MSGID: 2:221/1.58@fidonet e149409c   
   REPLY: 2:310/31.3@fidonet e1403f67   
   PID: OpenXP/5.0.43 (Win32)   
   CHRS: IBMPC 2   
   TZUTC: -0500   
   Hello Martin!   
      
   ** 09.02.20 - 11:36, Martin Foster wrote to August Abolins:   
      
    AA>> Which leads me to the security/bug/weakeness.   
      
    AA>> ..then anyone could arbitrarily send me a nodelist, and its   
    AA>> presence can screw up oxp (just like the presence of the old   
    AA>> nodelist/diffs that I still had in there did).   
      
    MF>It wasn't the presence of the old nodlists/diffs that was causing the   
    MF>problem :)   
      
   Correct. The main problem was having a Z1 nodelist and using a Z2 diff     
   update file.  But the only way I managed to clear the lock up was to     
   delete the latent nodelist/nodediff files I still had in the incoming     
   /FILES directory.   
      
      
    MF>..The only files it takes action on are nodediffs/pointdiffs and if   
    MF>any of them are out of sequence, it just ignores them.   
      
   It was still taking action on the NODEDIFF that was in /FILES, even though     
   I had cleared out the nodelist config tables.  The /FIDO directory was     
   empty!   
      
   The following settings marked "<==THIS" were probably enabled:   
      
   +- Configure Node/Pointlist ------------------------+   
   |                                                   |   
   |  List name         NODELIST.###      Number  038  |   
   |                                                   |   
   |  Format of list    Nodelist        ?              |   
   |  Zone/Address                                     |   
   |                                                   |   
   |  Update file       NODEDIFF.###                   |   
   |  Update archive    NODEDIFF.Z##                   |   
   |                                                   |   
   |  Process by                                       |   
   |                                                   |   
   |   [x]   Use internal nodelist processor           |<==THIS   
   |   [x]   Delete update after processing            |   
      
   +- Fido Options ---------------------------------+   
   Ý                                                Ý   
   Ý  Int. dial prefix    00                        Ý   
   Ý  Nat. dial prefix    0                         Ý   
   Ý  Your dialing code   49-631                    Ý   
   Ý                                                Ý   
   Ý   [x]   Import nodelist updates automatically  Ý<==THIS   
   Ý   [ ]   Delete empty messages                  Ý   
   Ý   [x]   Automatic TIC file processing          Ý<==THIS?   
      
      
   Is it the presence of a .TIC file in /FILES that can trigger the "action"     
   too?   
      
   Maybe I am worried over nothing since OXP probably takes a more secure     
   process (ie acting on files only received from my Boss system via the TIC     
   information) before it acts on just anything that looks like a diff file     
   in the /FILES directory.   
      
      
     ../|ug   
      
   --- OpenXP 5.0.43   
    * Origin: ....................... (2:221/1.58)   
   SEEN-BY: 1/123 90/1 154/10 203/0 221/1 6 360 227/114 229/426 1014   
   SEEN-BY: 240/5832 249/206 317 400 280/464 5003 288/100 292/854 310/31   
   SEEN-BY: 317/3 322/757 342/200 396/45 423/81 120 712/848 770/1 2452/250   
   PATH: 221/1 280/464 229/426