https://gitlab.synchro.net/main/sbbs/-/commit/3ad3f0282bcff37fa1926121
Modified Files:
src/sbbs3/websrvr.cpp
Log Message:
websrvr: cast away two best-effort unchecked returns (CIDs 639932, 639941)

CID 639932: remove(cleanup_file[i]) in close_request — best-effort
cleanup of temporary request files; failure is benign.
CID 639941: setsockopt(TCP_NODELAY) in http_session_thread — latency
hint; failure is non-fatal. Also widen the bool nodelay to
int so it has correct setsockopt() type.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/6ad832522da440e614b8fcdf
Modified Files:
src/sbbs3/websrvr.cpp
Log Message:
websrvr: clamp tls_sent and explicit cast in sess_sendbuf return (CID 639935)

The TLS path assigns 'result = tls_sent' where tls_sent is int and
could theoretically be negative on cryptlib edge cases. Adding it
to size_t 'sent' would underflow. Guard with 'if (result > 0)'.

Also make the size_t-to-int returns explicit casts so Coverity sees
the narrowing is intentional.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/c7df44f17c494f7277ac112e
Modified Files:
src/sbbs3/websrvr.cpp
Log Message:
websrvr: skip getuserdat for anonymous sessions in http_logon

Regression from 9e7649fe0: when http_logon is called with usr=NULL
on an anonymous request (session->user.number == 0), getuserdat
legitimately fails because user 0 doesn't exist, which now spams
the log with '!ERROR reading user #0 data' on every anon hit.

Only call getuserdat when there's an actual user number to read.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/commit/c94f75aa58112c228a8cdce9
Modified Files:
src/sbbs3/websrvr.cpp
Log Message:
websrvr: include protocol, IP, request, and ARS in no-auth log

The "!No authentication information" debug log line now reports the
protocol, client address, request line, and the ARS string that triggered
the auth requirement, so it's actionable when WEB_OPT_DEBUG_RX is on.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)