v1.16.2 - The Hardened Release

• Fixed (security): several holes in admin access are closed. dccore.mrc could accept a new login token from someone other than your bot, so update it to 1.19.4 and reload it with /reload -rs dccore.mrc. The console's fallback connection now waits for you alone. Console logins made at the same time from one address no longer get more password tries than the limit. A !rehash that cannot read settings.conf keeps the settings it had, and a line you delete from admin_config.py is gone after a !rehash. unpair now says so when it could not revoke a token. Update if you use the DCC console or dccore.mrc.
• Fixed (mIRC): the settings window's Unlock accepts a password with a space at either end or two spaces in a row. Such a password could log in but not unlock the window. Update dccore.mrc to 1.19.4 and reload it with /reload -rs dccore.mrc.
• Fixed (security): the dashboard's login and sessions are harder to abuse. Failed logins sent all at once are now counted like any others, and only a few passwords are checked at the same time. The dashboard refuses requests made under a web address it does not know, which stops a hostile page from locking you out of the login. Logging out, or changing the password, now ends the session on the server, so a copied session stops working. No other page can show the dashboard inside a frame. If you open the dashboard by a name rather than an IP address, localhost or your computer's own name (a router or VPN name, a reverse proxy), add that name to the new WEBUI_ALLOWED_HOSTS setting.
• Fixed (security): a download request could reach more than the file it names. On Windows, a specially written name could read hidden data stored alongside a shared file, including where the file was downloaded from. With several lists, a channel could be sent another channel's list. Such requests are now refused. A resumed download that sent nothing is no longer counted or announced as sent.
• Fixed: with rejoining turned off (REJOIN_ATTEMPTS = 0), the kick notice no longer says the bot will rejoin on the next advert.
• Fixed: the List Browser's filter finds a name whether it is written with composed or decomposed accents, as libraries copied from a Mac often are - for Vietnamese, Cyrillic, Japanese and Korean names as well. The search index is rebuilt once after the update, from the lists you hold.
• Fixed (security): names and text from other IRC users are kept in their place. A bot's nick could make DCCore keep its fetched list in a folder that held other bots' lists, so fetching or removing that list could delete or replace theirs; a file fetched under one particular name could make every later list fetch fail; some bot nicks could empty the List Browser's sidebar or break the @find results on the dashboard; text typed in a channel could act on the operator's terminal when the bot printed it; and each private message from a stranger cost a disk write while the bot was reading from the server. A list held under a nick or channel whose folder name changed is moved once, when the bot starts. Also fixed: a ? in a ban mask (and in ADMIN_HOSTMASKS) now matches one character, as on IRC - before, a ban written with ? was accepted but matched nobody.
• Fixed (mIRC): a password with a space at either end, or two spaces in a row, can be typed in the @DCCore window. mIRC closed such spaces up before sending, so the bot refused a password the dashboard accepted, and the script could not be paired. The script now sends such a password encoded and the bot decodes it; every other password goes as before. Update dccore.mrc to 1.19.4 and reload it with /reload -rs dccore.mrc.
• Fixed: a second login arriving while the console was checking a first one's password could close your live console and leave no console open at all. The replaced login is now simply turned away.
• Fixed: a damaged audio info cache is moved aside and a new one started, instead of every list rebuild from then on being written without audio lengths until the file was deleted by hand. The damaged file is kept beside it as audio_info.db.corrupt-<date>.
• Fixed: a failed save of the Downloads history was never tried again while nothing changed, so a restart could lose finished downloads or bring back deleted rows. It is retried on the next tick.
• Fixed: two saves at once could leave an older copy on disk - the download queue (an emptied queue could come back after a restart, a new one go missing) and the record of fetched lists (pointing at a list file already replaced). The newest copy is now always the one written last.
• New (mIRC): a settings window for the bot. /dccore settings (or Bot Settings / Settings... in the menus) shows the bot's settings as the dashboard's Settings page has them - six tabs, the pages of each down the left, Apply / OK / Cancel - with the dashboard's labels, help and checks: a value the bot refuses comes back with its reason and nothing is saved. It also edits the on-connect commands, the served lists with their channels and folders, and the bans and ignores, and previews a colour theme before you save it. Update dccore.mrc to 1.19.4 and reload it with /reload -rs dccore.mrc; the bot must be on this version too (an older bot is told apart, and the window then says to update it).
• New (mIRC): nicks, channels and the search term can have colours of their own in the @DCCore window. /dccore options has Search text, Nicks and Channels under the Show checkboxes, and Nicks can be per nick: each nick always gets the same colour, picked to be readable on the window's background, so one person's searches and requests stand out. Until you pick one, the window looks exactly as before. Update dccore.mrc to 1.19.4 and reload it with /reload -rs dccore.mrc.
• Fixed: an advert interval of 0 made the bot advert as fast as it could. ANNOUNCE_INTERVAL now has to be at least 60 seconds; a smaller value is refused when saved, and one already in settings.conf or admin_config.py is used as 60.
• Fixed: with more than one list, an unplugged drive on the main list stopped the bot from starting although the other lists were readable. It now starts while any list has something to serve, and names the list that has nothing.
• Fixed: changing only the capitalisation of the list name (or of the nickname it follows) kept the bot on its old list on Windows and macOS. The old files are renamed at the next start and cleaned up by the next rebuild, and the newest list is chosen by its date.
• Fixed: one broken line in settings.conf made the bot offer the first-run setup, which could replace your admin password and then fail. The bot now names the file and the line and stops, the setup check says the same, and neither setup writes anything until it knows settings.conf can take the answers.
• Fixed: the Settings page saved a music folder that does not exist, and the bot then would not start. It is refused when you save, with a hint if the path has quotes around it.
• Fixed: configure.py and the Settings page accepted channel names the browser setup refuses, such as mychannel or #one #two. All three now use the same rule: each channel starts with #, several are separated by commas. A settings.conf from before still loads: its real channels are joined, and the log names any entry that was dropped.
• Fixed: a list name with a character like | saved fine and then broke every list rebuild on Windows. Saving one is refused, with the name to use instead; one already in settings.conf is kept where your system accepts it (so your published list keeps its name) and corrected where it does not.
• Fixed: configure.py said a folder pasted with quotes (Explorer's "Copy as path") does not exist. The quotes are taken off, and only a full path is ever offered for creating.
• Fixed: a new console time format took effect only after a restart. It now applies from the next line.
• Fixed: a settings.conf error named the line after the real one, and sometimes a section the file does not have.
• Fixed: two people asking for the same folder no longer break each other's download. The second request could delete the archive the first person was waiting for, or a failed attempt could remove it, so the first person got "Could not send". The waiting archive is now sent to both. A finished archive is also no longer deleted while someone else's queue still needs it, and one is no longer left on disk because a different album has the same name.
• Fixed: a queued file from a folder you stopped sharing is no longer sent. A file queued from a folder you then removed on the dashboard's Folders page is dropped when its turn comes, and the user is told it is no longer shared.
• Fixed: @<bot>-remove during your own folder's packing now stops the pack. Before, the user was told the queue was removed, and the folder was packed and sent anyway. A file already being sent stays, and the notice now says so.
• Fixed: a nick change while a folder was packed no longer locks that user out until a restart, and the archive goes to the new nick. Running out of file handles at the moment a send starts no longer loses a slot either.
• Fixed: a list rebuild that failed at the wrong moment could leave the bot with no list until the next successful rebuild - @find said there was no list and the advert went quiet. The previous list is now always put back.
• Fixed: a multi-disc album (CD1, CD2 ...) can be packed with !rar again. Its row in the album list was refused every time it was pasted. The row itself is unchanged, so requests already queued in AutoQ still match.
• Fixed: the album list no longer offers the library folder or an artist folder just because a loose track sits in it. The bot always refused those. The tracks are still listed and requestable by name.
• Fixed: with more than one list, the file count is no longer re-read from disk on every advert and every Stats refresh.
• Fixed: -que and -stats in a channel bound to a second list now report that list's file count, date and size, the same as the advert there. They used to report the main list's.
• Fixed: @find finds accented names from a library copied off a Mac (for example "é" stored as "e" plus an accent). The list itself is unchanged.
• Fixed (Windows): a directory junction inside the library is no longer walked into, the same as a symlink. A junction pointing back up the library made every rebuild fail.
• Fixed (Linux): two folders whose names differ only in case no longer have their files mixed together in the list under repeated headings.
• Fixed: a file a bot sent late could be taken by a folder request to the same bot. A file request waiting to be asked again (the bot was busy, silent, or the disk was full) now gets its own answer, as the v1.16.0 fix meant it to.
• Fixed: deleting an old finished download could delete a newer download's file of the same name. Once the old file had been moved out of the Downloads folder, a later download of the same name took its name; deleting the old row now leaves the newer file alone.
• Fixed: a bot's main and RAR lists could be wiped when it was briefly out of another channel. A request for a bot's list in one channel is no longer sent to a different channel instead, and an answer from the wrong channel is never installed over what is held.
• Fixed: purging a bot left its other channels' lists on disk. They are removed with the rest now.
• Fixed: a bot that could not join any of its channels at connect never fully settled after it got in. This happened with a channel that needs a services login slower than the join, or bans at connect. Once a later rejoin got the bot in, fetches from other bots, debug-channel messages and the freeze of departed users' queues stayed off until the next reconnect. They now start as soon as the channel's member list arrives.
• Fixed: the address DCCore offers for transfers was looked up only once, at startup. If that lookup failed (the network was not up yet), every transfer was refused until a restart. If the ISP gave the connection a new address, the old one was offered and every transfer timed out. It is now looked up again whenever the bot reconnects, at most every five minutes. An address set in MY_IP_OR_DOCK is still used as it is.
• Fixed: a channel the bot gave up rejoining kept its users "present". Their queues kept being offered to and were never frozen. They are now treated as gone, as for any other channel the bot has left.
• Fixed: a channel name with [, ], \ or ~ that the server spells with {, }, | or ^ was never recognised. Most servers treat these as the same channel. The bot joined it but never advertised there and kept asking to rejoin. Channel names are now compared the way the server says it compares them.
• New: the dashboard's settings over the admin console, for the settings window coming to dccore.mrc: settings lists every setting with its value, set <KEY> <value> changes one (or setbegin ... setcommit saves many with one rehash), and served, folders, onconnect, setpreview and banlist cover the lists and channels, the folders, the on-connect commands, the theme preview and the bans. They run the dashboard's own checks and save, so a value one refuses the other refuses too, and they need the admin password as the dashboard does: a script logged in with its paired token can read the settings, and changes them only after unlock <password> once in that session. See docs/ADMIN-CONSOLE.md, "Settings over the console".
• Fixed: a letter like ö or é in a long line typed into the admin console could arrive as two � marks, when it fell where the bot read the line in two parts. And nan or inf is no longer accepted as a number by the Settings page or for the delay between on-connect commands.