Subj : docs/v322_new.md src/sbbs3/websrvr.cpp
To   : Git commit to main/sbbs/master
From : Rob Swindell (on Debian Linux)
Date : Wed Sep 30 2026 19:08:47

https://gitlab.synchro.net/main/sbbs/-/commit/aadcf82e0660f29d0b7afc10
Modified Files:
	docs/v322_new.md src/sbbs3/websrvr.cpp
Log Message:
Web Server: log script errors, don't send them to the client

Fixes #1203

js_ErrorReporter() wrote every uncaught JavaScript error, with the script's
absolute path and line number, into the HTTP response body as well as the
log, and the request still completed with a 200 and the page's content
type. That disclosed the server's layout to any visitor who could make a
script throw, and any error message that interpolated request data (a query
parameter, header or cookie) was a reflected script-injection vector in the
BBS's own origin.

Log the error only. A reported error (a warning does not count, nor does
exit(), which reports nothing) marks the session, and exec_ssjs() then
fails the request instead of sending what the script produced before
failing, so the normal 500 error path answers it. An error after the
script has already sent its headers can only be logged, as before.

Verified on a scratch web server: a page that throws with a query
parameter in the message returns 500 with an empty body and the error is
in the log; a page that ends with exit() still returns 200.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
--- SBBSecho 3.38-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.