Subj : src/sbbs3/websrvr.cpp
To   : Git commit to main/sbbs/master
From : Rob Swindell (on Debian Linux)
Date : Sat Aug 08 2026 18:05:04

https://gitlab.synchro.net/main/sbbs/-/commit/0791f3e3bfcdb04afeda7134
Modified Files:
	src/sbbs3/websrvr.cpp
Log Message:
Don't hand a CGI the web server's descriptors (#1174)

The CGI child sets up stdin, stdout and stderr and then execs with everything
else this process had open still in hand. Close the rest, as externals now
do. Nothing above stderr is a CGI's business: the client socket it reads
from, where it has one, has already been duplicated onto stdin.

Verified against a listen socket left deliberately inheritable, standing in
for the descriptors this cannot otherwise reach - the ones opened inside
libraries, where there is no call site to mark. Before, the CGI inherited it;
after, the CGI starts with stdio alone.

The exec-failure message now goes to stderr directly, which is the pipe the
parent already reads and logs as a CGI error. errprintf() is not usable after
the close: it is not fork-safe, and its descriptors are among those closed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.