https://gitlab.synchro.net/main/sbbs/-/commit/4b53b6a54d1944eb698f19af
Modified Files:
src/sbbs3/answer.cpp
Log Message:
Re-arrange the unlock's of the input_thread_mutex to make more sense

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/d0accc6f3d4dda6fa4d811a1
Modified Files:
src/sbbs3/answer.cpp
Log Message:
Log a msg to the node/system log when new user registration is canceled

Yeah, one 'l'.

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/f6746e937c8b888e60114770
Modified Files:
src/sbbs3/answer.cpp
Log Message:
Don't execute login module if user already disconnected

which might log the (new) error message: Error -1 executing login module

Users can easily disconnect before the login module is executed (e.g. during
a pause prompt while displaying text/answer.*).

We still might need more disconnection detection in login.js or lower the severity of the logged error if login.js still gets auto-terminated due to disconnection (which results in a -1 exit code if ungracefully terminated).

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/91273407cb15becbfd22ee5a
Modified Files:
src/sbbs3/answer.cpp
Log Message:
Remove extra blank line after copyright notice when connecting with PETSCII

This was added in the New Terminal Abstraction for unknown reason

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/ca239664d95bca090dc4b064
Modified Files:
src/sbbs3/answer.cpp
Log Message:
Reject DELETED/INACTIVE accounts on the SSH, SFTP and RLogin logon paths

An account flagged DELETED or INACTIVE could still log on via SSH, SFTP
or RLogin. Those paths resolve the account name themselves and, on a successful authentication, jump straight to logon(), bypassing login(),
which was the only place the flags were checked. That is why Telnet
correctly refused the same account while SSH let it straight in.

find_login_id() does not filter the flags on the caller's behalf:
matchuser() skips only DELETED accounts, because a deleted account's
alias is blanked in the user index, and the LOGIN_USERNUM shortcut
checks nothing at all.

Test user_is_active() once the account has been resolved. A terminal
session is sent text[UnknownUser] before the disconnect, the same
response Telnet gives, since login() treats a deactivated account as an
unknown one. An SFTP session has no terminal and is refused in the
channel handler instead, before the session is marked on-line and the
logon is counted.

Both sites record the rejection with badlogin(), so repeated attempts accumulate toward the hack and IP filter thresholds, as they already do
in the FTP and mail servers. The password is deliberately not passed
along: it was the correct one, and it would otherwise be written to the
hack log and to the ip.can entry.

GitLab #1239

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net