1.10.5

Web Interface

• Message composition: the compose editor's automatic line-wrap column now defaults to 72 instead of 79, and 72 is offered as the recommended choice in the compose Advanced Options. Wrapping at 72 leaves room for quote-attribution prefixes (for example AB>) so that quoted reply lines stay within the 79-column width that FidoNet readers expect. The 79-column option is still available for users who prefer it, and anyone who has already chosen a wrap width keeps their setting.
• Draft handling on send: when a message is sent successfully from the web compose page, the draft it was composed from is now deleted automatically — including a draft that was only ever created by the 2-minute auto-save. Previously an auto-saved draft could be left behind after the message had already gone out, cluttering the drafts list.
• Draft handling on send: a failed send (validation error, server error, or a netmail attachment upload failure) no longer silently disables auto-save for the rest of the editing session; the auto-save timer is restored so continued edits keep being saved.
• Bulk delete on the Drafts tab: the netmail page's Select button now works on the Drafts tab. Previously the drafts list rendered no selection checkboxes at all, so multi-select and the Delete Selected action were unavailable there — you could only delete drafts one at a time. Selecting drafts and choosing Delete Selected now removes them together via a new POST /api/messages/drafts/bulk-delete endpoint (each delete is scoped to the signed-in user).
• Admin BBS Settings: the Admin -> BBS Settings page is now organized into four tabs: System & Features, Credit System, Tag Lines, and Registration Screening. All settings and their save buttons are unchanged; they are only regrouped so the page is shorter and easier to navigate.
• Navbar active section indicator: the web navigation bar now marks the section for the page you are on: the matching top-level menu item is shown in bold with a short underline bar beneath it, in the navigation link colour of whatever theme is active. The section is worked out from the page URL, so a page with no menu entry of its own still highlights its parent — a message thread or the compose page marks Messaging, and a door launcher marks Doors.
• Navbar active section indicator: the Files menu's new-files cue is now shown on the file icon only. Previously an incoming file also turned the word "Files" yellow, which looked like the active-section highlight. The file icon and the Files link inside the dropdown still turn yellow; only the top-level text label no longer does.
• Themed message threading colors: the threaded-view accent colors on the echomail and netmail pages — the coloured left border on a thread root, the "N replies" badge, the reply arrow icon, and the row hover tint — were hardcoded to Bootstrap blue (#0d6efd) and stayed blue on every theme. They now derive from the theme's --fidonet-blue variable (falling back to #0d6efd), so dark, amber, greenterm, cyberpunk, and custom themes tint the threading UI to match. The badge additionally honours optional --thread-badge-bg / --thread-badge-color overrides.

Messaging / FTN

• NNTP server: BinktermPHP can now serve its echoareas as Usenet-style newsgroups over NNTP (RFC 3977), so members can read — and optionally post — echomail with a standard newsreader such as Thunderbird. It runs as a new optional daemon, scripts/nntp_server.php, and is disabled by default. Enable it, and configure rate limits and the plaintext-authentication policy, in the new Admin -> NNTP Server page. Posting from a newsreader is a second toggle on that page, also off by default.
• NNTP server: each member also gets a private netmail newsgroup whose articles are that member's own netmail; posting into it sends netmail. It is enabled by default when the NNTP server is on, with its own settings on the Admin -> NNTP Server page (group name, whether sending is allowed, whether sent mail is included, and a separate send rate limit).
• NNTP server: new database tables (nntp_article_numbers, nntp_area_watermark) are created and populated from your existing echomail during the upgrade, plus nntp_netmail_article_numbers and nntp_netmail_watermark (per member, filled on first read) and a tearline_component column on netmail.
• NNTP server: transport settings — bind address, ports, and TLS certificate paths — are read from .env. New keys: NNTP_BIND_HOST, NNTP_PORT (default 8119), NNTP_TLS_PORT (default 8563), NNTP_TLS_CERT_PATH, NNTP_TLS_KEY_PATH. The ports default to an unprivileged range; redirect the standard 119 / 563 to them with a firewall rule.
• AreaFix reply sync: AreaFix and FileFix replies from an uplink are now recognised in the web UI even when the uplink adds or drops the .0 point on its netmail address, so the conversation threads under Admin → AreaFix no longer break apart when a hub answers from a 3D address one way and a 4D address the next.
• AreaFix reply sync: the area-list parser now ignores command receipts, execution logs, help text, and rescan confirmations instead of treating their contents as echo tags. Previously an uplink's "request processed" acknowledgement or quoted-header block could create bogus, inactive echo areas in the database.
• AreaFix reply sync: inbound AreaFix / FileFix area-list replies received over an authenticated (secure) BinkP session are now synced into the local echoareas / file_areas tables automatically as packets are processed. Replies arriving over an insecure session, or whose packet origin does not match the configured uplink address, are ignored.
• AreaFix reply sync: Admin → AreaFix gains a Sync Areas to Local BBS button on the latest-reply preview, backed by a new POST /api/admin/areafix/sync-latest endpoint, for manually syncing the most recent area list on demand.
• AreaFix reply sync: box-art / decorative-line detection in the parser no longer discards area rows whose description contains accented UTF-8 characters.
• BinkP schedule status panel: the BinkP status view in the admin System Information area no longer breaks when an uplink's poll schedule has extra or irregular whitespace between its cron fields. Such a schedule previously showed next poll: Unknown, and a badly-formed field (for example a stray / or an empty step) could make GET /api/binkp/status return HTTP 500 so the whole panel failed to load. The schedule string is now split the same way the rest of the scheduler splits it, so leading, trailing, and repeated whitespace are tolerated.

Terminal Server

• Registration house rules: the terminal server's Register new account flow now shows the house rules in a paged box and requires the prospective user to type YES to accept them before any account details are collected. Declining aborts registration. Custom house rules from Admin -> Appearance -> Content -> House Rules are shown when set; otherwise the built-in default rule set is used. The browser registration page already linked to the same rules.
• Full-screen editor flicker: the terminal server's full-screen message editor (used automatically when the terminal has 15 or more rows) no longer erases and repaints the entire screen after every keystroke. Typing within a line now updates only that line, cursor movement emits only a cursor move, and structural edits repaint just the text area — borders and the footer stay put. This removes the constant blue-background blink that was visible while composing, especially on larger terminals or higher-latency connections. Terminals with ANSI colour disabled keep the previous full-redraw behaviour. Fixes issue #432.
• CP437 login ANSI art: the ANSI login screen (ansi_prompt display mode) now accepts .ans files saved in Code Page 437 by DOS / Synchronet tools. The high-byte box-drawing and block characters are converted to UTF-8 for display, and a trailing SAUCE / EOF record is stripped. Previously these bytes rendered as replacement characters, and the admin appearance editor could not load or save such art.
• Message body escape-sequence filtering (security fix, GHSA-4225-c933-76f3): echomail and netmail bodies, kludge lines, subjects, and author names are now stripped of terminal control sequences before being shown to a Telnet or SSH reader. Previously a message containing raw ANSI/VT escape codes could move the reader's cursor, repaint or erase their screen, spoof displayed content, and — on terminal emulators that honour them — set the window title, write the clipboard, or inject input via an answerback query. Because echomail is FidoNet-federated, such a message could originate from any user on any connected node. ANSI colour (SGR) codes are preserved; cursor positioning, screen clears, and OSC/DCS sequences are removed, so genuine ANSI-art messages keep their colours but lose absolute cursor placement when read on a terminal.

Door Games

• Door player backspace handling: the browser-based RLogin door player (public_html/webdoors/rlogindoors/index.php) now remaps the DEL byte (0x7f) that modern browsers send for the Backspace/Delete key to the Backspace byte (0x08) that RLogin door servers expect. Previously the Backspace key was ignored in RLogin doors (for example DOS doors run through DOSEMU/DOSBox, or MajorBBS). The equivalent DOS door players already had this remap; this brings the RLogin player in line.
• Door player backspace handling: all three browser door players (rlogindoors/index.php, webdoors/dosdoors/index.php, guest-door-player.php) now also translate an inbound 0x7f (DEL) coming from the door engine into a destructive backspace sequence (\b \b) before writing it to the terminal. Some door engines emit a bare DEL to erase the last character; xterm.js would otherwise render it as a visible glyph instead of erasing. Binary WebSocket frames are left untouched.
• BBSDEV.DRP drop file (experimental): door manifests can now select BBSDEV.DRP as their dropfile_format, for both native doors and DOS doors, in the Admin -> Door Manifest Editor. BBSDEV.DRP is a modern 19-line drop file (UTF-8, one value per line) defined by its own specification. A door set to this format receives only BBSDEV.DRP — no DOOR.SYS — and the drop file's absolute path is passed in the BBSDEV_DRP environment variable (native doors) or a guest environment variable of the same name (DOS doors). This support is experimental and has not been tested against a real door; DOOR.SYS remains the default and is unaffected.

MeshCore / PacketBBS

• Enable/disable toggle: a new Enable MeshCore toggle in Admin -> BBS Settings -> System & Features turns the whole MeshCore / PacketBBS radio subsystem on or off. It defaults to on, so existing MeshCore setups keep working. Turning it off makes the bridge API unreachable and hides every MeshCore surface (user settings tab, public nodes page, admin page, dashboard card, navigation links).

Docker

• WebSocket proxy: the bundled Docker image now proxies the realtime WebSocket stream (/ws) and the DOS door bridge (/dosdoor) through Apache, so the event bus and browser-side DOS door games work in container deployments. Rebuild the image to pick this up.
• Stale Apache PID cleanup: docker/entrypoint.sh now removes any stale /var/run/apache2/apache2.pid (and other /var/run/apache2/*.pid) files during container initialization, before starting the main process. This prevents a crash loop after an abrupt Docker host shutdown or a killed container leaves a stale Apache PID file behind on a persisted volume.

CLI Scripts

• Helper function loading: scripts/admin_daemon.php, scripts/install.php, scripts/setup.php, and scripts/upgrade.php now load src/functions.php alongside the Composer autoloader, so the global helper functions it defines (such as getServerLogger()) are always available to those entrypoints.

Documentation

• Community mods list: a new docs/MODS.md file is a curated list of third-party mods and extensions for BinktermPHP, linked from the Customization section of the README. It seeds with two mods by TheWebExpert: the Door Button Filter Mod (category filter bar on /games) and the Echo Area Button Mod (network-filter and quick-action bar on /echolist). Contributors add their own mods by pull request. Listed mods are maintained by their individual authors and have not necessarily been reviewed or tested by the BinktermPHP maintainer; review a mod's source before installing it.

Installation

• Caddy reverse proxy example: the Caddy site block in docs/INSTALL.md now wraps the /ws (realtime WebSocket) and /dosdoor (DOS door bridge) proxies in their own handle blocks. In the previous example these were bare reverse_proxy directives; mixed in with the handle blocks used for the rest of the site they were shadowed by the catch-all handler, so WebSocket requests fell through to PHP and stalled while holding the per-user session lock, making every following page load hang for several seconds. If you copied the old block, update your Caddyfile to match.