Differences

This shows you the differences between two versions of the page.

--- saltbush:history [2026-11-11 11:52] – Saltbush Terminal 1.9.1 guides slaterm
+++ saltbush:history [2026-11-11 14:59] (current) – Saltbush Terminal 1.9.2 guides slaterm
@@ Line 1: / Line 1: @@
 ====== Saltbush Terminal: version history ======
+===== 1.9.2 (2026-11-11) =====
+Fixes from a review of the whole program.
+==== Security ====
+  * Scripting on Windows: the script API's password (token) was always the same (all zeros), so any program on the computer could type into your sessions or read the clipboard through it. It is now random, and scripting does not start without a random source.
+  * BBS Directory and SyncTERM import: a BBS from a list was given the default session's logins, so an RLogin credential, an SSH key, agent forwarding or an expect/send password set there could be sent to someone else's BBS. These are now left out.
+  * Updates: a download is refused unless it is https (also after redirects) and the release gives its full SHA-256 checksum.
+  * SFTP downloads on Windows: a server could name a file ''C:something'' and have it written outside the download folder.
+  * A host could switch to the alternate screen, set the window title or ask for the cursor position past the session's settings by doubling the escape character (''ESC ESC ['').
+==== Fixed ====
+  * Crashes and freezes: narrowing the window (or a host switching to 80 columns) through a wide character, then writing in the last column; a host sending ''ESC[65535@''; a non-ASCII colour such as ''#1é234''; uploading a file dated before 1970.
+  * SSH Agent > Add Key with a wrong passphrase hung the whole program; it now says the passphrase is wrong.
+  * SSH port forwards: a program that stopped reading from a forward froze the session and every other forward; a program that half-closes its connection (as HTTP clients and ''nc -N'' do) now gets the reply; agent Remove always removes the key you chose.
+  * Settings: if settings.json or bbs-directory.json could not be read, the next save replaced it with defaults. An unreadable file is now never overwritten, and a damaged BBS directory is kept as a ''.bad-'' copy first.
+  * Sync: when the same session was made on two computers, the second one lost its own local settings for it (key file, shell, log folder); a failed retry no longer leaves the settings half changed.
+  * SFTP: uploads to servers without OpenSSH's fsync extension always failed; a read-only file could not be uploaded again; replacing a file on an older server now moves the old one aside instead of deleting it first; folder copies no longer follow links to folders (a link loop filled the disk), and Cancel works between folders.
+  * Zmodem: files over 4 GiB; a ZFILE resent without its file information; a confused receiver (ZACK, ZNAK) could stall or break an upload; a repeated file header left a stray ''.part'' file.
+  * Kermit: long file names no longer need packets the receiver did not agree to.
+  * Telnet: a server could make the subnegotiation buffer grow without limit.
+  * Terminal: leaving a full-screen program (such as ''less'' or ''vim'') threw a scrolled-back view to the top of the history; VPA moved the cursor right in origin mode with margins; a sixel image could show an earlier picture after a reset; SCO ANSI colours ''38;5;n'' were read as font switches; automatic reconnect never stopped for a server that closes at once.
+  * Copy Public Key: closing the window during the login left the connection open; a commented-out copy of the key counted as already installed.
+  * RLogin sends the current window size; on Windows, closing a serial session frees the COM port at once.
+  * A multi-line paste confirmed after switching tabs went into the wrong tab; closing a split pane could leave the active tab off screen; editing several sessions at once no longer changes their custom ports or clears their button bars; importing a SyncTERM list never overwrites an existing credential's password.
+  * Scripting: recorded Lua scripts could send the wrong bytes after a control character; relative script paths work; Python ''app.Screen'' keeps its read position; Lua ''write_file'' keeps the file's permissions and writes through links.
+  * RDP: Shift+Insert and a held Ctrl+Alt+End could leave keys held down on the remote desktop; copied text with Windows line ends got a blank line between lines.
+  * Log file names are made safe for Windows ('':'' and the other characters it refuses).
+==== Changed ====
+  * Sync no longer makes the window wait while the sync folder (perhaps a network drive) is read and written; it runs in the background.
+  * Small speed-ups in terminal output and drawing.
 ===== 1.9.1 (2026-11-11) =====