MegaMOO 0.7.3-beta

Security and correctness fixes. mm.db in this archive already contains the verb changes; an existing world picks up the engine fixes but not the verbs.

Fixed: passwords were echoed in plaintext over telnet

network.py defined the telnet ECHO option and never sent it, so a password typed at the login prompt appeared on the player’s own screen — and therefore in scrollback, screenshots, screen shares and recordings. The web client had implemented its own masking and its comment assumed telnet already handled this.

Per RFC 857, the server now sends IAC WILL ECHO before a password prompt and IAC WONT ECHO once the line has been read, so exactly one line is masked and echo is restored whether the login succeeds or fails. The prompt pattern moved to globals.py so both transports share one definition.

Anyone running an earlier build should assume passwords typed over telnet have been visible, and rotate accordingly.

Fixed: new characters were never gated by roundtime

do_wait — which reports whether a character may act — only consults roundtime for a character whose status carries a truthy life. Characters leaving chargen had an empty status, so no IC command was ever held, including the thirteen gated in 0.7.2 and movement.

Chargen now sets status["life"] = 1 and rt = 0. Characters created before this keep an empty status and need a backfill; setting life inside status (not as a property of its own) is what do_wait reads.

Fixed: verbs edited in-game were stale on disk

msg, msg_room and _allow had been edited in the database and never written back, leaving the files older than the database. That matters more than staleness: the auto-reloader pushes disk over database, so an old file silently reverts the newer verb the moment anything touches it. Every verb in the archive now matches its database copy — 201 of 201, checked before this release was built.

Upgrading an existing world

Engine fixes arrive with the files. Verb and database changes do not. Either start from the mm.db here, or copy the verbs you want from moo verbs/ and let the auto-reloader pick them up. For an existing world, also set status["life"] = 1 on characters that predate this release, or roundtime will not hold them.

Also in this release

su gains the LambdaMOO $string_utils surface: from_list, english_list, explode, words, first_word, rest, trim/triml/trimr, space, left/right/centre, capitalise, a_or_an, ordinal, group_number, is_numeric, pluralise, find_prefix, index_delimited, strip_chars, strip_all_but, char_list.

$string_utils is aliased to the same object, so porting only changes the call syntax:

$string_utils:from_list(lst, ", ")     MOO
$string_utils.from_list(lst, ", ")     here

Where MOO and Python differ, these follow MOO — explode() drops empty pieces, capitalise() leaves the rest of the string alone, find_prefix() returns -1 on an ambiguous prefix, and ordinal() handles the teens.