea1c6fd.
Thanks to xbit for pointing out in IRC.
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net
From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Wed May 6 19:41:53 2026
The link_list_t mutex is explicitly documented as recursive
(link_list.h:99) Ä internal listCountNodes/listFreeNodes/listRemoveNode/ listPushNodeData calls re-acquire it safely. Coverity doesn't trace the recursive flag, so it flags every "outer-locked listX call" as a
potential deadlock. Annotate each call site with a SUPPRESS plus a
pointer to the documented invariant.
CID 631145 (SLEEP-while-locked in loginBanned) was already mitigated
in current source: listUnlock is called before the trashcan() call.