AUP Version 10.0 Build 500.2

SPECIAL NOTES ABOUT THIS UPDATE:

Official Release of v10.0 series starting with build 500.

Plug & Play: If you use 3rd-party applications that load Wildcat! RPC DLLs outside of the main Wildcat! installation path (for example, moved copies in external door directories), you may encounter a version mismatch between the new 500 DLLs and older 454 DLLs. Replace those external copies with the updated 500 RPC DLLs.

SEE SPECIAL UPGRADE NOTES

- ENH: defender-exclusions.cmd -- optional Defender exclusion script for Windows Server 2022/2025 (500.2 26.6.4). Running Wildcat! on Windows Server 2022 or Windows Server 2025 with Windows Defender real-time protection active can cause measurable I/O overhead and application launch delays. Defender intercepts every file operation performed by high-frequency server processes (wcserver.exe, wcloader.exe, wconline.exe, pxonline.exe, pxecho.exe), adding latency to logins, message reads, conference activity, and desktop tool startup. A stock optional script is now provided: defender-exclusions.cmd Run this script once as Administrator on any Wildcat! server running Windows Server 2022 or Windows Server 2025. It configures process-level Defender exclusions for all Wildcat! and PX/WIN server executables and path exclusions for the PX/WIN inbound pipeline folders (C:\pxwin\work, C:\pxwin\outbound). Adjust the path exclusions for your PX/WIN layout if it differs from the defaults. IMPORTANT: The Wildcat! session work\ folder is intentionally NOT excluded. The scanfile.wcx upload hook fires in a work\ subfolder -- Defender must continue to monitor that path to intercept threats on upload. Excluding work\ would defeat the on-demand virus scan. No restart required. Exclusions take effect immediately. - NEW: Extended WCL code library support -- 3rd party .wcl libraries (500.2 26.6.18). wcServer now auto-loads any *.wcl file found in the server working directory at startup, after wildcat.wcl. Each library is keyed by its filename prefix (fidonet.wcl registers as "fidonet", mapapps.wcl as "mapapps", etc.) and appears in wildcat.log: Opening WILDCAT.WCL Opening FIDONET.WCL WCX modules inside a named library are addressed via the sub-path WUNC form: wc:\code\fidonet\fidomsg.wcx wc:\code\mapapps\xyz.wcx Dependencies declared with lib "..." resolve against the named library first, then fall back to wildcat.wcl automatically. Stock wildcat.wcl modules are always available to custom library modules without any changes. To create a named library, use wcllib /make from a folder containing only the WCX files intended for that library: md fidotmp copy *.wcx fidotmp\ cd fidotmp wcllib /make ..\fidonet.wcl *.wcx cd .. & rd /s /q fidotmp Drop the resulting .wcl in the Wildcat! working directory and restart wcServer. No other configuration is required. To override a specific module in {prefix}.wcl, place a standalone .wcx file in a subdirectory named {prefix}\ in the Wildcat! working directory. The disk file takes priority over the library version, mirroring the existing flat .wcx override model for wildcat.wcl: c:\wc10beta32\fidonet\fidomsg.wcx overrides fidomsg.wcx in fidonet.wcl This feature is intended for 3rd party developers who want to ship a collection of WCX modules as a single library file rather than as individual .wcx files in the server working directory. Each library prefix is a developer namespace -- fidonet\utils and mapapps\utils coexist without conflict. - FIX: corrected Makewild.Public.SMTPConfig.dwRevision during wcServer startup. The following log line as showing up in wildcat.log file redundantly the SMTP setup was updated. "! Updating SMTP Configuration. See AUP.CHM WCSMTP 454.15 Require SSL for AUTH" - FIX: Fixed wcserver Tray Icon (Shell_NotifyIcon) on Windows 2025. When starting Wcserver as desktop app on Windows 2025, it caused a Explorer to abort and restart. After the Explorer restart recovery, the wcserver tray icon disappeared. Wcserver now has a M_TASKBARCREATED handler to display the icon. - UPD: All Wildcat! binaries updated to FileVersion 10.0.500.2 for the general release (500.2 26.6.28). All *.exe and *.dll binaries in the 500.2 distribution now report a consistent FileVersion string of 10.0.500.2. The FileVersion string is displayed by the tool fileosver.exe and standard Windows file property dialogs. Future 500.2 updates may adopt the 5-field format (10.0.500.2.N) for individual binaries as they are revised, providing a finer-grained build identifier beyond the 4-field product version.

- ENH: Web Server IP Tracking/Blocking -- Enable IP Tracking checkbox activated (500.2 26.6.30). The Enable IP Tracking checkbox in Web Server > IP Tracking/Blocking was present in the dialog but hidden since its introduction in 454.6. It is now active and controls whether wchttps.dll counts error responses per IP toward the auto-ban threshold. Default is on. Existing installations with no explicit enable.tracking setting in iptrack.ini are treated as enabled for backward compatibility. Uncheck to disable error counting while leaving IP blocking enforcement (Enable IP Blocking) intact. - ENH: IP Tracking/Blocking pages upgraded to 500.2 ini format on first open (500.2 26.7.1). The IP Tracking/Blocking settings page (Web Server, FTP Server, POP3, SMTP, Telnet) now reads and writes a version key in wc:\data\iptrack.ini to coordinate defaults with the wcGeoIP connect hook (wc:\cmdhooks\connect.ini) when wcGeoIP is installed. EXISTING INSTALLATIONS: The first time each IP Tracking/Blocking page is opened after upgrading to 500.2.3, the OK button will be pre-enabled. This is expected and intentional -- wcConfig has detected that the ini file predates 500.2 format and needs to be updated. Click OK to write the updated settings. The page will be clean on all subsequent opens. No settings are changed; only the version marker is written. NEW INSTALLATIONS: wc:\data\iptrack.ini ships with version=1 in [General]. No forced save occurs and no action is required. If wcGeoIP is installed, saving any IP Tracking page also syncs the Enable IP Tracking state to the corresponding [protocol] enable key in wc:\cmdhooks\connect.ini, keeping the two configuration files in step.

- NEW: Added new wcODBC functions to the wcodbc.wch library: function OdbcResultReal (result as Long, field as String) as Real function OdbcResultDouble (result as Long, field as String) as Real see the updated wcodbc.wch header declarations. example usage: if OdbcFetchRow(result,0) then print "as string : "; OdbcResultString(result,"money") print "as valreal: "; ValReal(OdbcResultString(result,"money")) print "as double : "; odbcResultDouble(result,",money") print "as real : "; odbcResultReal(result,"money") end if Note: Importing a function returning a DOUBLE will be converted to REAL. wcBASIC does not support the DOUBLE type at this time.

- FIX: Attachment file prompt now handles full path input correctly. When typing a full file path (e.g. c:\pxwin\pxw1.log) at the "Enter name of file to attach" prompt, wcLocal now copies the file directly without showing the file browser, and stores only the filename (not the full path) as the attachment name. Entering a directory path (e.g. c:\pxwin) opens the file browser positioned at that directory with a blank filename field. Previously, a full path was concatenated onto the temp upload folder path, producing an invalid destination and an "Error Copying File" message.

- NEW: Added pxtype.wch -- PX/WIN FidoFlags (obXXXX) constants for wcBASIC. A new include file wcbasic\include\pxtype.wch exposes the TMsgHeader.FidoFlags bit constants used by PX/WIN for FTN message state tracking. Constants are translated from the PX/WIN pxtype.pas definitions with the leading underscore removed (the wcc compiler does not accept identifiers starting with underscore). Included automatically via fidoutil.wch. Usage example: if (msg.fidoflags and obSent) <> 0 then // message has been delivered via FTN end if Full constant list: obHold, obImmed, obDirect, obImported, obKillMsg, obKillFile, obLocked, obFileReq, obFileAtt, obFileUReq, obCrash, obSent, obForward, obOrphan, obTruncFile, obExtra, obSkipPkt, obPackUp, obNewMail, obPktFull, obSkipMsg, obTagged, obBookMark. - UPD: html-read message.wcc now shows "Sent" label for FTN netmail delivered by PX/WIN, matching the existing label shown for SMTP-delivered email. The HTML message header previously showed "Sent" only when wcSMTP had delivered the message (mfSmtpDelivered flag). The condition now also checks the PX/WIN FidoFlags obSent bit so that FTN netmail delivered via BinkP or the modem path shows the same "Sent" label and sets the MailFlags.sent template variable for custom templates. - UPD: msgutil.wcc DisplayMessage() and MSGHDR.BBS updated to show "Sent" label in the TUI message header for delivered FTN netmail. The ANSI/text message header (Private line) now appends "Sent" when either mfSmtpDelivered or the PX/WIN obSent FidoFlag is set on the message. No change to the header layout for messages that have not been delivered. - UPD: well-known.wcc updated (04/20/26) -- VDG-aware autoconfig and runtime XML fallback. print_config_v1_1(): domain now derived from the HTTP Host header instead of hardcoded mail.winserver.com. Supports VDG configurations where multiple domains share one Wildcat! server. wk_autoconfig(): runtime fallback to print_config_v1_1() when no physical autoconfig\mail\config-v1.1.xml exists. Replaces the prior compile-time #if 1/#else switch. See wcWEB for sysop-level description. - FIX: Fixed "Chat Between Nodes.wcc" /JOIN fix. See wcbasic_readme.txt for more details. - FIX: msgutil.wcc EditMessage() attachment name now uses JustFileName() to strip any full path typed by the user. Previously, entering a full path (e.g. c:\pxwin\pxw1.log) at the attach prompt stored the entire path as msg.Attachment and caused an invalid MoveFile destination in the upload staging area. The attachment name stored in the message header is now always the filename only. - ENH: html-new message.wcc now shows a FidoFrom AKA selector when composing Fidonet netmail (500.2 26.6.8). When composing a Fidonet netmail message in wcWEB, the From line now includes a dropdown list of all locally configured AKA addresses read from px.ini. The primary address is pre-selected. Select the AKA whose zone matches the destination node before sending. See wcWEB for the complementary autosuggest and auto-select feature that selects the correct AKA automatically when a destination is chosen. - FIX: wcWEB Fidonet netmail Priority selector now correctly pre-selects the configured default priority (500.2 26.6.16). The Priority dropdown (Hold / Crash / Immediate) in the wcWEB Fidonet netmail compose form defaulted to Hold regardless of the priority configured in PXCONFIG General Fidonet Setup. Root cause: wcBASIC 'not' on an integer is a bitwise NOT, not a logical NOT. The Hold pre-selection test evaluated as always true because bitwise NOT of any integer is non-zero. All four priority TemplateSetVariable calls have been rewritten using IsBitSet() from bitlib.wch, which returns a proper Boolean. Exactly one of Hold / Crash / Immediate now receives the 'selected' attribute, matching the pxconfig default. - FIX: GetLocalTextEx() moved from html-read message.wcc to msgutil.wcc; FTN kludge line filter added (500.2 26.6.18). GetLocalTextEx() reads the MIME-extracted message body (mimemail.dat) for display in the wcWEB full message view. The function has been moved to the msgutil library so it is available to all WCX modules that need to render message body content. A FTN kludge line filter was added at the same time. See wcWEB for the user-visible fix description. The updated msgutil.wch library header declares the function for use by WCX callers. - FIX: Corrected msgutil.wcc DisplayMessage() function. Changed SUBTEXT(1) to SUBTEXT(2) for the FidoFrom and FidoTo display This resolves the display of netmail messages not showing the right addresses. - FIX: wcrun/wcCore welcome screen (main.wcc) now reports the correct build number after an AUP update. main.wcc reads the global WC_VERSION string, which is compiled into wccdll.dll rather than read from wcglobal.h at runtime. Since wccdll.dll had no source changes this cycle, it was never recompiled, so it kept reporting v10.0.500.1 even on fully updated 500.2 servers. wccdll.rc's product version was updated to 10.0.500.2 and wccdll.dll was rebuilt and relinked into wildcat.wcl so main.wcx (and any other stock script relying on WC_VERSION) now correctly shows 500.2.

- UPD: Improved Thunderbird autoconfig support via /.well-known/autoconfig. The autoconfig endpoint now correctly serves the mail domain for each Virtual Domain Group (VDG) on the same Wildcat! server, rather than returning a hardcoded domain name. A physical config-v1.1.xml file is no longer required -- PX generates the response automatically when the file is absent. See wcBASIC well-known.wcc for source details. - NEW: wc10.css added to stock HTTP template library (http\template\wc10.css). A minimal, self-contained modern stylesheet for wcWEB templates. Dark theme with CSS custom properties, system-ui font stack, CSS grid card layout, and responsive design. Intended to be inlined via @include@ so pages carry no external CSS dependency. Used by the default home pages and the new terminal.htm template. - NEW: terminal.htm added to stock HTTP template library (http\template\terminal.htm). Modern telnet terminal launch page served by html-terminal.wcx (terminal.wcn). Edge, Chrome, and other Chromium-based browsers block automatic server-side redirects (HTTP 302) to external protocol URLs such as telnet:// as a security measure. The redirect worked only when the user right-clicked the link and chose "Open in new tab or window." The fix requires a user gesture before the browser will honor the external protocol hand-off. html-terminal.wcc already checked for this template file and fell through to HttpRedirect() only when it was absent. terminal.htm fills that hook, serving a styled intermediate page with a clickable Launch Terminal button. Clicking the button satisfies the browser user-gesture requirement and launches the locally installed Telnet client. After the click, the page navigates back automatically so no orphan tab is left open. A Home button provides an escape path for users who arrive at the page by mistake. The page uses @GET HTTP.HOST@ for the hostname (Computer.Config.WWWHostname is not required to be configured) and @GET Computer.Config.TelnetPort@ for the port number. - ENH: Fidonet nodelist autosuggest for the wcWEB new message compose form (500.2 26.6.9/10). When composing a Fidonet netmail message in wcWEB, the To: name and FTN address fields now support live search against the compiled PX nodelist: - Type any part of a sysop name (first name, last name, or partial) in the To: field to see matching nodelist entries. Selecting one fills both the To: name and FTN address fields automatically. - Type a zone:net/node prefix in the FTN address field to search by address. Entering a zone number alone (e.g. "99") shows all nodes in that zone. - When a destination node is selected, the FidoFrom AKA dropdown automatically switches to the local AKA whose zone matches the destination zone. - When the To: name is AreaFix or FileFix, the Subject field is automatically pre-filled with the node's password from the PX Node Book Manager, if one is configured. Requires PX/WIN installed and the nodelist compiled by PXNLIST. See wcBASIC html-new message.wcc for the FidoFrom AKA dropdown and PX/WIN for the html-suggest-nodes.wcx and html-get-fixpwd.wcx server scripts. - FIX: FTN kludge lines no longer appear in the wcWEB full message view when View Network Control Lines is set to No (500.2 26.6.18). FTN kludge lines are ctrl-A (0x01) prefixed lines embedded in Fidonet message bodies carrying routing and control information (INTL, MSGID, REPLY, PID, TZUTC, etc.). The user messaging option "View Network Control Lines" (User.ShowEmailHeaders) is intended to suppress these lines from display. The popup message preview correctly suppressed kludge lines because it reads the message body through the standard wc:\CONF(#)\MESSAGE(msgid) WUNC path, where the Wildcat! server applies the kludge/header filter based on the user setting. The full message view did not suppress them. Root cause: the full view path calls CreateMimeObject() internally, which reads the raw message body via the \FULLTEXT WUNC suffix, bypassing the server-side filter. The extracted body (mimemail.dat) was then passed to GetLocalTextEx() and displayed without further filtering. Fix: GetLocalTextEx() in msgutil.wcc now checks User.ShowEmailHeaders before including each line from mimemail.dat. Lines beginning with ctrl-A (0x01) are suppressed when ShowEmailHeaders is FALSE. When ShowEmailHeaders is TRUE (the user has chosen to see control lines), kludge lines are rendered in bold to visually distinguish them from normal body text. This fix applies to Fidonet netmail and echo conferences. The same suppression already applied to RFC 5322 headers in Internet email conferences via the server-side filter and is not affected by this change. - FIX: wchttps.dll now rejects unauthenticated HTTP POST requests before writing the request body to a temp file. On Windows Server 2022 and Windows Server 2025, Windows Defender real-time protection scans files as they are written to disk. External scanners and bots frequently send HTTP POST requests carrying exploit payloads (SQL injection, shell code, etc.) to any reachable HTTP server. wchttps was saving the POST body to a temp file (wcp*.tmp) before performing any authorization check. Defender flagged these temp files and issued security notifications, even though the requests were harmless because the protected URL would have returned 401 anyway. Fix: wchttps now checks for authentication credentials before creating the temp file. If the POST URL does not fall under a public path and the request carries no session cookie or Authorization header, a 401 response is returned immediately and the socket is closed. The POST body is never read or written to disk. Paths exempt from the early reject (no auth required): /public/* login form, signup page, and all other public pages /newuser new user registration form All other POST destinations require an authenticated session as they always have. The /.well-known/ path is unaffected; those requests are intercepted by wcohttp.dll before reaching wchttps. Each rejected POST is logged to a date-stamped local log file in the Wildcat! working directory. The filename follows the HTTP log period configured in wcConfig (Web Server | Logging): wchttp-unauth-post-YYYYMMDD.{computer}.log (daily, default) wchttp-unauth-post-YYYYMM.{computer}.log (monthly) Log lines include a timestamp, virtual host, source IP, and the URL: 20260531 14:23:07 HOST: santronics.com IP: 185.220.101.42 URL: /client?wp-login.php HTTP/1.0 20260531 14:23:09 HOST: santronics.com IP: 45.33.32.156 URL: /client?phpmyadmin HTTP/1.0 - ENH: wchttps.dll -- Per-IP HTTP error rate limiting and auto-ban (500.2 26.6.29/30). wchttps now tracks 4xx/5xx error responses per client IP within a sliding time window. When an IP exceeds the error threshold it is automatically added to the wcIPTrack temporary block list, causing wcohttp to drop subsequent connections at the listener level. Controlled by IP Tracking/Blocking settings in wcConfig (Web Server) and wc:\data\iptrack.ini [HTTP]: enable.tracking = 1 enable error counting (default: on) enable.block = 1 create .blk semaphore on ban (default: on) RateThreshold = 30 errors per window before ban RateWindow = 60 sliding window in seconds Ban events are logged to a date-stamped local log file in the Wildcat! working directory. The filename follows the same HTTP log period as the unauth-post log above: wchttp-autobanned-YYYYMMDD.{computer}.log (daily, default) wchttp-autobanned-YYYYMM.{computer}.log (monthly) Log lines include a timestamp, virtual host, source IP, error count, and the triggering URL: 20260630 10:26:26 HOST: santronics.com IP: 20.65.107.43 ERRS: 30 URL: /bjfl.php Only 4xx/5xx responses are counted. Normal authenticated traffic (200 OK) does not accumulate toward the threshold. IPv4 only; IPv6 addresses are not blocked.

PX/WIN 500.2 adds BinkP/1.1 TCP/IP Fidonet mail support to the Platinum Xpress Frontend Mailer (PXONLINE), plus extensive event scheduler improvements, CRAM-MD5 authentication, compatibility fixes, and configuration enhancements. For the complete list of PX/WIN changes organized by component (PXONLINE, PXCONFIG, PXECHO, PXTOOLS, PXNLIST), see: PX/WIN Version 10.0 Build 500.2 Changes