https://gitlab.synchro.net/main/sbbs/-/commit/4fc976e4a95c2afe121425e6
Modified Files:
src/sbbs3/sbbsecho.c
Log Message:
Don't import netmail addressed to an inactive user's number
import_netmail() resolves a numeric "To:" field with atoi() straight from
the packet, which short-circuits lookup_user() -- the only thing in this
path that skips deleted users. Nothing downstream catches it either: fmsgtosmsg() calls getuserdat(), which returns USER_SUCCESS for a deleted record, and no check guards the RECIPIENTEXT field written from it. A
remote system could therefore deposit netmail into a deleted user's
record, where it stays invisible until the record is recycled.
Reject an inactive account where the number is resolved, so the message
falls through to the existing lookup_user() / default_recipient /
"Unknown user" handling rather than changing what fmsgtosmsg() reports to
its callers. This matches the SMTP RCPT TO path, which already rejects a recipient that isn't an active account.
Fixes #1187
---
� Synchronet � Vertrauen � Home of Synchronet � [vert/cvs/bbs].synchro.net