eouzoe 671d0c5f9e Fix symlink escape in Gopher public file resolver ... The userTree function confined selectors with path cleaning and HasPrefix checks, but called os.Stat/os.ReadFile on the unresolved path. A symlink created inside a member's public area pointing outside would pass the lexical checks and leak external content. Fix: resolve symlinks with filepath.EvalSymlinks after the path check and reject the request if the real path escapes the member's area. Adds TestSymlinkEscapeRefused to verify both rejection of external symlinks and acceptance of symlinks within the member area.		2026-07-09 21:25:14 +08:00
..
admin	members: show joined date in admin + public lists; 'last active: X ago'	2026-07-01 02:40:24 +00:00
ascii	Video calls (PairUX→ASCII), agent@ chat, and finger routes	2026-06-11 11:43:38 +00:00
auth	feat(gopher): serve BBS content over Gopher + SSH-authenticated "hedgehog" (#83)	2026-07-07 05:39:35 -07:00
brand	Use the Profullstack </> ASCII logo as the BBS banner	2026-06-14 16:46:59 +00:00
calls	Video calls (PairUX→ASCII), agent@ chat, and finger routes	2026-06-11 11:43:38 +00:00
chat	Video calls (PairUX→ASCII), agent@ chat, and finger routes	2026-06-11 11:43:38 +00:00
files	Require POST for file web mutations (#82)	2026-07-07 05:41:16 -07:00
forgejo	feat(passwd): self-service password reset across git, mail & chat (#59)	2026-06-27 03:46:23 -07:00
forwardemail	Autonomous deploy + free-pod/Premium-email membership	2026-06-14 07:58:51 +00:00
games	M3: AgentGames — agent-vs-agent games, ELO ladder, replays (#7)	2026-06-14 03:30:12 -07:00
gopher	Fix symlink escape in Gopher public file resolver	2026-07-09 21:25:14 +08:00
hub	Fix/pod public html bind mount (#30)	2026-06-15 08:06:32 -07:00
ircpass	fix(passwd): also reset The Lounge web-login password (#61)	2026-06-27 09:40:28 -07:00
mail	bbs.profullstack.com launch kit: provisioner, custom domains, email verify, ascii-live	2026-06-11 15:53:19 +00:00
mailbox	fix(mailbox): reject invalid bot toggle values (#80)	2026-07-07 05:40:35 -07:00
mailu	Feat/mail all members (#55)	2026-06-23 03:38:31 -07:00
motd	Wire shared MOTD into BBS hub and IRC	2026-06-25 11:51:06 +00:00
news	fix(nntp): handle open-ended OVER range like '5-' (#75)	2026-07-02 17:20:39 -07:00
payments	Rebrand paid tier to $99 Founding Lifetime Member	2026-06-14 12:46:23 +00:00
plugin	fix(arcade): give ncurses games a TERM so they launch	2026-06-18 12:01:26 +00:00
pods	feat(pods): SSH agent forwarding → git push from the pod with your key	2026-06-23 09:16:29 +00:00
qryptinvite	Fix flaky TestTamperedTokenFails in qryptinvite	2026-06-14 17:05:30 +00:00
sandbox	AgentBBS: M0 core hub, M1 arcade, pods with CoinPay membership	2026-06-11 11:08:17 +00:00
sites	Free per-user homepages at <name>.<host> (wildcard subdomains)	2026-06-14 09:20:34 +00:00
source	fix: block shared/reserved IP ranges in SSRF guard (#47)	2026-06-22 05:23:15 -07:00
store	feat(messaging): group & broadcast messages + email-all	2026-06-27 12:18:41 +00:00
tor	tor: premium tor-url / tor-irc / tor routes over Tor	2026-06-14 10:54:21 +00:00
ui	Fix/pod public html bind mount (#30)	2026-06-15 08:06:32 -07:00