Subj : src/sbbs3/bat_xfer.cpp
To   : Git commit to main/sbbs/master
From : Rob Swindell (on Debian Linux)
Date : Sun Sep 20 2026 04:50:42

https://gitlab.synchro.net/main/sbbs/-/commit/d886b0623c88271819b82af2
Modified Files:
	src/sbbs3/bat_xfer.cpp
Log Message:
Widen the batch-download list's quoting the same way, too

7173641281 (statute-19-nobody, 2026-09-20) widened quoted_string() from
"contains a space" to SHELL_QUOTE_CHARS in filedat.c and xtrn.cpp, but
bat_xfer.cpp has a third copy that builds the space-separated list of
paths %s expands to on a batch-download command line.  It still quoted
on a space alone, and %s is substituted verbatim -- it never goes
through QUOTED_STRING -- so that copy is the only quoting on the path.

That matters because the double-quote this function adds is itself one
of the characters external() looks for when deciding to run the command
through a shell.  So one queued filename containing a space sends the
whole command line through sh, and any other queued filename containing
&, (, ), ', =, ^, [, ], {, } or # arrives unquoted.  All of those are
legal in an uploaded filename under the default Most ASCII setting;
they're in SHELL_QUOTE_CHARS precisely because ILLEGAL_FILENAME_CHARS
doesn't cover them.

Demonstrated with a queue of "big game (1).zip", "rock&roll.zip" and
"issue#7.zip": the shell took the & as a control operator, so the
protocol received "rock" as its second argument and the third file was
dropped along with the rest of the truncated command.

Not reachable from a stock configuration, where every batch-download
command line uses the list-file form @%f and the only entry using %s is
Local Copy, a JavaScript module that never sees a shell.  It needs a
sysop-configured protocol that passes %s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.