ANetBBS Changelog — Beta History (pre-v1.0.0)

Archived history of every internal beta build number (v1.0a1.1 through
v1.0b2.239) from before ANetBBS's v1.0.0 full release in August 2026.
Preserved as-is — a real record of what changed at each step during
development — but split out of the main CHANGELOG.md
once it passed 6,000 lines, to keep that file scannable for the
v1.0.0-onward history that actually matters day to day. Newest-first,
same as the main changelog.

v1.0b2.208 — Pre-release security audit, batch 1 (July 2026)

First installment of a full pre-release code audit. Added bandit + pyflakes to CI (there was no lint/security-scanner CI at all before this). Real fixes found, not just tooling:

Two stored-XSS gaps: the Markdown renderer (message/netmail bodies) and the wiki page renderer both silently fell back to emitting raw, unsanitized HTML if the bleach sanitizer library happened to be missing. The Markdown one is reachable via echomail/netmail from external FidoNet peers; the wiki one via any logged-in user's edit, not just admins. Both now fail safe instead.
Access-control leak: public profile pages showed post subjects and board names from restricted/sysop-only boards to any visitor, including anonymous ones — the same class of bug already fixed once in board search.
SSRF hardening on the RSS sixel-image preview (scheme-restricted to http/https).
An unsafe tar extraction in the upgrade wizard (path-traversal protection added).
A real crash bug: sending a private message in the terminal always crashed right after the message was saved, due to a missing import.
~70 dead imports cleaned up across the codebase.

Full suite verified clean (1577 passed, 2 skipped). This is the first of several planned batches — more to follow covering docs/wiki accuracy, the rest of the access-control sweep, and the install/upgrade paths.

v1.0b2.207 — Wiki content now self-heals on update; docs accuracy + coverage pass (July 2026)

Real root cause found: the in-app wiki's seed function was idempotent-only — once a page existed, no later content fix ever reached an already-seeded install, across several past docs/wiki accuracy sessions. Fixed: on every startup, any wiki page you haven't personally edited is now automatically refreshed to match the current shipped content; anything you've edited yourself is never touched.
Fixed a wrong MRC hub port in the wiki (was showing 5000, real port is 5001), and a doc page that presented the retired anetbbs-telnet/anetbbs-ssh services as current instead of the unified anetbbs.service.
Documented the new daily file download quota feature (wiki + docs/07-file-areas.md).
Added wiki coverage for ~16 admin tools that had none: New User Questions, Inactive Users, Registration Attempts, Chat Bans, Time Budgets, Default Echo Subs, IRC Server Presets, Setup Wizard, Preflight Checklist, Security Updates, Door Errors, Connection Test, Activity Log, Check for Updates, Logon/Logoff Modules, and Pre-update Backups.

Full suite verified clean (1572 passed, 2 skipped).

v1.0b2.206 — Daily file download quota by access level (July 2026)

New feature — admins can now cap how much a user downloads per day, scaled by access level, so one user can't tag-leech the entire file base overnight.

Configure tiers under Admin > File System > Download Quotas: a list of (minimum access level, daily quota in MB) pairs. A user gets whichever tier has the highest access level they still qualify for — a level 75 user with tiers set at 50 and 100 gets the level-50 quota, not the level-100 one. No tier configured at or below a level means unlimited downloads for that level. Admins always bypass.
Enforced everywhere a file can be downloaded: the web file-area and file-gallery download routes, ANSI telnet/SSH terminal (single and batch ZMODEM/YMODEM/XMODEM downloads), the PETSCII/C64 terminal (XMODEM), and FTP (RETR).
Resets at Eastern midnight.

Full suite verified clean (1567 passed, 2 skipped).

v1.0b2.205 — AreaFix %RESCAN could only ever be used once per area/node (July 2026)

After the first %RESCAN for a given area, every subsequent %RESCAN request (from the same node, same area) silently reported "0 messages" instead of re-queuing anything. Root cause: hold-queue rows are never deleted once delivered, only marked sent, and a database constraint means a message can only ever have one hold-queue row per node — so a repeat %RESCAN always found everything "already queued" and skipped it. %RESCAN now correctly resets already-delivered rows back to pending instead of skipping them, so a resend request actually resends.

Full suite verified clean (1550 passed, 2 skipped).

v1.0b2.204 — AreaFix/FileFix netmail no longer clutters the personal inbox (July 2026)

Every AreaFix/FileFix request and bot reply was appearing in the sysop's personal Netmail Inbox/Sent as if it were 1-on-1 mail, since the admin catch-all address matches the hub's own bare address that robot netmail is addressed to/from. This got far more visible after v1.0b2.201's dedup-exemption fix correctly stopped silently dropping repeat AreaFix commands. Robot netmail (AreaFix/FileFix/AreaMgr/FileMgr) is now excluded from the personal Netmail Inbox/Sent views — it's already fully logged in the dedicated admin AreaFix Log view.

Full suite verified clean (1549 passed, 2 skipped).

v1.0b2.203 — AreaFix/FileFix cross-network subscription leak (July 2026)

A downstream BinkP node's +ALL (or a plain +TAG for a tag belonging to another network) could subscribe it to echo/file areas from EVERY network this hub relays, not just the one it's actually a member of — a real cross-network data leak, found live. Hub-side AreaFix/FileFix now scope the available-area list to the requesting node's own network, failing closed (zero areas) rather than showing everything if a node's network isn't set.
New tools/cleanup_cross_network_subscriptions.py finds (dry-run) and removes (--apply) any bad subscription rows already created by the bug before this fix.

Full suite verified clean (1547 passed, 2 skipped).

v1.0b2.202 — Netmail zone fix + Eastern time display (July 2026)

Fixed an outbound BinkP netmail bug where the @INTL zone kludge was skipped whenever our zone matched the recipient's zone — a downstream system with multiple network identities could file the mail under the wrong one, since FTS-0001's binary header has no zone field at all.
Timestamps across the web UI and terminal/PETSCII interfaces now display in Eastern time (EST/EDT) instead of raw UTC — database storage is unchanged.

Full suite verified clean (1541 passed, 2 skipped).

v1.0b2.201 — Bug fixes (July 2026)

AreaFix/FileFix netmail could be silently discarded as a duplicate if it reused the same subject as an earlier, unrelated message from the same sender — every later command from that sender was dropped instead of processed.
Queued outbound netmail (sysop replies, AreaFix/FileFix bot responses) was never actually sent to a downstream node or peer network during an inbound BinkP session — only echomail was flushed, so affected netmail could sit unsent indefinitely.

Full suite verified clean (1526 passed, 2 skipped).

v1.0b2.200 — Bug fixes (July 2026)

Follow-up fix to v199's message display improvements: mixed CP437/Unicode content now renders correctly in all cases.

Full suite verified clean (1502 passed, 2 skipped).

v1.0b2.199 — Bug fixes + display improvements (July 2026)

Security and access-control fixes across the web, terminal, and network layers.
Fixed message display issues (CP437/Unicode rendering, word-wrap on inbound messages).

Full suite verified clean (1501 passed, 2 skipped).

v1.0b2.198 — Bug fixes (July 2026)

Minor bug fixes.

Full suite verified clean (1442 passed, 2 skipped).

v1.0b2.197 — Full echomail/QWK/BinkP audit + file-area storage validation (July 2026)

A full audit of the echomail/QWK/BinkP subsystem turned up 28 issues, now fixed:

File-echo hatch-out to downstream nodes was silently broken (subscribed peers never received files, no error anywhere).
Two real security gaps in TIC processing (path traversal, missing password check) and a third occurrence of a known QWK data-corruption bug (CONTROL.DAT) and a known batch-rollback bug.
Hub-side AreaFix/FileFix could leak internal sync-only areas to any downstream node.
AreaFix/FileFix now correctly process requests received during a hub-initiated outbound poll, not just inbound connections.
Assorted smaller fixes: duplicate netmail kludges, QWK reply-threading, stale-node nodelist flagging, a %PASSWORD AreaFix command, and a new "Unclaimed Netmail" admin review queue.
File areas: typing a Storage Path that doesn't exist now warns and offers to create it (single area and bulk import).

Full suite verified clean (1431 passed, 2 skipped).

v1.0b2.196 — Fixed InterBBS Last Callers flooding from sysop test logins (July 2026)

"Hide sysop from Last Callers" already hid sysop logins from the local display, but never stopped them from being relayed to other BBSes on the network — a heavily-tested sysop account could flood every peer's Last Callers area. Same toggle now blocks the relay too.

Full suite verified clean (1327 passed, 2 skipped).

v1.0b2.195 — Web: reorganized the Tools navbar dropdown (July 2026)

The Tools dropdown had grown to 24 flat items — split into 5 category landing pages (Community, Network Directory, Content, My Stuff, Info & Help), same treatment the Admin dropdown already got.

Full suite verified clean (1324 passed, 2 skipped).

v1.0b2.194 — Live bug fixes: FTP login crash, hub message delivery (July 2026)

Fixed a real FTP login crash on mixed-case usernames.
Fixed a hub bug where locally-composed echomail never reached downstream BinkP nodes — also added AreaFix %RESCAN so nodes can request a backlog re-send.

Full suite verified clean (1305 passed, 2 skipped).