https://gitlab.synchro.net/main/sbbs/-/commit/d886b0623c88271819b82af2
Modified Files:
src/sbbs3/bat_xfer.cpp
Log Message:
Widen the batch-download list's quoting the same way, too
7173641281 (statute-19-nobody, 2026-09-20) widened quoted_string() from "contains a space" to SHELL_QUOTE_CHARS in filedat.c and xtrn.cpp, but bat_xfer.cpp has a third copy that builds the space-separated list of
paths %s expands to on a batch-download command line. It still quoted
on a space alone, and %s is substituted verbatim -- it never goes
through QUOTED_STRING -- so that copy is the only quoting on the path.
That matters because the double-quote this function adds is itself one
of the characters external() looks for when deciding to run the command
through a shell. So one queued filename containing a space sends the
whole command line through sh, and any other queued filename containing
&, (, ), ', =, ^, [, ], {, } or # arrives unquoted. All of those are
legal in an uploaded filename under the default Most ASCII setting;
they're in SHELL_QUOTE_CHARS precisely because ILLEGAL_FILENAME_CHARS
doesn't cover them.
Demonstrated with a queue of "big game (1).zip", "rock&roll.zip" and "issue#7.zip": the shell took the & as a control operator, so the
protocol received "rock" as its second argument and the third file was
dropped along with the rest of the truncated command.
Not reachable from a stock configuration, where every batch-download
command line uses the list-file form @%f and the only entry using %s is
Local Copy, a JavaScript module that never sees a shell. It needs a sysop-configured protocol that passes %s.
Co-Authored-By: Claude Opus 5 (1M context) <
noreply@anthropic.com>
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net