1. Forum
  2. DOVE-Net
  3. Synchronet Programming

  • exec/webfileindex.ssjs

    From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Sun Sep 20 03:31:33 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/12504437d6e893524b5f72be
    Modified Files:
    exec/webfileindex.ssjs
    Log Message:
    webfileindex: serve archive listings from the content store

    view_archive() re-enumerated the archive on every request. It now reads the per-area content store, extracting and storing only on a miss, so a crawl of the file base pays for each archive once rather than once per view.

    Archive entry names are now HTML-encoded. Those names come from inside the archive, where ILLEGAL_FILENAME_CHARS does not constrain them, so an entry named with markup was written into the page as-is. File-base names elsewhere
    on the page are unaffected, since < > and " are illegal in those.

    'arc' joins the viewable-archive list. libarchive cannot read the format at all, so the web reported "Non-viewable file type" for every one of them and never reached the extraction path; the store's external-tool fallback lists them.

    #1247

    Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

    ---
    þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net
  • From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Mon Sep 21 22:21:21 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/cc328fcea5c7d4b48e7ccb6a
    Modified Files:
    exec/webfileindex.ssjs
    Log Message:
    webfileindex: encode archive entry names as text rather than as ANSI

    An entry name came from inside the archive and went through
    html_encode() with the ANSI and Ctrl-A conversions left enabled, so
    every listing row was wrapped in a hard-coded inline color span (black background, overriding the dark-mode style sheet), and an ESC or Ctrl-A
    in a name was rendered as markup rather than escaped.

    Extended ASCII was converted to numeric character references, which is
    correct for the CP437 names in a DOS-era archive but mangles a name a
    modern tool wrote in UTF-8: every byte of the sequence became a separate
    CP437 entity.

    Encode with only the HTML escaping enabled, then convert CP437 to UTF-8
    the way this script already does for file descriptions, skipping the
    conversion when the name is valid UTF-8 already. That is the test
    newsutil.js applies to a message body.

    Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

    ---
    þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net