https://gitlab.synchro.net/main/sbbs/-/commit/54066038b9055f4b7510c88f
Modified Files:
webv4/root/api/forum.ssjs
Log Message:
webv4: remove the unused get-thread-list forum API call
The call has failed with a ReferenceError since it was added in
3d556da85e (length-37-users, 2021-03-07): it calls getThreadList(), which exists only as a method of the forum object in lib/forum.js. Nothing in
webv4 makes the call, and nothing uses that object.
Correcting the reference would have been worse than the error. That
function returns the sender, recipient, address and subject of every
message in whatever sub it is given, with no can_read check, no
anonymous masking and no spam filtering, so any logged-in user could
have listed the headers of other users' private mail. It also reads
every header in the sub on each request.
An unknown call now gets the API's usual empty reply instead of a 500.
Co-Authored-By: Claude Opus 5.5 <
noreply@anthropic.com>
---
■ Synchronet ■ Vertrauen ■ Home of Synchronet ■ [vert/cvs/bbs].synchro.net